Britive Workload Identity Providers API

openapi: 3.2.0
info:
  title: Britive Services API Documentation Workload Identity Providers API
  version: v1
  description: API documentation for Users, Tags, Identity providers, Applications, Reporting, Audit logs, Tenants, SSO, Profiles, Password policies, MFA, Access Builder Settings, etc.
servers:
- url: https://{tenantURL}
  description: The primary server
  variables:
    tenantURL:
      default: test.britive-app.com
      description: The host of the server
security:
- bearerAuth: []
tags:
- name: Workload Identity Providers
  description: Manage workload identity providers
paths:
  /api/workload/identity-providers:
    post:
      tags:
      - Workload Identity Providers
      summary: Add new workload identity provider
      operationId: createIdentityProvider
      requestBody:
        content:
          application/json:
            schema:
              description: The new identity provider to add.
              oneOf:
              - $ref: '#/components/schemas/AwsProvider'
              - $ref: '#/components/schemas/OpenIdConnectProvider'
              - $ref: '#/components/schemas/SpiffeProvider'
        required: true
      responses:
        '200':
          description: Identity provider successfully created.
          content:
            application/json:
              schema:
                oneOf:
                - $ref: '#/components/schemas/AwsProvider'
                - $ref: '#/components/schemas/OpenIdConnectProvider'
                - $ref: '#/components/schemas/SpiffeProvider'
    get:
      tags:
      - Workload Identity Providers
      summary: Get workload identity providers by page
      operationId: getIdentityProviders
      parameters:
      - name: type
        in: query
        description: the type of identity provider.
        required: false
        schema:
          type: string
          enum:
          - OIDC
          - AWS
          - SCIM
          - SPIFFE
      - name: name
        in: query
        description: filter resource that starts with name
        required: false
        schema:
          type: string
      - name: page
        in: query
        description: Zero-based page index (0..N)
        required: false
        schema:
          minimum: '0'
          type: integer
          default: 0
      - name: size
        in: query
        description: The size of the page to be returned
        required: false
        schema:
          minimum: '1'
          type: integer
          default: 20
      - name: sort
        in: query
        description: 'Sorting criteria in the format: property,(asc|desc). Default sort order is ascending. Multiple sort criteria are supported.'
        required: false
        schema:
          type: array
          items:
            type: string
      responses:
        '200':
          description: successfully retrieve workload identity providers by page
          content:
            application/json:
              schema:
                type: array
                items:
                  oneOf:
                  - $ref: '#/components/schemas/AwsProvider'
                  - $ref: '#/components/schemas/OpenIdConnectProvider'
                  - $ref: '#/components/schemas/SpiffeProvider'
    put:
      tags:
      - Workload Identity Providers
      summary: Update workload identity provider
      operationId: updateIdentityProvider
      requestBody:
        content:
          application/json:
            schema:
              description: The existing identity provider to update.
              oneOf:
              - $ref: '#/components/schemas/AwsProvider'
              - $ref: '#/components/schemas/OpenIdConnectProvider'
              - $ref: '#/components/schemas/SpiffeProvider'
        required: true
      responses:
        '200':
          description: identity provider updated
          content:
            application/json:
              schema:
                oneOf:
                - $ref: '#/components/schemas/AwsProvider'
                - $ref: '#/components/schemas/OpenIdConnectProvider'
                - $ref: '#/components/schemas/SpiffeProvider'
        '404':
          description: identity provider not found
        '405':
          description: invalid identity provider
  /api/workload/identity-providers/{idpId}:
    delete:
      tags:
      - Workload Identity Providers
      summary: Delete identity provider
      operationId: deleteIdentityProvider
      parameters:
      - name: idpId
        in: path
        description: id of the identity provider.
        required: true
        schema:
          type: integer
          format: int32
      responses:
        '200':
          description: identity provider deleted.
    get:
      tags:
      - Workload Identity Providers
      summary: Get identity provider details
      operationId: getIdentityProvider
      parameters:
      - name: idpId
        in: path
        description: Id of the identity provider.
        required: true
        schema:
          type: integer
          format: int32
      responses:
        '200':
          description: identity provider retrieved
          content:
            application/json:
              schema:
                oneOf:
                - $ref: '#/components/schemas/AwsProvider'
                - $ref: '#/components/schemas/OpenIdConnectProvider'
                - $ref: '#/components/schemas/SpiffeProvider'
        '404':
          description: identity provider not found
components:
  schemas:
    SpiffeBundleProfile:
      description: the SPIFFE bundle endpoint profile
      type: string
      enum:
      - https_web
      - https_spiffe
    IdentityProvider:
      required:
      - idpType
      - name
      type: object
      properties:
        id:
          type: integer
          format: int32
        name:
          type: string
        description:
          type: string
        attributesMap:
          type: array
          description: Provider's identity attributes mapped to Britive service identity custom attributes.
          items:
            $ref: '#/components/schemas/AttributeMap'
        validationWindow:
          type: integer
          description: The amount of time in seconds, after the token has been issued/signed, Britive will attempt to validate the unverified token.  Outside this window, token validation will fail.
          format: int32
        idpType:
          type: string
      discriminator:
        propertyName: idpType
    AttributeMap:
      required:
      - idpAttr
      - userAttr
      type: object
      properties:
        idpAttr:
          type: string
        userAttr:
          type: string
      description: Single identity provider attribute mapped to service identity custom attribute
    SpiffeProvider:
      description: model of a SPIFFE Workload Identity Provider
      allOf:
      - $ref: '#/components/schemas/IdentityProvider'
      - type: object
        properties:
          bundleEndpoint:
            type: string
            format: uri
          bundleProfile:
            $ref: '#/components/schemas/SpiffeBundleProfile'
          trustDomain:
            type: string
      required:
      - bundleEndpoint
      - bundleProfile
      - trustDomain
      - attributesMap
    OpenIdConnectProvider:
      required:
      - idpType
      - issuerUrl
      - name
      type: object
      description: model of an OpenID Connect Provider
      discriminator:
        propertyName: idpType
      allOf:
      - $ref: '#/components/schemas/IdentityProvider'
      - type: object
        properties:
          issuerUrl:
            type: string
          allowedAudiences:
            type: array
            items:
              type: string
          idpType:
            type: string
    AwsProvider:
      required:
      - idpType
      - name
      type: object
      description: model of a AWS Provider
      discriminator:
        propertyName: idpType
      allOf:
      - $ref: '#/components/schemas/IdentityProvider'
      - type: object
        properties:
          maxDuration:
            type: integer
            description: The maximum number of hours the client can request the AWS token be valid.
            format: int32
          idpType:
            type: string
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
x-api-evangelist:
  assembled_from: https://docs.britive.com/apidocs/ (one OpenAPI fragment per operation page, .md variant)
  assembled_on: '2026-08-08'
  fragments: 372
  note: Britive publishes this contract only as per-operation fragments inside its Document360 API reference. This file is the faithful union of those fragments; the verbatim assembly is in openapi/_original/.