Trade a CI OIDC token for a delivery credential
The same exchange as `/api/v1/auth/oidc`, for a credential that will carry values into a build.
/api/v1/auth/oidc/deliveryThe same exchange as /api/v1/auth/oidc, for a credential that will carry values into a build. It lives five minutes rather than the fifteen the other exchanges hand out, it records the run on the credential so the audit trail names one execution, and it refuses the triggers that put untrusted code in the job.
Request Body
application/json
TypeScript Definitions
Use the request body type in TypeScript.
The GitHub Actions OIDC token for the run that will receive the values.
Response Body
application/json
application/json
application/json
application/json
application/json
application/json
curl -X POST "https://example.com/api/v1/auth/oidc/delivery" \ -H "Content-Type: application/json" \ -d '{ "token": "string" }'{ "credential": "string", "expiresAt": "2019-08-24T14:15:22Z"}Trade a CI OIDC token for a machine credential POST
Verifies the token against a trust you created, then mints an ordinary short-lived credential.
Trade a signed AWS caller-identity request for a machine credential POST
A workload signs a call that only asks AWS who it is, and we replay that call to find out.