Docs Home Pulumi IaC Pulumi ESC Pulumi Insights Pulumi IDP Pulumi Cloud Packages Tutorials
  1. Docs
  2. Pulumi Cloud
  3. Pulumi Cloud REST API
  4. OIDC Issuers

OIDC Issuers

    OpenID Connect (OIDC) issuers provide a way to authenticate with Pulumi Cloud using identity tokens from external providers like GitHub Actions. The OIDC Issuers API allows you to register and manage OIDC issuers for your organization.

    OIDC Issuer Operations

    The API provides endpoints for the following operations:

    • Registering new OIDC issuers
    • Updating and deleting issuers
    • Getting issuer details
    • Listing all issuers for an organization
    • Managing authentication policies for issuers

    Register a new issuer

    Register a new OIDC issuer.

    POST /api/orgs/{organization}/oidc/issuers

    Parameters

    ParameterTypeInDescription
    organizationstringpathorganization name
    namestringbodyoidc issuer name
    urlstringbodyissuer base url (this will be used as a base to build the OIDC configuration url, url + /.well-known/openid-configuration)
    thumbprintsarray[string]bodyOptional. issuer TLS certificate thumbprints
    maxExpirationintbodyOptional. max expiration for tokens issued for this issuer in seconds
    jwksjson (jwks format)bodyOptional. JWK Set from the OIDC issuer

    Example

    curl \
  -H "Accept: application/vnd.pulumi+8" \
  -H "Content-Type: application/json" \
  -H "Authorization: token $PULUMI_ACCESS_TOKEN" \
  --request POST \
  --data '{ "name":"GitHub", "url": "https://token.actions.githubusercontent.com", "maxExpiration": 3600 }' \
  https://api.pulumi.com/api/orgs/{organization}/oidc/issuers

    Default response

    Status: 200 OK

    {
  "id": "e9a13d0e-798e-4e33-bab2-dde06da317bf",
  "name": "github",
  "url": "https://token.actions.githubusercontent.com",
  "issuer": "https://token.actions.githubusercontent.com",
  "created": "2024-04-19 15:07:54.693",
  "thumbprints": [
      "2b6030088e8d08fcd61b8b897019f2d99f4b9a0f7b465b065c2b90e1c53bc07d"
  ],
  "maxExpiration": 3600,
}

    Update an issuer

    Update an existing OIDC issuer.

    PATCH /api/orgs/{organization}/oidc/issuers/{issuerId}

    Parameters

    ParameterTypeInDescription
    organizationstringpathorganization name
    issuerIdstringpathissuer id to update
    namestringbodyoidc issuer name
    thumbprintsarray[string]bodyOptional. issuer TLS certificate thumbprints
    maxExpirationintbodyOptional. max expiration for tokens issued for this issuer in seconds
    jwksjson (jwks format)bodyOptional. JWK Set from the OIDC issuer

    Example

    curl \
  -H "Accept: application/vnd.pulumi+8" \
  -H "Content-Type: application/json" \
  -H "Authorization: token $PULUMI_ACCESS_TOKEN" \
  --request PATCH \
  --data '{ "name":"GitHub", "maxExpiration": 3600 }' \
  https://api.pulumi.com/api/orgs/{organization}/oidc/issuers/{issuerId}

    Delete an issuer

    Delete an OIDC issuer.

    DELETE /api/orgs/{organization}/oidc/issuers/{issuerId}

    Parameters

    ParameterTypeInDescription
    organizationstringpathorganization name
    issuerIdstringpathissuer id to update

    Example

    curl \
  -H "Accept: application/vnd.pulumi+8" \
  -H "Content-Type: application/json" \
  -H "Authorization: token $PULUMI_ACCESS_TOKEN" \
  --request DELETE \
  https://api.pulumi.com/api/orgs/{organization}/oidc/issuers/{issuerId}

    Get an issuer

    Get details about a specific OIDC issuer.

    GET /api/orgs/{organization}/oidc/issuers/{issuerId}

    Parameters

    ParameterTypeInDescription
    organizationstringpathorganization name
    issuerIdstringpathissuer id to update

    Example

    curl \
  -H "Accept: application/vnd.pulumi+8" \
  -H "Content-Type: application/json" \
  -H "Authorization: token $PULUMI_ACCESS_TOKEN" \
  https://api.pulumi.com/api/orgs/{organization}/oidc/issuers/{issuerId}

    List issuers

    List all OIDC issuers for an organization.

    GET /api/orgs/{organization}/oidc/issuers

    Parameters

    ParameterTypeInDescription
    organizationstringpathorganization name

    Example

    curl \
  -H "Accept: application/vnd.pulumi+8" \
  -H "Content-Type: application/json" \
  -H "Authorization: token $PULUMI_ACCESS_TOKEN" \
  https://api.pulumi.com/api/{organization}/oidc/issuers

    Get the issuer’s auth policies

    Get authentication policies for an OIDC issuer.

    GET /api/orgs/{organization}/auth/policies/oidcissuers/{issuerId}

    Parameters

    ParameterTypeInDescription
    organizationstringpathorganization name
    issuerIdstringpathissuer id to update

    Example

    curl \
  -H "Accept: application/vnd.pulumi+8" \
  -H "Content-Type: application/json" \
  -H "Authorization: token $PULUMI_ACCESS_TOKEN" \
  https://api.pulumi.com/api/orgs/{organization}/auth/policies/oidcissuers/{issuerId}

    Update the issuer’s auth policies

    Update authentication policies for an OIDC issuer.

    PATCH /api/orgs/{organization}/auth/policies/{policyId}

    Parameters

    ParameterTypeInDescription
    organizationstringpathorganization name
    policyIdstringpathpolicy id to update
    policiesarray[object]bodyarray of policies
    policy.decisionstringbodydeny/allow
    policy.tokenTypestringbodyorganization/team/personal/runner
    policy.teamNamestringbodythe team name to issue tokens on behalf of, required for team token type
    policy.userLoginstringbodythe user login to issue tokens on behalf of, required for personal token type
    policy.runnerIDstringbodythe runner name to issue tokens for, required for runner token type
    policy.authorizedPermissionsarray[string]bodypermissions allowed by the policy (only admin is supported for organization tokens)
    policy.rulesobjectbodyrules to match the token claims

    For more information about authorization rules, refer to its documentation.

    Example

    curl \
  -H "Accept: application/vnd.pulumi+8" \
  -H "Content-Type: application/json" \
  -H "Authorization: token $PULUMI_ACCESS_TOKEN" \
  --request PATCH \
  --data '{ "policies": [{ "decision": "allow", "tokenType": "organization", "rules": { "aud": "urn:pulumi:org:org-name", "sub": "repo:organization/repo:*" }}] }' \
  https://api.pulumi.com/api/orgs/{organization}/auth/policies/{policyId}