Expand description
Stable transport-neutral contract for Runtime Workload Identity.
This crate owns identity, permission and credential value types only. It intentionally contains no HTTP framework, SQL, signer or attestation code.
Structs§
- Check
Permission Request - Check
Permission Response - Create
Recovery Credential Request - Create
Recovery Credential Response - Create
Runtime Identity Request - Create
Runtime Identity Response - Credential
Capability - Effective
Permissions Response - Issue
Runtime Credential Request - Issue
Runtime Credential Response - List
Recovery Credentials Response - List
Runtime Identities Request - List
Runtime Identities Response - Permission
Grant - Permission
Grant Id - Permission
Grant Input - Permissions
Response - Recovery
Credential - Recovery
Credential Id - Replace
Permissions Request - Resource
Relations - Domain-neutral many-to-many associations for an Infra-owned resource.
- Revoke
Recovery Credential Request - Revoke
Runtime Credential Request - Rotate
Recovery Credential Request - Runtime
Credential Claims - Runtime
Credential KeySet - Runtime
Credential Public Key - Runtime
Identity - Runtime
Identity Id - Tenant
Project Scope - Transition
Identity Request - Update
Runtime Identity Request - Verify
Runtime Credential Request - Verify
Runtime Credential Response
Enums§
- Identity
Access - Who may inspect Runtime Identity records inside one tenant/project.
- Recovery
Credential Status - Runtime
Identity Kind - Runtime
Identity Status
Constants§
- ACTIVATE_
PATH - AUDIENCE
- DEFAULT_
PORT - EFFECTIVE_
PERMISSIONS_ PATH - HEALTH_
PATH - IDENTITIES_
PATH - IDENTITY_
PATH - ISSUE_
CREDENTIAL_ PATH - JWKS_
PATH - LIST_
IDENTITIES_ PATH - PERMISSIONS_
PATH - PERMISSION_
CHECK_ PATH - RECOVERY_
CREDENTIALS_ PATH - RECOVERY_
CREDENTIAL_ ACTION_ PATH - RECOVERY_
CREDENTIAL_ PREFIX - RECOVER_
CREDENTIAL_ PATH - RESUME_
PATH - REVOKE_
CREDENTIAL_ PATH - REVOKE_
PATH - SERVICE_
NAME - SUSPEND_
PATH - VERIFY_
CREDENTIAL_ PATH
Functions§
- capability_
grant_ matches - Returns whether a granted capability contains a requested capability.
Wildcards match complete segments only; partial-segment wildcards are not
part of the capability grammar.
*is retained for platform principals. - validate_
audience - validate_
capabilities - validate_
runtime_ name