Create connection keys

Provision initial connection keys for Okta or OIDC connection strategies. This endpoint allows you to create keys before configuring the connection to use Private Key JWT authentication, enabling zero-downtime transitions.

POST https://{tenantDomain}/api/v2/connections/{id}/keys

Create connection keys

cURL

curl --request POST \
  --url https://{tenantDomain}/api/v2/connections/{id}/keys \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{}'

import requests

url = "https://{tenantDomain}/api/v2/connections/{id}/keys"

payload = {}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({})
};

fetch('https://{tenantDomain}/api/v2/connections/{id}/keys', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://{tenantDomain}/api/v2/connections/{id}/keys",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://{tenantDomain}/api/v2/connections/{id}/keys"

	payload := strings.NewReader("{}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://{tenantDomain}/api/v2/connections/{id}/keys")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://{tenantDomain}/api/v2/connections/{id}/keys")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{}"

response = http.request(request)
puts response.read_body

201

[
  {
    "kid": "<string>",
    "cert": "-----BEGIN CERTIFICATE-----\r\nMIIDDTCCA...YiA0TQhAt8=\r\n-----END CERTIFICATE-----",
    "fingerprint": "CC:FB:DD:D8:9A:B5:DE:1B:F0:CC:36:D2:99:59:21:12:03:DD:A8:25",
    "thumbprint": "CCFBDDD89AB5DE1BF0CC36D29959211203DDA825",
    "pkcs": "-----BEGIN PKCS7-----\r\nMIIDPA....t8xAA==\r\n-----END PKCS7-----",
    "current": true,
    "next": true,
    "current_since": "<string>",
    "algorithm": "<string>",
    "subject_dn": "<string>"
  }
]

Autorisations

bearerAuthoAuth2ClientCredentials

Authorization · string · header · requis

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Paramètres de chemin

id · string · requis

ID of the connection

Corps

application/jsonapplication/x-www-form-urlencoded

signing_alg · enum<string>

Selected Signing Algorithm

Options disponibles: RS256, RS384, RS512, PS256, PS384, ES256, ES384

Réponse

201

application/json

Connection keys successfully created.

kid · string · requis

The key id of the signing key

Maximum string length: 255

cert · string · défaut: -----BEGIN CERTIFICATE----- MIIDDTCCA...YiA0TQhAt8= -----END CERTIFICATE----- · requis

The public certificate of the signing key

Maximum string length: 4096

fingerprint · string · défaut: CC:FB:DD:D8:9A:B5:DE:1B:F0:CC:36:D2:99:59:21:12:03:DD:A8:25 · requis

The cert fingerprint

thumbprint · string · défaut: CCFBDDD89AB5DE1BF0CC36D29959211203DDA825 · requis

The cert thumbprint

Maximum string length: 255

pkcs · string · défaut: -----BEGIN PKCS7----- MIIDPA....t8xAA== -----END PKCS7-----

The public certificate of the signing key in pkcs7 format

Maximum string length: 4096

current · boolean · défaut: true

True if the key is the current key

next · boolean

True if the key is the next key

current_since · string

The date and time when the key became the current key

algorithm · string

Signing key algorithm

key_use · enum<string>

Signing key use, whether for encryption or signing

Options disponibles: encryption, signing

subject_dn · string

Maximum string length: 132