> For clean Markdown of any page, append .md to the page URL. > For a complete documentation index, see https://docs.mixlayer.com/llms.txt. > For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.mixlayer.com/_mcp/server. # Create a workload identity provider POST https://api.mixlayer.com/v1/organizations/{org_id}/workload_identity/providers Content-Type: application/json Requires an organization owner or an API key with `api-admin`. Reference: https://docs.mixlayer.com/api-reference/platform-api/workload-identity-providers/create-workload-identity-provider ## Authentication - `Authorization` header (bearer token, required) — Console user session, Mixlayer API key, or Mixlayer workload access token supplied as a Bearer token. ## Request ### Path parameters - `org_id` (string, required) — Organization ID ### Body (application/json) This endpoint expects a CreateWorkloadIdentityProvider. - `attribute_transformations` (map from string to string, required) — CEL expressions mapping assertion values to normalized attributes. - `authorization_rules` (list of WorkloadIdentityAuthorizationRule, required) — Ordered authorization rules ending in an unconditional fallback. - `config` (WorkloadIdentityProviderConfig, required) — Provider-specific trust configuration. - `name` (string, required) — Human-readable provider name. - `active` (boolean, optional, nullable) — Defaults to active when omitted. - `attribute_condition` (string, optional, nullable) — Optional CEL condition that admits or rejects the workload. ## Response ### 200 Created workload identity provider - `data` (ApiDataResponseWorkloadIdentityProviderData, required) — Persisted organization-scoped workload identity provider. ## Errors ### 400 Bad Request Error The request body contains malformed JSON or invalid values. - `error` (ApiErrorBody, required) — Structured error details. ### 401 Unauthorized Error Authentication is missing or invalid. - `error` (ApiErrorBody, required) — Structured error details. ### 403 Forbidden Error The authenticated principal cannot perform this operation. - `error` (ApiErrorBody, required) — Structured error details. ### 404 Not Found Error The requested resource is not visible to the authenticated principal. - `error` (ApiErrorBody, required) — Structured error details. ### 413 Content Too Large Error The request body exceeds the configured size limit. - `error` (ApiErrorBody, required) — Structured error details. ### 415 Unsupported Media Type Error The request does not have a JSON content type. - `error` (ApiErrorBody, required) — Structured error details. ### 422 Unprocessable Entity Error The JSON body does not match the request schema or contains a rejected field value. - `error` (ApiErrorBody, required) — Structured error details. ### 500 Internal Server Error An unexpected server or database error occurred. - `error` (ApiErrorBody, required) — Structured error details. ## Types ### WorkloadIdentityAuthorizationRule Ordered provider authorization rule with a fixed permission result. - `condition` (string, required) — CEL condition evaluated after attribute transformation. - `permissions` (list of enum, required) — Complete permission set selected when this rule is the first match. - Allowed values: `inference`, `api-read`, `api-write`, `api-admin` ### WorkloadIdentityProviderConfig Provider-specific external credential trust configuration. ### ApiDataResponseWorkloadIdentityProviderData Persisted organization-scoped workload identity provider. - `active` (boolean, required) — Whether token exchange may use this provider. - `attribute_transformations` (map from string to string, required) — CEL expressions mapping assertion claims into Mixlayer attributes. - `authorization_rules` (list of WorkloadIdentityAuthorizationRule, required) — Ordered, first-match authorization rules with a mandatory final fallback. - `config` (WorkloadIdentityProviderConfig, required) — External credential trust configuration. - `created_at` (datetime, required) — Time the provider was created. - `id` (string, required) — Stable generated provider ID with the `wi_` prefix. - `name` (string, required) — Human-readable provider name unique within the organization. - `organization_id` (string, required) — Organization that owns this provider. - `policy_revision` (long, required) — Monotonic revision incremented by every accepted provider update. - `updated_at` (datetime, required) — Time the provider was last updated. - `attribute_condition` (string, optional, nullable) — Optional CEL admission condition evaluated before authorization rules. ### ApiErrorBody Structured error details returned by the platform API. - `message` (string, required) — Human-readable error message. - `code` (string, optional, nullable) — Stable machine-readable error code, when available. - `details` (any, optional) — Error-specific structured context, when available. ### WorkloadIdentityProviderConfig0 OIDC JWT provider configuration. - `allowed_audiences` (list of string, required) — Audiences accepted from workload JWTs. - `issuer_uri` (string, required) — Exact HTTPS issuer URI expected in workload JWTs. - `type` (enum, required) — Discriminator that selects the `oidc` variant. - Allowed values: `oidc` - `jwks` (any, optional) — Optional static public JSON Web Key Set; null enables discovery later. ### WorkloadIdentityProviderConfig1 X.509 client certificate provider configuration. - `trust_anchors` (list of string, required) — PEM-encoded provider trust anchors. - `type` (enum, required) — Discriminator that selects the `x509` variant. - Allowed values: `x509` - `intermediate_cas` (list of string, optional) — PEM-encoded intermediate CAs used only for chain construction. ## Examples **Request** ```json { "authorization_rules": [ { "condition": "string", "permissions": [ "inference" ] } ], "config": { "allowed_audiences": [ "string" ], "issuer_uri": "string", "type": "oidc" }, "name": "string" } ``` **Response** ```json { "data": { "active": true, "attribute_transformations": {}, "authorization_rules": [ { "condition": "string", "permissions": [ "inference" ] } ], "config": { "allowed_audiences": [ "string" ], "issuer_uri": "string", "jwks": null, "type": "oidc" }, "created_at": "2024-01-15T09:30:00Z", "id": "string", "name": "string", "organization_id": "string", "policy_revision": 1, "updated_at": "2024-01-15T09:30:00Z", "attribute_condition": "string" } } ``` **SDK Code** ```python import requests url = "https://api.mixlayer.com/v1/organizations/org_id/workload_identity/providers" payload = { "authorization_rules": [ { "condition": "string", "permissions": ["inference"] } ], "config": { "allowed_audiences": ["string"], "issuer_uri": "string", "type": "oidc" }, "name": "string" } headers = { "Authorization": "Bearer ", "Content-Type": "application/json" } response = requests.post(url, json=payload, headers=headers) print(response.json()) ``` ```javascript const url = 'https://api.mixlayer.com/v1/organizations/org_id/workload_identity/providers'; const options = { method: 'POST', headers: {Authorization: 'Bearer ', 'Content-Type': 'application/json'}, body: '{"authorization_rules":[{"condition":"string","permissions":["inference"]}],"config":{"allowed_audiences":["string"],"issuer_uri":"string","type":"oidc"},"name":"string"}' }; try { const response = await fetch(url, options); const data = await response.json(); console.log(data); } catch (error) { console.error(error); } ``` ```go package main import ( "fmt" "strings" "net/http" "io" ) func main() { url := "https://api.mixlayer.com/v1/organizations/org_id/workload_identity/providers" payload := strings.NewReader("{\n \"authorization_rules\": [\n {\n \"condition\": \"string\",\n \"permissions\": [\n \"inference\"\n ]\n }\n ],\n \"config\": {\n \"allowed_audiences\": [\n \"string\"\n ],\n \"issuer_uri\": \"string\",\n \"type\": \"oidc\"\n },\n \"name\": \"string\"\n}") req, _ := http.NewRequest("POST", url, payload) req.Header.Add("Authorization", "Bearer ") req.Header.Add("Content-Type", "application/json") res, _ := http.DefaultClient.Do(req) defer res.Body.Close() body, _ := io.ReadAll(res.Body) fmt.Println(res) fmt.Println(string(body)) } ``` ```ruby require 'uri' require 'net/http' url = URI("https://api.mixlayer.com/v1/organizations/org_id/workload_identity/providers") http = Net::HTTP.new(url.host, url.port) http.use_ssl = true request = Net::HTTP::Post.new(url) request["Authorization"] = 'Bearer ' request["Content-Type"] = 'application/json' request.body = "{\n \"authorization_rules\": [\n {\n \"condition\": \"string\",\n \"permissions\": [\n \"inference\"\n ]\n }\n ],\n \"config\": {\n \"allowed_audiences\": [\n \"string\"\n ],\n \"issuer_uri\": \"string\",\n \"type\": \"oidc\"\n },\n \"name\": \"string\"\n}" response = http.request(request) puts response.read_body ``` ```java import com.mashape.unirest.http.HttpResponse; import com.mashape.unirest.http.Unirest; HttpResponse response = Unirest.post("https://api.mixlayer.com/v1/organizations/org_id/workload_identity/providers") .header("Authorization", "Bearer ") .header("Content-Type", "application/json") .body("{\n \"authorization_rules\": [\n {\n \"condition\": \"string\",\n \"permissions\": [\n \"inference\"\n ]\n }\n ],\n \"config\": {\n \"allowed_audiences\": [\n \"string\"\n ],\n \"issuer_uri\": \"string\",\n \"type\": \"oidc\"\n },\n \"name\": \"string\"\n}") .asString(); ``` ```php request('POST', 'https://api.mixlayer.com/v1/organizations/org_id/workload_identity/providers', [ 'body' => '{ "authorization_rules": [ { "condition": "string", "permissions": [ "inference" ] } ], "config": { "allowed_audiences": [ "string" ], "issuer_uri": "string", "type": "oidc" }, "name": "string" }', 'headers' => [ 'Authorization' => 'Bearer ', 'Content-Type' => 'application/json', ], ]); echo $response->getBody(); ```