federated_credential

El dominio federated_credential tiene 6 acciones. En la superficie meta se alcanzan todas a través de arcane_federated_credential; en la individual, cada una es una herramienta propia; en la dinámica se ejecutan con arcane_execute_action y el ID canónico.

Resumen

Acción	Título	Tipo
federated_credential.create	Create a federated credential	escritura
federated_credential.delete	Delete a federated credential	destructiva
federated_credential.get	Get a federated credential	lectura
federated_credential.list	List federated credentials	lectura
federated_credential.token_exchange	Exchange a workload identity token	escritura
federated_credential.update	Update a federated credential	escritura

Acciones

federated_credential.create

Create a federated credential

Create a workload identity federation trust rule

• Tipo: escritura
• Parámetros obligatorios: audiences, enabled, issuerUrl, name, roleId, subjectMatch
• Meta-herramienta: arcane_federated_credential con "action": "create"
• Herramienta individual: arcane_federated_credential_create
• Ruta de Arcane: POST /api/federated-credentials
• ID de operación: create-federated-credential
• Uso: Trusts tokens from an external OIDC issuer (a CI provider or cloud, issuerUrl must be HTTPS) whose audience is in audiences and whose subjectClaim (default sub) matches subjectMatch (matchType exact or glob, but a bare * glob is rejected). Global admin only, and roleId (from role.list) may not grant more than you hold. Matching tokens are exchanged for Arcane tokens of a dedicated service user holding roleId, optionally scoped to environmentId. Keyless alternative to an API key for CI pipelines.
• Acciones relacionadas: federated_credential.token_exchange, role.create, api_key.create

federated_credential.delete

Delete a federated credential

Delete a workload identity federation trust rule and its service user

• Tipo: destructiva — exige confirm: true
• Parámetros obligatorios: id
• Meta-herramienta: arcane_federated_credential con "action": "delete"
• Herramienta individual: arcane_federated_credential_delete
• Ruta de Arcane: DELETE /api/federated-credentials/{id}
• ID de operación: delete-federated-credential
• Uso: id from federated_credential.list. Global admin only. Removes the trust rule together with its svc_federated_ service user, so later exchanges fail unless another enabled rule for the same issuer still matches. To pause a rule instead, use federated_credential.update with enabled=false.
• Acciones relacionadas: federated_credential.list, federated_credential.update

federated_credential.get

Get a federated credential

Get details of a workload identity federation trust rule

• Tipo: lectura
• Parámetros obligatorios: id
• Meta-herramienta: arcane_federated_credential con "action": "get"
• Herramienta individual: arcane_federated_credential_get
• Ruta de Arcane: GET /api/federated-credentials/{id}
• ID de operación: get-federated-credential
• Uso: id from federated_credential.list. Returns one trust rule with its issuer, audiences, subject matching, roleId/roleName, environmentId, the dedicated service user (identityUserId, serviceUsername), tokenTtlSeconds, expiresAt and lastUsedAt. Needs federated:read.
• Acciones relacionadas: federated_credential.list, federated_credential.update

federated_credential.list

List federated credentials

Get a paginated list of workload identity federation trust rules

• Tipo: lectura
• Parámetros obligatorios: ninguno
• Meta-herramienta: arcane_federated_credential con "action": "list"
• Herramienta individual: arcane_federated_credential_list
• Ruta de Arcane: GET /api/federated-credentials
• ID de operación: list-federated-credentials
• Uso: Returns the trust rules with id, name, enabled, issuerUrl, audiences, subjectClaim/subjectMatch/matchType, roleName, serviceUsername, tokenTtlSeconds and lastUsedAt, plus pagination. search matches name, description, issuerUrl or subjectMatch. Page with start/limit (default 20). Needs federated:list.
• Acciones relacionadas: federated_credential.get, federated_credential.create, federated_credential.update, federated_credential.delete

federated_credential.token_exchange

Exchange a workload identity token

Exchange an external workload identity token (for example a CI job’s OIDC token) for a short-lived Arcane access token, as allowed by a federated credential trust rule (RFC 8693 token exchange). Public endpoint: the subject token is the only credential

• Tipo: escritura
• Parámetros obligatorios: subjectToken
• Meta-herramienta: arcane_federated_credential con "action": "token_exchange"
• Herramienta individual: arcane_federated_credential_token_exchange
• Ruta de Arcane: POST /api/auth/federated/token
• ID de operación: federated-token-exchange
• Uso: Each subject token can be exchanged only once (replay guard). Returns access_token, token_type Bearer and expires_in.
• Acciones relacionadas: federated_credential.list, federated_credential.create

federated_credential.update

Update a federated credential

Update a workload identity federation trust rule

• Tipo: escritura
• Parámetros obligatorios: id
• Meta-herramienta: arcane_federated_credential con "action": "update"
• Herramienta individual: arcane_federated_credential_update
• Ruta de Arcane: PUT /api/federated-credentials/{id}
• ID de operación: update-federated-credential
• Uso: id from federated_credential.list. Global admin only. Changes only the fields given (subjectMatch, audiences, roleId, enabled, tokenTtlSeconds…). enabled=false also revokes the sessions it issued, and a new roleId or environmentId re-assigns the service user’s role.
• Acciones relacionadas: federated_credential.list, federated_credential.get