federated_credential
The federated_credential domain has 6 actions. On the meta surface they are all reached through arcane_federated_credential; on the individual surface each one is its own tool; on the dynamic surface run them with arcane_execute_action and the canonical ID.
Summary
Section titled “Summary”| Action | Title | Kind |
|---|---|---|
federated_credential.create | Create a federated credential | write |
federated_credential.delete | Delete a federated credential | destructive |
federated_credential.get | Get a federated credential | read |
federated_credential.list | List federated credentials | read |
federated_credential.token_exchange | Exchange a workload identity token | write |
federated_credential.update | Update a federated credential | write |
Actions
Section titled “Actions”federated_credential.create
Section titled “federated_credential.create”Create a federated credential
Create a workload identity federation trust rule
- Kind: write
- Required parameters:
audiences,enabled,issuerUrl,name,roleId,subjectMatch - Meta tool:
arcane_federated_credentialwith"action": "create" - Individual tool:
arcane_federated_credential_create - Arcane route:
POST /api/federated-credentials - Operation ID:
create-federated-credential - Usage: Trusts tokens from an external OIDC issuer (a CI provider or cloud, issuerUrl must be HTTPS) whose audience is in audiences and whose subjectClaim (default sub) matches subjectMatch (matchType exact or glob, but a bare * glob is rejected). Global admin only, and roleId (from role.list) may not grant more than you hold. Matching tokens are exchanged for Arcane tokens of a dedicated service user holding roleId, optionally scoped to environmentId. Keyless alternative to an API key for CI pipelines.
- Related actions:
federated_credential.token_exchange,role.create,api_key.create
federated_credential.delete
Section titled “federated_credential.delete”Delete a federated credential
Delete a workload identity federation trust rule and its service user
- Kind: destructive — requires
confirm: true - Required parameters:
id - Meta tool:
arcane_federated_credentialwith"action": "delete" - Individual tool:
arcane_federated_credential_delete - Arcane route:
DELETE /api/federated-credentials/{id} - Operation ID:
delete-federated-credential - Usage: id from federated_credential.list. Global admin only. Removes the trust rule together with its svc_federated_ service user, so later exchanges fail unless another enabled rule for the same issuer still matches. To pause a rule instead, use federated_credential.update with enabled=false.
- Related actions:
federated_credential.list,federated_credential.update
federated_credential.get
Section titled “federated_credential.get”Get a federated credential
Get details of a workload identity federation trust rule
- Kind: read
- Required parameters:
id - Meta tool:
arcane_federated_credentialwith"action": "get" - Individual tool:
arcane_federated_credential_get - Arcane route:
GET /api/federated-credentials/{id} - Operation ID:
get-federated-credential - Usage: id from federated_credential.list. Returns one trust rule with its issuer, audiences, subject matching, roleId/roleName, environmentId, the dedicated service user (identityUserId, serviceUsername), tokenTtlSeconds, expiresAt and lastUsedAt. Needs federated:read.
- Related actions:
federated_credential.list,federated_credential.update
federated_credential.list
Section titled “federated_credential.list”List federated credentials
Get a paginated list of workload identity federation trust rules
- Kind: read
- Required parameters: none
- Meta tool:
arcane_federated_credentialwith"action": "list" - Individual tool:
arcane_federated_credential_list - Arcane route:
GET /api/federated-credentials - Operation ID:
list-federated-credentials - Usage: Returns the trust rules with id, name, enabled, issuerUrl, audiences, subjectClaim/subjectMatch/matchType, roleName, serviceUsername, tokenTtlSeconds and lastUsedAt, plus pagination. search matches name, description, issuerUrl or subjectMatch. Page with start/limit (default 20). Needs federated:list.
- Related actions:
federated_credential.get,federated_credential.create,federated_credential.update,federated_credential.delete
federated_credential.token_exchange
Section titled “federated_credential.token_exchange”Exchange a workload identity token
Exchange an external workload identity token (for example a CI job’s OIDC token) for a short-lived Arcane access token, as allowed by a federated credential trust rule (RFC 8693 token exchange). Public endpoint: the subject token is the only credential
- Kind: write
- Required parameters:
subjectToken - Meta tool:
arcane_federated_credentialwith"action": "token_exchange" - Individual tool:
arcane_federated_credential_token_exchange - Arcane route:
POST /api/auth/federated/token - Operation ID:
federated-token-exchange - Usage: Each subject token can be exchanged only once (replay guard). Returns access_token, token_type Bearer and expires_in.
- Related actions:
federated_credential.list,federated_credential.create
federated_credential.update
Section titled “federated_credential.update”Update a federated credential
Update a workload identity federation trust rule
- Kind: write
- Required parameters:
id - Meta tool:
arcane_federated_credentialwith"action": "update" - Individual tool:
arcane_federated_credential_update - Arcane route:
PUT /api/federated-credentials/{id} - Operation ID:
update-federated-credential - Usage: id from federated_credential.list. Global admin only. Changes only the fields given (subjectMatch, audiences, roleId, enabled, tokenTtlSeconds…). enabled=false also revokes the sessions it issued, and a new roleId or environmentId re-assigns the service user’s role.
- Related actions:
federated_credential.list,federated_credential.get