PHphaseo
Gateway

Create a trusted workload policy

Changed on

Creates a policy and its secretless key. Tokens must be issued for the audience https://api.phaseo.app and match the pinned owner and every claim condition. A workspace can have up to 50 policies; more returns 409 limit_reached. Requires keys:write on management keys and OAuth tokens, or a workspace owner or admin. Available only to workspaces in the trusted workloads beta; other workspaces get 404.

post/workload-identity/policies

Request

  • Base URL
    https://api.phaseo.app/v1
  • URL
    https://api.phaseo.app/v1/workload-identity/policies
  • Auth
    HTTP bearer

Request body

namestring required
provider'vercel' | 'github_actions' required

The platform that issues the OIDC tokens.

issuerstring

Required for Vercel: https://oidc.vercel.com/ followed by the team slug, or https://oidc.vercel.com for the global issuer. Defaults to https://token.actions.githubusercontent.com for GitHub Actions.

owner_idstring required

The Vercel team ID or GitHub organisation or user ID to pin.

claim_conditionsobject

Extra claims the token must match, as claim name to allowed values, for example project_id and environment for Vercel, or repository_id and ref for GitHub Actions. Every claim must match one of its values. At most 15 claims and 20 values per claim; iss, aud, exp, iat, nbf and jti cannot be used, and the pinned owner claim is set with owner_id.

max_token_lifetime_secondsinteger

Longest token lifetime (exp minus iat or nbf) the policy accepts.

Response

Trusted workload policy created

Changes