Retrieve Tenant Identity Configuration for current Org
Retrieve the tenant identity configuration and signing key metadata.
User must have authorization role with TENANT_ADMIN suffix in the URL {org}.
The response reflects the stored configuration. Fields you
omitted on PUT may be filled in by Core: allowedAudiences
defaults to [defaultAudience], and subjectPrefix defaults
to the issuer’s trust domain. signingKeys lists one entry
normally, or two during a key-rotation overlap.
Authentication
export JWT_BEARER_TOKEN="<jwt-bearer-token>"
# Example org name: "acme-inc
export ORG_NAME=<org-name>
# Use the JWT bearer token in your API request auth header:
curl -v -X GET -H "Content-Type: application/json" -H "Authorization: Bearer $JWT_BEARER_TOKEN" https://nico-rest-api.nico.svc.cluster.local/v2/org/$ORG_NAME/nico/user/current
Path parameters
Response
Stored allowlist of audience strings. Always non-empty: when a
PUT supplied an empty list, the Core gRPC API substituted
[defaultAudience] before persisting. Issuance rejects audiences
outside this list.
SPIFFE ID prefix used in the JWT sub claim. When the PUT body
omitted subjectPrefix, Core stored
spiffe://<trust-domain-from-issuer> here, so the value
returned by GET may differ from what was submitted.
Per-org signing keys currently published in JWKS. Exactly
one entry has currentSigner: true. During a rotation
overlap window a second entry is present with
currentSigner: false and a populated expireAt; once
the overlap window elapses the Core gRPC API deletes the
expired entry and only the current signer remains.
Date/time when the Tenant identity configuration was created
Date/time when the Tenant identity configuration was last updated