Enum HessraClient 

pub enum HessraClient {
    Http1(Http1Client),
}

The main Hessra client type providing token request and verification

Variants

Http1(Http1Client)

HTTP/1.1 client

Implementations

impl HessraClient

pub fn builder() -> HessraClientBuilder

Create a new client builder

pub async fn fetch_public_key( base_url: impl Into<String>, port: Option<u16>, server_ca: impl Into<String>, ) -> Result<String, ApiError>

Fetch the public key from the Hessra service without creating a client The public_key endpoint is available as both an authenticated and unauthenticated request.

pub async fn fetch_ca_cert( base_url: impl Into<String>, port: Option<u16>, ) -> Result<String, ApiError>

Fetch the CA certificate from the Hessra service without authentication

This function makes an unauthenticated request to the /ca_cert endpoint to retrieve the server’s CA certificate in PEM format. This is useful for bootstrapping trust when setting up a new client.

Bootstrap Trust Considerations

This function uses the system CA store for the initial connection. If the server uses a self-signed certificate, consider using fetch_ca_cert_insecure instead (with appropriate warnings to users).

pub async fn request_token( &self, resource: String, operation: String, domain: Option<String>, ) -> Result<TokenResponse, ApiError>

Request a token for a resource Returns the full TokenResponse which may include pending signoffs for multi-party tokens

Arguments

• resource - The resource identifier to request authorization for
• operation - The operation to request authorization for
• domain - Optional domain for domain-restricted identity token verification

pub async fn request_token_with_identity( &self, resource: String, operation: String, identity_token: String, domain: Option<String>, ) -> Result<TokenResponse, ApiError>

Request a token for a resource using an identity token for authentication The identity token will be sent in the Authorization header as a Bearer token Returns the full TokenResponse which may include pending signoffs for multi-party tokens

Arguments

• resource - The resource identifier to request authorization for
• operation - The operation to request authorization for
• identity_token - The identity token to use for authentication
• domain - Optional domain for domain-restricted identity token verification

pub async fn request_token_simple( &self, resource: String, operation: String, ) -> Result<String, ApiError>

Request a token for a resource (legacy method) This method returns just the token string for backward compatibility

pub async fn verify_token( &self, token: String, subject: String, resource: String, operation: String, ) -> Result<String, ApiError>

Verify a token for subject doing operation on resource. This will verify the token using the remote authorization service API.

pub async fn verify_service_chain_token( &self, token: String, subject: String, resource: String, component: Option<String>, ) -> Result<String, ApiError>

Verify a service chain token. If no component is provided, the entire service chain will be used to verify the token. If a component name is provided, the service chain up to and excluding the component will be used to verify the token. This is useful for a node in the middle of the service chain verifying a token has been attested by all previous nodes.

pub async fn sign_token( &self, token: &str, resource: &str, operation: &str, ) -> Result<SignTokenResponse, ApiError>

Sign a multi-party token by calling an authorization service’s signoff endpoint

pub async fn get_public_key(&self) -> Result<String, ApiError>

Get the public key from the server

pub async fn request_identity_token( &self, identifier: Option<String>, ) -> Result<IdentityTokenResponse, ApiError>

Request a new identity token from the authorization service

This endpoint requires mTLS authentication as it’s the initial issuance of an identity token. The identifier parameter is optional when using mTLS, as the identity can be derived from the client certificate.

Arguments

• identifier - Optional identifier for the identity. Required for non-mTLS future requests, optional with mTLS.

pub async fn refresh_identity_token( &self, current_token: String, identifier: Option<String>, ) -> Result<IdentityTokenResponse, ApiError>

Refresh an existing identity token

This endpoint can use either mTLS or the current identity token for authentication. When using identity token authentication (no mTLS), the identifier parameter is required. The current token will be validated and a new token with updated expiration will be issued.

Arguments

• current_token - The existing identity token to refresh
• identifier - Optional identifier. Required when not using mTLS authentication.

pub async fn mint_domain_restricted_identity_token( &self, subject: String, duration: Option<u64>, ) -> Result<MintIdentityTokenResponse, ApiError>

Mint a new domain-restricted identity token

This endpoint requires mTLS authentication from a “realm” identity (one without domain restriction). The minted token will be restricted to the minting identity’s domain and cannot mint further sub-identities. Permissions are determined by domain roles configured on the server.

Arguments

• subject - The subject identifier for the new identity (e.g., “uri:urn:test:argo-cli1:user123”)
• duration - Optional duration in seconds. If None, server uses configured default.