v57

latestOpenAPI 3.1.0Apache-2.0raw.githubusercontent.com2026-08-012143051018.3 KB

Tenant Identity

Retrieve Tenant Identity Configuration for current Org

Retrieve the tenant identity configuration and signing key metadata.

User must have authorization role with TENANT_ADMIN suffix in the URL {org}.

The response reflects the stored configuration. Fields you omitted on PUT may be filled in by Core: allowedAudiences defaults to [defaultAudience], and subjectPrefix defaults to the issuer's trust domain. signingKeys lists one entry normally, or two during a key-rotation overlap.

get/v2/org/{org}/nico/site/{siteID}/tenant-identity/config

Response

Tenant identity configuration retrieved

orgstring

Organization that owns the Tenant identity configuration

enabledboolean

Whether Tenant identity token delegation is enabled

issuerstring

Issuer URL for Tenant identity tokens

defaultAudiencestring

Default audience used for Tenant identity tokens

allowedAudiencesstring[]

Stored allowlist of audience strings. Always non-empty: when a PUT supplied an empty list, the Core gRPC API substituted [defaultAudience] before persisting. Issuance rejects audiences outside this list.

tokenTtlSecondsinteger

Lifetime of issued Tenant identity tokens, in seconds

subjectPrefixstring

SPIFFE ID prefix used in the JWT sub claim. When the PUT body omitted subjectPrefix, Core stored spiffe://<trust-domain-from-issuer> here, so the value returned by GET may differ from what was submitted.

createdstring date-time

Date/time when the Tenant identity configuration was created

updatedstring date-time

Date/time when the Tenant identity configuration was last updated