> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.nvidia.com/infra-controller/rest-api-reference/api-reference/tenant-identity/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.nvidia.com/infra-controller/_mcp/server.

# Tenant Identity

Tenant identity (JWT-SVID issuance) and RFC 8693 token delegation.

Tenant Admins use these endpoints to enable JWT-SVID issuance for an
org on a specific site, rotate the signing key, configure a token
exchange callback, and serve the public JWKS / OIDC discovery
documents that verifiers (OpenBao, tenant APIs, etc.) consume.

The six management endpoints (PUT / GET / DELETE on `tenant-identity/config`
and `tenant-identity/token-delegation`) require an authorization role with
`TENANT_ADMIN` suffix in the URL `{org}`. The three `.well-known/*`
endpoints are public; external verifiers can fetch public keys
without credentials.

PUT is a full-replace upsert: every call must include all required
fields, and omitted optional fields are cleared. To pause issuance
without destroying signing keys, PUT with `enabled: false`; to
destroy the signing keypair, use DELETE. Signing keys survive
`enabled: false` and survive non-rotation upserts, so JWKS consumers
and in-flight JWTs continue to verify across pauses and attribute
changes.

JWKS verifiers should treat every key in the returned set as valid
and match candidates by `kid` — during a key-rotation overlap
window two keys are present until the previous key expires. The
OIDC discovery endpoint's `id_token_signing_alg_values_supported`
is intentionally empty because NICo issues bearer access JWTs,
not OIDC `id_token`s. The three public endpoints return
`404 Not Found` when identity material cannot be served for this
org/site (unknown site, org is not a tenant, no tenant allocation
on the site, or no identity configuration); the two JWKS routes
additionally return `502 Bad Gateway` when the Core gRPC API
responds with a body that is not a parseable JWK Set.


## API Docs

- Tenant Identity [Retrieve Tenant Identity Configuration for current Org](https://docs.nvidia.com/infra-controller/rest-api-reference/api-reference/tenant-identity/get-tenant-identity-config.md)
- Tenant Identity [Create or Update Tenant Identity Configuration](https://docs.nvidia.com/infra-controller/rest-api-reference/api-reference/tenant-identity/create-or-update-tenant-identity-config.md)
- Tenant Identity [Delete Tenant Identity Configuration](https://docs.nvidia.com/infra-controller/rest-api-reference/api-reference/tenant-identity/delete-tenant-identity-config.md)
- Tenant Identity [Retrieve Token Delegation for current Org](https://docs.nvidia.com/infra-controller/rest-api-reference/api-reference/tenant-identity/get-tenant-identity-token-delegation.md)
- Tenant Identity [Create or Update Token Delegation](https://docs.nvidia.com/infra-controller/rest-api-reference/api-reference/tenant-identity/create-or-update-tenant-identity-token-delegation.md)
- Tenant Identity [Delete Token Delegation](https://docs.nvidia.com/infra-controller/rest-api-reference/api-reference/tenant-identity/delete-tenant-identity-token-delegation.md)
- Tenant Identity [Reencrypt Tenant Identity Secrets](https://docs.nvidia.com/infra-controller/rest-api-reference/api-reference/tenant-identity/reencrypt-tenant-identity-secrets.md)
- Tenant Identity [Retrieve OIDC JWKS for current Org](https://docs.nvidia.com/infra-controller/rest-api-reference/api-reference/tenant-identity/get-jwks.md)
- Tenant Identity [Retrieve OpenID Configuration for current Org](https://docs.nvidia.com/infra-controller/rest-api-reference/api-reference/tenant-identity/get-openid-configuration.md)
- Tenant Identity [Retrieve SPIFFE JWKS for current Org](https://docs.nvidia.com/infra-controller/rest-api-reference/api-reference/tenant-identity/get-spiffe-jwks.md)

## OpenAPI Specification

The raw OpenAPI 3.1 specification for this API is available at:
- [OpenAPI JSON](https://docs.nvidia.com/infra-controller/openapi.json)
- [OpenAPI YAML](https://docs.nvidia.com/infra-controller/openapi.yaml)