---
title: "Issue Mandates"
url: "https://docs.caracal.run/v1.0/services/sts/"
markdown_url: "https://docs.caracal.run/markdown/v1.0/services/sts.md"
description: "Understand supported STS calls, synchronous authority dependencies, approvals, and fail-closed issuance."
page_type: "reference"
concepts: []
requires: []
---

# Issue Mandates

Canonical URL: https://docs.caracal.run/v1.0/services/sts/
Markdown URL: https://docs.caracal.run/markdown/v1.0/services/sts.md
Description: Understand supported STS calls, synchronous authority dependencies, approvals, and fail-closed issuance.
Page type: reference
Concepts: none
Requires: none

---

STS authenticates application or workload proof, evaluates current authority, and issues short-lived mandates or configured provider credentials.

## Supported Callers and Routes

| Route                                                | Caller                                        |
| ---------------------------------------------------- | --------------------------------------------- |
| `POST /oauth/2/token`                                | SDK, documented token client, Gateway         |
| `POST /v1/run/manifest`                              | `caracal run`                                 |
| `POST /v1/run/credential`                            | `caracal run`                                 |
| `GET /.well-known/jwks.json?zone_id=...`             | Verifiers                                     |
| `GET /approvals/{id}`                                | Waiting client with the required hold context |
| `POST /approvals/{id}/decision`                 | Federated user decision flow                  |

Routes under `/internal/` for policy simulation/status and zone signing-key rotation are service-to-service APIs. Do not call or expose them as workload APIs; the API service owns those operations.

## Runtime Contract

| Item      | Local value                     |
| --------- | ------------------------------- |
| Port      | `8080`                          |
| Liveness  | `GET /health`                   |
| Readiness | `GET /ready`                    |
| Metrics   | `GET /metrics`, `/metrics.json` |

Service environment variables are cataloged in [Configure Service Environment](/v1.0/operations/env-vars/).

## Identity Boundary

STS does not authenticate end users and does not invent a user `sub`. It accepts a Federated user's token only from a registered Federated user issuer, then treats its stable `sub` as opaque. Without a subject token, the application's own identity is the Subject.

## Synchronous Dependencies

Issuance needs Postgres product, policy, authority, Session, Delegation, approval, signing, and secret state. It also consumes Redis invalidation and revocation state, requires the Secret Store KEK, verifies Gateway HMAC proof on the Gateway path, and emits audit evidence to Redis or replay storage.

## Failure Posture

Invalid client proof, Federated user issuer, resource, policy, operation, scope, Authority record, Session, Delegation, approval, signing key, or Gateway signature denies issuance. There is no fallback token. Resource mandates are capped at 15 minutes and Session mandates at 60 minutes.

An `interaction_required` response means policy raised an Approval hold. Approval alone is not issuance; the client retries and consumes the hold once.

Use [Use STS Endpoint](/v1.0/api/sts/) for exact request and error contracts and [Exchange Tokens](/v1.0/architecture/token-exchange-flow/) for the trust flow.

## Next Step

[Protect Upstreams](/v1.0/services/gateway/).