Workload Identity

A workload can exchange a verified machine identity for a short-lived STACK Passport. This avoids a stored operator API key on the workload.

SPIFFE and SPIRE

Configure a SPIFFE trust domain with its JWKS URL, audience, exact SPIFFE-ID-to-agent map, and rate limit. A SPIRE-issued JWT-SVID then calls POST /v1/workload/passport. STACK verifies the issuer, signature, audience, subject, configured mapping, and rate limit before it mints a Passport.

Every Passport is issued for exactly one Mission. Open a Mission for the workload's agent with POST /v1/missions and send its ID as mission_id. The Mission must be live. A missing ID returns 400 MISSION_REQUIRED. The body accepts no other fields.

curl -X POST https://api.getstack.run/v1/workload/passport \
  -H "Authorization: Bearer $JWT_SVID" \
  -H "Content-Type: application/json" \
  -d '{"mission_id":"ms_4hT9pQ2xVn"}'

WIMSE WITs

WIMSE uses a JWT Workload Identity Token. Configure an issuer URI, JWKS URI, audience, JWKS cache lifetime, rate limit, and exact workload-ID-to-agent map. The workload sends its WIT to POST /v1/workload/wit. Version 1 accepts JWT WITs. It does not accept X.509-style WITs. The body carries the same mission_id.

curl -X POST https://api.getstack.run/v1/workload/wit \
  -H "Authorization: Bearer $WIMSE_WIT" \
  -H "Content-Type: application/json" \
  -d '{"mission_id":"ms_4hT9pQ2xVn"}'

Configuration routes

• GET/POST /v1/identity/spiffe/trust-domains and GET/PATCH/DELETE /v1/identity/spiffe/trust-domains/:id.
• GET/POST /v1/identity/wimse/issuers and GET/PATCH/DELETE /v1/identity/wimse/issuers/:id.
• POST, PATCH, and DELETE require an admin principal. Agent-bearing contexts receive 403.
• Consumer routes accept the workload token as Bearer auth. Do not add a STACK API key.

Identity documentation map

See human identity and claims, OIDC, SSO, and STACK authentication, PII policy, and Passport claims.