RegisterOidcIssuer

Registers a new OIDC issuer for an organization, establishing a trust relationship with an external identity provider. Once registered, the identity provider can issue signed, short-lived tokens that are exchanged for temporary Pulumi Cloud credentials during deployments. This eliminates the need to store long-lived access tokens. Supported providers include AWS, Azure, Google Cloud, GitHub Actions, and any OIDC-compliant identity provider. The request must include the issuer URL, and the service will fetch the provider's public signing keys to verify token authenticity.

post/api/orgs/{orgName}/oidc/issuers

Request

Base URL: https://api.pulumi.com (the document declares no server; this is the origin it was published from)
URL: https://api.pulumi.com/api/orgs/{orgName}/oidc/issuers
Auth: none declared

Path parameters

orgNamestring required

The organization name

Request body

maxExpirationinteger

The maximum token expiration time in seconds.

namestring required

The display name of the OIDC issuer.

thumbprintsstring[]

SHA-1 certificate thumbprints used to verify the OIDC issuer's TLS certificate.

urlstring required

The URL of the OIDC issuer.

Response

createdstring

The ISO 8601 timestamp when the OIDC issuer was created.

idstring required

The unique identifier of the registered OIDC issuer.

issuerstring required

The OIDC issuer identifier, typically a URL that uniquely identifies the identity provider.

lastUsedstring

The ISO 8601 timestamp when the OIDC issuer was last used for token exchange.

maxExpirationinteger

The maximum token expiration time in seconds.

modifiedstring

The ISO 8601 timestamp when the OIDC issuer was last modified.