Create an identity certificate using an identity access token
POST /identity/v1/certificates
This request uses an identity access token, and certificate signing request, to generate an identity certificate.
Authorization
To call this method, you must be assigned one or more IAM access roles that include the following action.
Auditing
Calling this method generates the following auditing event.
is.metadata.certificate.create
Request
Request Body
IdentityCertificatePrototype
The identity certificate prototype
csr
Required *
string
A Public-Key Cryptography Standards (PKCS) #10 certification request provided in textual encoding described by RFC 7468.
Certificate signing requests (CSRs) must meet the following requirements: * Version: v1 (value `0`) * Subject public key algorithm: 2048-bit or 4096-bit RSA * Signature algorithm: SHA-256 with RSA encryption * Attributes: empty (constructed DER encoding value `a0 00`) * Subject: At least one of the following naming attributes must be specified: - `C`: The ISO 3166-1 alpha-2 country name (section 6.3.1 of X.520) - `L`: The locality name (section 6.3.4 of X.520) - `ST`: The full state or province name (section 6.3.5 of X.520) - `O`: The organization name (section 6.4.1 of X.520) - `OU`: The organizational unit name (section 6.4.2 of X.520) - No other naming attributes may be specified
See Generating an identity certificate by using an identity access token, ITU X.520 10/2019, RFC 5280, and RFC 2985 for more information.
expires_in
integer
The number of seconds remaining until the identity certificate expires
Response
201 - The identity certificate was created successfully.
certificates
array
The public key certificates, consisting of the identity certificate, and all intermediate CA certificates in its chain of trust. Certificates are based upon the X.509 v3 certificate format and the standard certificate extensions defined in RFC 5280 .
The certificates are issued by an IBM Cloud Virtual Private Cloud (VPC) certification authority (CA). VPC provides the public key infrastructure (PKI) establishing a chain of trust for use with VPC file share services.
All certificates are provided in textual encoding described by RFC 7468.
created_at
string
The date and time that the identity certificate was created
expires_at
string
The date and time that the identity certificate will expire
expires_in
integer
The number of seconds remaining until the identity certificate expires
id
string
The unique identifier for this identity certificate
400 - An invalid identity certificate prototype object was provided.
errors
array
The errors that occurred.
status_code
integer
The HTTP status code of the response
trace
string
The unique error identifier
401 - An invalid authentication token was provided
errors
array
The errors that occurred.
status_code
integer
The HTTP status code of the response
trace
string
The unique error identifier
403 - The provided token is not authorized for this operation
errors
array
The errors that occurred.
status_code
integer
The HTTP status code of the response
trace
string
The unique error identifier
Create an IAM token using an identity token
POST /identity/v1/iam_tokens
This request uses an identity token, and a trusted profile linked to a resource identity (whether the default linked at resource creation time, or one provided in the request body) to generate an IAM access token.
Authorization
To call this method, you must be assigned one or more IAM access roles that include the following action.
Auditing
Calling this method generates the following auditing event.
is.metadata.computeresource-token.request
Request
Request Body
IdentityIAMTokenPrototype
The IAM access token prototype.
trusted_profile
TrustedProfileIdentity
Identifies a trusted profile by a unique property.
Response
201 - The IAM access token was successfully generated.
access_token
string
The access token.
The instructions for decoding the access token and a description of the decoded token's format can be found in the documentation for Decoding the identity access token
created_at
string
The date and time that the access token was created
expires_at
string
The date and time that the access token will expire
expires_in
integer
The number of seconds remaining until the access token expires
400 - An invalid IAM access token prototype object was provided.
errors
array
The errors that occurred.
status_code
integer
The HTTP status code of the response
trace
string
The unique error identifier
401 - An invalid authentication token was provided
errors
array
The errors that occurred.
status_code
integer
The HTTP status code of the response
trace
string
The unique error identifier
403 - The provided token is not authorized for this operation
errors
array
The errors that occurred.
status_code
integer
The HTTP status code of the response
trace
string
The unique error identifier
Create an identity token
PUT /identity/v1/token
This request creates an identity token, which can be used to retrieve VPC metadata or to generate an IAM access token (using a trusted profile linked to the resource identity)
Authorization
To call this method, you must be assigned one or more IAM access roles that include the following action.
Auditing
Calling this method generates the following auditing event.
is.metadata.identity-token.createis.metadata.instance-identity-token.create
Request
Request Body
IdentityTokenPrototype
The identity token prototype. A valid prototype object is required even if no properties are specified.
expires_in
integer
The number of seconds remaining until the access token expires
nonce
string
A unique, unpredictable value that is used only once in a secure communication. If no value is provided, the system uses the current UTC timestamp following the ISO 8601 date time format rounded up to the millisecond.
The `nonce` property of the decoded `access_token` will have this value.
Path Parameters
Query Parameters
Response
201 - The identity token was created successfully.
access_token
string
The access token
created_at
string
The date and time that the access token was created
expires_at
string
The date and time that the access token will expire
expires_in
integer
The number of seconds remaining until the access token expires
nonce
string
A unique, unpredictable value that is used only once in a secure communication. The value will be set in the `nonce` property that's encoded in the `access_token`.
400 - An invalid identity token prototype object was provided.
errors
array
The errors that occurred.
status_code
integer
The HTTP status code of the response
trace
string
The unique error identifier