organization-keys

Create Own Federation Rule

Changed on

Let an OpenID Connect identity token stand in for a key, through the token exchange.

Needs federation_member_rules, else 403, and an organization owner or admin acting on their own key, or the deployment operator on any key in their active organization, else 403. The issuer may be any https URL; its signing keys are fetched only from a public host. The rule matches only in POST /api/v1/oauth/token naming its id, never as a bare identity token, so it lets a workload act as this key and no other: a rule naming another tenant's workload gives that workload nothing it did not ask for. A rule this key already holds answers 409.

post/api/v1/organizations/me/keys/{key_id}/federation-rules

Request

  • The document declares no server URL.
  • Auth
    • API key in header Otari-Key
    • or API key in header x-api-key

Path parameters

key_idstring required

Request body

audiencestring required

A value the token's 'aud' must contain.

emailstring nullable

The token's verified 'email', when the rule names one. Compared without regard to case.

issuerstring required

The token's 'iss'. On an operator's rule, one of the deployment's federation_issuers; on a member's own key, any https issuer, whose discovery document and signing keys are fetched only from a public host.

subjectstring nullable

The token's 'sub', when the rule names one.

Example request

{
  "audience": "https://otari.example.com",
  "email": "hackbot-api@my-project.iam.gserviceaccount.com",
  "issuer": "https://accounts.google.com"
}

Response

Successful Response

api_key_idstring required
audiencestring required
created_atstring date-time required
emailstring nullable required
idstring required
issuerstring required
member_managedboolean required

Whether a member gave the rule to their own key: it then matches only in the token exchange.

subjectstring nullable required

Changes