---
title: "Register a workload identity for an organization"
method: POST
path: "/organizations/{org_id}/workload-identities"
tags: ["Workload Identities"]
---

# Register a workload identity for an organization

`POST /organizations/{org_id}/workload-identities`

Admin-only. Records the public identifying fields of a cloud-native identity (today: Azure SP — `azure_client_id` + `azure_tenant_id`) so the workload behind it can authenticate to deeplake-api by presenting a cloud-signed OIDC token. Mirrors controlplane's POST /machine.

## Path parameters

- `org_id` string, required

## Request body

- GithubComActiveloopaiDeeplakeApiInternalIdentitiesRegisterRequest
  - `name` string
  - `workload_identity_data` GithubComActiveloopaiDeeplakeApiInternalIdentitiesWorkloadIdentityData
    - `type` 'azure' | 'aws' | 'gcs'

## Response `201`

Created

- GithubComActiveloopaiDeeplakeApiInternalIdentitiesWorkloadIdentity
  - `created_at` string
  - `created_by` string
  - `id` string
  - `name` string
  - `org_id` string
  - `type` 'azure' | 'aws' | 'gcs'
  - `updated_at` string

## Other responses

- `400` — Bad Request
- `401` — Unauthorized
- `403` — Forbidden
- `409` — name taken or cloud identity already registered

---

[API](https://skmtc.net/deeplake/apis/deeplake-api.md) · [All operations](https://skmtc.net/deeplake/apis/deeplake-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/deeplake/deeplake-api/revisions/e16ed11d991c/schema)