Package ai.vectros.resources.auth.requests

Class IssuerRequest

java.lang.Object
ai.vectros.resources.auth.requests.IssuerRequest
public final class IssuerRequest extends Object

  • Method Details

    • getIssuerId

      public String getIssuerId()
      Returns:
      Short slug identifying this issuer within your tenant: 3-31 characters, a lowercase letter first, then lowercase letters, digits, or hyphens. Immutable once registered.

    • getIssuer

      public String getIssuer()
      Returns:
      The IdP's iss claim value, exactly as it appears in tokens it issues.

    • getJwksUri

      public String getJwksUri()
      Returns:
      The IdP's remote JWKS endpoint, used to verify presented tokens' signatures.

    • getAudience

      public String getAudience()
      Returns:
      The aud claim value this contract requires a presented subject_token to carry. Must be globally unique in combination with issuer — use a distinct audience per environment/context sharing one IdP account (most OIDC providers support this as an ordinary per-API/application default).

    • getContextId

      public String getContextId()
      Returns:
      Which of your app contexts an exchanged token targets. Must be an existing app context (create it first via POST /v1/app-contexts). A credential authorized via the CLI bootstrap's provisioning capability may only name the app context it is itself bound to; naming another one is refused. A root API key may name any of its contexts.

    • getSubClaim

      public Optional<String> getSubClaim()
      Returns:
      The claim in the IdP's token that carries the subject identifier. Defaults to sub if omitted.

    • getEmailClaim

      public Optional<String> getEmailClaim()
      Returns:
      The claim in the IdP's token that carries the subject's email, used for first-login invite matching. Defaults to email if omitted.

    • getSelfSignupPolicies

      public Optional<List<SelfSignupPolicy>> getSelfSignupPolicies()
      Returns:
      Opt-in self-service signup: a list of {signup_type, role_id} pairs. When a first-time exchange caller presents no invite token but names a signup_type matching one of these (or omits signup_type and exactly one entry exists), a brand-new user is created and bound to that entry's role — no invite required. Every entry must, by construction, be something you're willing to grant to ANY caller who can present a token from this issuer: no entry may target a role carrying elevated (provisioning or wildcard) scope — rejected. Omit entirely to leave self-signup disabled (the default).

    • equals

      public boolean equals(Object other)
      Overrides:
      equals in class Object

    • getAdditionalProperties

      public Map<String,Object> getAdditionalProperties()

    • hashCode

      public int hashCode()
      Overrides:
      hashCode in class Object

    • toString

      public String toString()
      Overrides:
      toString in class Object

    • builder

      public static IssuerRequest.IssuerIdStage builder()