Create or Update Token Delegation
Register an RFC 8693 token exchange callback for the tenant. When configured, the Core gRPC API issues a short-lived intermediate JWT-SVID to the tenant’s exchange server instead of signing workload tokens directly.
User must have authorization role with TENANT_ADMIN suffix in the URL {org}.
Requires a pre-existing /tenant-identity/config on this org/site
(returns 404 otherwise). Because PUT is full-replace, omitting
clientSecretBasic on an update clears any stored credentials
and switches the org back to no-auth; re-supply clientId /
clientSecret on every PUT to keep basic auth (the raw secret
is never returned by GET). Returns 201 Created on first call,
200 OK on subsequent updates.
Authentication
export JWT_BEARER_TOKEN="<jwt-bearer-token>"
# Example org name: "acme-inc
export ORG_NAME=<org-name>
# Use the JWT bearer token in your API request auth header:
curl -v -X GET -H "Content-Type: application/json" -H "Authorization: Bearer $JWT_BEARER_TOKEN" https://nico-rest-api.nico.svc.cluster.local/v2/org/$ORG_NAME/nico/user/current
Path parameters
Request
URL of the tenant’s RFC 8693 token exchange endpoint.
The Core gRPC API validates scheme and host against its
configured [machine_identity].token_endpoint_domain_allowlist
and rejects mismatches with 400 Bad Request. Operators that
need to enforce HTTPS-only must populate that allowlist.
Audience value placed on the intermediate JWT-SVID posted to the exchange endpoint.
Client-secret basic authentication settings for token delegation
Response
Token delegation replaced/updated
Client-secret basic authentication settings for token delegation
Date/time when the token delegation configuration was created
Date/time when the token delegation configuration was last updated