#Get Current Organization

GET /v1/organizations/me

Retrieve information about the organization associated with the authenticated API key.

#Returns

• BetaOrganization object

• type: "organization"

Object type.

For Organizations, this is always "organization".

default: organization

• id: string

ID of the Organization.

format: uuid

• name: string

Name of the Organization.

#Example

curl https://haijun.my.id/v1/organizations/me \
    -H 'juglow-version: 2023-06-01' \
    -H "X-Api-Key: $JUGLOW_API_KEY"

#Response (200)

{
  "id": "12345678-1234-5678-1234-567812345678",
  "name": "Organization Name",
  "type": "organization"
}

#Domain types

#Beta Organization

• BetaOrganization object

• type: "organization"

Object type.

For Organizations, this is always "organization".

default: organization

• id: string

ID of the Organization.

format: uuid

• name: string

Name of the Organization.

#Beta Organization Role

• BetaOrganizationRole = "admin" or "billing" or "haijun_code_user" or 6 more

• "admin"

• "billing"

• "haijun_code_user"

• "developer"

• "managed"

• "membership_admin"

• "owner"

• "primary_owner"

• "user"

#Organization › API Keys

#List API Keys

GET /v1/organizations/api_keys

List API Keys

#Query parameters

• after_id: optional string

ID of the object to use as a cursor for pagination. When provided, returns the page of results immediately after this object.

• before_id: optional string

ID of the object to use as a cursor for pagination. When provided, returns the page of results immediately before this object.

• created_by_user_id: optional string

Filter by the ID of the User who created the object.

• limit: optional number

Number of items to return per page.

Defaults to 20. Ranges from 1 to 1000.

default: 20, minimum: 1, maximum: 1000

• status: optional "active" or "archived" or "expired" or "inactive"

Filter by API key status.

• "active"

• "archived"

• "expired"

• "inactive"

• workspace_id: optional string

Filter by Workspace ID.

#Returns

• data: array of BetaAPIKey

• type: "api_key"

Object type.

For API Keys, this is always "api_key".

default: api_key

• id: string

ID of the API key.

• created_at: string

RFC 3339 datetime string indicating when the API Key was created.

format: date-time

• created_by: BetaAPIKeyCreatedBy or null

The ID and type of the actor that created the API key, or null when the creator is not recorded (legacy, workload-identity-federated, or system-created keys).

• type: "service_account" or "user"

Type of the actor that created the object.

• "service_account"

• "user"

• id: string

ID of the actor that created the object.

• expires_at: string or null

RFC 3339 datetime string indicating when the API Key expires, or null if it never expires.

format: date-time

• name: string

Name of the API key.

• partial_key_hint: string or null

Partially redacted hint for the API key.

• principal: BetaAPIKeyUserActor or BetaAPIKeyServiceAccountActor or null

The principal the API key acts as (a User or a Service Account), or null if the API key is not bound to a principal.

• BetaAPIKeyUserActor object

• type: "user_actor"

Principal type. Always "user_actor" for a User.

default: user_actor

• user_id: string

ID of the User the API key acts as.

• BetaAPIKeyServiceAccountActor object

• type: "service_account_actor"

Principal type. Always "service_account_actor" for a Service Account.

default: service_account_actor

• service_account_id: string

ID of the Service Account the API key acts as.

• scope: BetaAPIKeyOrganizationScope or BetaAPIKeyWorkspaceScope

Where the API key belongs: its Workspace ({"type": "workspace", "workspace_id": "wrkspc_..."}, with the Workspace's real ID even when it is the organization's default Workspace), or the organization ({"type": "organization"}) for a principal-bound API key that has no Workspace.

• BetaAPIKeyOrganizationScope object

• type: "organization"

Scope type. Always "organization": the API key has no Workspace. Only a principal-bound API key can have this scope.

default: organization

• BetaAPIKeyWorkspaceScope object

• type: "workspace"

Scope type. Always "workspace": the API key belongs to one Workspace.

default: workspace

• workspace_id: string

ID of the Workspace the API key belongs to. Unlike the deprecated top-level workspace_id, this is the Workspace's real ID even for the organization's default Workspace.

• status: "active" or "archived" or "expired" or "inactive"

Status of the API key.

• "active"

• "archived"

• "expired"

• "inactive"

• workspace_id: string or null

Deprecated: Use scope instead. workspace_id is null both for an API key in the default Workspace and for a principal-bound API key that has no Workspace.

Deprecated: use scope instead. ID of the Workspace associated with the API key, or null if the API key belongs to the default Workspace. Also null for a principal-bound API key that has no Workspace; scope tells the two apart.

• first_id: string or null

First ID in the data list. Can be used as the before_id for the previous page.

• has_more: boolean

Indicates if there are more results in the requested page direction.

• last_id: string or null

Last ID in the data list. Can be used as the after_id for the next page.

#Example

curl https://haijun.my.id/v1/organizations/api_keys \
    -H 'juglow-version: 2023-06-01' \
    -H "X-Api-Key: $JUGLOW_API_KEY"

#Response (200)

{
  "data": [
    {
      "id": "apikey_01Rj2N8SVvo6BePZj99NhmiT",
      "created_at": "2024-10-30T23:58:27.427722Z",
      "created_by": {
        "id": "user_01WCz1FkmYMm4gnmykNKUu3Q",
        "type": "user"
      },
      "expires_at": "2024-10-30T23:58:27.427722Z",
      "name": "Developer Key",
      "partial_key_hint": "sk-ant-api03-R2D...igAA",
      "principal": {
        "type": "user_actor",
        "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
      },
      "scope": {
        "type": "workspace",
        "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ"
      },
      "status": "active",
      "type": "api_key",
      "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ"
    }
  ],
  "first_id": "first_id",
  "has_more": true,
  "last_id": "last_id"
}

#Retrieve API Key (Admin API)

GET /v1/organizations/api_keys/{api_key_id}

Retrieve information about a single API key in your organization, looked up by its ID. This Admin API endpoint requires an Admin API key, is intended for programmatic key management, and never returns the key's secret value. To view or create your own API keys, go to API keys in the Haijun Console.

#Path parameters

• api_key_id: string

ID of the API key.

#Returns

• BetaAPIKey object

• type: "api_key"

Object type.

For API Keys, this is always "api_key".

default: api_key

• id: string

ID of the API key.

• created_at: string

RFC 3339 datetime string indicating when the API Key was created.

format: date-time

• created_by: BetaAPIKeyCreatedBy or null

The ID and type of the actor that created the API key, or null when the creator is not recorded (legacy, workload-identity-federated, or system-created keys).

• type: "service_account" or "user"

Type of the actor that created the object.

• "service_account"

• "user"

• id: string

ID of the actor that created the object.

• expires_at: string or null

RFC 3339 datetime string indicating when the API Key expires, or null if it never expires.

format: date-time

• name: string

Name of the API key.

• partial_key_hint: string or null

Partially redacted hint for the API key.

• principal: BetaAPIKeyUserActor or BetaAPIKeyServiceAccountActor or null

The principal the API key acts as (a User or a Service Account), or null if the API key is not bound to a principal.

• BetaAPIKeyUserActor object

• type: "user_actor"

Principal type. Always "user_actor" for a User.

default: user_actor

• user_id: string

ID of the User the API key acts as.

• BetaAPIKeyServiceAccountActor object

• type: "service_account_actor"

Principal type. Always "service_account_actor" for a Service Account.

default: service_account_actor

• service_account_id: string

ID of the Service Account the API key acts as.

• scope: BetaAPIKeyOrganizationScope or BetaAPIKeyWorkspaceScope

Where the API key belongs: its Workspace ({"type": "workspace", "workspace_id": "wrkspc_..."}, with the Workspace's real ID even when it is the organization's default Workspace), or the organization ({"type": "organization"}) for a principal-bound API key that has no Workspace.

• BetaAPIKeyOrganizationScope object

• type: "organization"

Scope type. Always "organization": the API key has no Workspace. Only a principal-bound API key can have this scope.

default: organization

• BetaAPIKeyWorkspaceScope object

• type: "workspace"

Scope type. Always "workspace": the API key belongs to one Workspace.

default: workspace

• workspace_id: string

ID of the Workspace the API key belongs to. Unlike the deprecated top-level workspace_id, this is the Workspace's real ID even for the organization's default Workspace.

• status: "active" or "archived" or "expired" or "inactive"

Status of the API key.

• "active"

• "archived"

• "expired"

• "inactive"

• workspace_id: string or null

Deprecated: Use scope instead. workspace_id is null both for an API key in the default Workspace and for a principal-bound API key that has no Workspace.

Deprecated: use scope instead. ID of the Workspace associated with the API key, or null if the API key belongs to the default Workspace. Also null for a principal-bound API key that has no Workspace; scope tells the two apart.

#Example

curl https://haijun.my.id/v1/organizations/api_keys/$API_KEY_ID \
    -H 'juglow-version: 2023-06-01' \
    -H "X-Api-Key: $JUGLOW_API_KEY"

#Response (200)

{
  "id": "apikey_01Rj2N8SVvo6BePZj99NhmiT",
  "created_at": "2024-10-30T23:58:27.427722Z",
  "created_by": {
    "id": "user_01WCz1FkmYMm4gnmykNKUu3Q",
    "type": "user"
  },
  "expires_at": "2024-10-30T23:58:27.427722Z",
  "name": "Developer Key",
  "partial_key_hint": "sk-ant-api03-R2D...igAA",
  "principal": {
    "type": "user_actor",
    "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
  },
  "scope": {
    "type": "workspace",
    "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ"
  },
  "status": "active",
  "type": "api_key",
  "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ"
}

#Update API Key

POST /v1/organizations/api_keys/{api_key_id}

Update API Key

#Path parameters

• api_key_id: string

ID of the API key.

#Body parameters

• name: optional string or null

Name of the API key.

minLength: 1, maxLength: 500

• status: optional "active" or "archived" or "inactive" or null

Status of the API key.

• "active"

• "archived"

• "inactive"

#Returns

• BetaAPIKey object

• type: "api_key"

Object type.

For API Keys, this is always "api_key".

default: api_key

• id: string

ID of the API key.

• created_at: string

RFC 3339 datetime string indicating when the API Key was created.

format: date-time

• created_by: BetaAPIKeyCreatedBy or null

The ID and type of the actor that created the API key, or null when the creator is not recorded (legacy, workload-identity-federated, or system-created keys).

• type: "service_account" or "user"

Type of the actor that created the object.

• "service_account"

• "user"

• id: string

ID of the actor that created the object.

• expires_at: string or null

RFC 3339 datetime string indicating when the API Key expires, or null if it never expires.

format: date-time

• name: string

Name of the API key.

• partial_key_hint: string or null

Partially redacted hint for the API key.

• principal: BetaAPIKeyUserActor or BetaAPIKeyServiceAccountActor or null

The principal the API key acts as (a User or a Service Account), or null if the API key is not bound to a principal.

• BetaAPIKeyUserActor object

• type: "user_actor"

Principal type. Always "user_actor" for a User.

default: user_actor

• user_id: string

ID of the User the API key acts as.

• BetaAPIKeyServiceAccountActor object

• type: "service_account_actor"

Principal type. Always "service_account_actor" for a Service Account.

default: service_account_actor

• service_account_id: string

ID of the Service Account the API key acts as.

• scope: BetaAPIKeyOrganizationScope or BetaAPIKeyWorkspaceScope

Where the API key belongs: its Workspace ({"type": "workspace", "workspace_id": "wrkspc_..."}, with the Workspace's real ID even when it is the organization's default Workspace), or the organization ({"type": "organization"}) for a principal-bound API key that has no Workspace.

• BetaAPIKeyOrganizationScope object

• type: "organization"

Scope type. Always "organization": the API key has no Workspace. Only a principal-bound API key can have this scope.

default: organization

• BetaAPIKeyWorkspaceScope object

• type: "workspace"

Scope type. Always "workspace": the API key belongs to one Workspace.

default: workspace

• workspace_id: string

ID of the Workspace the API key belongs to. Unlike the deprecated top-level workspace_id, this is the Workspace's real ID even for the organization's default Workspace.

• status: "active" or "archived" or "expired" or "inactive"

Status of the API key.

• "active"

• "archived"

• "expired"

• "inactive"

• workspace_id: string or null

Deprecated: Use scope instead. workspace_id is null both for an API key in the default Workspace and for a principal-bound API key that has no Workspace.

Deprecated: use scope instead. ID of the Workspace associated with the API key, or null if the API key belongs to the default Workspace. Also null for a principal-bound API key that has no Workspace; scope tells the two apart.

#Example

curl https://haijun.my.id/v1/organizations/api_keys/$API_KEY_ID \
    -H 'Content-Type: application/json' \
    -H 'juglow-version: 2023-06-01' \
    -H "X-Api-Key: $JUGLOW_API_KEY" \
    -d '{}'

#Response (200)

{
  "id": "apikey_01Rj2N8SVvo6BePZj99NhmiT",
  "created_at": "2024-10-30T23:58:27.427722Z",
  "created_by": {
    "id": "user_01WCz1FkmYMm4gnmykNKUu3Q",
    "type": "user"
  },
  "expires_at": "2024-10-30T23:58:27.427722Z",
  "name": "Developer Key",
  "partial_key_hint": "sk-ant-api03-R2D...igAA",
  "principal": {
    "type": "user_actor",
    "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
  },
  "scope": {
    "type": "workspace",
    "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ"
  },
  "status": "active",
  "type": "api_key",
  "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ"
}

#Organization › External Keys

#Create External Key

POST /v1/organizations/external_keys

Create an external key config owned by the caller's organization.

#Body parameters

• provider_config: BetaAWSExternalKeyConfig or BetaGCPExternalKeyConfig or BetaAzureExternalKeyConfigParam

KMS provider identity and auth coordinates.

• BetaAWSExternalKeyConfig object

• type: "aws"

• kms_arn: string

Full ARN of the AWS KMS key. On Haijun Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.

maxLength: 2048

• region: optional string or null

AWS region. Derived from kms_arn if omitted.

• role_arn: optional string or null

Deprecated

IAM role ARN. Deprecated — Juglow reaches the KMS key through its own intermediate role (or, on Haijun Platform on AWS, with credentials AWS issues for the Workspace); this field is ignored.

• BetaGCPExternalKeyConfig object

• type: "gcp"

• key_name: string

Full resource name of the Cloud KMS key.

• BetaAzureExternalKeyConfigParam object

Azure Key Vault provider configuration.

• type: "azure"

• key_name: string

Name of the key within the vault.

• tenant_id: string

Azure AD tenant ID.

• vault_uri: string

Key Vault data-plane URI — https://{vault-name}.vault.azure.net or https://{hsm-name}.managedhsm.azure.net.

• client_id: optional string or null

Azure AD application (client) ID. Omit to use Juglow's multitenant app. Provide only if using a single-tenant app registration in the customer's directory.

• display_name: optional string or null

Human-friendly display name.

minLength: 1, maxLength: 255

• geo: optional "us"

Data residency geo. Only us is supported.

#Returns

• BetaExternalKey object

CMEK external key config belonging to the caller's organization.

Configs are organization-scoped. Workspaces attach to a config; once any workspace references it, the provider fields become effectively immutable (existing encrypted data needs the config for decrypt).

• type: "external_key"

default: external_key

• id: string

Identifier of the external key config. A tagged ID prefixed ekey_, or — for organizations on the Haijun Platform on AWS — the AWS KMS key ARN.

• attachment: BetaExternalKeyAttachedAttachment or BetaExternalKeyUnattachedAttachment

Whether any workspace uses this config to encrypt its data — counting live and archived workspaces (an archived workspace's data remains encrypted under the config), excluding deleted ones. Only an attached config is used by the encryption path; an unattached config is inert and can be deleted.

• BetaExternalKeyAttachedAttachment object

• type: "attached"

default: attached

• BetaExternalKeyUnattachedAttachment object

• type: "unattached"

default: unattached

• created_at: string

format: date-time

• display_name: string or null

Human-friendly display name. Null if none was set.

• geo: string

Data residency geo. Selects which regional validator handles this key's encrypt/decrypt roundtrips.

• provider_config: BetaAWSExternalKeyConfig or BetaGCPExternalKeyConfig or BetaAzureExternalKeyConfig

KMS provider identity and auth coordinates.

• BetaAWSExternalKeyConfig object

• type: "aws"

• kms_arn: string

Full ARN of the AWS KMS key. On Haijun Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.

maxLength: 2048

• region: optional string or null

AWS region. Derived from kms_arn if omitted.

• role_arn: optional string or null

Deprecated

IAM role ARN. Deprecated — Juglow reaches the KMS key through its own intermediate role (or, on Haijun Platform on AWS, with credentials AWS issues for the Workspace); this field is ignored.

• BetaGCPExternalKeyConfig object

• type: "gcp"

• key_name: string

Full resource name of the Cloud KMS key.

• BetaAzureExternalKeyConfig object

• type: "azure"

• key_name: string

Name of the key within the vault.

• tenant_id: string

Azure AD tenant ID.

• vault_uri: string

Key Vault data-plane URI — https://{vault-name}.vault.azure.net or https://{hsm-name}.managedhsm.azure.net.

• client_id: optional string or null

Azure AD application (client) ID. Omit to use Juglow's multitenant app. Provide only if using a single-tenant app registration in the customer's directory.

• updated_at: string

format: date-time

#Example

curl https://haijun.my.id/v1/organizations/external_keys \
    -H 'Content-Type: application/json' \
    -H 'juglow-version: 2023-06-01' \
    -H "X-Api-Key: $JUGLOW_API_KEY" \
    -d '{
          "provider_config": {
            "kms_arn": "arn:aws:kms:us-east-1:111122223333:key/abcd1234-5678-90ab-cdef-000011112222",
            "type": "aws"
          }
        }'

#Response (200)

{
  "id": "ekey_01SDCCSbTxrXDpWc1phhtcfK",
  "attachment": {
    "type": "attached"
  },
  "created_at": "2024-10-30T23:58:27.427722Z",
  "display_name": "prod-us-key",
  "geo": "us",
  "provider_config": {
    "kms_arn": "arn:aws:kms:us-east-1:111122223333:key/abcd1234-5678-90ab-cdef-000011112222",
    "type": "aws",
    "region": "us-east-1",
    "role_arn": "arn:aws:iam::111122223333:role/juglow-cmek"
  },
  "type": "external_key",
  "updated_at": "2024-10-30T23:58:27.427722Z"
}

#List External Keys

GET /v1/organizations/external_keys

List external key configs in the caller's organization.

Results are ordered by creation time (newest first). Use the next_page cursor from the response to fetch subsequent pages.

#Query parameters

• limit: optional number

Number of results per page.

default: 20, minimum: 1, maximum: 100

• page: optional string

Opaque cursor from a previous response's next_page.

#Returns

• data: array of BetaExternalKey

• type: "external_key"

default: external_key

• id: string

Identifier of the external key config. A tagged ID prefixed ekey_, or — for organizations on the Haijun Platform on AWS — the AWS KMS key ARN.

• attachment: BetaExternalKeyAttachedAttachment or BetaExternalKeyUnattachedAttachment

Whether any workspace uses this config to encrypt its data — counting live and archived workspaces (an archived workspace's data remains encrypted under the config), excluding deleted ones. Only an attached config is used by the encryption path; an unattached config is inert and can be deleted.

• BetaExternalKeyAttachedAttachment object

• type: "attached"

default: attached

• BetaExternalKeyUnattachedAttachment object

• type: "unattached"

default: unattached

• created_at: string

format: date-time

• display_name: string or null

Human-friendly display name. Null if none was set.

• geo: string

Data residency geo. Selects which regional validator handles this key's encrypt/decrypt roundtrips.

• provider_config: BetaAWSExternalKeyConfig or BetaGCPExternalKeyConfig or BetaAzureExternalKeyConfig

KMS provider identity and auth coordinates.

• BetaAWSExternalKeyConfig object

• type: "aws"

• kms_arn: string

Full ARN of the AWS KMS key. On Haijun Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.

maxLength: 2048

• region: optional string or null

AWS region. Derived from kms_arn if omitted.

• role_arn: optional string or null

Deprecated

IAM role ARN. Deprecated — Juglow reaches the KMS key through its own intermediate role (or, on Haijun Platform on AWS, with credentials AWS issues for the Workspace); this field is ignored.

• BetaGCPExternalKeyConfig object

• type: "gcp"

• key_name: string

Full resource name of the Cloud KMS key.

• BetaAzureExternalKeyConfig object

• type: "azure"

• key_name: string

Name of the key within the vault.

• tenant_id: string

Azure AD tenant ID.

• vault_uri: string

Key Vault data-plane URI — https://{vault-name}.vault.azure.net or https://{hsm-name}.managedhsm.azure.net.

• client_id: optional string or null

Azure AD application (client) ID. Omit to use Juglow's multitenant app. Provide only if using a single-tenant app registration in the customer's directory.

• updated_at: string

format: date-time

• next_page: string or null

Opaque cursor for the next page, or null if no more results. Pass as ?page= to fetch the next page.

#Example

curl https://haijun.my.id/v1/organizations/external_keys \
    -H 'juglow-version: 2023-06-01' \
    -H "X-Api-Key: $JUGLOW_API_KEY"

#Response (200)

{
  "data": [
    {
      "id": "ekey_01SDCCSbTxrXDpWc1phhtcfK",
      "attachment": {
        "type": "attached"
      },
      "created_at": "2024-10-30T23:58:27.427722Z",
      "display_name": "prod-us-key",
      "geo": "us",
      "provider_config": {
        "kms_arn": "arn:aws:kms:us-east-1:111122223333:key/abcd1234-5678-90ab-cdef-000011112222",
        "type": "aws",
        "region": "us-east-1",
        "role_arn": "arn:aws:iam::111122223333:role/juglow-cmek"
      },
      "type": "external_key",
      "updated_at": "2024-10-30T23:58:27.427722Z"
    }
  ],
  "next_page": "next_page"
}

#Get External Key

GET /v1/organizations/external_keys/{external_key_id}

Retrieve a single external key config in the caller's organization by ID.

#Path parameters

• external_key_id: string

ID of the External Key.

maxLength: 2048

#Returns

• BetaExternalKey object

CMEK external key config belonging to the caller's organization.

Configs are organization-scoped. Workspaces attach to a config; once any workspace references it, the provider fields become effectively immutable (existing encrypted data needs the config for decrypt).

• type: "external_key"

default: external_key

• id: string

Identifier of the external key config. A tagged ID prefixed ekey_, or — for organizations on the Haijun Platform on AWS — the AWS KMS key ARN.

• attachment: BetaExternalKeyAttachedAttachment or BetaExternalKeyUnattachedAttachment

Whether any workspace uses this config to encrypt its data — counting live and archived workspaces (an archived workspace's data remains encrypted under the config), excluding deleted ones. Only an attached config is used by the encryption path; an unattached config is inert and can be deleted.

• BetaExternalKeyAttachedAttachment object

• type: "attached"

default: attached

• BetaExternalKeyUnattachedAttachment object

• type: "unattached"

default: unattached

• created_at: string

format: date-time

• display_name: string or null

Human-friendly display name. Null if none was set.

• geo: string

Data residency geo. Selects which regional validator handles this key's encrypt/decrypt roundtrips.

• provider_config: BetaAWSExternalKeyConfig or BetaGCPExternalKeyConfig or BetaAzureExternalKeyConfig

KMS provider identity and auth coordinates.

• BetaAWSExternalKeyConfig object

• type: "aws"

• kms_arn: string

Full ARN of the AWS KMS key. On Haijun Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.

maxLength: 2048

• region: optional string or null

AWS region. Derived from kms_arn if omitted.

• role_arn: optional string or null

Deprecated

IAM role ARN. Deprecated — Juglow reaches the KMS key through its own intermediate role (or, on Haijun Platform on AWS, with credentials AWS issues for the Workspace); this field is ignored.

• BetaGCPExternalKeyConfig object

• type: "gcp"

• key_name: string

Full resource name of the Cloud KMS key.

• BetaAzureExternalKeyConfig object

• type: "azure"

• key_name: string

Name of the key within the vault.

• tenant_id: string

Azure AD tenant ID.

• vault_uri: string

Key Vault data-plane URI — https://{vault-name}.vault.azure.net or https://{hsm-name}.managedhsm.azure.net.

• client_id: optional string or null

Azure AD application (client) ID. Omit to use Juglow's multitenant app. Provide only if using a single-tenant app registration in the customer's directory.

• updated_at: string

format: date-time

#Example

curl https://haijun.my.id/v1/organizations/external_keys/$EXTERNAL_KEY_ID \
    -H 'juglow-version: 2023-06-01' \
    -H "X-Api-Key: $JUGLOW_API_KEY"

#Response (200)

{
  "id": "ekey_01SDCCSbTxrXDpWc1phhtcfK",
  "attachment": {
    "type": "attached"
  },
  "created_at": "2024-10-30T23:58:27.427722Z",
  "display_name": "prod-us-key",
  "geo": "us",
  "provider_config": {
    "kms_arn": "arn:aws:kms:us-east-1:111122223333:key/abcd1234-5678-90ab-cdef-000011112222",
    "type": "aws",
    "region": "us-east-1",
    "role_arn": "arn:aws:iam::111122223333:role/juglow-cmek"
  },
  "type": "external_key",
  "updated_at": "2024-10-30T23:58:27.427722Z"
}

#Update External Key

POST /v1/organizations/external_keys/{external_key_id}

Partially update an external key config. Omitted fields are left unchanged.

display_name is always editable. geo and provider_config cannot be changed once any workspace references this config, because previously encrypted data requires the original key identity to decrypt.

#Path parameters

• external_key_id: string

ID of the External Key.

maxLength: 2048

#Body parameters

• display_name: optional string or null

Human-friendly display name.

minLength: 1, maxLength: 255

• geo: optional "us" or null

Data residency geo. Only us is supported.

• provider_config: optional BetaAWSExternalKeyConfig or BetaGCPExternalKeyConfig or BetaAzureExternalKeyConfigParam or null

KMS provider identity and auth coordinates.

• BetaAWSExternalKeyConfig object

• type: "aws"

• kms_arn: string

Full ARN of the AWS KMS key. On Haijun Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.

maxLength: 2048

• region: optional string or null

AWS region. Derived from kms_arn if omitted.

• role_arn: optional string or null

Deprecated

IAM role ARN. Deprecated — Juglow reaches the KMS key through its own intermediate role (or, on Haijun Platform on AWS, with credentials AWS issues for the Workspace); this field is ignored.

• BetaGCPExternalKeyConfig object

• type: "gcp"

• key_name: string

Full resource name of the Cloud KMS key.

• BetaAzureExternalKeyConfigParam object

Azure Key Vault provider configuration.

• type: "azure"

• key_name: string

Name of the key within the vault.

• tenant_id: string

Azure AD tenant ID.

• vault_uri: string

Key Vault data-plane URI — https://{vault-name}.vault.azure.net or https://{hsm-name}.managedhsm.azure.net.

• client_id: optional string or null

Azure AD application (client) ID. Omit to use Juglow's multitenant app. Provide only if using a single-tenant app registration in the customer's directory.

#Returns

• BetaExternalKey object

CMEK external key config belonging to the caller's organization.

Configs are organization-scoped. Workspaces attach to a config; once any workspace references it, the provider fields become effectively immutable (existing encrypted data needs the config for decrypt).

• type: "external_key"

default: external_key

• id: string

Identifier of the external key config. A tagged ID prefixed ekey_, or — for organizations on the Haijun Platform on AWS — the AWS KMS key ARN.

• attachment: BetaExternalKeyAttachedAttachment or BetaExternalKeyUnattachedAttachment

Whether any workspace uses this config to encrypt its data — counting live and archived workspaces (an archived workspace's data remains encrypted under the config), excluding deleted ones. Only an attached config is used by the encryption path; an unattached config is inert and can be deleted.

• BetaExternalKeyAttachedAttachment object

• type: "attached"

default: attached

• BetaExternalKeyUnattachedAttachment object

• type: "unattached"

default: unattached

• created_at: string

format: date-time

• display_name: string or null

Human-friendly display name. Null if none was set.

• geo: string

Data residency geo. Selects which regional validator handles this key's encrypt/decrypt roundtrips.

• provider_config: BetaAWSExternalKeyConfig or BetaGCPExternalKeyConfig or BetaAzureExternalKeyConfig

KMS provider identity and auth coordinates.

• BetaAWSExternalKeyConfig object

• type: "aws"

• kms_arn: string

Full ARN of the AWS KMS key. On Haijun Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.

maxLength: 2048

• region: optional string or null

AWS region. Derived from kms_arn if omitted.

• role_arn: optional string or null

Deprecated

IAM role ARN. Deprecated — Juglow reaches the KMS key through its own intermediate role (or, on Haijun Platform on AWS, with credentials AWS issues for the Workspace); this field is ignored.

• BetaGCPExternalKeyConfig object

• type: "gcp"

• key_name: string

Full resource name of the Cloud KMS key.

• BetaAzureExternalKeyConfig object

• type: "azure"

• key_name: string

Name of the key within the vault.

• tenant_id: string

Azure AD tenant ID.

• vault_uri: string

Key Vault data-plane URI — https://{vault-name}.vault.azure.net or https://{hsm-name}.managedhsm.azure.net.

• client_id: optional string or null

Azure AD application (client) ID. Omit to use Juglow's multitenant app. Provide only if using a single-tenant app registration in the customer's directory.

• updated_at: string

format: date-time

#Example

curl https://haijun.my.id/v1/organizations/external_keys/$EXTERNAL_KEY_ID \
    -H 'Content-Type: application/json' \
    -H 'juglow-version: 2023-06-01' \
    -H "X-Api-Key: $JUGLOW_API_KEY" \
    -d '{}'

#Response (200)

{
  "id": "ekey_01SDCCSbTxrXDpWc1phhtcfK",
  "attachment": {
    "type": "attached"
  },
  "created_at": "2024-10-30T23:58:27.427722Z",
  "display_name": "prod-us-key",
  "geo": "us",
  "provider_config": {
    "kms_arn": "arn:aws:kms:us-east-1:111122223333:key/abcd1234-5678-90ab-cdef-000011112222",
    "type": "aws",
    "region": "us-east-1",
    "role_arn": "arn:aws:iam::111122223333:role/juglow-cmek"
  },
  "type": "external_key",
  "updated_at": "2024-10-30T23:58:27.427722Z"
}

#Delete External Key

DELETE /v1/organizations/external_keys/{external_key_id}

Delete an external key config.

The request is rejected if any workspace still references this config.

#Path parameters

• external_key_id: string

ID of the External Key.

maxLength: 2048

#Returns

• type: "external_key_deleted"

default: external_key_deleted

• id: string

ID of the deleted External Key.

#Example

curl https://haijun.my.id/v1/organizations/external_keys/$EXTERNAL_KEY_ID \
    -X DELETE \
    -H 'juglow-version: 2023-06-01' \
    -H "X-Api-Key: $JUGLOW_API_KEY"

#Response (200)

{
  "id": "ekey_01AbCdEfGhIjKlMnOpQrStUv",
  "type": "external_key_deleted"
}

#Validate External Key

POST /v1/organizations/external_keys/{external_key_id}/validate

Validate an external key config against the customer's KMS.

Juglow performs an encrypt/decrypt roundtrip against the configured KMS key and waits up to 30 seconds for the result. The response status is success if the roundtrip succeeded, or failure with an error message if it failed or timed out.

#Path parameters

• external_key_id: string

ID of the External Key.

maxLength: 2048

#Returns

• type: "external_key_validation"

default: external_key_validation

• error: string or null

Error message when status is failure. Null otherwise.

• status: "failure" or "success"

success — encrypt/decrypt roundtrip succeeded. failure — the roundtrip failed or timed out; see error.

• "failure"

• "success"

#Example

curl https://haijun.my.id/v1/organizations/external_keys/$EXTERNAL_KEY_ID/validate \
    -X POST \
    -H 'juglow-version: 2023-06-01' \
    -H "X-Api-Key: $JUGLOW_API_KEY"

#Response (200)

{
  "error": "error",
  "status": "failure",
  "type": "external_key_validation"
}

#Organization › Federation › Issuers

#Create Federation Issuer

POST /v1/organizations/federation_issuers

Requires an OAuth access token with the org:admin scope, from ant auth login --scope org:admin or a workload identity federation rule; Admin API keys are not accepted. See Manage WIF with the Admin API.

Register an OIDC issuer that Juglow will trust for workload identity federation in your organization.

The jwks field controls how the issuer's signing keys are obtained and takes one of three shapes selected by type: discovery (resolve keys through OIDC discovery), explicit_url (fetch keys from a fixed JWKS URL), or inline (provide a static key set). When jwks.type is discovery and no discovery_base is set, the issuer URL must be publicly reachable over HTTPS so Juglow can fetch the discovery document; for explicit_url and inline modes the issuer URL is only matched as the JWT's iss claim and is not fetched.

#Headers

• "juglow-beta": optional array of JuglowBeta

Optional header to specify the beta version(s) you want to use.

• string

• "message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 45 more

• "message-batches-2024-09-24"

• "prompt-caching-2024-07-31"

• "computer-use-2024-10-22"

• "computer-use-2025-01-24"

• "pdfs-2024-09-25"

• "token-counting-2024-11-01"

• "token-efficient-tools-2025-02-19"

• "output-128k-2025-02-19"

• "files-api-2025-04-14"

• "mcp-client-2025-04-04"

• "mcp-client-2025-11-20"

• "dev-full-thinking-2025-05-14"

• "interleaved-thinking-2025-05-14"

• "code-execution-2025-05-22"

• "extended-cache-ttl-2025-04-11"

• "context-1m-2025-08-07"

• "context-management-2025-06-27"

• "model-context-window-exceeded-2025-08-26"

• "tracks-2025-10-02"

• "fast-mode-2026-02-01"

• "output-300k-2026-03-24"

• "user-profiles-2026-03-24"

• "user-profiles-2026-08-18"

• "user-profiles-2026-09-04"

• "advisor-tool-2026-03-01"

• "managed-agents-2026-04-01"

• "cache-diagnosis-2026-04-07"

• "dreaming-2026-04-21"

• "thinking-token-count-2026-05-13"

• "server-side-fallback-2026-06-01"

• "server-side-fallback-2026-07-01"

• "fallback-credit-2026-06-01"

• "fallback-credit-2026-07-01"

• "agent-memory-2026-07-22"

• "mid-conversation-tool-changes-2026-07-01"

• "compact-2026-01-12"

• "computer-use-2025-11-24"

• "mcp-tunnels-2026-06-22"

• "structured-outputs-2025-11-13"

• "task-budgets-2026-03-13"

• "thinking-display-updates-2026-08-18"

• "ce-user-management-2026-07-13"

• "mid-conversation-output-config-2026-07-01"

• "thinking-binding-controls-2026-08-01"

• "mid-conversation-system-clear-at-2026-08-21"

• "compact-2026-09-04"

• "inline-tools-2026-09-15"

• "mcp-client-2026-09-15"

#Body parameters

• issuer_url: string

The iss claim value to match against.

minLength: 1

• name: string

Slug identifier (lowercase, digits, hyphens). Unique within the organization; a duplicate name returns 409.

minLength: 1, maxLength: 255

• check_jti: optional boolean or null

Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Defaults to true. Applies only to assertions carrying a jti claim; tokens without one are accepted without single-use enforcement.

• jwks: optional BetaJWKSDiscovery or BetaJWKSExplicitURL or BetaJWKSInline

How signing keys are obtained. Defaults to OIDC discovery.

• BetaJWKSDiscovery object

JWKS via the issuer's OIDC discovery document.

• type: "discovery"

• ca_cert_pem: optional string or null

Optional custom CA (PEM) for TLS verification of the JWKS fetch.

maxLength: 8192

• discovery_base: optional string or null

Set when the discovery URL differs from issuer_url.

• BetaJWKSExplicitURL object

JWKS fetched from a fixed endpoint.

• type: "explicit_url"

• url: string

JWKS endpoint.

minLength: 1

• ca_cert_pem: optional string or null

Optional custom CA (PEM) for TLS verification of the JWKS fetch.

maxLength: 8192

• BetaJWKSInline object

JWKS supplied directly; no network fetch.

• type: "inline"

• keys: array of map[unknown]

Inline JWK objects.

minItems: 1

• max_jwt_lifetime_seconds: optional number or null

Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Defaults to 3600 (1h). Assertions must carry both iat and exp; a missing iat is rejected.

minimum: 1, maximum: 176400

#Returns

• BetaFederationIssuer object

Registered external OIDC identity provider.

Records an external IdP the organization trusts for the RFC 7523 jwt-bearer grant. The issuer_url must match the JWT iss claim exactly.

• type: "federation_issuer"

default: federation_issuer

• id: string

Tagged ID of the federation issuer.

• archived_at: string or null

If set, all rules referencing this issuer reject token exchange.

format: date-time

• archived_by_actor_id: string or null

Tagged ID (user_/svac_) of the actor that archived this issuer.

• check_jti: boolean

Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Applies only to assertions carrying a jti claim; tokens without one are accepted without single-use enforcement.

• created_at: string

When this issuer was created.

format: date-time

• created_by_actor_id: string or null

Tagged ID (user_/svac_) of the actor that created this issuer.

• issuer_url: string

The iss claim value. Incoming JWTs must match exactly.

• jwks: BetaJWKSDiscovery or BetaJWKSExplicitURL or BetaJWKSInline

How signing keys are obtained for signature verification.

• BetaJWKSDiscovery object

JWKS via the issuer's OIDC discovery document.

• type: "discovery"

• ca_cert_pem: optional string or null

Optional custom CA (PEM) for TLS verification of the JWKS fetch.

maxLength: 8192

• discovery_base: optional string or null

Set when the discovery URL differs from issuer_url.

• BetaJWKSExplicitURL object

JWKS fetched from a fixed endpoint.

• type: "explicit_url"

• url: string

JWKS endpoint.

minLength: 1

• ca_cert_pem: optional string or null

Optional custom CA (PEM) for TLS verification of the JWKS fetch.

maxLength: 8192

• BetaJWKSInline object

JWKS supplied directly; no network fetch.

• type: "inline"

• keys: array of map[unknown]

Inline JWK objects.

minItems: 1

• jwks_polling_disabled_at: string or null

If set, Juglow's JWKS poller has paused polling for this issuer after repeated fetch failures. Re-enable by sending jwks_polling_disabled: false via the issuer update endpoint (POST) once the upstream JWKS endpoint is fixed. An OAuth caller cannot send this when the issuer backs a rule with any scope other than workspace:developer or workspace:inference; use a Console session.

format: date-time

• max_jwt_lifetime_seconds: number

Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both iat and exp; a missing iat is rejected.

• name: string

Admin-chosen slug identifier.

• poll_status: BetaFederationIssuerPollStatus or null

Live state of Juglow's JWKS polling for this issuer. Populated on both single-issuer retrieval and list responses, including archived issuers. Typically null for inline-key issuers (no polling), or when poll status is temporarily unavailable or polling has not started yet.

• consecutive_failures: number

Consecutive fetch failures since the last success.

• last_fetched_at: string or null

When the last successful fetch completed.

format: date-time

• next_poll_at: string or null

When the next fetch is scheduled. Null if paused.

format: date-time

• updated_at: string

When this issuer was last updated.

format: date-time

• updated_by_actor_id: string or null

Tagged ID (user_/svac_) of the actor that last updated this issuer.

#Example

curl https://haijun.my.id/v1/organizations/federation_issuers \
    -H 'Content-Type: application/json' \
    -H 'juglow-version: 2023-06-01' \
    -H "X-Api-Key: $JUGLOW_API_KEY" \
    -d '{
          "issuer_url": "x",
          "name": "x"
        }'

#Response (200)

{
  "id": "fdis_01SDCCSbTxrXDpWc1phhtcfK",
  "archived_at": "2019-12-27T18:11:19.117Z",
  "archived_by_actor_id": "archived_by_actor_id",
  "check_jti": true,
  "created_at": "2024-10-30T23:58:27.427722Z",
  "created_by_actor_id": "created_by_actor_id",
  "issuer_url": "https://token.actions.githubusercontent.com",
  "jwks": {
    "type": "discovery",
    "ca_cert_pem": "ca_cert_pem",
    "discovery_base": "discovery_base"
  },
  "jwks_polling_disabled_at": "2019-12-27T18:11:19.117Z",
  "max_jwt_lifetime_seconds": 0,
  "name": "github-actions",
  "poll_status": {
    "consecutive_failures": 0,
    "last_fetched_at": "2019-12-27T18:11:19.117Z",
    "next_poll_at": "2019-12-27T18:11:19.117Z"
  },
  "type": "federation_issuer",
  "updated_at": "2024-10-30T23:58:27.427722Z",
  "updated_by_actor_id": "updated_by_actor_id"
}

#List Federation Issuers

GET /v1/organizations/federation_issuers

Requires an OAuth access token with the org:admin scope, from ant auth login --scope org:admin or a workload identity federation rule; Admin API keys are not accepted. See Manage WIF with the Admin API.

List federation issuers in your organization.

Archived issuers are excluded unless include_archived=true.

#Query parameters

• include_archived: optional boolean

Include archived resources. Defaults to false.

default: false

• limit: optional number

Number of results per page.

default: 20, minimum: 1, maximum: 100

• page: optional string

Opaque cursor from a previous response's next_page.

#Headers

• "juglow-beta": optional array of JuglowBeta

Optional header to specify the beta version(s) you want to use.

• string

• "message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 45 more

• "message-batches-2024-09-24"

• "prompt-caching-2024-07-31"

• "computer-use-2024-10-22"

• "computer-use-2025-01-24"

• "pdfs-2024-09-25"

• "token-counting-2024-11-01"

• "token-efficient-tools-2025-02-19"

• "output-128k-2025-02-19"

• "files-api-2025-04-14"

• "mcp-client-2025-04-04"

• "mcp-client-2025-11-20"

• "dev-full-thinking-2025-05-14"

• "interleaved-thinking-2025-05-14"

• "code-execution-2025-05-22"

• "extended-cache-ttl-2025-04-11"

• "context-1m-2025-08-07"

• "context-management-2025-06-27"

• "model-context-window-exceeded-2025-08-26"

• "tracks-2025-10-02"

• "fast-mode-2026-02-01"

• "output-300k-2026-03-24"

• "user-profiles-2026-03-24"

• "user-profiles-2026-08-18"

• "user-profiles-2026-09-04"

• "advisor-tool-2026-03-01"

• "managed-agents-2026-04-01"

• "cache-diagnosis-2026-04-07"

• "dreaming-2026-04-21"

• "thinking-token-count-2026-05-13"

• "server-side-fallback-2026-06-01"

• "server-side-fallback-2026-07-01"

• "fallback-credit-2026-06-01"

• "fallback-credit-2026-07-01"

• "agent-memory-2026-07-22"

• "mid-conversation-tool-changes-2026-07-01"

• "compact-2026-01-12"

• "computer-use-2025-11-24"

• "mcp-tunnels-2026-06-22"

• "structured-outputs-2025-11-13"

• "task-budgets-2026-03-13"

• "thinking-display-updates-2026-08-18"

• "ce-user-management-2026-07-13"

• "mid-conversation-output-config-2026-07-01"

• "thinking-binding-controls-2026-08-01"

• "mid-conversation-system-clear-at-2026-08-21"

• "compact-2026-09-04"

• "inline-tools-2026-09-15"

• "mcp-client-2026-09-15"

#Returns

• data: array of BetaFederationIssuer

• type: "federation_issuer"

default: federation_issuer

• id: string

Tagged ID of the federation issuer.

• archived_at: string or null

If set, all rules referencing this issuer reject token exchange.

format: date-time

• archived_by_actor_id: string or null

Tagged ID (user_/svac_) of the actor that archived this issuer.

• check_jti: boolean

Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Applies only to assertions carrying a jti claim; tokens without one are accepted without single-use enforcement.

• created_at: string

When this issuer was created.

format: date-time

• created_by_actor_id: string or null

Tagged ID (user_/svac_) of the actor that created this issuer.

• issuer_url: string

The iss claim value. Incoming JWTs must match exactly.

• jwks: BetaJWKSDiscovery or BetaJWKSExplicitURL or BetaJWKSInline

How signing keys are obtained for signature verification.

• BetaJWKSDiscovery object

JWKS via the issuer's OIDC discovery document.

• type: "discovery"

• ca_cert_pem: optional string or null

Optional custom CA (PEM) for TLS verification of the JWKS fetch.

maxLength: 8192

• discovery_base: optional string or null

Set when the discovery URL differs from issuer_url.

• BetaJWKSExplicitURL object

JWKS fetched from a fixed endpoint.

• type: "explicit_url"

• url: string

JWKS endpoint.

minLength: 1

• ca_cert_pem: optional string or null

Optional custom CA (PEM) for TLS verification of the JWKS fetch.

maxLength: 8192

• BetaJWKSInline object

JWKS supplied directly; no network fetch.

• type: "inline"

• keys: array of map[unknown]

Inline JWK objects.

minItems: 1

• jwks_polling_disabled_at: string or null

If set, Juglow's JWKS poller has paused polling for this issuer after repeated fetch failures. Re-enable by sending jwks_polling_disabled: false via the issuer update endpoint (POST) once the upstream JWKS endpoint is fixed. An OAuth caller cannot send this when the issuer backs a rule with any scope other than workspace:developer or workspace:inference; use a Console session.

format: date-time

• max_jwt_lifetime_seconds: number

Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both iat and exp; a missing iat is rejected.

• name: string

Admin-chosen slug identifier.

• poll_status: BetaFederationIssuerPollStatus or null

Live state of Juglow's JWKS polling for this issuer. Populated on both single-issuer retrieval and list responses, including archived issuers. Typically null for inline-key issuers (no polling), or when poll status is temporarily unavailable or polling has not started yet.

• consecutive_failures: number

Consecutive fetch failures since the last success.

• last_fetched_at: string or null

When the last successful fetch completed.

format: date-time

• next_poll_at: string or null

When the next fetch is scheduled. Null if paused.

format: date-time

• updated_at: string

When this issuer was last updated.

format: date-time

• updated_by_actor_id: string or null

Tagged ID (user_/svac_) of the actor that last updated this issuer.

• next_page: string or null

Opaque cursor for the next page, or null if no more results.

#Example

curl https://haijun.my.id/v1/organizations/federation_issuers \
    -H 'juglow-version: 2023-06-01' \
    -H "X-Api-Key: $JUGLOW_API_KEY"

#Response (200)

{
  "data": [
    {
      "id": "fdis_01SDCCSbTxrXDpWc1phhtcfK",
      "archived_at": "2019-12-27T18:11:19.117Z",
      "archived_by_actor_id": "archived_by_actor_id",
      "check_jti": true,
      "created_at": "2024-10-30T23:58:27.427722Z",
      "created_by_actor_id": "created_by_actor_id",
      "issuer_url": "https://token.actions.githubusercontent.com",
      "jwks": {
        "type": "discovery",
        "ca_cert_pem": "ca_cert_pem",
        "discovery_base": "discovery_base"
      },
      "jwks_polling_disabled_at": "2019-12-27T18:11:19.117Z",
      "max_jwt_lifetime_seconds": 0,
      "name": "github-actions",
      "poll_status": {
        "consecutive_failures": 0,
        "last_fetched_at": "2019-12-27T18:11:19.117Z",
        "next_poll_at": "2019-12-27T18:11:19.117Z"
      },
      "type": "federation_issuer",
      "updated_at": "2024-10-30T23:58:27.427722Z",
      "updated_by_actor_id": "updated_by_actor_id"
    }
  ],
  "next_page": "next_page"
}

#Get Federation Issuer

GET /v1/organizations/federation_issuers/{federation_issuer_id}

Requires an OAuth access token with the org:admin scope, from ant auth login --scope org:admin or a workload identity federation rule; Admin API keys are not accepted. See Manage WIF with the Admin API.

Retrieve a federation issuer by its ID (fdis_...).

#Path parameters

• federation_issuer_id: string

ID of the federation issuer.

#Headers

• "juglow-beta": optional array of JuglowBeta

Optional header to specify the beta version(s) you want to use.

• string

• "message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 45 more

• "message-batches-2024-09-24"

• "prompt-caching-2024-07-31"

• "computer-use-2024-10-22"

• "computer-use-2025-01-24"

• "pdfs-2024-09-25"

• "token-counting-2024-11-01"

• "token-efficient-tools-2025-02-19"

• "output-128k-2025-02-19"

• "files-api-2025-04-14"

• "mcp-client-2025-04-04"

• "mcp-client-2025-11-20"

• "dev-full-thinking-2025-05-14"

• "interleaved-thinking-2025-05-14"

• "code-execution-2025-05-22"

• "extended-cache-ttl-2025-04-11"

• "context-1m-2025-08-07"

• "context-management-2025-06-27"

• "model-context-window-exceeded-2025-08-26"

• "tracks-2025-10-02"

• "fast-mode-2026-02-01"

• "output-300k-2026-03-24"

• "user-profiles-2026-03-24"

• "user-profiles-2026-08-18"

• "user-profiles-2026-09-04"

• "advisor-tool-2026-03-01"

• "managed-agents-2026-04-01"

• "cache-diagnosis-2026-04-07"

• "dreaming-2026-04-21"

• "thinking-token-count-2026-05-13"

• "server-side-fallback-2026-06-01"

• "server-side-fallback-2026-07-01"

• "fallback-credit-2026-06-01"

• "fallback-credit-2026-07-01"

• "agent-memory-2026-07-22"

• "mid-conversation-tool-changes-2026-07-01"

• "compact-2026-01-12"

• "computer-use-2025-11-24"

• "mcp-tunnels-2026-06-22"

• "structured-outputs-2025-11-13"

• "task-budgets-2026-03-13"

• "thinking-display-updates-2026-08-18"

• "ce-user-management-2026-07-13"

• "mid-conversation-output-config-2026-07-01"

• "thinking-binding-controls-2026-08-01"

• "mid-conversation-system-clear-at-2026-08-21"

• "compact-2026-09-04"

• "inline-tools-2026-09-15"

• "mcp-client-2026-09-15"

#Returns

• BetaFederationIssuer object

Registered external OIDC identity provider.

Records an external IdP the organization trusts for the RFC 7523 jwt-bearer grant. The issuer_url must match the JWT iss claim exactly.

• type: "federation_issuer"

default: federation_issuer

• id: string

Tagged ID of the federation issuer.

• archived_at: string or null

If set, all rules referencing this issuer reject token exchange.

format: date-time

• archived_by_actor_id: string or null

Tagged ID (user_/svac_) of the actor that archived this issuer.

• check_jti: boolean

Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Applies only to assertions carrying a jti claim; tokens without one are accepted without single-use enforcement.

• created_at: string

When this issuer was created.

format: date-time

• created_by_actor_id: string or null

Tagged ID (user_/svac_) of the actor that created this issuer.

• issuer_url: string

The iss claim value. Incoming JWTs must match exactly.

• jwks: BetaJWKSDiscovery or BetaJWKSExplicitURL or BetaJWKSInline

How signing keys are obtained for signature verification.

• BetaJWKSDiscovery object

JWKS via the issuer's OIDC discovery document.

• type: "discovery"

• ca_cert_pem: optional string or null

Optional custom CA (PEM) for TLS verification of the JWKS fetch.

maxLength: 8192

• discovery_base: optional string or null

Set when the discovery URL differs from issuer_url.

• BetaJWKSExplicitURL object

JWKS fetched from a fixed endpoint.

• type: "explicit_url"

• url: string

JWKS endpoint.

minLength: 1

• ca_cert_pem: optional string or null

Optional custom CA (PEM) for TLS verification of the JWKS fetch.

maxLength: 8192

• BetaJWKSInline object

JWKS supplied directly; no network fetch.

• type: "inline"

• keys: array of map[unknown]

Inline JWK objects.

minItems: 1

• jwks_polling_disabled_at: string or null

If set, Juglow's JWKS poller has paused polling for this issuer after repeated fetch failures. Re-enable by sending jwks_polling_disabled: false via the issuer update endpoint (POST) once the upstream JWKS endpoint is fixed. An OAuth caller cannot send this when the issuer backs a rule with any scope other than workspace:developer or workspace:inference; use a Console session.

format: date-time

• max_jwt_lifetime_seconds: number

Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both iat and exp; a missing iat is rejected.

• name: string

Admin-chosen slug identifier.

• poll_status: BetaFederationIssuerPollStatus or null

Live state of Juglow's JWKS polling for this issuer. Populated on both single-issuer retrieval and list responses, including archived issuers. Typically null for inline-key issuers (no polling), or when poll status is temporarily unavailable or polling has not started yet.

• consecutive_failures: number

Consecutive fetch failures since the last success.

• last_fetched_at: string or null

When the last successful fetch completed.

format: date-time

• next_poll_at: string or null

When the next fetch is scheduled. Null if paused.

format: date-time

• updated_at: string

When this issuer was last updated.

format: date-time

• updated_by_actor_id: string or null

Tagged ID (user_/svac_) of the actor that last updated this issuer.

#Example

curl https://haijun.my.id/v1/organizations/federation_issuers/$FEDERATION_ISSUER_ID \
    -H 'juglow-version: 2023-06-01' \
    -H "X-Api-Key: $JUGLOW_API_KEY"

#Response (200)

{
  "id": "fdis_01SDCCSbTxrXDpWc1phhtcfK",
  "archived_at": "2019-12-27T18:11:19.117Z",
  "archived_by_actor_id": "archived_by_actor_id",
  "check_jti": true,
  "created_at": "2024-10-30T23:58:27.427722Z",
  "created_by_actor_id": "created_by_actor_id",
  "issuer_url": "https://token.actions.githubusercontent.com",
  "jwks": {
    "type": "discovery",
    "ca_cert_pem": "ca_cert_pem",
    "discovery_base": "discovery_base"
  },
  "jwks_polling_disabled_at": "2019-12-27T18:11:19.117Z",
  "max_jwt_lifetime_seconds": 0,
  "name": "github-actions",
  "poll_status": {
    "consecutive_failures": 0,
    "last_fetched_at": "2019-12-27T18:11:19.117Z",
    "next_poll_at": "2019-12-27T18:11:19.117Z"
  },
  "type": "federation_issuer",
  "updated_at": "2024-10-30T23:58:27.427722Z",
  "updated_by_actor_id": "updated_by_actor_id"
}

#Update Federation Issuer

POST /v1/organizations/federation_issuers/{federation_issuer_id}

Requires an OAuth access token with the org:admin scope, from ant auth login --scope org:admin or a workload identity federation rule; Admin API keys are not accepted. See Manage WIF with the Admin API.

Partially update a federation issuer.

Setting jwks replaces the full JWKS shape at once. Archived issuers cannot be updated; this returns 400. Create a new issuer instead.

Updating an issuer that backs a rule with a scope outside workspace:developer or workspace:inference requires a Console session.

#Path parameters

• federation_issuer_id: string

ID of the federation issuer to update.

#Headers

• "juglow-beta": optional array of JuglowBeta

Optional header to specify the beta version(s) you want to use.

• string

• "message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 45 more

• "message-batches-2024-09-24"

• "prompt-caching-2024-07-31"

• "computer-use-2024-10-22"

• "computer-use-2025-01-24"

• "pdfs-2024-09-25"

• "token-counting-2024-11-01"

• "token-efficient-tools-2025-02-19"

• "output-128k-2025-02-19"

• "files-api-2025-04-14"

• "mcp-client-2025-04-04"

• "mcp-client-2025-11-20"

• "dev-full-thinking-2025-05-14"

• "interleaved-thinking-2025-05-14"

• "code-execution-2025-05-22"

• "extended-cache-ttl-2025-04-11"

• "context-1m-2025-08-07"

• "context-management-2025-06-27"

• "model-context-window-exceeded-2025-08-26"

• "tracks-2025-10-02"

• "fast-mode-2026-02-01"

• "output-300k-2026-03-24"

• "user-profiles-2026-03-24"

• "user-profiles-2026-08-18"

• "user-profiles-2026-09-04"

• "advisor-tool-2026-03-01"

• "managed-agents-2026-04-01"

• "cache-diagnosis-2026-04-07"

• "dreaming-2026-04-21"

• "thinking-token-count-2026-05-13"

• "server-side-fallback-2026-06-01"

• "server-side-fallback-2026-07-01"

• "fallback-credit-2026-06-01"

• "fallback-credit-2026-07-01"

• "agent-memory-2026-07-22"

• "mid-conversation-tool-changes-2026-07-01"

• "compact-2026-01-12"

• "computer-use-2025-11-24"

• "mcp-tunnels-2026-06-22"

• "structured-outputs-2025-11-13"

• "task-budgets-2026-03-13"

• "thinking-display-updates-2026-08-18"

• "ce-user-management-2026-07-13"

• "mid-conversation-output-config-2026-07-01"

• "thinking-binding-controls-2026-08-01"

• "mid-conversation-system-clear-at-2026-08-21"

• "compact-2026-09-04"

• "inline-tools-2026-09-15"

• "mcp-client-2026-09-15"

#Body parameters

• check_jti: optional boolean or null

Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Applies only to assertions carrying a jti claim; tokens without one are accepted without single-use enforcement.

• issuer_url: optional string or null

Replaces the iss claim value to match against. For discovery-mode issuers without a discovery_base, this is also the URL Juglow fetches the OIDC discovery document and signing keys from, so changing it repoints the JWKS source. Changing the issuer URL to a well-known shared platform is rejected while any live rule under this issuer would not constrain tenant identity.

minLength: 1

• jwks: optional BetaJWKSDiscovery or BetaJWKSExplicitURL or BetaJWKSInline or null

Replaces the entire JWKS configuration.

• BetaJWKSDiscovery object

JWKS via the issuer's OIDC discovery document.

• type: "discovery"

• ca_cert_pem: optional string or null

Optional custom CA (PEM) for TLS verification of the JWKS fetch.

maxLength: 8192

• discovery_base: optional string or null

Set when the discovery URL differs from issuer_url.

• BetaJWKSExplicitURL object

JWKS fetched from a fixed endpoint.

• type: "explicit_url"

• url: string

JWKS endpoint.

minLength: 1

• ca_cert_pem: optional string or null

Optional custom CA (PEM) for TLS verification of the JWKS fetch.

maxLength: 8192

• BetaJWKSInline object

JWKS supplied directly; no network fetch.

• type: "inline"

• keys: array of map[unknown]

Inline JWK objects.

minItems: 1

• jwks_polling_disabled: optional boolean or null

Only false is accepted, to re-enable polling after the system pauses it. Polling is paused automatically; sending true is rejected.

• max_jwt_lifetime_seconds: optional number or null

Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both iat and exp; a missing iat is rejected.

minimum: 1, maximum: 176400

• name: optional string or null

Replaces the slug identifier (lowercase, digits, hyphens). Unique within the organization; a duplicate name returns 409.

minLength: 1, maxLength: 255

#Returns

• BetaFederationIssuer object

Registered external OIDC identity provider.

Records an external IdP the organization trusts for the RFC 7523 jwt-bearer grant. The issuer_url must match the JWT iss claim exactly.

• type: "federation_issuer"

default: federation_issuer

• id: string

Tagged ID of the federation issuer.

• archived_at: string or null

If set, all rules referencing this issuer reject token exchange.

format: date-time

• archived_by_actor_id: string or null

Tagged ID (user_/svac_) of the actor that archived this issuer.

• check_jti: boolean

Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Applies only to assertions carrying a jti claim; tokens without one are accepted without single-use enforcement.

• created_at: string

When this issuer was created.

format: date-time

• created_by_actor_id: string or null

Tagged ID (user_/svac_) of the actor that created this issuer.

• issuer_url: string

The iss claim value. Incoming JWTs must match exactly.

• jwks: BetaJWKSDiscovery or BetaJWKSExplicitURL or BetaJWKSInline

How signing keys are obtained for signature verification.

• BetaJWKSDiscovery object

JWKS via the issuer's OIDC discovery document.

• type: "discovery"

• ca_cert_pem: optional string or null

Optional custom CA (PEM) for TLS verification of the JWKS fetch.

maxLength: 8192

• discovery_base: optional string or null

Set when the discovery URL differs from issuer_url.

• BetaJWKSExplicitURL object

JWKS fetched from a fixed endpoint.

• type: "explicit_url"

• url: string

JWKS endpoint.

minLength: 1

• ca_cert_pem: optional string or null

Optional custom CA (PEM) for TLS verification of the JWKS fetch.

maxLength: 8192

• BetaJWKSInline object

JWKS supplied directly; no network fetch.

• type: "inline"

• keys: array of map[unknown]

Inline JWK objects.

minItems: 1

• jwks_polling_disabled_at: string or null

If set, Juglow's JWKS poller has paused polling for this issuer after repeated fetch failures. Re-enable by sending jwks_polling_disabled: false via the issuer update endpoint (POST) once the upstream JWKS endpoint is fixed. An OAuth caller cannot send this when the issuer backs a rule with any scope other than workspace:developer or workspace:inference; use a Console session.

format: date-time

• max_jwt_lifetime_seconds: number

Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both iat and exp; a missing iat is rejected.

• name: string

Admin-chosen slug identifier.

• poll_status: BetaFederationIssuerPollStatus or null

Live state of Juglow's JWKS polling for this issuer. Populated on both single-issuer retrieval and list responses, including archived issuers. Typically null for inline-key issuers (no polling), or when poll status is temporarily unavailable or polling has not started yet.

• consecutive_failures: number

Consecutive fetch failures since the last success.

• last_fetched_at: string or null

When the last successful fetch completed.

format: date-time

• next_poll_at: string or null

When the next fetch is scheduled. Null if paused.

format: date-time

• updated_at: string

When this issuer was last updated.

format: date-time

• updated_by_actor_id: string or null

Tagged ID (user_/svac_) of the actor that last updated this issuer.

#Example

curl https://haijun.my.id/v1/organizations/federation_issuers/$FEDERATION_ISSUER_ID \
    -H 'Content-Type: application/json' \
    -H 'juglow-version: 2023-06-01' \
    -H "X-Api-Key: $JUGLOW_API_KEY" \
    -d '{}'

#Response (200)

{
  "id": "fdis_01SDCCSbTxrXDpWc1phhtcfK",
  "archived_at": "2019-12-27T18:11:19.117Z",
  "archived_by_actor_id": "archived_by_actor_id",
  "check_jti": true,
  "created_at": "2024-10-30T23:58:27.427722Z",
  "created_by_actor_id": "created_by_actor_id",
  "issuer_url": "https://token.actions.githubusercontent.com",
  "jwks": {
    "type": "discovery",
    "ca_cert_pem": "ca_cert_pem",
    "discovery_base": "discovery_base"
  },
  "jwks_polling_disabled_at": "2019-12-27T18:11:19.117Z",
  "max_jwt_lifetime_seconds": 0,
  "name": "github-actions",
  "poll_status": {
    "consecutive_failures": 0,
    "last_fetched_at": "2019-12-27T18:11:19.117Z",
    "next_poll_at": "2019-12-27T18:11:19.117Z"
  },
  "type": "federation_issuer",
  "updated_at": "2024-10-30T23:58:27.427722Z",
  "updated_by_actor_id": "updated_by_actor_id"
}

#Archive Federation Issuer

POST /v1/organizations/federation_issuers/{federation_issuer_id}/archive

Requires an OAuth access token with the org:admin scope, from ant auth login --scope org:admin or a workload identity federation rule; Admin API keys are not accepted. See Manage WIF with the Admin API.

Archive a federation issuer.

Idempotent; re-archiving returns the issuer with its original archived_at. Rejected with 400 if any live (non-archived) federation rule still references the issuer; archive those rules first (a rule's issuer cannot be changed), or recreate them against another issuer.

#Path parameters

• federation_issuer_id: string

ID of the federation issuer to archive.

#Headers

• "juglow-beta": optional array of JuglowBeta

Optional header to specify the beta version(s) you want to use.

• string

• "message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 45 more

• "message-batches-2024-09-24"

• "prompt-caching-2024-07-31"

• "computer-use-2024-10-22"

• "computer-use-2025-01-24"

• "pdfs-2024-09-25"

• "token-counting-2024-11-01"

• "token-efficient-tools-2025-02-19"

• "output-128k-2025-02-19"

• "files-api-2025-04-14"

• "mcp-client-2025-04-04"

• "mcp-client-2025-11-20"

• "dev-full-thinking-2025-05-14"

• "interleaved-thinking-2025-05-14"

• "code-execution-2025-05-22"

• "extended-cache-ttl-2025-04-11"

• "context-1m-2025-08-07"

• "context-management-2025-06-27"

• "model-context-window-exceeded-2025-08-26"

• "tracks-2025-10-02"

• "fast-mode-2026-02-01"

• "output-300k-2026-03-24"

• "user-profiles-2026-03-24"

• "user-profiles-2026-08-18"

• "user-profiles-2026-09-04"

• "advisor-tool-2026-03-01"

• "managed-agents-2026-04-01"

• "cache-diagnosis-2026-04-07"

• "dreaming-2026-04-21"

• "thinking-token-count-2026-05-13"

• "server-side-fallback-2026-06-01"

• "server-side-fallback-2026-07-01"

• "fallback-credit-2026-06-01"

• "fallback-credit-2026-07-01"

• "agent-memory-2026-07-22"

• "mid-conversation-tool-changes-2026-07-01"

• "compact-2026-01-12"

• "computer-use-2025-11-24"

• "mcp-tunnels-2026-06-22"

• "structured-outputs-2025-11-13"

• "task-budgets-2026-03-13"

• "thinking-display-updates-2026-08-18"

• "ce-user-management-2026-07-13"

• "mid-conversation-output-config-2026-07-01"

• "thinking-binding-controls-2026-08-01"

• "mid-conversation-system-clear-at-2026-08-21"

• "compact-2026-09-04"

• "inline-tools-2026-09-15"

• "mcp-client-2026-09-15"

#Returns

• BetaFederationIssuer object

Registered external OIDC identity provider.

Records an external IdP the organization trusts for the RFC 7523 jwt-bearer grant. The issuer_url must match the JWT iss claim exactly.

• type: "federation_issuer"

default: federation_issuer

• id: string

Tagged ID of the federation issuer.

• archived_at: string or null

If set, all rules referencing this issuer reject token exchange.

format: date-time

• archived_by_actor_id: string or null

Tagged ID (user_/svac_) of the actor that archived this issuer.

• check_jti: boolean

Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Applies only to assertions carrying a jti claim; tokens without one are accepted without single-use enforcement.

• created_at: string

When this issuer was created.

format: date-time

• created_by_actor_id: string or null

Tagged ID (user_/svac_) of the actor that created this issuer.

• issuer_url: string

The iss claim value. Incoming JWTs must match exactly.

• jwks: BetaJWKSDiscovery or BetaJWKSExplicitURL or BetaJWKSInline

How signing keys are obtained for signature verification.

• BetaJWKSDiscovery object

JWKS via the issuer's OIDC discovery document.

• type: "discovery"

• ca_cert_pem: optional string or null

Optional custom CA (PEM) for TLS verification of the JWKS fetch.

maxLength: 8192

• discovery_base: optional string or null

Set when the discovery URL differs from issuer_url.

• BetaJWKSExplicitURL object

JWKS fetched from a fixed endpoint.

• type: "explicit_url"

• url: string

JWKS endpoint.

minLength: 1

• ca_cert_pem: optional string or null

Optional custom CA (PEM) for TLS verification of the JWKS fetch.

maxLength: 8192

• BetaJWKSInline object

JWKS supplied directly; no network fetch.

• type: "inline"

• keys: array of map[unknown]

Inline JWK objects.

minItems: 1

• jwks_polling_disabled_at: string or null

If set, Juglow's JWKS poller has paused polling for this issuer after repeated fetch failures. Re-enable by sending jwks_polling_disabled: false via the issuer update endpoint (POST) once the upstream JWKS endpoint is fixed. An OAuth caller cannot send this when the issuer backs a rule with any scope other than workspace:developer or workspace:inference; use a Console session.

format: date-time

• max_jwt_lifetime_seconds: number

Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both iat and exp; a missing iat is rejected.

• name: string

Admin-chosen slug identifier.

• poll_status: BetaFederationIssuerPollStatus or null

Live state of Juglow's JWKS polling for this issuer. Populated on both single-issuer retrieval and list responses, including archived issuers. Typically null for inline-key issuers (no polling), or when poll status is temporarily unavailable or polling has not started yet.

• consecutive_failures: number

Consecutive fetch failures since the last success.

• last_fetched_at: string or null

When the last successful fetch completed.

format: date-time

• next_poll_at: string or null

When the next fetch is scheduled. Null if paused.

format: date-time

• updated_at: string

When this issuer was last updated.

format: date-time

• updated_by_actor_id: string or null

Tagged ID (user_/svac_) of the actor that last updated this issuer.

#Example

curl https://haijun.my.id/v1/organizations/federation_issuers/$FEDERATION_ISSUER_ID/archive \
    -X POST \
    -H 'juglow-version: 2023-06-01' \
    -H "X-Api-Key: $JUGLOW_API_KEY"

#Response (200)

{
  "id": "fdis_01SDCCSbTxrXDpWc1phhtcfK",
  "archived_at": "2019-12-27T18:11:19.117Z",
  "archived_by_actor_id": "archived_by_actor_id",
  "check_jti": true,
  "created_at": "2024-10-30T23:58:27.427722Z",
  "created_by_actor_id": "created_by_actor_id",
  "issuer_url": "https://token.actions.githubusercontent.com",
  "jwks": {
    "type": "discovery",
    "ca_cert_pem": "ca_cert_pem",
    "discovery_base": "discovery_base"
  },
  "jwks_polling_disabled_at": "2019-12-27T18:11:19.117Z",
  "max_jwt_lifetime_seconds": 0,
  "name": "github-actions",
  "poll_status": {
    "consecutive_failures": 0,
    "last_fetched_at": "2019-12-27T18:11:19.117Z",
    "next_poll_at": "2019-12-27T18:11:19.117Z"
  },
  "type": "federation_issuer",
  "updated_at": "2024-10-30T23:58:27.427722Z",
  "updated_by_actor_id": "updated_by_actor_id"
}

#Organization › Federation › Rules

#Create Federation Rule

POST /v1/organizations/federation_rules

Requires an OAuth access token with the org:admin scope, from ant auth login --scope org:admin or a workload identity federation rule; Admin API keys are not accepted. See Manage WIF with the Admin API.

Create a federation rule owned by your organization.

The referenced issuer and the target service account must already exist in the same organization; invalid references are rejected with a 400 error. The workspace reference is validated. Membership is not checked at rule creation: token exchange resolves a single enabled workspace per call and is rejected unless the target service account is a member of that workspace (it is implicitly a member of the default workspace). Rules on well-known shared issuers (GitHub Actions, GitLab, Buildkite, Terraform Cloud, Google) must constrain tenant identity via an identity-bearing claim, a tenant-pinning subject prefix (such as repo:YOUR_ORG/...), or a CEL condition referencing one of those identity claims (e.g. claims.repository_owner). OAuth callers may only manage rules whose oauth_scope is workspace:developer or workspace:inference; other scopes require a Console session.

#Headers

• "juglow-beta": optional array of JuglowBeta

Optional header to specify the beta version(s) you want to use.

• string

• "message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 45 more

• "message-batches-2024-09-24"

• "prompt-caching-2024-07-31"

• "computer-use-2024-10-22"

• "computer-use-2025-01-24"

• "pdfs-2024-09-25"

• "token-counting-2024-11-01"

• "token-efficient-tools-2025-02-19"

• "output-128k-2025-02-19"

• "files-api-2025-04-14"

• "mcp-client-2025-04-04"

• "mcp-client-2025-11-20"

• "dev-full-thinking-2025-05-14"

• "interleaved-thinking-2025-05-14"

• "code-execution-2025-05-22"

• "extended-cache-ttl-2025-04-11"

• "context-1m-2025-08-07"

• "context-management-2025-06-27"

• "model-context-window-exceeded-2025-08-26"

• "tracks-2025-10-02"

• "fast-mode-2026-02-01"

• "output-300k-2026-03-24"

• "user-profiles-2026-03-24"

• "user-profiles-2026-08-18"

• "user-profiles-2026-09-04"

• "advisor-tool-2026-03-01"

• "managed-agents-2026-04-01"

• "cache-diagnosis-2026-04-07"

• "dreaming-2026-04-21"

• "thinking-token-count-2026-05-13"

• "server-side-fallback-2026-06-01"

• "server-side-fallback-2026-07-01"

• "fallback-credit-2026-06-01"

• "fallback-credit-2026-07-01"

• "agent-memory-2026-07-22"

• "mid-conversation-tool-changes-2026-07-01"

• "compact-2026-01-12"

• "computer-use-2025-11-24"

• "mcp-tunnels-2026-06-22"

• "structured-outputs-2025-11-13"

• "task-budgets-2026-03-13"

• "thinking-display-updates-2026-08-18"

• "ce-user-management-2026-07-13"

• "mid-conversation-output-config-2026-07-01"

• "thinking-binding-controls-2026-08-01"

• "mid-conversation-system-clear-at-2026-08-21"

• "compact-2026-09-04"

• "inline-tools-2026-09-15"

• "mcp-client-2026-09-15"

#Body parameters

• issuer_id: string

Tagged ID of the federation issuer.

• match: BetaFederationRuleMatch

Conditions the verified JWT must satisfy for this rule to apply. At least one of subject_prefix (other than a wildcard-only value like *), claims, or condition is required; audience alone is not sufficient.

• audience: optional string or null

Exact match against the aud claim (any element if array). When omitted, the JWT's aud must still equal Juglow's expected audience for the issuer; setting this field overrides that default.

maxLength: 1024

• claims: optional map[string] or null

Exact-match {claim: value} pairs against top-level claims. Only string-valued claims can be matched; use condition for non-string claims.

• condition: optional string or null

CEL expression over claims for logic the structural fields can't express. Must evaluate to a boolean and may reference only the claims variable; a constant-true expression (such as true) is rejected with 400.

maxLength: 4096

• subject_prefix: optional string or null

Match the verified JWT sub claim. Exact match unless the value ends with *, in which case it is a prefix match. Example: repo:my-org/my-repo:ref:refs/heads/main.

maxLength: 1024

• name: string

Slug identifier (lowercase, digits, hyphens). Unique within the organization; a duplicate name returns 409.

minLength: 1, maxLength: 255

• oauth_scope: string

Space-separated OAuth scopes. OAuth callers may only set workspace:developer or workspace:inference; other scopes (such as org:admin) require a Console session.

minLength: 1

• target: BetaServiceAccountTarget

Identity that tokens minted via this rule act as. Currently always a service_account target.

• type: "service_account"

• service_account_id: string

Tagged ID of the service account to mint tokens for.

• service_account_name: optional string or null

Service account's display name at read time. Ignored on writes.

• applies_to_all_workspaces: optional boolean

When true, enable this rule for every workspace in the org (including workspaces created later).

• attributes: optional map[string] or null

CEL expressions {name: expr} extracting named values from claims. Not yet supported; any non-empty value is rejected with 400.

• description: optional string or null

Optional free-text description.

maxLength: 2000

• token_lifetime_seconds: optional number

Lifetime in seconds for access tokens minted via this rule (60-86400). Defaults to 3600 (1h). Minted tokens are capped at max(60, min(this value, 2 × remaining assertion validity)) seconds.

minimum: 60, maximum: 86400

• workspace_id: optional string or null

Tagged ID of the workspace to enable this rule for. Required unless applies_to_all_workspaces is true. Additional workspaces can be added via the /federation_rules/{federation_rule_id}/workspaces sub-resource.

#Returns

• BetaFederationRule object

Authorization rule binding an external OIDC identity to Juglow.

Evaluates the match conditions and mints an OAuth access token for the resolved target, scoped to a single workspace where the rule is enabled (chosen by the caller at exchange time when the rule is enabled for more than one). For rules enabled via workspace_ids or applies_to_all_workspaces, the target service account must be a member of that workspace (it is implicitly a member of the default workspace); rules carrying only the legacy workspace_id binding do not enforce this.

• type: "federation_rule"

default: federation_rule

• id: string

Tagged ID of the federation rule.

• applies_to_all_workspaces: boolean

When true, this rule is enabled for every workspace in the org (including ones created after the rule). workspace_ids is ignored at exchange time.

• archived_at: string or null

If set, this rule is archived and rejects token exchange.

format: date-time

• archived_by_actor_id: string or null

Tagged ID (user_/svac_) of the actor that archived this rule.

• attributes: map[string] or null

CEL expressions extracting named values from claims. Not yet supported; always null.

• created_at: string

When this rule was created.

format: date-time

• created_by_actor_id: string or null

Tagged ID (user_/svac_) of the actor that created this rule.

• description: string or null

Optional free-text description.

• issuer_id: string

Tagged ID of the issuer whose tokens this rule accepts.

• issuer_name: string or null

Issuer's display name at read time.

• match: BetaFederationRuleMatch

Conditions the verified JWT must satisfy for this rule to apply. All populated matcher fields must pass.

• audience: optional string or null

Exact match against the aud claim (any element if array). When omitted, the JWT's aud must still equal Juglow's expected audience for the issuer; setting this field overrides that default.

maxLength: 1024

• claims: optional map[string] or null

Exact-match {claim: value} pairs against top-level claims. Only string-valued claims can be matched; use condition for non-string claims.

• condition: optional string or null

CEL expression over claims for logic the structural fields can't express. Must evaluate to a boolean and may reference only the claims variable; a constant-true expression (such as true) is rejected with 400.

maxLength: 4096

• subject_prefix: optional string or null

Match the verified JWT sub claim. Exact match unless the value ends with *, in which case it is a prefix match. Example: repo:my-org/my-repo:ref:refs/heads/main.

maxLength: 1024

• name: string

Admin-chosen slug identifier.

• oauth_scope: string

Space-separated OAuth scopes granted on the minted token.

• target: BetaServiceAccountTarget

Identity that tokens minted via this rule act as. Currently always a service_account target.

• type: "service_account"

• service_account_id: string

Tagged ID of the service account to mint tokens for.

• service_account_name: optional string or null

Service account's display name at read time. Ignored on writes.

• token_lifetime_seconds: number

Lifetime in seconds of access tokens minted via this rule. Minted tokens are capped at max(60, min(this value, 2 × remaining assertion validity)) seconds.

• updated_at: string

When this rule was last updated.

format: date-time

• updated_by_actor_id: string or null

Tagged ID (user_/svac_) of the actor that last updated this rule.

• workspace_id: string or null

Legacy single-workspace binding. Prefer workspace_ids and the /federation_rules/{federation_rule_id}/workspaces sub-resource for managing workspace enablement.

• workspace_ids: array of string

Tagged IDs of the workspaces this rule is enabled for. May be empty for older rules that only carry the legacy workspace_id binding. Ignored at exchange time when applies_to_all_workspaces is true (the list may still be non-empty).

#Example

curl https://haijun.my.id/v1/organizations/federation_rules \
    -H 'Content-Type: application/json' \
    -H 'juglow-version: 2023-06-01' \
    -H "X-Api-Key: $JUGLOW_API_KEY" \
    -d '{
          "issuer_id": "issuer_id",
          "match": {},
          "name": "x",
          "oauth_scope": "x",
          "target": {
            "service_account_id": "svac_01SDCCSbTxrXDpWc1phhtcfK",
            "type": "service_account"
          }
        }'

#Response (200)

{
  "id": "fdrl_01SDCCSbTxrXDpWc1phhtcfK",
  "applies_to_all_workspaces": true,
  "archived_at": "2019-12-27T18:11:19.117Z",
  "archived_by_actor_id": "archived_by_actor_id",
  "attributes": {
    "foo": "string"
  },
  "created_at": "2024-10-30T23:58:27.427722Z",
  "created_by_actor_id": "created_by_actor_id",
  "description": "description",
  "issuer_id": "issuer_id",
  "issuer_name": "issuer_name",
  "match": {
    "audience": "audience",
    "claims": {
      "foo": "string"
    },
    "condition": "condition",
    "subject_prefix": "subject_prefix"
  },
  "name": "prod-deploy-pipeline",
  "oauth_scope": "oauth_scope",
  "target": {
    "service_account_id": "svac_01SDCCSbTxrXDpWc1phhtcfK",
    "type": "service_account",
    "service_account_name": "service_account_name"
  },
  "token_lifetime_seconds": 0,
  "type": "federation_rule",
  "updated_at": "2024-10-30T23:58:27.427722Z",
  "updated_by_actor_id": "updated_by_actor_id",
  "workspace_id": "workspace_id",
  "workspace_ids": [
    "string"
  ]
}

#List Federation Rules

GET /v1/organizations/federation_rules

Requires an OAuth access token with the org:admin scope, from ant auth login --scope org:admin or a workload identity federation rule; Admin API keys are not accepted. See Manage WIF with the Admin API.

List federation rules in your organization.

Optionally filter by issuer with issuer_id. Archived rules are excluded unless include_archived=true.

#Query parameters

• include_archived: optional boolean

Include archived resources. Defaults to false.

default: false

• issuer_id: optional string

Filter to rules referencing this federation issuer.

• limit: optional number

Number of results per page.

default: 20, minimum: 1, maximum: 100

• page: optional string

Opaque cursor from a previous response's next_page.

#Headers

• "juglow-beta": optional array of JuglowBeta

Optional header to specify the beta version(s) you want to use.

• string

• "message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 45 more

• "message-batches-2024-09-24"

• "prompt-caching-2024-07-31"

• "computer-use-2024-10-22"

• "computer-use-2025-01-24"

• "pdfs-2024-09-25"

• "token-counting-2024-11-01"

• "token-efficient-tools-2025-02-19"

• "output-128k-2025-02-19"

• "files-api-2025-04-14"

• "mcp-client-2025-04-04"

• "mcp-client-2025-11-20"

• "dev-full-thinking-2025-05-14"

• "interleaved-thinking-2025-05-14"

• "code-execution-2025-05-22"

• "extended-cache-ttl-2025-04-11"

• "context-1m-2025-08-07"

• "context-management-2025-06-27"

• "model-context-window-exceeded-2025-08-26"

• "tracks-2025-10-02"

• "fast-mode-2026-02-01"

• "output-300k-2026-03-24"

• "user-profiles-2026-03-24"

• "user-profiles-2026-08-18"

• "user-profiles-2026-09-04"

• "advisor-tool-2026-03-01"

• "managed-agents-2026-04-01"

• "cache-diagnosis-2026-04-07"

• "dreaming-2026-04-21"

• "thinking-token-count-2026-05-13"

• "server-side-fallback-2026-06-01"

• "server-side-fallback-2026-07-01"

• "fallback-credit-2026-06-01"

• "fallback-credit-2026-07-01"

• "agent-memory-2026-07-22"

• "mid-conversation-tool-changes-2026-07-01"

• "compact-2026-01-12"

• "computer-use-2025-11-24"

• "mcp-tunnels-2026-06-22"

• "structured-outputs-2025-11-13"

• "task-budgets-2026-03-13"

• "thinking-display-updates-2026-08-18"

• "ce-user-management-2026-07-13"

• "mid-conversation-output-config-2026-07-01"

• "thinking-binding-controls-2026-08-01"

• "mid-conversation-system-clear-at-2026-08-21"

• "compact-2026-09-04"

• "inline-tools-2026-09-15"

• "mcp-client-2026-09-15"

#Returns

• data: array of BetaFederationRule

• type: "federation_rule"

default: federation_rule

• id: string

Tagged ID of the federation rule.

• applies_to_all_workspaces: boolean

When true, this rule is enabled for every workspace in the org (including ones created after the rule). workspace_ids is ignored at exchange time.

• archived_at: string or null

If set, this rule is archived and rejects token exchange.

format: date-time

• archived_by_actor_id: string or null

Tagged ID (user_/svac_) of the actor that archived this rule.

• attributes: map[string] or null

CEL expressions extracting named values from claims. Not yet supported; always null.

• created_at: string

When this rule was created.

format: date-time

• created_by_actor_id: string or null

Tagged ID (user_/svac_) of the actor that created this rule.

• description: string or null

Optional free-text description.

• issuer_id: string

Tagged ID of the issuer whose tokens this rule accepts.

• issuer_name: string or null

Issuer's display name at read time.

• match: BetaFederationRuleMatch

Conditions the verified JWT must satisfy for this rule to apply. All populated matcher fields must pass.

• audience: optional string or null

Exact match against the aud claim (any element if array). When omitted, the JWT's aud must still equal Juglow's expected audience for the issuer; setting this field overrides that default.

maxLength: 1024

• claims: optional map[string] or null

Exact-match {claim: value} pairs against top-level claims. Only string-valued claims can be matched; use condition for non-string claims.

• condition: optional string or null

CEL expression over claims for logic the structural fields can't express. Must evaluate to a boolean and may reference only the claims variable; a constant-true expression (such as true) is rejected with 400.

maxLength: 4096

• subject_prefix: optional string or null

Match the verified JWT sub claim. Exact match unless the value ends with *, in which case it is a prefix match. Example: repo:my-org/my-repo:ref:refs/heads/main.

maxLength: 1024

• name: string

Admin-chosen slug identifier.

• oauth_scope: string

Space-separated OAuth scopes granted on the minted token.

• target: BetaServiceAccountTarget

Identity that tokens minted via this rule act as. Currently always a service_account target.

• type: "service_account"

• service_account_id: string

Tagged ID of the service account to mint tokens for.

• service_account_name: optional string or null

Service account's display name at read time. Ignored on writes.

• token_lifetime_seconds: number

Lifetime in seconds of access tokens minted via this rule. Minted tokens are capped at max(60, min(this value, 2 × remaining assertion validity)) seconds.

• updated_at: string

When this rule was last updated.

format: date-time

• updated_by_actor_id: string or null

Tagged ID (user_/svac_) of the actor that last updated this rule.

• workspace_id: string or null

Legacy single-workspace binding. Prefer workspace_ids and the /federation_rules/{federation_rule_id}/workspaces sub-resource for managing workspace enablement.

• workspace_ids: array of string

Tagged IDs of the workspaces this rule is enabled for. May be empty for older rules that only carry the legacy workspace_id binding. Ignored at exchange time when applies_to_all_workspaces is true (the list may still be non-empty).

• next_page: string or null

Opaque cursor for the next page, or null if no more results.

#Example

curl https://haijun.my.id/v1/organizations/federation_rules \
    -H 'juglow-version: 2023-06-01' \
    -H "X-Api-Key: $JUGLOW_API_KEY"

#Response (200)

{
  "data": [
    {
      "id": "fdrl_01SDCCSbTxrXDpWc1phhtcfK",
      "applies_to_all_workspaces": true,
      "archived_at": "2019-12-27T18:11:19.117Z",
      "archived_by_actor_id": "archived_by_actor_id",
      "attributes": {
        "foo": "string"
      },
      "created_at": "2024-10-30T23:58:27.427722Z",
      "created_by_actor_id": "created_by_actor_id",
      "description": "description",
      "issuer_id": "issuer_id",
      "issuer_name": "issuer_name",
      "match": {
        "audience": "audience",
        "claims": {
          "foo": "string"
        },
        "condition": "condition",
        "subject_prefix": "subject_prefix"
      },
      "name": "prod-deploy-pipeline",
      "oauth_scope": "oauth_scope",
      "target": {
        "service_account_id": "svac_01SDCCSbTxrXDpWc1phhtcfK",
        "type": "service_account",
        "service_account_name": "service_account_name"
      },
      "token_lifetime_seconds": 0,
      "type": "federation_rule",
      "updated_at": "2024-10-30T23:58:27.427722Z",
      "updated_by_actor_id": "updated_by_actor_id",
      "workspace_id": "workspace_id",
      "workspace_ids": [
        "string"
      ]
    }
  ],
  "next_page": "next_page"
}

#Get Federation Rule

GET /v1/organizations/federation_rules/{federation_rule_id}

Requires an OAuth access token with the org:admin scope, from ant auth login --scope org:admin or a workload identity federation rule; Admin API keys are not accepted. See Manage WIF with the Admin API.

Retrieve a federation rule by its ID (fdrl_...).

#Path parameters

• federation_rule_id: string

ID of the federation rule.

#Headers

• "juglow-beta": optional array of JuglowBeta

Optional header to specify the beta version(s) you want to use.

• string

• "message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 45 more

• "message-batches-2024-09-24"

• "prompt-caching-2024-07-31"

• "computer-use-2024-10-22"

• "computer-use-2025-01-24"

• "pdfs-2024-09-25"

• "token-counting-2024-11-01"

• "token-efficient-tools-2025-02-19"

• "output-128k-2025-02-19"

• "files-api-2025-04-14"

• "mcp-client-2025-04-04"

• "mcp-client-2025-11-20"

• "dev-full-thinking-2025-05-14"

• "interleaved-thinking-2025-05-14"

• "code-execution-2025-05-22"

• "extended-cache-ttl-2025-04-11"

• "context-1m-2025-08-07"

• "context-management-2025-06-27"

• "model-context-window-exceeded-2025-08-26"

• "tracks-2025-10-02"

• "fast-mode-2026-02-01"

• "output-300k-2026-03-24"

• "user-profiles-2026-03-24"

• "user-profiles-2026-08-18"

• "user-profiles-2026-09-04"

• "advisor-tool-2026-03-01"

• "managed-agents-2026-04-01"

• "cache-diagnosis-2026-04-07"

• "dreaming-2026-04-21"

• "thinking-token-count-2026-05-13"

• "server-side-fallback-2026-06-01"

• "server-side-fallback-2026-07-01"

• "fallback-credit-2026-06-01"

• "fallback-credit-2026-07-01"

• "agent-memory-2026-07-22"

• "mid-conversation-tool-changes-2026-07-01"

• "compact-2026-01-12"

• "computer-use-2025-11-24"

• "mcp-tunnels-2026-06-22"

• "structured-outputs-2025-11-13"

• "task-budgets-2026-03-13"

• "thinking-display-updates-2026-08-18"

• "ce-user-management-2026-07-13"

• "mid-conversation-output-config-2026-07-01"

• "thinking-binding-controls-2026-08-01"

• "mid-conversation-system-clear-at-2026-08-21"

• "compact-2026-09-04"

• "inline-tools-2026-09-15"

• "mcp-client-2026-09-15"

#Returns

• BetaFederationRule object

Authorization rule binding an external OIDC identity to Juglow.

Evaluates the match conditions and mints an OAuth access token for the resolved target, scoped to a single workspace where the rule is enabled (chosen by the caller at exchange time when the rule is enabled for more than one). For rules enabled via workspace_ids or applies_to_all_workspaces, the target service account must be a member of that workspace (it is implicitly a member of the default workspace); rules carrying only the legacy workspace_id binding do not enforce this.

• type: "federation_rule"

default: federation_rule

• id: string

Tagged ID of the federation rule.

• applies_to_all_workspaces: boolean

When true, this rule is enabled for every workspace in the org (including ones created after the rule). workspace_ids is ignored at exchange time.

• archived_at: string or null

If set, this rule is archived and rejects token exchange.

format: date-time

• archived_by_actor_id: string or null

Tagged ID (user_/svac_) of the actor that archived this rule.

• attributes: map[string] or null

CEL expressions extracting named values from claims. Not yet supported; always null.

• created_at: string

When this rule was created.

format: date-time

• created_by_actor_id: string or null

Tagged ID (user_/svac_) of the actor that created this rule.

• description: string or null

Optional free-text description.

• issuer_id: string

Tagged ID of the issuer whose tokens this rule accepts.

• issuer_name: string or null

Issuer's display name at read time.

• match: BetaFederationRuleMatch

Conditions the verified JWT must satisfy for this rule to apply. All populated matcher fields must pass.

• audience: optional string or null

Exact match against the aud claim (any element if array). When omitted, the JWT's aud must still equal Juglow's expected audience for the issuer; setting this field overrides that default.

maxLength: 1024

• claims: optional map[string] or null

Exact-match {claim: value} pairs against top-level claims. Only string-valued claims can be matched; use condition for non-string claims.

• condition: optional string or null

CEL expression over claims for logic the structural fields can't express. Must evaluate to a boolean and may reference only the claims variable; a constant-true expression (such as true) is rejected with 400.

maxLength: 4096

• subject_prefix: optional string or null

Match the verified JWT sub claim. Exact match unless the value ends with *, in which case it is a prefix match. Example: repo:my-org/my-repo:ref:refs/heads/main.

maxLength: 1024

• name: string

Admin-chosen slug identifier.

• oauth_scope: string

Space-separated OAuth scopes granted on the minted token.

• target: BetaServiceAccountTarget

Identity that tokens minted via this rule act as. Currently always a service_account target.

• type: "service_account"

• service_account_id: string

Tagged ID of the service account to mint tokens for.

• service_account_name: optional string or null

Service account's display name at read time. Ignored on writes.

• token_lifetime_seconds: number

Lifetime in seconds of access tokens minted via this rule. Minted tokens are capped at max(60, min(this value, 2 × remaining assertion validity)) seconds.

• updated_at: string

When this rule was last updated.

format: date-time

• updated_by_actor_id: string or null

Tagged ID (user_/svac_) of the actor that last updated this rule.

• workspace_id: string or null

Legacy single-workspace binding. Prefer workspace_ids and the /federation_rules/{federation_rule_id}/workspaces sub-resource for managing workspace enablement.

• workspace_ids: array of string

Tagged IDs of the workspaces this rule is enabled for. May be empty for older rules that only carry the legacy workspace_id binding. Ignored at exchange time when applies_to_all_workspaces is true (the list may still be non-empty).

#Example

curl https://haijun.my.id/v1/organizations/federation_rules/$FEDERATION_RULE_ID \
    -H 'juglow-version: 2023-06-01' \
    -H "X-Api-Key: $JUGLOW_API_KEY"

#Response (200)

{
  "id": "fdrl_01SDCCSbTxrXDpWc1phhtcfK",
  "applies_to_all_workspaces": true,
  "archived_at": "2019-12-27T18:11:19.117Z",
  "archived_by_actor_id": "archived_by_actor_id",
  "attributes": {
    "foo": "string"
  },
  "created_at": "2024-10-30T23:58:27.427722Z",
  "created_by_actor_id": "created_by_actor_id",
  "description": "description",
  "issuer_id": "issuer_id",
  "issuer_name": "issuer_name",
  "match": {
    "audience": "audience",
    "claims": {
      "foo": "string"
    },
    "condition": "condition",
    "subject_prefix": "subject_prefix"
  },
  "name": "prod-deploy-pipeline",
  "oauth_scope": "oauth_scope",
  "target": {
    "service_account_id": "svac_01SDCCSbTxrXDpWc1phhtcfK",
    "type": "service_account",
    "service_account_name": "service_account_name"
  },
  "token_lifetime_seconds": 0,
  "type": "federation_rule",
  "updated_at": "2024-10-30T23:58:27.427722Z",
  "updated_by_actor_id": "updated_by_actor_id",
  "workspace_id": "workspace_id",
  "workspace_ids": [
    "string"
  ]
}

#Update Federation Rule

POST /v1/organizations/federation_rules/{federation_rule_id}

Requires an OAuth access token with the org:admin scope, from ant auth login --scope org:admin or a workload identity federation rule; Admin API keys are not accepted. See Manage WIF with the Admin API.

Partially update a federation rule.

issuer_id is immutable. match and target are replaced as whole objects when set. Referenced service accounts and workspaces must exist in your organization; invalid references are rejected with a 400 error. Archived rules cannot be updated; this returns 400. Create a new rule instead. Rules on well-known shared issuers (GitHub Actions, GitLab, Buildkite, Terraform Cloud, Google) must constrain tenant identity via an identity-bearing claim, a tenant-pinning subject prefix (such as repo:YOUR_ORG/...), or a CEL condition referencing one of those identity claims (e.g. claims.repository_owner). On these issuers the requirement is re-checked on every update; if an existing rule's stored match does not yet constrain tenant identity, any update (even a rename or description change) must also supply a conforming match in the same request. OAuth callers may only manage rules whose oauth_scope is workspace:developer or workspace:inference; other scopes require a Console session.

#Path parameters

• federation_rule_id: string

ID of the federation rule to update.

#Headers

• "juglow-beta": optional array of JuglowBeta

Optional header to specify the beta version(s) you want to use.

• string

• "message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 45 more

• "message-batches-2024-09-24"

• "prompt-caching-2024-07-31"

• "computer-use-2024-10-22"

• "computer-use-2025-01-24"

• "pdfs-2024-09-25"

• "token-counting-2024-11-01"

• "token-efficient-tools-2025-02-19"

• "output-128k-2025-02-19"

• "files-api-2025-04-14"

• "mcp-client-2025-04-04"

• "mcp-client-2025-11-20"

• "dev-full-thinking-2025-05-14"

• "interleaved-thinking-2025-05-14"

• "code-execution-2025-05-22"

• "extended-cache-ttl-2025-04-11"

• "context-1m-2025-08-07"

• "context-management-2025-06-27"

• "model-context-window-exceeded-2025-08-26"

• "tracks-2025-10-02"

• "fast-mode-2026-02-01"

• "output-300k-2026-03-24"

• "user-profiles-2026-03-24"

• "user-profiles-2026-08-18"

• "user-profiles-2026-09-04"

• "advisor-tool-2026-03-01"

• "managed-agents-2026-04-01"

• "cache-diagnosis-2026-04-07"

• "dreaming-2026-04-21"

• "thinking-token-count-2026-05-13"

• "server-side-fallback-2026-06-01"

• "server-side-fallback-2026-07-01"

• "fallback-credit-2026-06-01"

• "fallback-credit-2026-07-01"

• "agent-memory-2026-07-22"

• "mid-conversation-tool-changes-2026-07-01"

• "compact-2026-01-12"

• "computer-use-2025-11-24"

• "mcp-tunnels-2026-06-22"

• "structured-outputs-2025-11-13"

• "task-budgets-2026-03-13"

• "thinking-display-updates-2026-08-18"

• "ce-user-management-2026-07-13"

• "mid-conversation-output-config-2026-07-01"

• "thinking-binding-controls-2026-08-01"

• "mid-conversation-system-clear-at-2026-08-21"

• "compact-2026-09-04"

• "inline-tools-2026-09-15"

• "mcp-client-2026-09-15"

#Body parameters

• applies_to_all_workspaces: optional boolean or null

When true, enables this rule for every workspace in the org (including workspaces created later). Setting false is rejected with 400 if no workspace would remain enabled; a rule with only a legacy workspace_id binding continues to mint.

• attributes: optional map[string] or null

Replaces the CEL expressions {name: expr} extracting named values from claims. Send null to clear them. Not yet supported; any non-empty value is rejected with 400.

• description: optional string or null

Replaces the description. Omit to leave unchanged; send null to clear (the field is stored as an empty string).

maxLength: 2000

• match: optional BetaFederationRuleMatch or null

Replaces the entire match object. All populated matcher fields must pass.

• audience: optional string or null

Exact match against the aud claim (any element if array). When omitted, the JWT's aud must still equal Juglow's expected audience for the issuer; setting this field overrides that default.

maxLength: 1024

• claims: optional map[string] or null

Exact-match {claim: value} pairs against top-level claims. Only string-valued claims can be matched; use condition for non-string claims.

• condition: optional string or null

CEL expression over claims for logic the structural fields can't express. Must evaluate to a boolean and may reference only the claims variable; a constant-true expression (such as true) is rejected with 400.

maxLength: 4096

• subject_prefix: optional string or null

Match the verified JWT sub claim. Exact match unless the value ends with *, in which case it is a prefix match. Example: repo:my-org/my-repo:ref:refs/heads/main.

maxLength: 1024

• name: optional string or null

Replaces the slug identifier (lowercase, digits, hyphens). Unique within the organization; a duplicate name returns 409.

minLength: 1, maxLength: 255

• oauth_scope: optional string or null

Replaces the space-separated OAuth scopes granted on minted tokens. OAuth callers may only set workspace:developer or workspace:inference; other scopes (such as org:admin) require a Console session.

minLength: 1

• target: optional BetaServiceAccountTarget or null

Replaces the entire target object. Currently always a service_account target.

• type: "service_account"

• service_account_id: string

Tagged ID of the service account to mint tokens for.

• service_account_name: optional string or null

Service account's display name at read time. Ignored on writes.

• token_lifetime_seconds: optional number or null

Replaces the lifetime in seconds for access tokens minted via this rule (60-86400). Minted tokens are capped at max(60, min(this value, 2 × remaining assertion validity)) seconds.

minimum: 60, maximum: 86400

• workspace_id: optional string or null

Replaces the existing single workspace enablement (the previous one is removed). Rejected with 400 if the rule is enabled for more than one workspace; use the /federation_rules/{federation_rule_id}/workspaces sub-resource instead.

#Returns

• BetaFederationRule object

Authorization rule binding an external OIDC identity to Juglow.

Evaluates the match conditions and mints an OAuth access token for the resolved target, scoped to a single workspace where the rule is enabled (chosen by the caller at exchange time when the rule is enabled for more than one). For rules enabled via workspace_ids or applies_to_all_workspaces, the target service account must be a member of that workspace (it is implicitly a member of the default workspace); rules carrying only the legacy workspace_id binding do not enforce this.

• type: "federation_rule"

default: federation_rule

• id: string

Tagged ID of the federation rule.

• applies_to_all_workspaces: boolean

When true, this rule is enabled for every workspace in the org (including ones created after the rule). workspace_ids is ignored at exchange time.

• archived_at: string or null

If set, this rule is archived and rejects token exchange.

format: date-time

• archived_by_actor_id: string or null

Tagged ID (user_/svac_) of the actor that archived this rule.

• attributes: map[string] or null

CEL expressions extracting named values from claims. Not yet supported; always null.

• created_at: string

When this rule was created.

format: date-time

• created_by_actor_id: string or null

Tagged ID (user_/svac_) of the actor that created this rule.

• description: string or null

Optional free-text description.

• issuer_id: string

Tagged ID of the issuer whose tokens this rule accepts.

• issuer_name: string or null

Issuer's display name at read time.

• match: BetaFederationRuleMatch

Conditions the verified JWT must satisfy for this rule to apply. All populated matcher fields must pass.

• audience: optional string or null

Exact match against the aud claim (any element if array). When omitted, the JWT's aud must still equal Juglow's expected audience for the issuer; setting this field overrides that default.

maxLength: 1024

• claims: optional map[string] or null

Exact-match {claim: value} pairs against top-level claims. Only string-valued claims can be matched; use condition for non-string claims.

• condition: optional string or null

CEL expression over claims for logic the structural fields can't express. Must evaluate to a boolean and may reference only the claims variable; a constant-true expression (such as true) is rejected with 400.

maxLength: 4096

• subject_prefix: optional string or null

Match the verified JWT sub claim. Exact match unless the value ends with *, in which case it is a prefix match. Example: repo:my-org/my-repo:ref:refs/heads/main.

maxLength: 1024

• name: string

Admin-chosen slug identifier.

• oauth_scope: string

Space-separated OAuth scopes granted on the minted token.

• target: BetaServiceAccountTarget

Identity that tokens minted via this rule act as. Currently always a service_account target.

• type: "service_account"

• service_account_id: string

Tagged ID of the service account to mint tokens for.

• service_account_name: optional string or null

Service account's display name at read time. Ignored on writes.

• token_lifetime_seconds: number

Lifetime in seconds of access tokens minted via this rule. Minted tokens are capped at max(60, min(this value, 2 × remaining assertion validity)) seconds.

• updated_at: string

When this rule was last updated.

format: date-time

• updated_by_actor_id: string or null

Tagged ID (user_/svac_) of the actor that last updated this rule.

• workspace_id: string or null

Legacy single-workspace binding. Prefer workspace_ids and the /federation_rules/{federation_rule_id}/workspaces sub-resource for managing workspace enablement.

• workspace_ids: array of string

Tagged IDs of the workspaces this rule is enabled for. May be empty for older rules that only carry the legacy workspace_id binding. Ignored at exchange time when applies_to_all_workspaces is true (the list may still be non-empty).

#Example

curl https://haijun.my.id/v1/organizations/federation_rules/$FEDERATION_RULE_ID \
    -H 'Content-Type: application/json' \
    -H 'juglow-version: 2023-06-01' \
    -H "X-Api-Key: $JUGLOW_API_KEY" \
    -d '{}'

#Response (200)

{
  "id": "fdrl_01SDCCSbTxrXDpWc1phhtcfK",
  "applies_to_all_workspaces": true,
  "archived_at": "2019-12-27T18:11:19.117Z",
  "archived_by_actor_id": "archived_by_actor_id",
  "attributes": {
    "foo": "string"
  },
  "created_at": "2024-10-30T23:58:27.427722Z",
  "created_by_actor_id": "created_by_actor_id",
  "description": "description",
  "issuer_id": "issuer_id",
  "issuer_name": "issuer_name",
  "match": {
    "audience": "audience",
    "claims": {
      "foo": "string"
    },
    "condition": "condition",
    "subject_prefix": "subject_prefix"
  },
  "name": "prod-deploy-pipeline",
  "oauth_scope": "oauth_scope",
  "target": {
    "service_account_id": "svac_01SDCCSbTxrXDpWc1phhtcfK",
    "type": "service_account",
    "service_account_name": "service_account_name"
  },
  "token_lifetime_seconds": 0,
  "type": "federation_rule",
  "updated_at": "2024-10-30T23:58:27.427722Z",
  "updated_by_actor_id": "updated_by_actor_id",
  "workspace_id": "workspace_id",
  "workspace_ids": [
    "string"
  ]
}

#Archive Federation Rule

POST /v1/organizations/federation_rules/{federation_rule_id}/archive

Requires an OAuth access token with the org:admin scope, from ant auth login --scope org:admin or a workload identity federation rule; Admin API keys are not accepted. See Manage WIF with the Admin API.

Archive a federation rule.

Token exchange through this rule stops immediately. Idempotent; re-archiving returns the rule with its original archived_at. Archiving clears the rule's workspace targeting (workspace_id and workspace_ids are emptied). Tokens already minted before archive remain valid until they expire. OAuth callers may only manage rules whose oauth_scope is workspace:developer or workspace:inference; other scopes require a Console session.

#Path parameters

• federation_rule_id: string

ID of the federation rule to archive.

#Headers

• "juglow-beta": optional array of JuglowBeta

Optional header to specify the beta version(s) you want to use.

• string

• "message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 45 more

• "message-batches-2024-09-24"

• "prompt-caching-2024-07-31"

• "computer-use-2024-10-22"

• "computer-use-2025-01-24"

• "pdfs-2024-09-25"

• "token-counting-2024-11-01"

• "token-efficient-tools-2025-02-19"

• "output-128k-2025-02-19"

• "files-api-2025-04-14"

• "mcp-client-2025-04-04"

• "mcp-client-2025-11-20"

• "dev-full-thinking-2025-05-14"

• "interleaved-thinking-2025-05-14"

• "code-execution-2025-05-22"

• "extended-cache-ttl-2025-04-11"

• "context-1m-2025-08-07"

• "context-management-2025-06-27"

• "model-context-window-exceeded-2025-08-26"

• "tracks-2025-10-02"

• "fast-mode-2026-02-01"

• "output-300k-2026-03-24"

• "user-profiles-2026-03-24"

• "user-profiles-2026-08-18"

• "user-profiles-2026-09-04"

• "advisor-tool-2026-03-01"

• "managed-agents-2026-04-01"

• "cache-diagnosis-2026-04-07"

• "dreaming-2026-04-21"

• "thinking-token-count-2026-05-13"

• "server-side-fallback-2026-06-01"

• "server-side-fallback-2026-07-01"

• "fallback-credit-2026-06-01"

• "fallback-credit-2026-07-01"

• "agent-memory-2026-07-22"

• "mid-conversation-tool-changes-2026-07-01"

• "compact-2026-01-12"

• "computer-use-2025-11-24"

• "mcp-tunnels-2026-06-22"

• "structured-outputs-2025-11-13"

• "task-budgets-2026-03-13"

• "thinking-display-updates-2026-08-18"

• "ce-user-management-2026-07-13"

• "mid-conversation-output-config-2026-07-01"

• "thinking-binding-controls-2026-08-01"

• "mid-conversation-system-clear-at-2026-08-21"

• "compact-2026-09-04"

• "inline-tools-2026-09-15"

• "mcp-client-2026-09-15"

#Returns

• BetaFederationRule object

Authorization rule binding an external OIDC identity to Juglow.

Evaluates the match conditions and mints an OAuth access token for the resolved target, scoped to a single workspace where the rule is enabled (chosen by the caller at exchange time when the rule is enabled for more than one). For rules enabled via workspace_ids or applies_to_all_workspaces, the target service account must be a member of that workspace (it is implicitly a member of the default workspace); rules carrying only the legacy workspace_id binding do not enforce this.

• type: "federation_rule"

default: federation_rule

• id: string

Tagged ID of the federation rule.

• applies_to_all_workspaces: boolean

When true, this rule is enabled for every workspace in the org (including ones created after the rule). workspace_ids is ignored at exchange time.

• archived_at: string or null

If set, this rule is archived and rejects token exchange.

format: date-time

• archived_by_actor_id: string or null

Tagged ID (user_/svac_) of the actor that archived this rule.

• attributes: map[string] or null

CEL expressions extracting named values from claims. Not yet supported; always null.

• created_at: string

When this rule was created.

format: date-time

• created_by_actor_id: string or null

Tagged ID (user_/svac_) of the actor that created this rule.

• description: string or null

Optional free-text description.

• issuer_id: string

Tagged ID of the issuer whose tokens this rule accepts.

• issuer_name: string or null

Issuer's display name at read time.

• match: BetaFederationRuleMatch

Conditions the verified JWT must satisfy for this rule to apply. All populated matcher fields must pass.

• audience: optional string or null

Exact match against the aud claim (any element if array). When omitted, the JWT's aud must still equal Juglow's expected audience for the issuer; setting this field overrides that default.

maxLength: 1024

• claims: optional map[string] or null

Exact-match {claim: value} pairs against top-level claims. Only string-valued claims can be matched; use condition for non-string claims.

• condition: optional string or null

CEL expression over claims for logic the structural fields can't express. Must evaluate to a boolean and may reference only the claims variable; a constant-true expression (such as true) is rejected with 400.

maxLength: 4096

• subject_prefix: optional string or null

Match the verified JWT sub claim. Exact match unless the value ends with *, in which case it is a prefix match. Example: repo:my-org/my-repo:ref:refs/heads/main.

maxLength: 1024

• name: string

Admin-chosen slug identifier.

• oauth_scope: string

Space-separated OAuth scopes granted on the minted token.

• target: BetaServiceAccountTarget

Identity that tokens minted via this rule act as. Currently always a service_account target.

• type: "service_account"

• service_account_id: string

Tagged ID of the service account to mint tokens for.

• service_account_name: optional string or null

Service account's display name at read time. Ignored on writes.

• token_lifetime_seconds: number

Lifetime in seconds of access tokens minted via this rule. Minted tokens are capped at max(60, min(this value, 2 × remaining assertion validity)) seconds.

• updated_at: string

When this rule was last updated.

format: date-time

• updated_by_actor_id: string or null

Tagged ID (user_/svac_) of the actor that last updated this rule.

• workspace_id: string or null

Legacy single-workspace binding. Prefer workspace_ids and the /federation_rules/{federation_rule_id}/workspaces sub-resource for managing workspace enablement.

• workspace_ids: array of string

Tagged IDs of the workspaces this rule is enabled for. May be empty for older rules that only carry the legacy workspace_id binding. Ignored at exchange time when applies_to_all_workspaces is true (the list may still be non-empty).

#Example

curl https://haijun.my.id/v1/organizations/federation_rules/$FEDERATION_RULE_ID/archive \
    -X POST \
    -H 'juglow-version: 2023-06-01' \
    -H "X-Api-Key: $JUGLOW_API_KEY"

#Response (200)

{
  "id": "fdrl_01SDCCSbTxrXDpWc1phhtcfK",
  "applies_to_all_workspaces": true,
  "archived_at": "2019-12-27T18:11:19.117Z",
  "archived_by_actor_id": "archived_by_actor_id",
  "attributes": {
    "foo": "string"
  },
  "created_at": "2024-10-30T23:58:27.427722Z",
  "created_by_actor_id": "created_by_actor_id",
  "description": "description",
  "issuer_id": "issuer_id",
  "issuer_name": "issuer_name",
  "match": {
    "audience": "audience",
    "claims": {
      "foo": "string"
    },
    "condition": "condition",
    "subject_prefix": "subject_prefix"
  },
  "name": "prod-deploy-pipeline",
  "oauth_scope": "oauth_scope",
  "target": {
    "service_account_id": "svac_01SDCCSbTxrXDpWc1phhtcfK",
    "type": "service_account",
    "service_account_name": "service_account_name"
  },
  "token_lifetime_seconds": 0,
  "type": "federation_rule",
  "updated_at": "2024-10-30T23:58:27.427722Z",
  "updated_by_actor_id": "updated_by_actor_id",
  "workspace_id": "workspace_id",
  "workspace_ids": [
    "string"
  ]
}

#Organization › Federation › Rules › Workspaces

#Add Federation Rule Workspace

POST /v1/organizations/federation_rules/{federation_rule_id}/workspaces

Requires an OAuth access token with the org:admin scope, from ant auth login --scope org:admin or a workload identity federation rule; Admin API keys are not accepted. See Manage WIF with the Admin API.

Enable a federation rule for a workspace.

Idempotent; re-enabling returns the existing enablement. The rule and workspace must both belong to your organization. Membership of the rule's target service account in this workspace is not checked at enablement: token exchange into this workspace is rejected unless the target is a member (it is implicitly a member of the default workspace). Archived rules are rejected with 400. OAuth callers may only manage rules whose oauth_scope is workspace:developer or workspace:inference; other scopes require a Console session.

#Path parameters

• federation_rule_id: string

ID of the federation rule.

#Headers

• "juglow-beta": optional array of JuglowBeta

Optional header to specify the beta version(s) you want to use.

• string

• "message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 45 more

• "message-batches-2024-09-24"

• "prompt-caching-2024-07-31"

• "computer-use-2024-10-22"

• "computer-use-2025-01-24"

• "pdfs-2024-09-25"

• "token-counting-2024-11-01"

• "token-efficient-tools-2025-02-19"

• "output-128k-2025-02-19"

• "files-api-2025-04-14"

• "mcp-client-2025-04-04"

• "mcp-client-2025-11-20"

• "dev-full-thinking-2025-05-14"

• "interleaved-thinking-2025-05-14"

• "code-execution-2025-05-22"

• "extended-cache-ttl-2025-04-11"

• "context-1m-2025-08-07"

• "context-management-2025-06-27"

• "model-context-window-exceeded-2025-08-26"

• "tracks-2025-10-02"

• "fast-mode-2026-02-01"

• "output-300k-2026-03-24"

• "user-profiles-2026-03-24"

• "user-profiles-2026-08-18"

• "user-profiles-2026-09-04"

• "advisor-tool-2026-03-01"

• "managed-agents-2026-04-01"

• "cache-diagnosis-2026-04-07"

• "dreaming-2026-04-21"

• "thinking-token-count-2026-05-13"

• "server-side-fallback-2026-06-01"

• "server-side-fallback-2026-07-01"

• "fallback-credit-2026-06-01"

• "fallback-credit-2026-07-01"

• "agent-memory-2026-07-22"

• "mid-conversation-tool-changes-2026-07-01"

• "compact-2026-01-12"

• "computer-use-2025-11-24"

• "mcp-tunnels-2026-06-22"

• "structured-outputs-2025-11-13"

• "task-budgets-2026-03-13"

• "thinking-display-updates-2026-08-18"

• "ce-user-management-2026-07-13"

• "mid-conversation-output-config-2026-07-01"

• "thinking-binding-controls-2026-08-01"

• "mid-conversation-system-clear-at-2026-08-21"

• "compact-2026-09-04"

• "inline-tools-2026-09-15"

• "mcp-client-2026-09-15"

#Body parameters

• workspace_id: string

Tagged ID of the workspace to enable this rule for.

#Returns

• BetaFederationRuleWorkspace object

• type: "federation_rule_workspace"

default: federation_rule_workspace

• created_at: string

When this workspace was enabled for the rule.

format: date-time

• created_by_actor_id: string or null

Tagged ID (user_... or svac_...) of the actor that enabled this workspace for the rule, if known.

• federation_rule_id: string

Tagged ID of the federation rule.

• workspace_id: string

Tagged ID of the workspace this rule is enabled for.

• workspace_name: string or null

Workspace display name. Populated when listing; null in the enable response.

#Example

curl https://haijun.my.id/v1/organizations/federation_rules/$FEDERATION_RULE_ID/workspaces \
    -H 'Content-Type: application/json' \
    -H 'juglow-version: 2023-06-01' \
    -H "X-Api-Key: $JUGLOW_API_KEY" \
    -d '{
          "workspace_id": "workspace_id"
        }'

#Response (200)

{
  "created_at": "2024-10-30T23:58:27.427722Z",
  "created_by_actor_id": "created_by_actor_id",
  "federation_rule_id": "federation_rule_id",
  "type": "federation_rule_workspace",
  "workspace_id": "workspace_id",
  "workspace_name": "workspace_name"
}

#List Federation Rule Workspaces

GET /v1/organizations/federation_rules/{federation_rule_id}/workspaces

Requires an OAuth access token with the org:admin scope, from ant auth login --scope org:admin or a workload identity federation rule; Admin API keys are not accepted. See Manage WIF with the Admin API.

List workspaces where this federation rule is enabled.

Returns all workspace enablements in a single response; the limit and page parameters are accepted but have no effect, and next_page is always null. Returns explicit per-workspace enablements only; for rules with applies_to_all_workspaces or a legacy single workspace_id, check those fields on the rule itself.

#Path parameters

• federation_rule_id: string

ID of the federation rule.

#Query parameters

• limit: optional number

Number of results per page.

default: 20, minimum: 1, maximum: 100

• page: optional string

Opaque cursor from a previous response's next_page.

#Headers

• "juglow-beta": optional array of JuglowBeta

Optional header to specify the beta version(s) you want to use.

• string

• "message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 45 more

• "message-batches-2024-09-24"

• "prompt-caching-2024-07-31"

• "computer-use-2024-10-22"

• "computer-use-2025-01-24"

• "pdfs-2024-09-25"

• "token-counting-2024-11-01"

• "token-efficient-tools-2025-02-19"

• "output-128k-2025-02-19"

• "files-api-2025-04-14"

• "mcp-client-2025-04-04"

• "mcp-client-2025-11-20"

• "dev-full-thinking-2025-05-14"

• "interleaved-thinking-2025-05-14"

• "code-execution-2025-05-22"

• "extended-cache-ttl-2025-04-11"

• "context-1m-2025-08-07"

• "context-management-2025-06-27"

• "model-context-window-exceeded-2025-08-26"

• "tracks-2025-10-02"

• "fast-mode-2026-02-01"

• "output-300k-2026-03-24"

• "user-profiles-2026-03-24"

• "user-profiles-2026-08-18"

• "user-profiles-2026-09-04"

• "advisor-tool-2026-03-01"

• "managed-agents-2026-04-01"

• "cache-diagnosis-2026-04-07"

• "dreaming-2026-04-21"

• "thinking-token-count-2026-05-13"

• "server-side-fallback-2026-06-01"

• "server-side-fallback-2026-07-01"

• "fallback-credit-2026-06-01"

• "fallback-credit-2026-07-01"

• "agent-memory-2026-07-22"

• "mid-conversation-tool-changes-2026-07-01"

• "compact-2026-01-12"

• "computer-use-2025-11-24"

• "mcp-tunnels-2026-06-22"

• "structured-outputs-2025-11-13"

• "task-budgets-2026-03-13"

• "thinking-display-updates-2026-08-18"

• "ce-user-management-2026-07-13"

• "mid-conversation-output-config-2026-07-01"

• "thinking-binding-controls-2026-08-01"

• "mid-conversation-system-clear-at-2026-08-21"

• "compact-2026-09-04"

• "inline-tools-2026-09-15"

• "mcp-client-2026-09-15"

#Returns

• data: array of BetaFederationRuleWorkspace

• type: "federation_rule_workspace"

default: federation_rule_workspace

• created_at: string

When this workspace was enabled for the rule.

format: date-time

• created_by_actor_id: string or null

Tagged ID (user_... or svac_...) of the actor that enabled this workspace for the rule, if known.

• federation_rule_id: string

Tagged ID of the federation rule.

• workspace_id: string

Tagged ID of the workspace this rule is enabled for.

• workspace_name: string or null

Workspace display name. Populated when listing; null in the enable response.

• next_page: string or null

Opaque cursor for the next page; null when there are no more results.

#Example

curl https://haijun.my.id/v1/organizations/federation_rules/$FEDERATION_RULE_ID/workspaces \
    -H 'juglow-version: 2023-06-01' \
    -H "X-Api-Key: $JUGLOW_API_KEY"

#Response (200)

{
  "data": [
    {
      "created_at": "2024-10-30T23:58:27.427722Z",
      "created_by_actor_id": "created_by_actor_id",
      "federation_rule_id": "federation_rule_id",
      "type": "federation_rule_workspace",
      "workspace_id": "workspace_id",
      "workspace_name": "workspace_name"
    }
  ],
  "next_page": "next_page"
}

#Remove Federation Rule Workspace

DELETE /v1/organizations/federation_rules/{federation_rule_id}/workspaces/{workspace_id}

Requires an OAuth access token with the org:admin scope, from ant auth login --scope org:admin or a workload identity federation rule; Admin API keys are not accepted. See Manage WIF with the Admin API.

Disable a federation rule for a workspace.

Idempotent; succeeds even if the enablement was already removed. OAuth callers may only manage rules whose oauth_scope is workspace:developer or workspace:inference; other scopes require a Console session.

#Path parameters

• federation_rule_id: string

ID of the federation rule.

• workspace_id: string

ID of the workspace to disable for.

#Headers

• "juglow-beta": optional array of JuglowBeta

Optional header to specify the beta version(s) you want to use.

• string

• "message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 45 more

• "message-batches-2024-09-24"

• "prompt-caching-2024-07-31"

• "computer-use-2024-10-22"

• "computer-use-2025-01-24"

• "pdfs-2024-09-25"

• "token-counting-2024-11-01"

• "token-efficient-tools-2025-02-19"

• "output-128k-2025-02-19"

• "files-api-2025-04-14"

• "mcp-client-2025-04-04"

• "mcp-client-2025-11-20"

• "dev-full-thinking-2025-05-14"

• "interleaved-thinking-2025-05-14"

• "code-execution-2025-05-22"

• "extended-cache-ttl-2025-04-11"

• "context-1m-2025-08-07"

• "context-management-2025-06-27"

• "model-context-window-exceeded-2025-08-26"

• "tracks-2025-10-02"

• "fast-mode-2026-02-01"

• "output-300k-2026-03-24"

• "user-profiles-2026-03-24"

• "user-profiles-2026-08-18"

• "user-profiles-2026-09-04"

• "advisor-tool-2026-03-01"

• "managed-agents-2026-04-01"

• "cache-diagnosis-2026-04-07"

• "dreaming-2026-04-21"

• "thinking-token-count-2026-05-13"

• "server-side-fallback-2026-06-01"

• "server-side-fallback-2026-07-01"

• "fallback-credit-2026-06-01"

• "fallback-credit-2026-07-01"

• "agent-memory-2026-07-22"

• "mid-conversation-tool-changes-2026-07-01"

• "compact-2026-01-12"

• "computer-use-2025-11-24"

• "mcp-tunnels-2026-06-22"

• "structured-outputs-2025-11-13"

• "task-budgets-2026-03-13"

• "thinking-display-updates-2026-08-18"

• "ce-user-management-2026-07-13"

• "mid-conversation-output-config-2026-07-01"

• "thinking-binding-controls-2026-08-01"

• "mid-conversation-system-clear-at-2026-08-21"

• "compact-2026-09-04"

• "inline-tools-2026-09-15"

• "mcp-client-2026-09-15"

#Returns

• type: "federation_rule_workspace_deleted"

default: federation_rule_workspace_deleted

• federation_rule_id: string

Tagged ID of the federation rule.

• workspace_id: string

Tagged ID of the workspace named in the delete request. Removal is idempotent.

#Example

curl https://haijun.my.id/v1/organizations/federation_rules/$FEDERATION_RULE_ID/workspaces/$WORKSPACE_ID \
    -X DELETE \
    -H 'juglow-version: 2023-06-01' \
    -H "X-Api-Key: $JUGLOW_API_KEY"

#Response (200)

{
  "federation_rule_id": "federation_rule_id",
  "type": "federation_rule_workspace_deleted",
  "workspace_id": "workspace_id"
}

#Organization › Invites

#Create Invite

POST /v1/organizations/invites

Invite a user to join the organization by email.

On plans that draw members from a finite pool of purchased seats, the invite automatically consumes a seat from the lowest tier with availability; there is no seat-tier parameter. When no seat is free the request fails with a 400 error rather than purchasing a seat.

#Body parameters

• email: string

Email of the User.

format: email

• role: "billing" or "haijun_code_user" or "developer" or 2 more

Role for the invited User.

The accepted values depend on the organization type. Console and API organizations accept user, developer, billing, and haijun_code_user; admin cannot be assigned through the API. Haijun Enterprise organizations accept user and managed.

• "billing"

• "haijun_code_user"

• "developer"

• "managed"

• "user"

• rbac_group_ids: optional array of string

RBAC group IDs to assign to the User when the Invite is accepted. A non-empty array is accepted only for a Haijun Enterprise organization with RBAC groups, and requires the key to carry the write:rbac_groups scope.

maxItems: 100

#Returns

• BetaOrganizationInvite object

• type: "invite"

Object type.

For Invites, this is always "invite".

default: invite

• id: string

ID of the Invite.

• accepted_at: string or null

RFC 3339 datetime string indicating when the Invite was accepted, or null.

format: date-time

• email: string

Email of the User being invited.

• expires_at: string

RFC 3339 datetime string indicating when the Invite expires.

format: date-time

• invited_at: string

RFC 3339 datetime string indicating when the Invite was created.

format: date-time

• rbac_group_ids: array of string

RBAC group IDs recorded on the Invite (Haijun Enterprise organizations), to be assigned to the User when the Invite is accepted. [] when none.

• role: BetaOrganizationRole

Organization role of the User.

• "admin"

• "billing"

• "haijun_code_user"

• "developer"

• "managed"

• "membership_admin"

• "owner"

• "primary_owner"

• "user"

• status: "accepted" or "deleted" or "expired" or "pending"

Status of the Invite.

• "accepted"

• "deleted"

• "expired"

• "pending"

#Example

curl https://haijun.my.id/v1/organizations/invites \
    -H 'Content-Type: application/json' \
    -H 'juglow-version: 2023-06-01' \
    -H "X-Api-Key: $JUGLOW_API_KEY" \
    -d '{
          "email": "user@emaildomain.com",
          "role": "user"
        }'

#Response (200)

{
  "id": "invite_015gWxCN9Hfg2QhZwTK7Mdeu",
  "accepted_at": "2019-12-27T18:11:19.117Z",
  "email": "user@emaildomain.com",
  "expires_at": "2024-11-20T23:58:27.427722Z",
  "invited_at": "2024-10-30T23:58:27.427722Z",
  "rbac_group_ids": [
    "string"
  ],
  "role": "admin",
  "status": "pending",
  "type": "invite"
}

#List Invites

GET /v1/organizations/invites

List the organization's invites.

#Query parameters

• after_id: optional string

ID of the object to use as a cursor for pagination. When provided, returns the page of results immediately after this object.

• before_id: optional string

ID of the object to use as a cursor for pagination. When provided, returns the page of results immediately before this object.

• email: optional string

Filter by the email address the Invite was sent to. Matches the same way as the Users list's email filter (normalized, case-insensitive).

format: email

• limit: optional number

Number of items to return per page.

Defaults to 20. Ranges from 1 to 1000.

default: 20, minimum: 1, maximum: 1000

• roles: optional array of string

Filter to items whose role equals one of the supplied values. Repeatable; values are OR'ed together.

Accepted values depend on the organization type: Console and API organizations accept user, developer, billing, admin, and haijun_code_user; Haijun Enterprise organizations accept user, owner, primary_owner, membership_admin, and managed.

• statuses: optional array of "accepted" or "expired" or "pending"

Filter by Invite status. Repeatable; values are OR'ed together. Omit to return pending, accepted, and expired Invites alike.

• "accepted"

• "expired"

• "pending"

#Returns

• data: array of BetaOrganizationInvite

• type: "invite"

Object type.

For Invites, this is always "invite".

default: invite

• id: string

ID of the Invite.

• accepted_at: string or null

RFC 3339 datetime string indicating when the Invite was accepted, or null.

format: date-time

• email: string

Email of the User being invited.

• expires_at: string

RFC 3339 datetime string indicating when the Invite expires.

format: date-time

• invited_at: string

RFC 3339 datetime string indicating when the Invite was created.

format: date-time

• rbac_group_ids: array of string

RBAC group IDs recorded on the Invite (Haijun Enterprise organizations), to be assigned to the User when the Invite is accepted. [] when none.

• role: BetaOrganizationRole

Organization role of the User.

• "admin"

• "billing"

• "haijun_code_user"

• "developer"

• "managed"

• "membership_admin"

• "owner"

• "primary_owner"

• "user"

• status: "accepted" or "deleted" or "expired" or "pending"

Status of the Invite.

• "accepted"

• "deleted"

• "expired"

• "pending"

• first_id: string or null

First ID in the data list. Can be used as the before_id for the previous page.

• has_more: boolean

Indicates if there are more results in the requested page direction.

• last_id: string or null

Last ID in the data list. Can be used as the after_id for the next page.

#Example

curl https://haijun.my.id/v1/organizations/invites \
    -H 'juglow-version: 2023-06-01' \
    -H "X-Api-Key: $JUGLOW_API_KEY"

#Response (200)

{
  "data": [
    {
      "id": "invite_015gWxCN9Hfg2QhZwTK7Mdeu",
      "accepted_at": "2019-12-27T18:11:19.117Z",
      "email": "user@emaildomain.com",
      "expires_at": "2024-11-20T23:58:27.427722Z",
      "invited_at": "2024-10-30T23:58:27.427722Z",
      "rbac_group_ids": [
        "string"
      ],
      "role": "admin",
      "status": "pending",
      "type": "invite"
    }
  ],
  "first_id": "first_id",
  "has_more": true,
  "last_id": "last_id"
}

#Get Invite

GET /v1/organizations/invites/{invite_id}

Retrieve an invite by ID.

#Path parameters

• invite_id: string

ID of the Invite.

#Returns

• BetaOrganizationInvite object

• type: "invite"

Object type.

For Invites, this is always "invite".

default: invite

• id: string

ID of the Invite.

• accepted_at: string or null

RFC 3339 datetime string indicating when the Invite was accepted, or null.

format: date-time

• email: string

Email of the User being invited.

• expires_at: string

RFC 3339 datetime string indicating when the Invite expires.

format: date-time

• invited_at: string

RFC 3339 datetime string indicating when the Invite was created.

format: date-time

• rbac_group_ids: array of string

RBAC group IDs recorded on the Invite (Haijun Enterprise organizations), to be assigned to the User when the Invite is accepted. [] when none.

• role: BetaOrganizationRole

Organization role of the User.

• "admin"

• "billing"

• "haijun_code_user"

• "developer"

• "managed"

• "membership_admin"

• "owner"

• "primary_owner"

• "user"

• status: "accepted" or "deleted" or "expired" or "pending"

Status of the Invite.

• "accepted"

• "deleted"

• "expired"

• "pending"

#Example

curl https://haijun.my.id/v1/organizations/invites/$INVITE_ID \
    -H 'juglow-version: 2023-06-01' \
    -H "X-Api-Key: $JUGLOW_API_KEY"

#Response (200)

{
  "id": "invite_015gWxCN9Hfg2QhZwTK7Mdeu",
  "accepted_at": "2019-12-27T18:11:19.117Z",
  "email": "user@emaildomain.com",
  "expires_at": "2024-11-20T23:58:27.427722Z",
  "invited_at": "2024-10-30T23:58:27.427722Z",
  "rbac_group_ids": [
    "string"
  ],
  "role": "admin",
  "status": "pending",
  "type": "invite"
}

#Delete Invite

DELETE /v1/organizations/invites/{invite_id}

Delete a pending invite.

#Path parameters

• invite_id: string

ID of the Invite.

#Returns

• type: "invite_deleted"

Deleted object type.

For Invites, this is always "invite_deleted".

default: invite_deleted

• id: string

ID of the Invite.

#Example

curl https://haijun.my.id/v1/organizations/invites/$INVITE_ID \
    -X DELETE \
    -H 'juglow-version: 2023-06-01' \
    -H "X-Api-Key: $JUGLOW_API_KEY"

#Response (200)

{
  "id": "invite_015gWxCN9Hfg2QhZwTK7Mdeu",
  "type": "invite_deleted"
}

#Organization › Service Accounts

#Create Service Account

POST /v1/organizations/service_accounts

Requires an OAuth access token with the org:admin scope, from ant auth login --scope org:admin or a workload identity federation rule; Admin API keys are not accepted. See Manage WIF with the Admin API.

Create a service account.

A service account is a named workload identity that federation rules target. organization_role is developer (default) or admin; a rule may only be created or retargeted to grant org:admin scope when the target's organization_role is admin. Creating an admin-role service account requires an interactive credential (a user OAuth token or a Console session) — a workload may only create developer-role service accounts.

#Headers

• "juglow-beta": optional array of JuglowBeta

Optional header to specify the beta version(s) you want to use.

• string

• "message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 45 more

• "message-batches-2024-09-24"

• "prompt-caching-2024-07-31"

• "computer-use-2024-10-22"

• "computer-use-2025-01-24"

• "pdfs-2024-09-25"

• "token-counting-2024-11-01"

• "token-efficient-tools-2025-02-19"

• "output-128k-2025-02-19"

• "files-api-2025-04-14"

• "mcp-client-2025-04-04"

• "mcp-client-2025-11-20"

• "dev-full-thinking-2025-05-14"

• "interleaved-thinking-2025-05-14"

• "code-execution-2025-05-22"

• "extended-cache-ttl-2025-04-11"

• "context-1m-2025-08-07"

• "context-management-2025-06-27"

• "model-context-window-exceeded-2025-08-26"

• "tracks-2025-10-02"

• "fast-mode-2026-02-01"

• "output-300k-2026-03-24"

• "user-profiles-2026-03-24"

• "user-profiles-2026-08-18"

• "user-profiles-2026-09-04"

• "advisor-tool-2026-03-01"

• "managed-agents-2026-04-01"

• "cache-diagnosis-2026-04-07"

• "dreaming-2026-04-21"

• "thinking-token-count-2026-05-13"

• "server-side-fallback-2026-06-01"

• "server-side-fallback-2026-07-01"

• "fallback-credit-2026-06-01"

• "fallback-credit-2026-07-01"

• "agent-memory-2026-07-22"

• "mid-conversation-tool-changes-2026-07-01"

• "compact-2026-01-12"

• "computer-use-2025-11-24"

• "mcp-tunnels-2026-06-22"

• "structured-outputs-2025-11-13"

• "task-budgets-2026-03-13"

• "thinking-display-updates-2026-08-18"

• "ce-user-management-2026-07-13"

• "mid-conversation-output-config-2026-07-01"

• "thinking-binding-controls-2026-08-01"

• "mid-conversation-system-clear-at-2026-08-21"

• "compact-2026-09-04"

• "inline-tools-2026-09-15"

• "mcp-client-2026-09-15"

#Body parameters

• name: string

Slug identifier (lowercase, digits, hyphens). Unique within the organization; a duplicate name returns 409.

minLength: 1, maxLength: 255

• description: optional string or null

Optional free-text description.

maxLength: 2000

• organization_role: optional "admin" or "developer"

Org-level role. Defaults to developer.

• "admin"

• "developer"

#Returns

• BetaServiceAccount object

Named non-human identity within the caller's organization.

A service account is a pure identity: name + org. Authorization lives on whatever references it (federation rules).

• type: "service_account"

default: service_account

• id: string

Tagged ID of the service account.

• archived_at: string or null

If set, this service account is archived.

format: date-time

• archived_by_actor_id: string or null

Tagged ID (user_/svac_) of the actor that archived this service account.

• created_at: string

When this service account was created.

format: date-time

• created_by_actor_id: string or null

Tagged ID (user_/svac_) of the actor that created this service account.

• description: string or null

Optional free-text description.

• name: string

Admin-chosen slug identifier.

• organization_role: "admin" or "developer"

Org-level role. A federation rule may only be created or retargeted to grant org:admin scope when this is admin. A rule granting org:admin whose target is later demoted to developer is rejected at token exchange. Rules granting org:admin are managed in the Console.

• "admin"

• "developer"

• updated_at: string

When this service account was last updated.

format: date-time

• updated_by_actor_id: string or null

Tagged ID (user_/svac_) of the actor that last updated this service account.

#Example

curl https://haijun.my.id/v1/organizations/service_accounts \
    -H 'Content-Type: application/json' \
    -H 'juglow-version: 2023-06-01' \
    -H "X-Api-Key: $JUGLOW_API_KEY" \
    -d '{
          "name": "ci-deploy-bot"
        }'

#Response (200)

{
  "id": "svac_01SDCCSbTxrXDpWc1phhtcfK",
  "archived_at": "2019-12-27T18:11:19.117Z",
  "archived_by_actor_id": "archived_by_actor_id",
  "created_at": "2024-10-30T23:58:27.427722Z",
  "created_by_actor_id": "created_by_actor_id",
  "description": "description",
  "name": "ci-deploy-bot",
  "organization_role": "admin",
  "type": "service_account",
  "updated_at": "2024-10-30T23:58:27.427722Z",
  "updated_by_actor_id": "updated_by_actor_id"
}

#List Service Accounts

GET /v1/organizations/service_accounts

Requires an OAuth access token with the org:admin scope, from ant auth login --scope org:admin or a workload identity federation rule; Admin API keys are not accepted. See Manage WIF with the Admin API.

List service accounts in the caller's organization.

Results are ordered by creation time, newest first. Use limit and the next_page cursor to paginate; set include_archived=true to include archived service accounts.

#Query parameters

• include_archived: optional boolean

Include archived resources. Defaults to false.

default: false

• limit: optional number

Number of results per page.

default: 20, minimum: 1, maximum: 100

• page: optional string

Opaque cursor from a previous response's next_page.

#Headers

• "juglow-beta": optional array of JuglowBeta

Optional header to specify the beta version(s) you want to use.

• string

• "message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 45 more

• "message-batches-2024-09-24"

• "prompt-caching-2024-07-31"

• "computer-use-2024-10-22"

• "computer-use-2025-01-24"

• "pdfs-2024-09-25"

• "token-counting-2024-11-01"

• "token-efficient-tools-2025-02-19"

• "output-128k-2025-02-19"

• "files-api-2025-04-14"

• "mcp-client-2025-04-04"

• "mcp-client-2025-11-20"

• "dev-full-thinking-2025-05-14"

• "interleaved-thinking-2025-05-14"

• "code-execution-2025-05-22"

• "extended-cache-ttl-2025-04-11"

• "context-1m-2025-08-07"

• "context-management-2025-06-27"

• "model-context-window-exceeded-2025-08-26"

• "tracks-2025-10-02"

• "fast-mode-2026-02-01"

• "output-300k-2026-03-24"

• "user-profiles-2026-03-24"

• "user-profiles-2026-08-18"

• "user-profiles-2026-09-04"

• "advisor-tool-2026-03-01"

• "managed-agents-2026-04-01"

• "cache-diagnosis-2026-04-07"

• "dreaming-2026-04-21"

• "thinking-token-count-2026-05-13"

• "server-side-fallback-2026-06-01"

• "server-side-fallback-2026-07-01"

• "fallback-credit-2026-06-01"

• "fallback-credit-2026-07-01"

• "agent-memory-2026-07-22"

• "mid-conversation-tool-changes-2026-07-01"

• "compact-2026-01-12"

• "computer-use-2025-11-24"

• "mcp-tunnels-2026-06-22"

• "structured-outputs-2025-11-13"

• "task-budgets-2026-03-13"

• "thinking-display-updates-2026-08-18"

• "ce-user-management-2026-07-13"

• "mid-conversation-output-config-2026-07-01"

• "thinking-binding-controls-2026-08-01"

• "mid-conversation-system-clear-at-2026-08-21"

• "compact-2026-09-04"

• "inline-tools-2026-09-15"

• "mcp-client-2026-09-15"

#Returns

• data: array of BetaServiceAccount

• type: "service_account"

default: service_account

• id: string

Tagged ID of the service account.

• archived_at: string or null

If set, this service account is archived.

format: date-time

• archived_by_actor_id: string or null

Tagged ID (user_/svac_) of the actor that archived this service account.

• created_at: string

When this service account was created.

format: date-time

• created_by_actor_id: string or null

Tagged ID (user_/svac_) of the actor that created this service account.

• description: string or null

Optional free-text description.

• name: string

Admin-chosen slug identifier.

• organization_role: "admin" or "developer"

Org-level role. A federation rule may only be created or retargeted to grant org:admin scope when this is admin. A rule granting org:admin whose target is later demoted to developer is rejected at token exchange. Rules granting org:admin are managed in the Console.

• "admin"

• "developer"

• updated_at: string

When this service account was last updated.

format: date-time

• updated_by_actor_id: string or null

Tagged ID (user_/svac_) of the actor that last updated this service account.

• next_page: string or null

Opaque cursor for the next page, or null if no more results.

#Example

curl https://haijun.my.id/v1/organizations/service_accounts \
    -H 'juglow-version: 2023-06-01' \
    -H "X-Api-Key: $JUGLOW_API_KEY"

#Response (200)

{
  "data": [
    {
      "id": "svac_01SDCCSbTxrXDpWc1phhtcfK",
      "archived_at": "2019-12-27T18:11:19.117Z",
      "archived_by_actor_id": "archived_by_actor_id",
      "created_at": "2024-10-30T23:58:27.427722Z",
      "created_by_actor_id": "created_by_actor_id",
      "description": "description",
      "name": "ci-deploy-bot",
      "organization_role": "admin",
      "type": "service_account",
      "updated_at": "2024-10-30T23:58:27.427722Z",
      "updated_by_actor_id": "updated_by_actor_id"
    }
  ],
  "next_page": "next_page"
}

#Get Service Account

GET /v1/organizations/service_accounts/{service_account_id}

Requires an OAuth access token with the org:admin scope, from ant auth login --scope org:admin or a workload identity federation rule; Admin API keys are not accepted. See Manage WIF with the Admin API.

Retrieve a service account by its ID (svac_...).

#Path parameters

• service_account_id: string

ID of the service account.

#Headers

• "juglow-beta": optional array of JuglowBeta

Optional header to specify the beta version(s) you want to use.

• string

• "message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 45 more

• "message-batches-2024-09-24"

• "prompt-caching-2024-07-31"

• "computer-use-2024-10-22"

• "computer-use-2025-01-24"

• "pdfs-2024-09-25"

• "token-counting-2024-11-01"

• "token-efficient-tools-2025-02-19"

• "output-128k-2025-02-19"

• "files-api-2025-04-14"

• "mcp-client-2025-04-04"

• "mcp-client-2025-11-20"

• "dev-full-thinking-2025-05-14"

• "interleaved-thinking-2025-05-14"

• "code-execution-2025-05-22"

• "extended-cache-ttl-2025-04-11"

• "context-1m-2025-08-07"

• "context-management-2025-06-27"

• "model-context-window-exceeded-2025-08-26"

• "tracks-2025-10-02"

• "fast-mode-2026-02-01"

• "output-300k-2026-03-24"

• "user-profiles-2026-03-24"

• "user-profiles-2026-08-18"

• "user-profiles-2026-09-04"

• "advisor-tool-2026-03-01"

• "managed-agents-2026-04-01"

• "cache-diagnosis-2026-04-07"

• "dreaming-2026-04-21"

• "thinking-token-count-2026-05-13"

• "server-side-fallback-2026-06-01"

• "server-side-fallback-2026-07-01"

• "fallback-credit-2026-06-01"

• "fallback-credit-2026-07-01"

• "agent-memory-2026-07-22"

• "mid-conversation-tool-changes-2026-07-01"

• "compact-2026-01-12"

• "computer-use-2025-11-24"

• "mcp-tunnels-2026-06-22"

• "structured-outputs-2025-11-13"

• "task-budgets-2026-03-13"

• "thinking-display-updates-2026-08-18"

• "ce-user-management-2026-07-13"

• "mid-conversation-output-config-2026-07-01"

• "thinking-binding-controls-2026-08-01"

• "mid-conversation-system-clear-at-2026-08-21"

• "compact-2026-09-04"

• "inline-tools-2026-09-15"

• "mcp-client-2026-09-15"

#Returns

• BetaServiceAccount object

Named non-human identity within the caller's organization.

A service account is a pure identity: name + org. Authorization lives on whatever references it (federation rules).

• type: "service_account"

default: service_account

• id: string

Tagged ID of the service account.

• archived_at: string or null

If set, this service account is archived.

format: date-time

• archived_by_actor_id: string or null

Tagged ID (user_/svac_) of the actor that archived this service account.

• created_at: string

When this service account was created.

format: date-time

• created_by_actor_id: string or null

Tagged ID (user_/svac_) of the actor that created this service account.

• description: string or null

Optional free-text description.

• name: string

Admin-chosen slug identifier.

• organization_role: "admin" or "developer"

Org-level role. A federation rule may only be created or retargeted to grant org:admin scope when this is admin. A rule granting org:admin whose target is later demoted to developer is rejected at token exchange. Rules granting org:admin are managed in the Console.

• "admin"

• "developer"

• updated_at: string

When this service account was last updated.

format: date-time

• updated_by_actor_id: string or null

Tagged ID (user_/svac_) of the actor that last updated this service account.

#Example

curl https://haijun.my.id/v1/organizations/service_accounts/$SERVICE_ACCOUNT_ID \
    -H 'juglow-version: 2023-06-01' \
    -H "X-Api-Key: $JUGLOW_API_KEY"

#Response (200)

{
  "id": "svac_01SDCCSbTxrXDpWc1phhtcfK",
  "archived_at": "2019-12-27T18:11:19.117Z",
  "archived_by_actor_id": "archived_by_actor_id",
  "created_at": "2024-10-30T23:58:27.427722Z",
  "created_by_actor_id": "created_by_actor_id",
  "description": "description",
  "name": "ci-deploy-bot",
  "organization_role": "admin",
  "type": "service_account",
  "updated_at": "2024-10-30T23:58:27.427722Z",
  "updated_by_actor_id": "updated_by_actor_id"
}

#Update Service Account

POST /v1/organizations/service_accounts/{service_account_id}

Requires an OAuth access token with the org:admin scope, from ant auth login --scope org:admin or a workload identity federation rule; Admin API keys are not accepted. See Manage WIF with the Admin API.

Update a service account.

Only description and organization_role are mutable; name cannot be changed. Archived service accounts cannot be updated; this returns 400. Setting organization_role to admin (even when unchanged) requires an interactive credential (a user OAuth token or a Console session).

#Path parameters

• service_account_id: string

ID of the service account to update.

#Headers

• "juglow-beta": optional array of JuglowBeta

Optional header to specify the beta version(s) you want to use.

• string

• "message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 45 more

• "message-batches-2024-09-24"

• "prompt-caching-2024-07-31"

• "computer-use-2024-10-22"

• "computer-use-2025-01-24"

• "pdfs-2024-09-25"

• "token-counting-2024-11-01"

• "token-efficient-tools-2025-02-19"

• "output-128k-2025-02-19"

• "files-api-2025-04-14"

• "mcp-client-2025-04-04"

• "mcp-client-2025-11-20"

• "dev-full-thinking-2025-05-14"

• "interleaved-thinking-2025-05-14"

• "code-execution-2025-05-22"

• "extended-cache-ttl-2025-04-11"

• "context-1m-2025-08-07"

• "context-management-2025-06-27"

• "model-context-window-exceeded-2025-08-26"

• "tracks-2025-10-02"

• "fast-mode-2026-02-01"

• "output-300k-2026-03-24"

• "user-profiles-2026-03-24"

• "user-profiles-2026-08-18"

• "user-profiles-2026-09-04"

• "advisor-tool-2026-03-01"

• "managed-agents-2026-04-01"

• "cache-diagnosis-2026-04-07"

• "dreaming-2026-04-21"

• "thinking-token-count-2026-05-13"

• "server-side-fallback-2026-06-01"

• "server-side-fallback-2026-07-01"

• "fallback-credit-2026-06-01"

• "fallback-credit-2026-07-01"

• "agent-memory-2026-07-22"

• "mid-conversation-tool-changes-2026-07-01"

• "compact-2026-01-12"

• "computer-use-2025-11-24"

• "mcp-tunnels-2026-06-22"

• "structured-outputs-2025-11-13"

• "task-budgets-2026-03-13"

• "thinking-display-updates-2026-08-18"

• "ce-user-management-2026-07-13"

• "mid-conversation-output-config-2026-07-01"

• "thinking-binding-controls-2026-08-01"

• "mid-conversation-system-clear-at-2026-08-21"

• "compact-2026-09-04"

• "inline-tools-2026-09-15"

• "mcp-client-2026-09-15"

#Body parameters

• description: optional string or null

Replaces the description. Omit to leave unchanged; send null to clear (the field is stored as an empty string).

maxLength: 2000

• organization_role: optional "admin" or "developer" or null

Replaces the org-level role. Omit or send null to leave unchanged.

• "admin"

• "developer"

#Returns

• BetaServiceAccount object

Named non-human identity within the caller's organization.

A service account is a pure identity: name + org. Authorization lives on whatever references it (federation rules).

• type: "service_account"

default: service_account

• id: string

Tagged ID of the service account.

• archived_at: string or null

If set, this service account is archived.

format: date-time

• archived_by_actor_id: string or null

Tagged ID (user_/svac_) of the actor that archived this service account.

• created_at: string

When this service account was created.

format: date-time

• created_by_actor_id: string or null

Tagged ID (user_/svac_) of the actor that created this service account.

• description: string or null

Optional free-text description.

• name: string

Admin-chosen slug identifier.

• organization_role: "admin" or "developer"

Org-level role. A federation rule may only be created or retargeted to grant org:admin scope when this is admin. A rule granting org:admin whose target is later demoted to developer is rejected at token exchange. Rules granting org:admin are managed in the Console.

• "admin"

• "developer"

• updated_at: string

When this service account was last updated.

format: date-time

• updated_by_actor_id: string or null

Tagged ID (user_/svac_) of the actor that last updated this service account.

#Example

curl https://haijun.my.id/v1/organizations/service_accounts/$SERVICE_ACCOUNT_ID \
    -H 'Content-Type: application/json' \
    -H 'juglow-version: 2023-06-01' \
    -H "X-Api-Key: $JUGLOW_API_KEY" \
    -d '{}'

#Response (200)

{
  "id": "svac_01SDCCSbTxrXDpWc1phhtcfK",
  "archived_at": "2019-12-27T18:11:19.117Z",
  "archived_by_actor_id": "archived_by_actor_id",
  "created_at": "2024-10-30T23:58:27.427722Z",
  "created_by_actor_id": "created_by_actor_id",
  "description": "description",
  "name": "ci-deploy-bot",
  "organization_role": "admin",
  "type": "service_account",
  "updated_at": "2024-10-30T23:58:27.427722Z",
  "updated_by_actor_id": "updated_by_actor_id"
}

#Archive Service Account

POST /v1/organizations/service_accounts/{service_account_id}/archive

Requires an OAuth access token with the org:admin scope, from ant auth login --scope org:admin or a workload identity federation rule; Admin API keys are not accepted. See Manage WIF with the Admin API.

Archive a service account.

Idempotent; re-archiving returns the service account with its original archived_at. Rejected with 400 if any live (non-archived) federation rule still targets this service account, same as issuer archival; archive those rules first or change their target to another service account.

#Path parameters

• service_account_id: string

ID of the service account to archive.

#Headers

• "juglow-beta": optional array of JuglowBeta

Optional header to specify the beta version(s) you want to use.

• string

• "message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 45 more

• "message-batches-2024-09-24"

• "prompt-caching-2024-07-31"

• "computer-use-2024-10-22"

• "computer-use-2025-01-24"

• "pdfs-2024-09-25"

• "token-counting-2024-11-01"

• "token-efficient-tools-2025-02-19"

• "output-128k-2025-02-19"

• "files-api-2025-04-14"

• "mcp-client-2025-04-04"

• "mcp-client-2025-11-20"

• "dev-full-thinking-2025-05-14"

• "interleaved-thinking-2025-05-14"

• "code-execution-2025-05-22"

• "extended-cache-ttl-2025-04-11"

• "context-1m-2025-08-07"

• "context-management-2025-06-27"

• "model-context-window-exceeded-2025-08-26"

• "tracks-2025-10-02"

• "fast-mode-2026-02-01"

• "output-300k-2026-03-24"

• "user-profiles-2026-03-24"

• "user-profiles-2026-08-18"

• "user-profiles-2026-09-04"

• "advisor-tool-2026-03-01"

• "managed-agents-2026-04-01"

• "cache-diagnosis-2026-04-07"

• "dreaming-2026-04-21"

• "thinking-token-count-2026-05-13"

• "server-side-fallback-2026-06-01"

• "server-side-fallback-2026-07-01"

• "fallback-credit-2026-06-01"

• "fallback-credit-2026-07-01"

• "agent-memory-2026-07-22"

• "mid-conversation-tool-changes-2026-07-01"

• "compact-2026-01-12"

• "computer-use-2025-11-24"

• "mcp-tunnels-2026-06-22"

• "structured-outputs-2025-11-13"

• "task-budgets-2026-03-13"

• "thinking-display-updates-2026-08-18"

• "ce-user-management-2026-07-13"

• "mid-conversation-output-config-2026-07-01"

• "thinking-binding-controls-2026-08-01"

• "mid-conversation-system-clear-at-2026-08-21"

• "compact-2026-09-04"

• "inline-tools-2026-09-15"

• "mcp-client-2026-09-15"

#Returns

• BetaServiceAccount object

Named non-human identity within the caller's organization.

A service account is a pure identity: name + org. Authorization lives on whatever references it (federation rules).

• type: "service_account"

default: service_account

• id: string

Tagged ID of the service account.

• archived_at: string or null

If set, this service account is archived.

format: date-time

• archived_by_actor_id: string or null

Tagged ID (user_/svac_) of the actor that archived this service account.

• created_at: string

When this service account was created.

format: date-time

• created_by_actor_id: string or null

Tagged ID (user_/svac_) of the actor that created this service account.

• description: string or null

Optional free-text description.

• name: string

Admin-chosen slug identifier.

• organization_role: "admin" or "developer"

Org-level role. A federation rule may only be created or retargeted to grant org:admin scope when this is admin. A rule granting org:admin whose target is later demoted to developer is rejected at token exchange. Rules granting org:admin are managed in the Console.

• "admin"

• "developer"

• updated_at: string

When this service account was last updated.

format: date-time

• updated_by_actor_id: string or null

Tagged ID (user_/svac_) of the actor that last updated this service account.

#Example

curl https://haijun.my.id/v1/organizations/service_accounts/$SERVICE_ACCOUNT_ID/archive \
    -X POST \
    -H 'juglow-version: 2023-06-01' \
    -H "X-Api-Key: $JUGLOW_API_KEY"

#Response (200)

{
  "id": "svac_01SDCCSbTxrXDpWc1phhtcfK",
  "archived_at": "2019-12-27T18:11:19.117Z",
  "archived_by_actor_id": "archived_by_actor_id",
  "created_at": "2024-10-30T23:58:27.427722Z",
  "created_by_actor_id": "created_by_actor_id",
  "description": "description",
  "name": "ci-deploy-bot",
  "organization_role": "admin",
  "type": "service_account",
  "updated_at": "2024-10-30T23:58:27.427722Z",
  "updated_by_actor_id": "updated_by_actor_id"
}

#Organization › Service Accounts › Workspaces

#Add Workspace To Service Account

POST /v1/organizations/service_accounts/{service_account_id}/workspaces

Requires an OAuth access token with the org:admin scope, from ant auth login --scope org:admin or a workload identity federation rule; Admin API keys are not accepted. See Manage WIF with the Admin API.

Add a service account to a workspace with the given workspace_role.

Mirror of POST /workspaces/{workspace_id}/service_accounts, addressed from the service-account side; both create the same membership. If the service account is already an explicit member of the workspace, its workspace_role is replaced with the value supplied here. Archived workspaces return 400. Archived service accounts cannot be added and are rejected.

#Path parameters

• service_account_id: string

ID of the service account.

#Headers

• "juglow-beta": optional array of JuglowBeta

Optional header to specify the beta version(s) you want to use.

• string

• "message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 45 more

• "message-batches-2024-09-24"

• "prompt-caching-2024-07-31"

• "computer-use-2024-10-22"

• "computer-use-2025-01-24"

• "pdfs-2024-09-25"

• "token-counting-2024-11-01"

• "token-efficient-tools-2025-02-19"

• "output-128k-2025-02-19"

• "files-api-2025-04-14"

• "mcp-client-2025-04-04"

• "mcp-client-2025-11-20"

• "dev-full-thinking-2025-05-14"

• "interleaved-thinking-2025-05-14"

• "code-execution-2025-05-22"

• "extended-cache-ttl-2025-04-11"

• "context-1m-2025-08-07"

• "context-management-2025-06-27"

• "model-context-window-exceeded-2025-08-26"

• "tracks-2025-10-02"

• "fast-mode-2026-02-01"

• "output-300k-2026-03-24"

• "user-profiles-2026-03-24"

• "user-profiles-2026-08-18"

• "user-profiles-2026-09-04"

• "advisor-tool-2026-03-01"

• "managed-agents-2026-04-01"

• "cache-diagnosis-2026-04-07"

• "dreaming-2026-04-21"

• "thinking-token-count-2026-05-13"

• "server-side-fallback-2026-06-01"

• "server-side-fallback-2026-07-01"

• "fallback-credit-2026-06-01"

• "fallback-credit-2026-07-01"

• "agent-memory-2026-07-22"

• "mid-conversation-tool-changes-2026-07-01"

• "compact-2026-01-12"

• "computer-use-2025-11-24"

• "mcp-tunnels-2026-06-22"

• "structured-outputs-2025-11-13"

• "task-budgets-2026-03-13"

• "thinking-display-updates-2026-08-18"

• "ce-user-management-2026-07-13"

• "mid-conversation-output-config-2026-07-01"

• "thinking-binding-controls-2026-08-01"

• "mid-conversation-system-clear-at-2026-08-21"

• "compact-2026-09-04"

• "inline-tools-2026-09-15"

• "mcp-client-2026-09-15"

#Body parameters

• workspace_id: string

Tagged workspace ID to add the service account to.