---
title: "Exchange GitHub Actions workload identity for one run"
method: POST
path: "/v1/github/oidc/exchange"
---

# Exchange GitHub Actions workload identity for one run

`POST /v1/github/oidc/exchange`

## Request

- Base URL: `https://api.plori.ai`
- URL: `https://api.plori.ai/v1/github/oidc/exchange`
- Auth: none required

Verifies a GitHub Actions OIDC JWT minted for audience `plori.ai`, resolves the repository's persistent agent, and returns a short-lived single-run capability. Public repositories receive up to 3 free runs per repository and 10 per GitHub owner per UTC month while unclaimed. Private repositories and exhausted public repositories receive a claim URL instead. This endpoint never creates a customer account or API key.

## Request body

- object
  - `token` string, required: GitHub Actions OIDC JWT with audience plori.ai.

## Response `200`

Repository identity accepted; use this capability once on POST /v1/agents/{agentID}/runs.

- GitHubOIDCExchange
  - `token` string, required
  - `agent_id` string, uuid, required
  - `repository` string, required
  - `expires_at` string, date-time, required
  - `free_tier` boolean, required
  - `repo_runs_remaining` integer, required
  - `owner_runs_remaining` integer, required
  - `claim_url` string, uri, required

## Other responses

- `401`: OIDC signature, issuer, audience, lifetime, or repository claims are invalid.
- `402`: Repository must be claimed before it can run. The body includes a signed claim URL.
- `409`: The repository agent is being provisioned. Retry after the indicated delay.

---

[API](https://skmtc.dev/plori/apis/plori-rest-api.md) · [All operations](https://skmtc.dev/plori/apis/plori-rest-api/llms.txt) · [OpenAPI document](https://skmtc.dev/plori/apis/plori-rest-api/revisions/15c4f9260dff?raw)