Package ai.vectros.resources.auth.requests

Class IssuerRequest

java.lang.Object
ai.vectros.resources.auth.requests.IssuerRequest
public final class IssuerRequest extends Object

  • Method Details

    • getIssuerId

      public String getIssuerId()
      Returns:
      Short slug identifying this issuer within your tenant: 3-31 characters, a lowercase letter first, then lowercase letters, digits, or hyphens. Immutable once registered.

    • getIssuer

      public String getIssuer()
      Returns:
      The IdP's iss claim value, exactly as it appears in tokens it issues.

    • getJwksUri

      public String getJwksUri()
      Returns:
      The IdP's remote JWKS endpoint, used to verify presented tokens' signatures.

    • getAudience

      public String getAudience()
      Returns:
      The aud claim value this contract requires a presented subject_token to carry. Must be globally unique in combination with issuer — use a distinct audience per environment/context sharing one IdP account (most OIDC providers support this as an ordinary per-API/application default).

    • getContextId

      public String getContextId()
      Returns:
      Which of your app contexts an exchanged token targets. Must be an existing app context (create it first via POST /v1/app-contexts). A credential authorized via the CLI bootstrap's provisioning capability may only name the app context it is itself bound to; naming another one is refused. A root API key may name any of its contexts.

    • getSubClaim

      public Optional<String> getSubClaim()
      Returns:
      The claim in the IdP's token that carries the subject identifier. Defaults to sub if omitted.

    • getEmailClaim

      public Optional<String> getEmailClaim()
      Returns:
      The claim in the IdP's token that carries the subject's email, used for first-login invite matching. Defaults to email if omitted.

    • getUserinfoUri

      public Optional<String> getUserinfoUri()
      Returns:
      The IdP's OIDC userinfo endpoint. Optional. Presented tokens are access tokens, which under OIDC don't carry email unless the IdP was specifically configured to add it — if emailClaim misses on the presented token, and userinfoUri is configured, Vectros falls back to calling this endpoint (with the presented token as the bearer credential) and reads emailClaim from its JSON response instead. Omit to leave the fallback disabled — a token that doesn't carry the configured email claim then fails first-login exactly as it does today.

    • getSelfSignupPolicies

      public Optional<List<SelfSignupPolicy>> getSelfSignupPolicies()
      Returns:
      Opt-in self-service signup: a list of {signup_type, role_id} pairs. When a first-time exchange caller presents no invite token but names a signup_type matching one of these (or omits signup_type and exactly one entry exists), a brand-new user is created and bound to that entry's role — no invite required. Every entry must, by construction, be something you're willing to grant to ANY caller who can present a token from this issuer: no entry may target a role carrying elevated (provisioning or wildcard) scope — rejected. Omit entirely to leave self-signup disabled (the default).

    • equals

      public boolean equals(Object other)
      Overrides:
      equals in class Object

    • getAdditionalProperties

      public Map<String,Object> getAdditionalProperties()

    • hashCode

      public int hashCode()
      Overrides:
      hashCode in class Object

    • toString

      public String toString()
      Overrides:
      toString in class Object

    • builder

      public static IssuerRequest.IssuerIdStage builder()