Skip to Content
veriom

Exchange CI OIDC token

Trade a GitHub Actions OIDC token for a short-lived token for its repository. No secret is stored in the repository: the job asks GitHub for an OIDC token naming the `veriom` audience and sends it here.

POST
/v1/ci/oidc/exchange

Trade a GitHub Actions OIDC token for a short-lived token for its repository.

No secret is stored in the repository: the job asks GitHub for an OIDC token naming the veriom audience and sends it here.

Request Body

application/json
  1. body
token*Token

The run's GitHub Actions OIDC token, from core.getIDToken('veriom'). The job needs permissions: id-token: write.

Length20 <= length <= 8192
workspace_id?|

Required only when the repository is connected to more than one workspace; the API then answers 409 ci_oidc_workspace_ambiguous without it.

Response Body

Successful Response

application/json
  1. response
access_token*Access Token

A vat_ bearer token for this run's repository.

expires_at*Expires At
Formatdate-time
repository_id*Repository Id
Formatuuid
scopes*array<string>
token_type?Token Type
Default"Bearer"
workspace_id*Workspace Id
Formatuuid
Example Request
curl -X POST 'https://api.veriom.ai/v1/ci/oidc/exchange' \  -H 'Content-Type: application/json' \  -d '{  "token": "stringstringstringst"}'
Example Response
{  "access_token": "string",  "expires_at": "2019-08-24T14:15:22Z",  "repository_id": "b349ae61-b973-4c6c-a5e0-89183ba99ff3",  "scopes": [    "string"  ],  "token_type": "Bearer",  "workspace_id": "0967198e-ec7b-4c6b-b4d3-f71244cadbe9"}