Issue Mandates
STS authenticates application or workload proof, evaluates current authority, and issues short-lived mandates or configured provider credentials.
Supported Callers and Routes
Section titled “Supported Callers and Routes”| Route | Caller |
|---|---|
POST /oauth/2/token | SDK, documented token client, Gateway |
POST /v1/run/manifest | caracal run |
POST /v1/run/credential | caracal run |
GET /.well-known/jwks.json?zone_id=... | Verifiers |
GET /approvals/{id} | Waiting client with the required hold context |
POST /approvals/{id}/decision | Federated user decision flow |
Routes under /internal/ for policy simulation/status and zone signing-key rotation are service-to-service APIs. Do not call or expose them as workload APIs; the API service owns those operations.
Runtime Contract
Section titled “Runtime Contract”| Item | Local value |
|---|---|
| Port | 8080 |
| Liveness | GET /health |
| Readiness | GET /ready |
| Metrics | GET /metrics, /metrics.json |
Service environment variables are cataloged in Configure Service Environment.
Identity Boundary
Section titled “Identity Boundary”STS does not authenticate end users and does not invent a user sub. It accepts a Federated user’s token only from a registered Federated user issuer, then treats its stable sub as opaque. Without a subject token, the application’s own identity is the Subject.
Synchronous Dependencies
Section titled “Synchronous Dependencies”Issuance needs Postgres product, policy, authority, Session, Delegation, approval, signing, and secret state. It also consumes Redis invalidation and revocation state, requires the Secret Store KEK, verifies Gateway HMAC proof on the Gateway path, and emits audit evidence to Redis or replay storage.
Failure Posture
Section titled “Failure Posture”Invalid client proof, Federated user issuer, resource, policy, operation, scope, Authority record, Session, Delegation, approval, signing key, or Gateway signature denies issuance. There is no fallback token. Resource mandates are capped at 15 minutes and Session mandates at 60 minutes.
An interaction_required response means policy raised an Approval hold. Approval alone is not issuance; the client retries and consumes the hold once.
Use Use STS Endpoint for exact request and error contracts and Exchange Tokens for the trust flow.