v32

latestOpenAPI 3.1.0raw.githubusercontent.com2026-05-224341,4072.0 MB

Workload Federation

Test Token

TestToken validates a JWT against a specific trust's configuration without issuing an access token. Returns per-step validation results for debugging.

post/api/v1/service_principals/{service_principal_id}/trusts/{client_id}/test

Path parameters

service_principal_idstring required

The service principal ID (from URL path).

client_idstring required

The trust client ID. Accepts the cutename (e.g. "clever-fox-42195") or the full client ID (e.g. "clever-fox-42195@acme.conductorone.com/wfe"). The server normalizes to the cutename portion before lookup.

Request body

sourceIpstring

Optional: override source IP for CIDR testing. If empty, uses the request's source IP. Accepts IPv4 (e.g. 10.0.0.5) or IPv6 (e.g. 2001:db8::1) addresses, optionally with a CIDR prefix.

subjectTokenstring

The raw JWT to validate (the subject_token from a CI job).

Response

Successful response

decodedClaimsJsonstring

The decoded JWT claims (best-effort, even if signature fails). Returned as JSON string for display.

overallResultboolean

Overall result: true only if ALL steps passed.