Issue a Service Credential
Single-tenant only. Issues the credential a Lerian service signs in with: source is the service the credential speaks for, recorded as its sourceService claim, and target the service it calls. Both must appear in GET /v1/applications/available.
Only a person may call this. An application token is refused even when it may create applications.
The application is displayed as {target}-service. For target plugin-identity it joins no permission: it only authenticates the service’s own permission declaration. For any other target it is listed on the target’s service lane, {target}-service-m2m-permission, which carries the roles the target declares in m2m.service_roles; it never joins the client lane {target}-m2m-permission.
⚠️ The response carries the clientSecret IN FULL, and no other Identity API response returns it.
Revoke it with DELETE /v1/applications/{id}, which also removes it from the service lane. Each issue is a new credential, so to rotate one: issue the new one, deploy it, then revoke the old one.
Failures:
400—sourceortargetis missing, orIDE-0012when either is not in the catalog.403— the caller is an application, not a person (401where M2M inversion is off).409 IDE-1065— the generated application name is taken. Nothing was created; retry it.422— the target has no service lane yet: it declares nom2m.service_roles, or it has not published its declaration. Nothing was created.501— multi-tenant deployment: the tenant manager issues service credentials there.503 IDE-0064/IDE-0065— another write to the same service lane held it past the wait, or the service that coordinates those writes did not answer. Nothing was created; retry it.503 IDE-0066— the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later.
Autorizações
JWT bearer token issued by the identity provider.
Corpo
The service credential to issue.
The Lerian service that signs in with this credential; it becomes the sourceService claim. Must match GET /v1/applications/available.
"jd-courier"
The service this credential calls. Must match GET /v1/applications/available.
"plugin-identity"
Resposta
Created
Returned only by the create call. Absent from every Identity API read.
"2021-09-01T00:00:00Z"
"Midaz Used By Application X"
"00000000-0000-0000-0000-000000000000"
"Midaz"
"00000000-0000-0000-0000-000000000000"

