v57

latestOpenAPI 3.1.0Apache-2.0raw.githubusercontent.com2026-08-012143051018.3 KB

Tenant Identity

Create or Update Token Delegation

Register an RFC 8693 token exchange callback for the tenant. When configured, the Core gRPC API issues a short-lived intermediate JWT-SVID to the tenant's exchange server instead of signing workload tokens directly.

User must have authorization role with TENANT_ADMIN suffix in the URL {org}.

Requires a pre-existing /tenant-identity/config on this org/site (returns 404 otherwise). Because PUT is full-replace, omitting clientSecretBasic on an update clears any stored credentials and switches the org back to no-auth; re-supply clientId / clientSecret on every PUT to keep basic auth (the raw secret is never returned by GET). Returns 201 Created on first call, 200 OK on subsequent updates.

put/v2/org/{org}/nico/site/{siteID}/tenant-identity/token-delegation

Request body

tokenEndpointstring uri required

URL of the tenant's RFC 8693 token exchange endpoint. The Core gRPC API validates scheme and host against its configured [machine_identity].token_endpoint_domain_allowlist and rejects mismatches with 400 Bad Request. Operators that need to enforce HTTPS-only must populate that allowlist.

subjectTokenAudiencestring required

Audience value placed on the intermediate JWT-SVID posted to the exchange endpoint.

Response

Token delegation replaced/updated

tokenEndpointstring uri

Token endpoint used to exchange delegated Tenant identity tokens

subjectTokenAudiencestring

Audience value expected on the subject token

createdstring date-time

Date/time when the token delegation configuration was created

updatedstring date-time

Date/time when the token delegation configuration was last updated