PHphaseo
Gateway

Update a trusted workload policy

Changed on

Changes a policy's name, status, claim conditions or maximum token lifetime. The provider, issuer and owner cannot change; create a new policy instead. Changes reach the gateway within a minute. Requires keys:write on management keys and OAuth tokens, or a workspace owner or admin. Available only to workspaces in the trusted workloads beta; other workspaces get 404.

patch/workload-identity/policies/{id}

Request

  • Base URL
    https://api.phaseo.app/v1
  • URL
    https://api.phaseo.app/v1/workload-identity/policies/{id}
  • Auth
    HTTP bearer

Request body

namestring
status'active' | 'disabled'
claim_conditionsobject

Extra claims the token must match, as claim name to allowed values, for example project_id and environment for Vercel, or repository_id and ref for GitHub Actions. Every claim must match one of its values. At most 15 claims and 20 values per claim; iss, aud, exp, iat, nbf and jti cannot be used, and the pinned owner claim is set with owner_id.

max_token_lifetime_secondsinteger

Longest token lifetime (exp minus iat or nbf) the policy accepts.

Response

Trusted workload policy updated

Changes