Sign in

v57

latestOpenAPI 3.1.0Apache-2.0raw.githubusercontent.com2026-08-012143051018.3 KB
Tenant Identity

Create or Update Tenant Identity Configuration

Create or update tenant identity (JWT-SVID) configuration for the org/site.

User must have authorization role with TENANT_ADMIN suffix in the URL {org}.

On first call the Core gRPC API generates a new ES256 signing keypair; on subsequent calls the existing keypair is reused unless rotateKey: true is supplied. Returns 201 Created on first call, 200 OK on subsequent updates. See the Tenant Identity tag description for upsert semantics and the enabled vs DELETE distinction.

put/v2/org/{org}/nico/site/{siteID}/tenant-identity/config

Request body

OR

Response

Tenant identity configuration replaced/updated

orgstring

Organization that owns the Tenant identity configuration

enabledboolean

Whether Tenant identity token delegation is enabled

issuerstring

Issuer URL for Tenant identity tokens

defaultAudiencestring

Default audience used for Tenant identity tokens

allowedAudiencesstring[]

Stored allowlist of audience strings. Always non-empty: when a PUT supplied an empty list, the Core gRPC API substituted [defaultAudience] before persisting. Issuance rejects audiences outside this list.

tokenTtlSecondsinteger

Lifetime of issued Tenant identity tokens, in seconds

subjectPrefixstring

SPIFFE ID prefix used in the JWT sub claim. When the PUT body omitted subjectPrefix, Core stored spiffe://<trust-domain-from-issuer> here, so the value returned by GET may differ from what was submitted.

createdstring date-time

Date/time when the Tenant identity configuration was created

updatedstring date-time

Date/time when the Tenant identity configuration was last updated