Dynatrace

Dynatrace Workload Identity Federation API

Manage workload identity federation trust policies and their service-user mappings.

GitHub OpenAPI
Business capability
Identity & Access Management BC-620.20

Operations 12

Each operation below carries the questions people ask an LLM about it and the instructions they give an agent to run it. Generated by API Evangelist overlay

GET /iam/v1/accounts/{account-uuid}/wif/trust-policies List workload identity trust policies · Returns WIF trust policies within account #
Ask an LLM
“Which external identity providers are trusted for workload identity federation?”
“Can I page through WIF trust policies?”
Tell an agent
List the WIF trust policies on account {account}.
Show page {page} of trust policies for {account}.
POST /iam/v1/accounts/{account-uuid}/wif/trust-policies Create a workload identity trust policy · Creates WIF trust policy #
Ask an LLM
“How do I let CI jobs authenticate with OIDC tokens instead of secrets?”
“What issuer URL and audience does a new trust policy need?”
Tell an agent
Create trust policy {name} on {account} for issuer {issuer} and audience {audience}.
Add a WIF trust policy {name} in {account} trusting {issuer}, audience {audience}, JWKS at {jwks}.
GET /iam/v1/accounts/{account-uuid}/wif/trust-policies/{trust-policy-uuid} Get a workload identity trust policy · Returns WIF trust policy #
Ask an LLM
“What issuer and audience does a specific trust policy accept?”
“Can I look up one trust policy by UUID?”
Tell an agent
Get trust policy {policy} on account {account}.
Show the issuer and audience of trust policy {policy} in {account}.
PUT /iam/v1/accounts/{account-uuid}/wif/trust-policies/{trust-policy-uuid} Update a workload identity trust policy · Updates WIF trust policy #
Ask an LLM
“Can I change the issuer or audience on an existing trust policy?”
“Where do I update a trust policy's JWKS URI?”
Tell an agent
Update trust policy {policy} on {account}: name {name}, issuer {issuer}, audience {audience}.
Point trust policy {policy} in {account} at JWKS {jwks}, keeping name {name}, issuer {issuer}, audience {audience}.
DELETE /iam/v1/accounts/{account-uuid}/wif/trust-policies/{trust-policy-uuid} Delete a workload identity trust policy · Deletes WIF trust policy #
Ask an LLM
“How do I stop trusting an identity provider permanently?”
“Can a WIF trust policy be deleted outright?”
Tell an agent destructive · confirm first
Delete trust policy {policy} from account {account}.
Remove the WIF trust policy {policy} on {account}.
PATCH /iam/v1/accounts/{account-uuid}/wif/trust-policies/{trust-policy-uuid} Enable or disable a trust policy · Updates WIF trust policy status #
Ask an LLM
“Can I temporarily switch off a trust policy without deleting it?”
“Is there a way to re-enable a disabled WIF trust policy?”
Tell an agent
Set trust policy {policy} on {account} to status {status}.
Disable WIF trust policy {policy} in {account} by setting its status to {status}.
GET /iam/v1/accounts/{account-uuid}/wif/trust-policies/{trust-policy-uuid}/mappings List service user mappings for a trust policy · Returns WIF service user mappings #
Ask an LLM
“Which service users can federated workloads assume under a trust policy?”
“Can I page through a trust policy's mappings?”
Tell an agent
List service user mappings for trust policy {policy} on {account}.
Show {size} mappings per page under trust policy {policy} in {account}.
POST /iam/v1/accounts/{account-uuid}/wif/trust-policies/{trust-policy-uuid}/mappings Map federated identities to a service user · Creates WIF service user mapping #
Ask an LLM
“How do I map claims from an external token to a service user and scopes?”
“Can a mapping restrict federated access to one environment?”
Tell an agent
Map trust policy {policy} on {account} to service user {serviceUser} in environment {environment} with scopes {scopes} and claims {claims}.
Create a mapping under {policy} in {account}: claims {claims} become {serviceUser} on {environment}, scopes {scopes}.
GET /iam/v1/accounts/{account-uuid}/wif/trust-policies/{trust-policy-uuid}/mappings/{mapping-uuid} Get a service user mapping · Returns WIF service user mapping #
Ask an LLM
“Which claims and scopes does a specific mapping grant?”
“Can I read one WIF mapping by UUID?”
Tell an agent
Get mapping {mapping} under trust policy {policy} on {account}.
Show the claims and scopes of mapping {mapping} in trust policy {policy}, account {account}.
PUT /iam/v1/accounts/{account-uuid}/wif/trust-policies/{trust-policy-uuid}/mappings/{mapping-uuid} Update a service user mapping · Updates WIF service user mapping #
Ask an LLM
“Can I change the scopes an existing federated mapping grants?”
“Where do I edit the claim rules on a WIF mapping?”
Tell an agent
Update mapping {mapping} in trust policy {policy} on {account} to service user {serviceUser}, environment {environment}, scopes {scopes}, claims {claims}.
Change the scopes of mapping {mapping} ({policy}, {account}) to {scopes} for {serviceUser} on {environment}, claims {claims}.
DELETE /iam/v1/accounts/{account-uuid}/wif/trust-policies/{trust-policy-uuid}/mappings/{mapping-uuid} Delete a service user mapping · Deletes WIF service user mapping #
Ask an LLM
“How do I revoke a federated workload's access to a service user?”
“Can I delete one mapping but keep the trust policy?”
Tell an agent destructive · confirm first
Delete mapping {mapping} from trust policy {policy} on {account}.
Remove the WIF mapping {mapping} under {policy} in {account}.
PATCH /iam/v1/accounts/{account-uuid}/wif/trust-policies/{trust-policy-uuid}/mappings/{mapping-uuid} Enable or disable a service user mapping · Updates WIF service user mapping status #
Ask an LLM
“Can I pause one federated mapping without deleting it?”
“Is there a status toggle on individual WIF mappings?”
Tell an agent
Set mapping {mapping} in trust policy {policy} on {account} to status {status}.
Disable the mapping {mapping} under {policy} in {account} with status {status}.

Specifications

⚙
OpenAPI
https://raw.githubusercontent.com/api-evangelist/dynatrace/refs/heads/main/openapi/dynatrace-workload-identity-federation-api-openapi.yml

Schemas & Data

📊
JSONSchema
https://raw.githubusercontent.com/api-evangelist/dynatrace/refs/heads/main/json-schema/dynatrace-rest-wif-trust-policy-schema.json
📊
JSONSchema
https://raw.githubusercontent.com/api-evangelist/dynatrace/refs/heads/main/json-schema/dynatrace-rest-wif-service-user-mapping-schema.json
📊
JSONSchema
https://raw.githubusercontent.com/api-evangelist/dynatrace/refs/heads/main/json-schema/dynatrace-rest-wif-service-user-mapping-form-schema.json
📊
JSONSchema
https://raw.githubusercontent.com/api-evangelist/dynatrace/refs/heads/main/json-schema/dynatrace-rest-wif-trust-policy-form-schema.json
📊
JSONSchema
https://raw.githubusercontent.com/api-evangelist/dynatrace/refs/heads/main/json-schema/dynatrace-rest-wif-service-user-mapping-list-schema.json
📊
JSONSchema
https://raw.githubusercontent.com/api-evangelist/dynatrace/refs/heads/main/json-schema/dynatrace-rest-wif-trust-policy-list-schema.json

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/dynatrace:dynatrace-workload-identity-federation-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

dynatrace-workload-identity-federation-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  title: Dynatrace Account Management … … Workload Identity………
  description: The enterprise management API for Dynatrace SaaS enables automation of operational tasks related to user access and environment lifecycle management.
  version: '1.0'
  contact: {}
servers: []
tags:
- name: Workload Identity Federation
  description: Manage workload identity federation trust policies and their service-user mappings.
paths:
  /iam/v1/accounts/{account-uuid}/wif/trust-policies:
    get:
      operationId: listWifTrustPolicies
      parameters:
      - name: account-uuid
        required: true
        in: path
        description: "The ID of the required account. \n\n You can find the UUID on the **Account Management** > **Identity & access management** > **OAuth clients** page, during creation of an OAuth client."
        schema:
          type: string
      - name: pageNumber
        required: false
        in: query
        description: The number of the requested page.
        schema:
          type: number
      - name: pageSize
        required: false
        in: query
        description: Defines the requested number of entries for the next page.
        schema:
          type: number
      responses:
        '200':
          description: WIF trust policies fetched.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RestWifTrustPolicyList'
      security:
      - bearer: []
      summary: Returns WIF trust policies within account
      tags:
      - Workload Identity Federation
      x-token-scopes:
      - account-idm-read
    post:
      operationId: createWifTrustPolicy
      parameters:
      - name: account-uuid
        required: true
        in: path
        description: "The ID of the required account. \n\n You can find the UUID on the **Account Management** > **Identity & access management** > **OAuth clients** page, during creation of an OAuth client."
        schema:
          type: string
      requestBody:
        required: true
        description: WIF trust policy creation form
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RestWifTrustPolicyForm'
      responses:
        '201':
          description: WIF trust policy created.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RestWifTrustPolicy'
      security:
      - bearer: []
      summary: Creates WIF trust policy
      tags:
      - Workload Identity Federation
      x-token-scopes:
      - account-idm-write
  /iam/v1/accounts/{account-uuid}/wif/trust-policies/{trust-policy-uuid}:
    get:
      operationId: getWifTrustPolicy
      parameters:
      - name: account-uuid
        required: true
        in: path
        description: "The ID of the required account. \n\n You can find the UUID on the **Account Management** > **Identity & access management** > **OAuth clients** page, during creation of an OAuth client."
        schema:
          type: string
      - name: trust-policy-uuid
        required: true
        in: path
        description: The UUID of the required trust policy.
        schema:
          type: string
      responses:
        '200':
          description: WIF trust policy fetched.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RestWifTrustPolicy'
      security:
      - bearer: []
      summary: Returns WIF trust policy
      tags:
      - Workload Identity Federation
      x-token-scopes:
      - account-idm-read
    put:
      operationId: updateWifTrustPolicy
      parameters:
      - name: account-uuid
        required: true
        in: path
        description: "The ID of the required account. \n\n You can find the UUID on the **Account Management** > **Identity & access management** > **OAuth clients** page, during creation of an OAuth client."
        schema:
          type: string
      - name: trust-policy-uuid
        required: true
        in: path
        description: The UUID of the required trust policy.
        schema:
          type: string
      requestBody:
        required: true
        description: WIF trust policy update form
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RestWifTrustPolicyForm'
      responses:
        '200':
          description: WIF trust policy updated.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RestWifTrustPolicy'
      security:
      - bearer: []
      summary: Updates WIF trust policy
      tags:
      - Workload Identity Federation
      x-token-scopes:
      - account-idm-write
    delete:
      operationId: deleteWifTrustPolicy
      parameters:
      - name: account-uuid
        required: true
        in: path
        description: "The ID of the required account. \n\n You can find the UUID on the **Account Management** > **Identity & access management** > **OAuth clients** page, during creation of an OAuth client."
        schema:
          type: string
      - name: trust-policy-uuid
        required: true
        in: path
        description: The UUID of the required trust policy.
        schema:
          type: string
      responses:
        '200':
          description: WIF trust policy deleted.
      security:
      - bearer: []
      summary: Deletes WIF trust policy
      tags:
      - Workload Identity Federation
      x-token-scopes:
      - account-idm-write
    patch:
      operationId: patchWifTrustPolicyStatus
      parameters:
      - name: account-uuid
        required: true
        in: path
        description: "The ID of the required account. \n\n You can find the UUID on the **Account Management** > **Identity & access management** > **OAuth clients** page, during creation of an OAuth client."
        schema:
          type: string
      - name: trust-policy-uuid
        required: true
        in: path
        description: The UUID of the required trust policy.
        schema:
          type: string
      requestBody:
        required: true
        description: WIF trust policy status update form
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RestWifTrustPolicyPatchForm'
      responses:
        '200':
          description: WIF trust policy status updated.
      security:
      - bearer: []
      summary: Updates WIF trust policy status
      tags:
      - Workload Identity Federation
      x-token-scopes:
      - account-idm-write
  /iam/v1/accounts/{account-uuid}/wif/trust-policies/{trust-policy-uuid}/mappings:
    get:
      operationId: listWifServiceUserMappings
      parameters:
      - name: account-uuid
        required: true
        in: path
        description: "The ID of the required account. \n\n You can find the UUID on the **Account Management** > **Identity & access management** > **OAuth clients** page, during creation of an OAuth client."
        schema:
          type: string
      - name: trust-policy-uuid
        required: true
        in: path
        description: The UUID of the required trust policy.
        schema:
          type: string
      - name: pageNumber
        required: false
        in: query
        description: The number of the requested page.
        schema:
          type: number
      - name: pageSize
        required: false
        in: query
        description: Defines the requested number of entries for the next page.
        schema:
          type: number
      responses:
        '200':
          description: WIF service user mappings fetched.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RestWifServiceUserMappingList'
      security:
      - bearer: []
      summary: Returns WIF service user mappings
      tags:
      - Workload Identity Federation
      x-token-scopes:
      - account-idm-read
    post:
      operationId: createWifServiceUserMapping
      parameters:
      - name: account-uuid
        required: true
        in: path
        description: "The ID of the required account. \n\n You can find the UUID on the **Account Management** > **Identity & access management** > **OAuth clients** page, during creation of an OAuth client."
        schema:
          type: string
      - name: trust-policy-uuid
        required: true
        in: path
        description: The UUID of the required trust policy.
        schema:
          type: string
      requestBody:
        required: true
        description: WIF service user mapping creation form
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RestWifServiceUserMappingForm'
      responses:
        '201':
          description: WIF service user mapping created.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RestWifServiceUserMapping'
      security:
      - bearer: []
      summary: Creates WIF service user mapping
      tags:
      - Workload Identity Federation
      x-token-scopes:
      - account-idm-write
  /iam/v1/accounts/{account-uuid}/wif/trust-policies/{trust-policy-uuid}/mappings/{mapping-uuid}:
    get:
      operationId: getWifServiceUserMapping
      parameters:
      - name: account-uuid
        required: true
        in: path
        description: "The ID of the required account. \n\n You can find the UUID on the **Account Management** > **Identity & access management** > **OAuth clients** page, during creation of an OAuth client."
        schema:
          type: string
      - name: trust-policy-uuid
        required: true
        in: path
        description: The UUID of the required trust policy.
        schema:
          type: string
      - name: mapping-uuid
        required: true
        in: path
        description: The UUID of the required service user mapping.
        schema:
          type: string
      responses:
        '200':
          description: WIF service user mapping fetched.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RestWifServiceUserMapping'
      security:
      - bearer: []
      summary: Returns WIF service user mapping
      tags:
      - Workload Identity Federation
      x-token-scopes:
      - account-idm-read
    put:
      operationId: updateWifServiceUserMapping
      parameters:
      - name: account-uuid
        required: true
        in: path
        description: "The ID of the required account. \n\n You can find the UUID on the **Account Management** > **Identity & access management** > **OAuth clients** page, during creation of an OAuth client."
        schema:
          type: string
      - name: trust-policy-uuid
        required: true
        in: path
        description: The UUID of the required trust policy.
        schema:
          type: string
      - name: mapping-uuid
        required: true
        in: path
        description: The UUID of the required service user mapping.
        schema:
          type: string
      requestBody:
        required: true
        description: WIF service user mapping update form
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RestWifServiceUserMappingForm'
      responses:
        '200':
          description: WIF service user mapping updated.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RestWifServiceUserMapping'
      security:
      - bearer: []
      summary: Updates WIF service user mapping
      tags:
      - Workload Identity Federation
      x-token-scopes:
      - account-idm-write
    delete:
      operationId: deleteWifServiceUserMapping
      parameters:
      - name: account-uuid
        required: true
        in: path
        description: "The ID of the required account. \n\n You can find the UUID on the **Account Management** > **Identity & access management** > **OAuth clients** page, during creation of an OAuth client."
        schema:
          type: string
      - name: trust-policy-uuid
        required: true
        in: path
        description: The UUID of the required trust policy.
        schema:
          type: string
      - name: mapping-uuid
        required: true
        in: path
        description: The UUID of the required service user mapping.
        schema:
          type: string
      responses:
        '200':
          description: WIF service user mapping deleted.
      security:
      - bearer: []
      summary: Deletes WIF service user mapping
      tags:
      - Workload Identity Federation
      x-token-scopes:
      - account-idm-write
    patch:
      operationId: patchWifServiceUserMappingStatus
      parameters:
      - name: account-uuid
        required: true
        in: path
        description: "The ID of the required account. \n\n You can find the UUID on the **Account Management** > **Identity & access management** > **OAuth clients** page, during creation of an OAuth client."
        schema:
          type: string
      - name: trust-policy-uuid
        required: true
        in: path
        description: The UUID of the required trust policy.
        schema:
          type: string
      - name: mapping-uuid
        required: true
        in: path
        description: The UUID of the required service user mapping.
        schema:
          type: string
      requestBody:
        required: true
        description: WIF service user mapping status update form
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RestWifServiceUserMappingPatchForm'
      responses:
        '200':
          description: WIF service user mapping status updated.
      security:
      - bearer: []
      summary: Updates WIF service user mapping status
      tags:
      - Workload Identity Federation
      x-token-scopes:
      - account-idm-write
components:
  schemas:
    RestWifServiceUserMappingForm:
      type: object
      properties:
        serviceUserUuid:
          type: string
        environmentId:
          type: string
        scopes:
          type: array
          items:
            type: string
        claimMappings:
          type: array
          items:
            $ref: '#/components/schemas/RestWifClaimMappingForm'
      required:
      - serviceUserUuid
      - environmentId
      - scopes
      - claimMappings
    RestWifTrustPolicyForm:
      type: object
      properties:
        name:
          type: string
        issuerUrl:
          type: string
        jwksUri:
          type: string
        audience:
          type: string
        description:
          type: string
      required:
      - name
      - issuerUrl
      - audience
    RestWifTrustPolicyListItem:
      type: object
      properties:
        uuid:
          type: string
        name:
          type: string
        issuerUrl:
          type: string
        audience:
          type: string
        status:
          type: string
          enum:
          - ACTIVE
          - INACTIVE
        createdAt:
          format: date-time
          type: string
        updatedAt:
          format: date-time
          type: string
    RestWifServiceUserMapping:
      type: object
      properties:
        uuid:
          type: string
        serviceUserUuid:
          type: string
        environmentId:
          type: string
        scopes:
          type: array
          items:
            type: string
        status:
          type: string
          enum:
          - ACTIVE
          - INACTIVE
        claimMappings:
          type: array
          items:
            $ref: '#/components/schemas/RestWifClaimMapping'
        createdAt:
          format: date-time
          type: string
        updatedAt:
          format: date-time
          type: string
    RestWifServiceUserMappingPatchForm:
      type: object
      properties:
        status:
          type: string
          enum:
          - ACTIVE
          - INACTIVE
      required:
      - status
    RestWifServiceUserMappingList:
      type: object
      properties:
        pageSize:
          type: number
        pageNumber:
          type: number
        total:
          type: number
        results:
          type: array
          items:
            $ref: '#/components/schemas/RestWifServiceUserMappingListItem'
    RestWifTrustPolicyPatchForm:
      type: object
      properties:
        status:
          type: string
          enum:
          - ACTIVE
          - INACTIVE
      required:
      - status
    RestWifTrustPolicy:
      type: object
      properties:
        uuid:
          type: string
        name:
          type: string
        issuerUrl:
          type: string
        issuerUrlHash:
          type: string
        jwksUri:
          type: string
        description:
          type: string
        audience:
          type: string
        status:
          type: string
          enum:
          - ACTIVE
          - INACTIVE
        createdAt:
          format: date-time
          type: string
        updatedAt:
          format: date-time
          type: string
        serviceUserMappings:
          type: array
          items:
            $ref: '#/components/schemas/RestWifServiceUserMapping'
    RestWifClaimMappingForm:
      type: object
      properties:
        claimName:
          type: string
        claimValue:
          type: string
        matchType:
          type: string
          enum:
          - EXACT
          - GLOB
      required:
      - claimName
      - claimValue
      - matchType
    RestWifTrustPolicyList:
      type: object
      properties:
        pageSize:
          type: number
        pageNumber:
          type: number
        total:
          type: number
        results:
          type: array
          items:
            $ref: '#/components/schemas/RestWifTrustPolicyListItem'
    RestWifServiceUserMappingListItem:
      type: object
      properties:
        uuid:
          type: string
        serviceUserUuid:
          type: string
        environmentId:
          type: string
        scopes:
          type: array
          items:
            type: string
        status:
          type: string
          enum:
          - ACTIVE
          - INACTIVE
        createdAt:
          format: date-time
          type: string
        updatedAt:
          format: date-time
          type: string
    RestWifClaimMapping:
      type: object
      properties:
        claimName:
          type: string
        claimValue:
          type: string
        matchType:
          type: string
          enum:
          - EXACT
          - GLOB
  securitySchemes:
    bearer:
      scheme: bearer
      bearerFormat: JWT
      type: http
externalDocs:
  description: OpenAPI specification
  url: /openapi.json