curl --request POST \
--url https://iam.basaltic.sh/v1/oidc-providers \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"name": "github",
"issuer": "https://token.actions.githubusercontent.com",
"audiences": [
"basaltic-iam-sts"
],
"description": "<string>",
"tags": {}
}
'import requests
url = "https://iam.basaltic.sh/v1/oidc-providers"
payload = {
"name": "github",
"issuer": "https://token.actions.githubusercontent.com",
"audiences": ["basaltic-iam-sts"],
"description": "<string>",
"tags": {}
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
name: 'github',
issuer: 'https://token.actions.githubusercontent.com',
audiences: ['basaltic-iam-sts'],
description: '<string>',
tags: {}
})
};
fetch('https://iam.basaltic.sh/v1/oidc-providers', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://iam.basaltic.sh/v1/oidc-providers",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'name' => 'github',
'issuer' => 'https://token.actions.githubusercontent.com',
'audiences' => [
'basaltic-iam-sts'
],
'description' => '<string>',
'tags' => [
]
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://iam.basaltic.sh/v1/oidc-providers"
payload := strings.NewReader("{\n \"name\": \"github\",\n \"issuer\": \"https://token.actions.githubusercontent.com\",\n \"audiences\": [\n \"basaltic-iam-sts\"\n ],\n \"description\": \"<string>\",\n \"tags\": {}\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://iam.basaltic.sh/v1/oidc-providers")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"name\": \"github\",\n \"issuer\": \"https://token.actions.githubusercontent.com\",\n \"audiences\": [\n \"basaltic-iam-sts\"\n ],\n \"description\": \"<string>\",\n \"tags\": {}\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://iam.basaltic.sh/v1/oidc-providers")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"name\": \"github\",\n \"issuer\": \"https://token.actions.githubusercontent.com\",\n \"audiences\": [\n \"basaltic-iam-sts\"\n ],\n \"description\": \"<string>\",\n \"tags\": {}\n}"
response = http.request(request)
puts response.read_body{
"oidc_provider": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"crn": "crn:iam::production:oidc-provider/github",
"name": "github",
"issuer": "https://token.actions.githubusercontent.com",
"audiences": [
"basaltic-iam-sts"
],
"is_system": false,
"tags": {},
"created_at": "2023-11-07T05:31:56Z",
"updated_at": "2023-11-07T05:31:56Z",
"description": "<string>"
}
}{
"error": {
"code": "INVALID_INPUT",
"message": "Invalid request parameters",
"request_id": "550e8400-e29b-41d4-a716-446655440000"
}
}{
"error": {
"code": "UNAUTHORIZED",
"message": "Authentication required",
"request_id": "550e8400-e29b-41d4-a716-446655440000"
}
}{
"error": {
"code": "ACCESS_DENIED",
"message": "You don't have permission to perform this action",
"request_id": "550e8400-e29b-41d4-a716-446655440000"
}
}{
"error": {
"code": "NOT_FOUND",
"message": "Resource not found",
"request_id": "550e8400-e29b-41d4-a716-446655440000"
}
}{
"error": {
"code": "CONFLICT",
"message": "Resource with this name already exists",
"request_id": "550e8400-e29b-41d4-a716-446655440000"
}
}{
"error": {
"code": "INTERNAL_ERROR",
"message": "An internal error occurred",
"request_id": "550e8400-e29b-41d4-a716-446655440000"
}
}Create an OIDC provider
Register an HTTPS OIDC issuer and allowed audiences in the selected account. The issuer must publish discovery metadata and public signing keys. Roles must explicitly trust this provider and restrict the subject; registration alone grants no access.
curl --request POST \
--url https://iam.basaltic.sh/v1/oidc-providers \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"name": "github",
"issuer": "https://token.actions.githubusercontent.com",
"audiences": [
"basaltic-iam-sts"
],
"description": "<string>",
"tags": {}
}
'import requests
url = "https://iam.basaltic.sh/v1/oidc-providers"
payload = {
"name": "github",
"issuer": "https://token.actions.githubusercontent.com",
"audiences": ["basaltic-iam-sts"],
"description": "<string>",
"tags": {}
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
name: 'github',
issuer: 'https://token.actions.githubusercontent.com',
audiences: ['basaltic-iam-sts'],
description: '<string>',
tags: {}
})
};
fetch('https://iam.basaltic.sh/v1/oidc-providers', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://iam.basaltic.sh/v1/oidc-providers",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'name' => 'github',
'issuer' => 'https://token.actions.githubusercontent.com',
'audiences' => [
'basaltic-iam-sts'
],
'description' => '<string>',
'tags' => [
]
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://iam.basaltic.sh/v1/oidc-providers"
payload := strings.NewReader("{\n \"name\": \"github\",\n \"issuer\": \"https://token.actions.githubusercontent.com\",\n \"audiences\": [\n \"basaltic-iam-sts\"\n ],\n \"description\": \"<string>\",\n \"tags\": {}\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://iam.basaltic.sh/v1/oidc-providers")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"name\": \"github\",\n \"issuer\": \"https://token.actions.githubusercontent.com\",\n \"audiences\": [\n \"basaltic-iam-sts\"\n ],\n \"description\": \"<string>\",\n \"tags\": {}\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://iam.basaltic.sh/v1/oidc-providers")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"name\": \"github\",\n \"issuer\": \"https://token.actions.githubusercontent.com\",\n \"audiences\": [\n \"basaltic-iam-sts\"\n ],\n \"description\": \"<string>\",\n \"tags\": {}\n}"
response = http.request(request)
puts response.read_body{
"oidc_provider": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"crn": "crn:iam::production:oidc-provider/github",
"name": "github",
"issuer": "https://token.actions.githubusercontent.com",
"audiences": [
"basaltic-iam-sts"
],
"is_system": false,
"tags": {},
"created_at": "2023-11-07T05:31:56Z",
"updated_at": "2023-11-07T05:31:56Z",
"description": "<string>"
}
}{
"error": {
"code": "INVALID_INPUT",
"message": "Invalid request parameters",
"request_id": "550e8400-e29b-41d4-a716-446655440000"
}
}{
"error": {
"code": "UNAUTHORIZED",
"message": "Authentication required",
"request_id": "550e8400-e29b-41d4-a716-446655440000"
}
}{
"error": {
"code": "ACCESS_DENIED",
"message": "You don't have permission to perform this action",
"request_id": "550e8400-e29b-41d4-a716-446655440000"
}
}{
"error": {
"code": "NOT_FOUND",
"message": "Resource not found",
"request_id": "550e8400-e29b-41d4-a716-446655440000"
}
}{
"error": {
"code": "CONFLICT",
"message": "Resource with this name already exists",
"request_id": "550e8400-e29b-41d4-a716-446655440000"
}
}{
"error": {
"code": "INTERNAL_ERROR",
"message": "An internal error occurred",
"request_id": "550e8400-e29b-41d4-a716-446655440000"
}
}iam:CreateOIDCProvider. See IAM permissions for the full list, what each one covers, and an example policy.Authorizations
An OAuth 2.0 bearer token, sent as Authorization: Bearer <token>.
This is the recommended way to authenticate.
Get one by exchanging a service account's access key pair at
POST /v1/oauth/token with grant_type=client_credentials. It is the
standard client-credentials grant, so any OAuth-aware library will
obtain and refresh it for you.
curl -s -u "$KEY_ID:$SECRET" -d grant_type=client_credentials \
https://iam.basaltic.sh/v1/oauth/token
Tokens last an hour by default. The same access key pair is separately your AWS SigV4 credential for the S3-compatible object endpoint, which speaks nothing else.
Body
"github"
Immutable HTTPS issuer URL. Public discovery and JWKS endpoints are required for customer providers.
"https://token.actions.githubusercontent.com"
1 - 100 elements1 - 255["basaltic-iam-sts"]
Show child attributes
Show child attributes
Response
Create an OIDC provider
Show child attributes
Show child attributes

