Canonical Identities API

The identities API from Canonical — 15 operation(s) for identities.

Documentation GitHub OpenAPI

Operations 28

Each operation below carries the questions people ask an LLM about it and the instructions they give an agent to run it. Generated by API Evangelist overlay

GET /1.0/auth/identities List URLs of all identities across auth methods · Get the identities #

Ask an LLM

“Where can I get the URLs of every identity LXD knows about, whatever the auth method?”

“Is there a quick way to enumerate all identity links on my LXD server without full records?”

Tell an agent

Give me the URL of every identity on the LXD server.

Enumerate all identity links regardless of authentication method.

GET /1.0/auth/identities/bearer List URLs of bearer identities · Get the bearer identities #

Ask an LLM

“Which bearer-token identities exist on my LXD server, as a list of links?”

“How do I get just the URLs of bearer identities in LXD?”

Tell an agent

List the URLs of all bearer identities.

Give me the links for every bearer-token identity on this server.

POST /1.0/auth/identities/bearer Create a bearer identity · Add a bearer identity #

Ask an LLM

“How do I add a new bearer-token identity to LXD?”

“Can I put a new bearer identity into authorization groups when I create it?”

Tell an agent

Create a bearer identity named {name} of type {type}.

Add bearer identity {name} and place it in groups {groups}.

DELETE /1.0/auth/identities/bearer/{nameOrID}/token Revoke a bearer identity's token · Revoke a bearer identity token #

Ask an LLM

“How can I revoke the token of a bearer identity without deleting the identity itself?”

“Can I cut off a bearer identity's access by killing its current token?”

Tell an agent destructive · confirm first

Revoke the current token for this bearer identity but keep the identity.

Invalidate the bearer token held by identity {identity}.

POST /1.0/auth/identities/bearer/{nameOrID}/token Issue a new token for a bearer identity · Issue a token for a bearer identity #

Ask an LLM

“How do I generate a fresh token for an existing bearer identity?”

“Does issuing a new bearer token revoke the one the identity already had?”

Tell an agent destructive · confirm first

Issue a new token for this bearer identity that expires after {expiry}.

Rotate the token of bearer identity {identity}, replacing whatever token it had.

DELETE /1.0/auth/identities/bearer/{nameOrIdentifier} Delete a bearer identity · Delete the bearer identity #

Ask an LLM

“How do I remove a bearer identity from LXD completely?”

“What happens when I delete a bearer-token identity?”

Tell an agent destructive · confirm first

Delete bearer identity {identity} from the server.

Remove this bearer-token identity entirely.

GET /1.0/auth/identities/bearer/{nameOrIdentifier} Get one bearer identity · Get the bearer identity #

Ask an LLM

“What groups is a particular bearer identity in?”

“Can I look up a single bearer identity by its name or ID?”

Tell an agent

Show me the details of bearer identity {identity}.

Look up one bearer identity by name or identifier.

PATCH /1.0/auth/identities/bearer/{nameOrIdentifier} Partially update a bearer identity · Partially update the bearer identity #

Ask an LLM

“Can I change only some fields of a bearer identity and leave the rest alone?”

“Is there a way to tweak a bearer identity's groups without a full replace?”

Tell an agent

Patch bearer identity {identity} so its groups become {groups}, leaving other fields untouched.

Partially update the bearer identity's certificate to {tls_certificate}.

PUT /1.0/auth/identities/bearer/{nameOrIdentifier} Replace a bearer identity's editable fields · Update the bearer identity #

Ask an LLM

“How do I overwrite all editable fields of a bearer identity at once?”

“Can I replace a bearer identity's group list entirely?”

Tell an agent

Replace the groups of bearer identity {identity} with exactly {groups}.

Fully rewrite the bearer identity with groups {groups} and certificate {tls_certificate}.

GET /1.0/auth/identities/bearer?recursion=1 List bearer identities with full details · Get the bearer identities #

Ask an LLM

“Can I see the full records of all bearer identities, including their groups?”

“What does each bearer-token identity on the server look like in detail?”

Tell an agent

Fetch full details for every bearer identity, not just links.

Show all bearer-token identities with their groups and settings.

GET /1.0/auth/identities/current Show the identity making the request · Get the current identity #

Ask an LLM

“Who am I authenticated as against this LXD server?”

“What permissions does my own current identity have?”

Tell an agent

Tell me which identity I'm using and what it's authorized to do.

Show my current identity with its authorization context.

GET /1.0/auth/identities/oidc List URLs of OIDC identities · Get the OIDC identities #

Ask an LLM

“Which users have signed in to LXD via OIDC, as a list of links?”

“How do I get just the URLs of OIDC identities?”

Tell an agent

List the URLs of all OIDC identities.

Give me links to every single sign-on identity on this server.

DELETE /1.0/auth/identities/oidc/{nameOrIdentifier} Delete an OIDC identity · Delete the OIDC identity #

Ask an LLM

“How do I remove an OIDC user's identity from LXD?”

“Can I delete a single sign-on identity that should no longer have access?”

Tell an agent destructive · confirm first

Delete the OIDC identity {identity}.

Remove this single sign-on identity from the server.

GET /1.0/auth/identities/oidc/{nameOrIdentifier} Get one OIDC identity · Get the OIDC identity #

Ask an LLM

“What groups does a specific OIDC user belong to in LXD?”

“Can I look up a single OIDC identity by name or ID?”

Tell an agent

Show me the OIDC identity {identity}.

Look up one single sign-on identity by its name or identifier.

PATCH /1.0/auth/identities/oidc/{nameOrIdentifier} Partially update an OIDC identity · Partially update the OIDC identity #

Ask an LLM

“Can I change only an OIDC user's groups without replacing the whole identity?”

“Is a partial update possible for an OIDC identity?”

Tell an agent

Patch OIDC identity {identity} so its groups become {groups}, keeping everything else.

Partially update the OIDC identity's certificate to {tls_certificate}.

PUT /1.0/auth/identities/oidc/{nameOrIdentifier} Replace an OIDC identity's editable fields · Update the OIDC identity #

Ask an LLM

“How do I overwrite all editable fields on an OIDC identity?”

“Can I set an OIDC user's groups to an exact new list?”

Tell an agent

Replace the groups of OIDC identity {identity} with exactly {groups}.

Fully rewrite the OIDC identity with groups {groups} and certificate {tls_certificate}.

GET /1.0/auth/identities/oidc?recursion=1 List OIDC identities with full details · Get the OIDC identities #

Ask an LLM

“Can I see full records of every OIDC identity, including groups?”

“What details does LXD hold for each OIDC-authenticated user?”

Tell an agent

Fetch full details for every OIDC identity, not just links.

Show all single sign-on identities with their groups.

GET /1.0/auth/identities/tls List URLs of TLS identities · Get the TLS identities #

Ask an LLM

“Which TLS client certificates are registered as identities, as a list of links?”

“How do I get just the URLs of TLS identities in LXD?”

Tell an agent

List the URLs of all TLS identities.

Give me links to every certificate-based identity on this server.

POST /1.0/auth/identities/tls Add a trusted or pending TLS identity · Add a TLS identity #

Ask an LLM

“How do I trust a new client certificate in LXD?”

“Can I create a pending TLS identity and get a join token for an untrusted client?”

Tell an agent

Trust client certificate {certificate} as TLS identity {name}.

Create a pending TLS identity {name} in groups {groups} and return a token for it.

DELETE /1.0/auth/identities/tls/{nameOrIdentifier} Delete a TLS identity and revoke its trust · Delete the TLS identity #

Ask an LLM

“How do I stop trusting a client certificate in LXD?”

“Does deleting a TLS identity also revoke its trust?”

Tell an agent destructive · confirm first

Delete TLS identity {identity} and revoke its trust.

Untrust and remove this certificate-based client.

GET /1.0/auth/identities/tls/{nameOrIdentifier} Get one TLS identity · Get the TLS identity #

Ask an LLM

“What groups is a specific TLS certificate identity in?”

“Can I look up one certificate-based identity by name or ID?”

Tell an agent

Show me the TLS identity {identity}.

Look up one certificate-based identity by name or identifier.

PATCH /1.0/auth/identities/tls/{nameOrIdentifier} Partially update a TLS identity · Partially update the TLS identity #

Ask an LLM

“Can I change just the groups on a TLS client identity?”

“Is there a partial update for certificate-based identities?”

Tell an agent

Patch the groups of TLS identity {identity} to {groups}, leaving its certificate alone.

Partially update only the certificate on this TLS identity to {tls_certificate}.

PUT /1.0/auth/identities/tls/{nameOrIdentifier} Replace a TLS identity's editable fields · Update the TLS identity #

Ask an LLM

“How do I swap the certificate on an existing TLS identity?”

“Can I overwrite a TLS identity's groups and certificate in one go?”

Tell an agent

Replace the certificate of TLS identity {identity} with {tls_certificate}.

Fully rewrite the TLS identity so its groups are exactly {groups}.

POST /1.0/auth/identities/tls?public Self-register a TLS client using a trust token · Add a TLS identity #

Ask an LLM

“As an untrusted client, how do I add my own certificate using a trust token?”

“Which certificate gets trusted when a client redeems a trust token over the public endpoint?”

Tell an agent

Redeem my trust token so the certificate from this TLS handshake becomes trusted.

Register this untrusted client's own certificate via the public trust-token endpoint.

GET /1.0/auth/identities/tls?recursion=1 List TLS identities with full details · Get the TLS identities #

Ask an LLM

“Can I see full records of every TLS certificate identity at once?”

“What groups is each certificate-based client in?”

Tell an agent

Fetch full details for every TLS identity, not just links.

Show all certificate-based identities with their groups.

GET /1.0/auth/identities?recursion=1 List all identities with full details · Get the identities #

Ask an LLM

“Can I pull the complete records of every identity in one call, bearer, OIDC and TLS together?”

“What groups and auth method does each identity on my LXD server have?”

Tell an agent

Fetch the full details of every identity on the server, not just URLs.

Show each identity's name, auth method and groups across all methods.

GET /v1/identities Get the map of all v1 identities · Get all identities #

Ask an LLM

“Which identities are configured in the system through the v1 identities endpoint?”

“Can I see every v1 identity and its access level as one map keyed by name?”

Tell an agent

Show me the map of all identities from the v1 identities endpoint.

Dump every v1 identity name with its access settings.

POST /v1/identities Add, update, replace or remove v1 identities · Manage identities #

Ask an LLM

“How can I add or remove several v1 identities in one request?”

“What actions does the v1 identities endpoint accept for changing identities?”

Tell an agent

Run v1 identities action {action} with identities {identities}.

Add these v1 identities to the system: {identities}.

Canonical Identities API

Operations 28

Documentation

Specifications

Schemas & Data

Other Resources

Work with this as data

MCP server

Tools for apis

Call it yourself

Get an API key

OpenAPI Specification