> For the complete documentation index, see [llms.txt](https://docs.enclaive.cloud/vault/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.enclaive.cloud/vault/api/secrets-engines/identity/tokens.md).

# tokens

### Configure the identity tokens backend <a href="#configure-the-identity-tokens-backend" id="configure-the-identity-tokens-backend"></a>

This endpoint updates configurations for OIDC-compliant identity tokens issued by Vault.

| Method | Path                   |
| ------ | ---------------------- |
| `POST` | `identity/oidc/config` |

#### Parameters <a href="#parameters" id="parameters"></a>

* `issuer` `(string: "")` – Issuer URL to be used in the iss claim of the token. If not set, Vault's api\_addr will be used. The issuer is a case sensitive URL using the https scheme that contains scheme, host, and an optional port number.

#### Sample payload <a href="#sample-payload" id="sample-payload"></a>

```json
{
  "issuer": "https://example.com:1234"
}
```

#### Sample request <a href="#sample-request" id="sample-request"></a>

```shell-session
$ curl \
    --header "X-Vault-Token: ..." \
    --request POST \
    --data @payload.json \
    http://127.0.0.1:8200/v1/identity/oidc/config
```

#### Sample response <a href="#sample-response" id="sample-response"></a>

```json
{
  "data": null,
  "warnings": [
    "If \"issuer\" is set explicitly, all tokens must be validated against that address, including those issued by secondary clusters. Setting issuer to \"\" will restore the default behavior of using the cluster's api_addr as the issuer."
  ]
}
```

### Read configurations for the identity tokens backend <a href="#read-configurations-for-the-identity-tokens-backend" id="read-configurations-for-the-identity-tokens-backend"></a>

This endpoint queries vault identity tokens configurations.

| Method | Path                   |
| ------ | ---------------------- |
| `GET`  | `identity/oidc/config` |

#### Sample request <a href="#sample-request-1" id="sample-request-1"></a>

```shell-session
$ curl \
    --header "X-Vault-Token: ..." \
    --request GET \
    http://127.0.0.1:8200/v1/identity/oidc/config
```

#### Sample response <a href="#sample-response-1" id="sample-response-1"></a>

```json
{
  "data": {
    "issuer": "https://example.com:1234"
  }
}
```

### Create a named key <a href="#create-a-named-key" id="create-a-named-key"></a>

This endpoint creates or updates a named key which is used by a role to sign tokens.

| Method | Path                      |
| ------ | ------------------------- |
| `POST` | `identity/oidc/key/:name` |

#### Parameters <a href="#parameters-1" id="parameters-1"></a>

* `name` `(string)` – Name of the named key.
* `rotation_period` `(int or time string: "24h")` - How often to generate a new signing key. Uses duration format strings.
* `verification_ttl` `(int or time string: "24h")` - Controls how long the public portion of a signing key will be available for verification after being rotated. Uses duration format strings.
* `allowed_client_ids` `(list: [])` - Array of role client ids allowed to use this key for signing. If empty, no roles are allowed. If "\*", all roles are allowed.
* `algorithm` `(string: "RS256")` - Signing algorithm to use. Allowed values are: RS256 (default), RS384, RS512, ES256, ES384, ES512, EdDSA.

#### Sample payload <a href="#sample-payload-1" id="sample-payload-1"></a>

```json
{
  "rotation_period": "12h",
  "verification_ttl": 43200
}
```

#### Sample request <a href="#sample-request-2" id="sample-request-2"></a>

```shell-session
$ curl \
    --header "X-Vault-Token: ..." \
    --request POST \
    --data @payload.json \
    http://127.0.0.1:8200/v1/identity/oidc/key/named-key-001
```

### Read a named key <a href="#read-a-named-key" id="read-a-named-key"></a>

This endpoint queries a named key and returns its configurations.

| Method | Path                      |
| ------ | ------------------------- |
| `GET`  | `identity/oidc/key/:name` |

#### Parameters <a href="#parameters-2" id="parameters-2"></a>

* `name` `(string)` – Name of the key.

#### Sample request <a href="#sample-request-3" id="sample-request-3"></a>

```shell-session
$ curl \
    --header "X-Vault-Token: ..." \
    --request GET \
    http://127.0.0.1:8200/v1/identity/oidc/key/named-key-001
```

#### Sample response <a href="#sample-response-2" id="sample-response-2"></a>

```json
{
  "data": {
    "algorithm": "RS256",
    "rotation_period": 43200,
    "verification_ttl": 43200
  }
}
```

### Delete a named key <a href="#delete-a-named-key" id="delete-a-named-key"></a>

This endpoint deletes a named key.

| Method   | Path                      |
| -------- | ------------------------- |
| `DELETE` | `identity/oidc/key/:name` |

#### Parameters <a href="#parameters-3" id="parameters-3"></a>

* `name` `(string)` – Name of the key.

#### Sample request <a href="#sample-request-4" id="sample-request-4"></a>

```shell-session
$ curl \
    --header "X-Vault-Token: ..." \
    --request DELETE \
    http://127.0.0.1:8200/v1/identity/oidc/key/named-key-001
```

### List named keys <a href="#list-named-keys" id="list-named-keys"></a>

This endpoint will List all named keys.

| Method | Path                |
| ------ | ------------------- |
| `LIST` | `identity/oidc/key` |

#### Sample request <a href="#sample-request-5" id="sample-request-5"></a>

```shell-session
$ curl \
    --header "X-Vault-Token: ..." \
    --request LIST \
    http://127.0.0.1:8200/v1/identity/oidc/key
```

#### Sample response <a href="#sample-response-3" id="sample-response-3"></a>

```json
{
  "data": {
    "keys": ["named-key-001", "named-key-002"]
  }
}
```

### Rotate a named key <a href="#rotate-a-named-key" id="rotate-a-named-key"></a>

This endpoint rotates a named key.

| Method | Path                             |
| ------ | -------------------------------- |
| `POST` | `identity/oidc/key/:name/rotate` |

#### Parameters <a href="#parameters-4" id="parameters-4"></a>

* `name` `(string)` – Name of the key to be rotated.
* `verification_ttl` `(string: <optional>)` - Controls how long the public portion of the key will be available for verification after being rotated. Setting verification\_ttl here will override the verification\_ttl set on the key.

#### Sample payload <a href="#sample-payload-2" id="sample-payload-2"></a>

```json
{
  "verification_ttl": 0
}
```

#### Sample request <a href="#sample-request-6" id="sample-request-6"></a>

```shell-session
$ curl \
    --header "X-Vault-Token: ..." \
    --request POST \
    --data @payload.json \
    http://127.0.0.1:8200/v1/identity/oidc/key/named-key-001/rotate
```

### Create or update a role <a href="#create-or-update-a-role" id="create-or-update-a-role"></a>

Create or update a role. ID tokens are generated against a role and signed against a named key.

| Method | Path                       |
| ------ | -------------------------- |
| `POST` | `identity/oidc/role/:name` |

#### Parameters <a href="#parameters-5" id="parameters-5"></a>

* `name` `(string)` – Name of the role.
* `key` `(string)` – A configured named key, the key must already exist.
* `template` `(string: <optional>)` - The template string to use for generating tokens. This may be in string-ified JSON or base64 format.
* `client_id` `(string: <optional>)` - Optional client ID. A random ID will be generated if left unset.
* `ttl` `(int or time string: "24h")` - TTL of the tokens generated against the role. Uses duration format strings.

#### Sample payload <a href="#sample-payload-3" id="sample-payload-3"></a>

```json
{
  "key": "named-key-001",
  "ttl": "12h"
}
```

#### Sample request <a href="#sample-request-7" id="sample-request-7"></a>

```shell-session
$ curl \
    --header "X-Vault-Token: ..." \
    --request POST \
    --data @payload.json \
    http://127.0.0.1:8200/v1/identity/oidc/role/role-001
```

### Read a role <a href="#read-a-role" id="read-a-role"></a>

This endpoint queries a role and returs its configuration.

| Method | Path                       |
| ------ | -------------------------- |
| `GET`  | `identity/oidc/role/:name` |

#### Parameters <a href="#parameters-6" id="parameters-6"></a>

* `name` `(string)` – Name of the role.

#### Sample request <a href="#sample-request-8" id="sample-request-8"></a>

```shell-session
$ curl \
    --header "X-Vault-Token: ..." \
    --request GET \
    http://127.0.0.1:8200/v1/identity/oidc/role/role-001
```

#### Sample response <a href="#sample-response-4" id="sample-response-4"></a>

```json
{
  "data": {
    "client_id": "PGE8tf4RmJkDwvjI1FgARkXEmH",
    "key": "named-key-001",
    "template": "",
    "ttl": 43200
  }
}
```

### Delete a role <a href="#delete-a-role" id="delete-a-role"></a>

This endpoint deletes a role.

| Method   | Path                       |
| -------- | -------------------------- |
| `DELETE` | `identity/oidc/role/:name` |

#### Parameters <a href="#parameters-7" id="parameters-7"></a>

* `name` `(string)` – Name of the role.

#### Sample request <a href="#sample-request-9" id="sample-request-9"></a>

```shell-session
$ curl \
    --header "X-Vault-Token: ..." \
    --request DELETE \
    http://127.0.0.1:8200/v1/identity/oidc/role/role-001
```

### List roles <a href="#list-roles" id="list-roles"></a>

This endpoint will list all signing keys.

| Method | Path                 |
| ------ | -------------------- |
| `LIST` | `identity/oidc/role` |

#### Sample request <a href="#sample-request-10" id="sample-request-10"></a>

```shell-session
$ curl \
    --header "X-Vault-Token: ..." \
    --request LIST \
    http://127.0.0.1:8200/v1/identity/oidc/role
```

#### Sample response <a href="#sample-response-5" id="sample-response-5"></a>

```json
{
  "data": {
    "keys": ["role-001", "role-002", "testrole"]
  }
}
```

### Generate a signed ID token <a href="#generate-a-signed-id-token" id="generate-a-signed-id-token"></a>

Use this endpoint to generate a signed ID (OIDC) token.

| Method | Path                        |
| ------ | --------------------------- |
| `GET`  | `identity/oidc/token/:name` |

#### Parameters <a href="#parameters-8" id="parameters-8"></a>

* `name` `(string: "")` – The name of the role against which to generate a signed ID token

#### Sample request <a href="#sample-request-11" id="sample-request-11"></a>

```shell-session
$ curl \
    --header "X-Vault-Token: ..." \
    --request GET \
    --data @payload.json \
    http://127.0.0.1:8200/v1/identity/oidc/token/role-001
```

#### Sample response <a href="#sample-response-6" id="sample-response-6"></a>

```json
{
  "data": {
    "client_id": "P6CfCzyHsQY4pMcA6kWAOCItA7",
    "token": "eyJhbGciOiJSUzI1NiIsImtpZCI6IjJkMGI4YjlkLWYwNGQtNzFlYy1iNjc0LWM3MzU4NDMyYmM1YiJ9.eyJhdWQiOiJQNkNmQ3p5SHNRWTRwTWNBNmtXQU9DSXRBNyIsImV4cCI6MTU2MTQ4ODQxMiwiaWF0IjoxNTYxNDAyMDEyLCJpc3MiOiJodHRwczovL2V4YW1wbGUuY29tOjEyMzQiLCJzdWIiOiI2YzY1ZWFmNy1kNGY0LTEzMzMtMDJiYy0xYzc1MjE5YzMxMDIifQ.IcbWTmks7P5eVtwmIBl5rL1B88MI55a9JJuYVLIlwE9aP_ilXpX5fE38CDm5PixDDVJb8TI2Q_FO4GMMH0ymHDO25ZvA917WcyHCSBGaQlgcS-WUL2fYTqFjSh-pezszaYBgPuGvH7hJjlTZO6g0LPCyUWat3zcRIjIQdXZum-OyhWAelQlveEL8sOG_ldyZ8v7fy7GXDxfJOK1kpw5AX9DXJKylbwZTBS8tLb-7edq8uZ0lNQyWy9VPEW_EEIZvGWy0AHua-Loa2l59GRRP8mPxuMYxH_c88x1lsSw0vH9E3rU8AXLyF3n4d40PASXEjZ-7dnIf4w4hf2P4L0xs_g",
    "ttl": 86400
  }
}
```

### Introspect a signed ID token <a href="#introspect-a-signed-id-token" id="introspect-a-signed-id-token"></a>

This endpoint can verify the authenticity and active state of a signed ID token.

| Method | Path                       |
| ------ | -------------------------- |
| `POST` | `identity/oidc/introspect` |

#### Parameters <a href="#parameters-9" id="parameters-9"></a>

* `token` `(string)` – A signed OIDC compliant ID token
* `client_id` `(string: <optional>)` - Specifying the client ID additionally requires the token to contain a matching `aud` claim

#### Sample payload <a href="#sample-payload-4" id="sample-payload-4"></a>

```json
{
  "token": "eyJhbGciOiJSUzI1NiIsImtpZCI6ImE4NDQ4YmVkLTk4ZTMtMDNhMC01ODY4LTdmOWYyZDc5NWY2NSJ9.eyJhdWQiOiJpUDdyV1A4dmhDVFFpOTAydGhaR0hUazJMbyIsImV4cCI6MTU2MTQ4OTE0OSwiaWF0IjoxNTYxNDAyNzQ5LCJpc3MiOiJodHRwOi8vMTI3LjAuMC4xOjgyMDAvdjEvaWRlbnRpdHkvb2lkYyIsInN1YiI6IjQ1NDQxZTg3LWMyMWQtYzY5NS0wNGM3LWU0YmU4MGU1M2Y0ZiJ9.IYZx1bBofBgwphLZggugFUE7V3ZLFDNr0UYv3hhc4RlIu5WgFZPRjpKVXPdORozYJJB_37aJW6qm5j8nNSz4WrWUmMcrVxoZi2VBExu-GcHHniEPRryR9t_45rqP2MycLBz0dICOjFDWvfkp6ddyCsQfkRnplPGCaN67MUEdgYQf5QNyxaG-yabRPiATY_OtXSjiNsMhJe6ZloYTZZc9gTTfKcKQf4mfy5yRY6471qkqeTuYNhKjwdkEnCSaEjHmCdZOYC5DAet16eQ7ankcwBno17_zs7vbPmkXNttALOrjSQgGe1td1SCfZeg5UOs7_IPk0qqdwOdyQ8wsrDmSyg"
}
```

#### Sample request <a href="#sample-request-12" id="sample-request-12"></a>

```shell-session
$ curl \
    --header "X-Vault-Token: ..." \
    --request POST \
    --data @payload.json \
    http://127.0.0.1:8200/v1/identity/oidc/introspect
```

#### Sample response <a href="#sample-response-7" id="sample-response-7"></a>

```json
{
  "active": true
}
```

### Read .well-known configurations <a href="#read-well-known-configurations" id="read-well-known-configurations"></a>

Query this path to retrieve a set of claims about the identity tokens' configuration. The response is a compliant OpenID Provider Configuration Response.

| Method | Path                                             |
| ------ | ------------------------------------------------ |
| `GET`  | `identity/oidc/.well-known/openid-configuration` |

#### Sample request <a href="#sample-request-13" id="sample-request-13"></a>

```shell-session
$ curl \
    --request GET \
    http://127.0.0.1:8200/v1/identity/oidc/.well-known/openid-configuration
```

#### Sample response <a href="#sample-response-8" id="sample-response-8"></a>

```json
{
  "issuer": "https://example.com:1234",
  "authorization_endpoint": "",
  "token_endpoint": "",
  "jwks_uri": "https://example.com:1234/.well-known/keys",
  "response_types_supported": null,
  "subject_types_supported": ["public"],
  "id_token_signing_alg_values_supported": ["RS256"],
  "scopes_supported": null,
  "token_endpoint_auth_methods_supported": null,
  "claims_supported": null
}
```

### Read active public keys <a href="#read-active-public-keys" id="read-active-public-keys"></a>

Query this path to retrieve the public portion of named keys. Clients can use this to validate the authenticity of an identity token.

#### Sample request <a href="#sample-request-14" id="sample-request-14"></a>

```shell-session
$ curl \
    --request GET \
    http://127.0.0.1:8200/v1/identity/oidc/.well-known/keys
```

#### Sample response <a href="#sample-response-9" id="sample-response-9"></a>

```json
{
  "keys": [
    {
      "use": "sig",
      "kty": "RSA",
      "kid": "94178020-55b5-e18d-b32b-1010ba5a35b4",
      "alg": "RS256",
      "n": "1bt-V8T7g0zr7koNbdppFrUM5YrnybPDOt-cK3MKmL1FcN3aOltCw9tCYStHgm8mIz_DJ1HgIjA-DcK_O9gacEGFCidUuudV8O4TixToHEVyRe1yXu-Q98hwkm9JtFF9PvMzDXhn4s3bLanOZzO15JAdVCo0JnwSIT9Ay3LxPLbWHYbPj7ROScuvic99OyvWz87qBK-AoXmxo9lRNY39LtieMr1D2iq0HvtjHkfiarr34CSTcuksknOsY49BU5ktrs_YJSEVpeRQ8RywY1sWrq8w_UmGsNFfPr--crXQw0ekJCXzmotsRHE5jwMuhjuucVlnyQFBYEdfDB_iPbC7Hw",
      "e": "AQAB"
    }
  ]
}
```