SHshorebird
service-accounts

Add an OIDC trust rule to a service account.

Lets jobs of one GitHub Actions workflow authenticate as the service account by exchanging their GitHub OIDC token, so no long-lived key has to be stored in CI. github is the only provider.

The rule matches a token from the named repository and workflow file, optionally only in one environment and only on matching refs. The server looks up repository_owner on GitHub and stores the owner's numeric id, which the token's repository_owner_id claim must match, so a deleted owner name registered again by someone else does not inherit the trust.

Adding a rule requires a plan with OIDC federation (Business or Enterprise). Requires the serviceAccountTrustRules.create permission, which only the admin and owner roles hold. Personal access tokens and federated tokens are refused whatever their role.

post/organizations/{organizationId}/service-accounts/{serviceAccountId}/trust-rules

Request

  • Base URL
    https://api.shorebird.dev/api/v1
  • Auth
    • HTTP bearer
    • or HTTP bearer

Request body

provider'github' required

The identity provider whose tokens an OIDC trust rule accepts.

repository_ownerstring required

The login of the GitHub user or organization that owns the repository: letters, digits and hyphens, starting with a letter or digit, at most 39 characters (^[A-Za-z0-9][A-Za-z0-9-]{0,38}$). Must exist on GitHub; the server resolves it to its numeric id.

repository_namestring required

The repository's name: 1 to 100 letters, digits, ., - or _ (^[A-Za-z0-9._-]{1,100}$), and neither . nor ...

workflow_pathstring required

The workflow file, directly in .github/workflows/ and ending .yml or .yaml, such as .github/workflows/release.yml. May not contain ...

environmentstring nullable

The GitHub environment the job must run in: 1 to 255 characters, without surrounding spaces. Omitted or null accepts any environment.

ref_patternstring nullable

The ref the job must run on, at most 255 characters: exact (refs/heads/main), or a prefix ending in a single * (refs/tags/*), with no other * and no whitespace. Omitted or null accepts any ref.

Response

The newly-added trust rule.

idinteger required

The trust rule's ID.

provider'github' required

The identity provider whose tokens an OIDC trust rule accepts.

created_atstring date-time required

When the rule was added.

created_by_user_idinteger nullable required

The user who added the rule, or null once that user has been deleted.

last_used_atstring date-time nullable required

When a token was last exchanged under the rule, or null if never.

Changes

No recorded changes to this operation across all 1 revision of this API.