Issue a Service Credential

Single-tenant only. Issues the credential a Lerian service signs in with: source is the service the credential speaks for, recorded as its sourceService claim, and target the service it calls. Both must appear in GET /v1/applications/available.

Only a person may call this. An application token is refused even when it may create applications.

For target plugin-identity the application, displayed {target}-service, joins no permission: it only authenticates the service’s own permission declaration. For any other target, when the target declares the role service-{source} in m2m.service_roles, it is displayed {target}-service-{source} and listed on that caller’s own lane, {target}-service-{source}-m2m-permission, which holds that role alone. Otherwise it is displayed {target}-service and listed on the shared service lane, {target}-service-m2m-permission, which holds the target’s other service roles; when the target later declares service-{source}, its next re-apply moves the credential to that caller’s lane and display name; once it stops declaring it, back to the shared lane. It never joins the client lane {target}-m2m-permission.

⚠️ The response carries the clientSecret IN FULL, and no other Identity API response returns it.

Revoke it with DELETE /v1/applications/{id}, which also removes it from its lane. Each issue is a new credential, so to rotate one: issue the new one, deploy it, then revoke the old one.

Failures:

• 400 — source or target is missing, or IDE-0012 when either is not in the catalog.
• 403 — the caller is an application, not a person (401 where M2M inversion is off).
• 409 IDE-1065 — the generated application name is taken. Nothing was created; retry it.
• 422 — the target has no service lane yet: it declares no m2m.service_roles, or it has not published its declaration; or its lane gives that source no role. Nothing was created.
• 501 — multi-tenant deployment: the tenant manager issues service credentials there.
• 503 IDE-0064 / IDE-0065 — another write to the same service lane held it past the wait, or the service that coordinates those writes did not answer. Nothing was created; retry it.
• 503 IDE-0066 — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later.

POST /v1/applications/service-credentials

Issue a Service Credential

cURL

curl --request POST \
  --url https://identity.sandbox.lerian.net/v1/applications/service-credentials \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "source": "jd-courier",
  "target": "plugin-identity"
}
'

201

{
  "clientId": "<string>",
  "clientSecret": "<string>",
  "createdAt": "2021-09-01T00:00:00Z",
  "description": "Midaz Used By Application X",
  "id": "00000000-0000-0000-0000-000000000000",
  "name": "Midaz",
  "partnerId": "00000000-0000-0000-0000-000000000000"
}

Authorizations

Authorization · string · header · required

JWT bearer token issued by the identity provider.

Body

application/json

The service credential to issue.

source · string · required

The Lerian service that signs in with this credential; it becomes the sourceService claim. Must match GET /v1/applications/available.

Example:

"jd-courier"

target · string · required

The service this credential calls. Must match GET /v1/applications/available.

Example:

"plugin-identity"

Response

201

application/json

Created

clientId · string

clientSecret · string

Returned only by the create call. Absent from every Identity API read.

createdAt · string

Example:

"2021-09-01T00:00:00Z"

description · string

Example:

"Midaz Used By Application X"

id · string

Example:

"00000000-0000-0000-0000-000000000000"

name · string

Example:

"Midaz"

partnerId · string

Example:

"00000000-0000-0000-0000-000000000000"