Register an AWS delegated grant
Registers the AWS delegated-grant coordinates for an AWS-sink subscription (sqs, eventbridge) — the non-secret cross-account delivery role ARN, region, and destination the dispatcher assumes at delivery time. This is the write that follows the customer applying the setup-artifacts trust policy in their AWS account. It is write-only: it runs no inline probe and does not change the verification state (a registered grant stays pending_verification until a later verify). No AWS credential crosses this body. The destination host is validated before the write. A non-AWS sink returns 422 validation_error.
Authorizations
A bearer JWT issued by plugin-auth (lib-auth). The tenant identity is resolved from the validated token claims; the /v1 surface never reads a tenant from the body, path, or query. Machine callers obtain a token via the plugin-auth client-credentials flow. The /admin surface authorizes against an operator scope and carries no tenant context.
Headers
A client-chosen unique key that makes this mutation at-most-once. A mutation sent without it is rejected before any write with 400 missing_idempotency_key. Reusing the same key with an identical request replays the original response byte-for-byte (with X-Idempotency-Replayed: true); reusing it with a different request body returns 409 idempotency_conflict. To re-drive a corrected request, mint a new key.
Path Parameters
The unique identifier of the subscription (UUIDv7).
Body
The non-secret AWS delegated-grant coordinates. No AWS credential crosses this body — the role is assumed per delivery, guarded by the separately minted ExternalId.
The cross-account delivery role ARN Streaming Hub assumes at delivery time.
"arn:aws:iam::444455556666:role/streaming-hub-delegated-delivery"
The AWS region of the destination.
"us-east-1"
The resolved destination (queue URL or event-bus ARN). SSRF-validated before the write.
"https://sqs.us-east-1.amazonaws.com/444455556666/orders"
Response
The grant was persisted (no body; the verification state is unchanged).

