---
title: "Create Own Federation Rule"
method: POST
path: "/api/v1/organizations/me/keys/{key_id}/federation-rules"
tags: ["organization-keys"]
---

# Create Own Federation Rule

`POST /api/v1/organizations/me/keys/{key_id}/federation-rules`

## Request

- The document declares no server URL.
- Auth: one of:
  - API key in header `Otari-Key`
  - API key in header `x-api-key`

Let an OpenID Connect identity token stand in for a key, through the token exchange.

Needs ``federation_member_rules``, else 403, and an organization owner or admin acting on their own key, or the
deployment operator on any key in their active organization, else 403. The issuer may be any https URL; its
signing keys are fetched only from a public host. The rule matches only in ``POST /api/v1/oauth/token`` naming
its id, never as a bare identity token, so it lets a workload act as this key and no other: a rule naming another
tenant's workload gives that workload nothing it did not ask for. A rule this key already holds answers 409.

## Path parameters

- `key_id` string, required

## Request body

- FederationRuleCreate: An OpenID Connect identity that may authenticate as the key, in place of its secret. A token matches when it is signed by ``issuer``, names ``audience`` among its audiences, and carries each of ``subject`` and ``email`` that the rule sets; an email matches only when the token marks it verified. At least one of the two is required.
  - `audience` string, required: A value the token's 'aud' must contain.
  - `email` string, nullable: The token's verified 'email', when the rule names one. Compared without regard to case.
  - `issuer` string, required: The token's 'iss'. On an operator's rule, one of the deployment's federation_issuers; on a member's own key, any https issuer, whose discovery document and signing keys are fetched only from a public host.
  - `subject` string, nullable: The token's 'sub', when the rule names one.

## Response `201`

Successful Response

- FederationRulePublic: A federation rule of an API key.
  - `api_key_id` string, required
  - `audience` string, required
  - `created_at` string, date-time, required
  - `email` string, nullable, required
  - `id` string, required
  - `issuer` string, required
  - `member_managed` boolean, required: Whether a member gave the rule to their own key: it then matches only in the token exchange.
  - `subject` string, nullable, required

## Other responses

- `422`: Validation Error

## Changes

- **2026-10-22** `c07cbca35c1f`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/mozilla-ai/apis/otari/changes/api/v1/organizations/me/keys/:key_id/federation-rules/post.md)

---

[API](https://skmtc.dev/mozilla-ai/apis/otari.md) - [All operations](https://skmtc.dev/mozilla-ai/apis/otari/llms.txt) - [OpenAPI document](https://skmtc.dev/mozilla-ai/apis/otari/revisions/42276d3c251d?raw)