API-Edge-Full: Complete API reference for Aembit Edge API # Aembit Edge API - Full Reference > Complete API reference including endpoints and schemas for Aembit Edge API # Aembit Edge API [Section titled “Aembit Edge API”](#aembit-edge-api) **Version:** v1 ## Base URL [Section titled “Base URL”](#base-url) https\://{tenant}.aembit.io *** # Aembit Edge API - API Endpoints [Section titled “Aembit Edge API - API Endpoints”](#aembit-edge-api---api-endpoints) **Version:** v1 **Base URL:** https\://{tenant}.aembit.io ## Auth [Section titled “Auth”](#auth) ### POST /edge/v1/auth [Section titled “POST /edge/v1/auth”](#post-edgev1auth) **Summary:** Authenticate to the Edge API **Description:** Bootstraps a session with the Aembit Edge API. This endpoint authenticates a Client Workload by \nverifying its identity against a specific Aembit Trust Provider. The Trust Provider must be configured in the \nAembit Console to match the environment where the workload is running. Supported Trust Provider types include\nAWS Metadata Service, AWS Role, GCP Identity Token, GitHub Action ID Token, GitLab Job ID Token, Kubernetes Service Account,\nOIDC ID Token, and Terraform Cloud Identity Token. **Operation ID:** edge-api-auth **Parameters:** * **X-Aembit-ResourceSet** (undefined) *(optional)*: any **Request Body:** * Content-Type: application/json * Schema: any **Responses:** * **‘200’**: Successfully retrieved access token * Content-Type: application/json * Schema: any * **‘400’**: Invalid request or missing parameters * Content-Type: application/json * Schema: any * **‘401’**: Unauthorized * Content-Type: application/json * Schema: any * **‘429’**: Too many authentication requests * Content-Type: application/json * Schema: any * **‘500’**: Internal server error * Content-Type: application/json * Schema: any **cURL Example:** ```bash curl -X POST \ -H "Authorization: Bearer your-access-token" -H "Content-Type: application/json" \ -d '{"example": "data"}' \ "https://your-tenant.aembit.io/edge/v1/auth" ``` ## Credentials [Section titled “Credentials”](#credentials) ### POST /edge/v1/credentials [Section titled “POST /edge/v1/credentials”](#post-edgev1credentials) **Summary:** Get credentials for a Client Workload **Description:** Retrieves credentials for a Client Workload based on configured Access Policies **Operation ID:** edge-api-get-credentials **Parameters:** * **X-Aembit-ResourceSet** (undefined) *(optional)*: any **Request Body:** * Content-Type: application/json * Schema: any **Responses:** * **‘200’**: Credentials returned for specified Client Workload * Content-Type: application/json * Schema: any * **‘400’**: Invalid request or missing parameters * Content-Type: application/json * Schema: any * **‘401’**: Unauthorized access * Content-Type: application/json * Schema: any * **‘403’**: Not applicable for this request * Content-Type: application/json * Schema: any * **‘404’**: No client/server workload or access policy was found. Response will be of type ApiCredentialsResponse with credential type set to Unknown * Content-Type: application/json * Schema: any * **‘429’**: Too many credential requests * Content-Type: application/json * Schema: any * **‘500’**: Internal server error * Content-Type: application/json * Schema: any **cURL Example:** ```bash curl -X POST \ -H "Content-Type: application/json" \ -d '{"example": "data"}' \ "https://your-tenant.aembit.io/edge/v1/credentials" ``` *** # Aembit Edge API - Data Schemas [Section titled “Aembit Edge API - Data Schemas”](#aembit-edge-api---data-schemas) **Version:** v1 ### ApiCredentialsRequest [Section titled “ApiCredentialsRequest”](#apicredentialsrequest) Request payload for retrieving credentials for a Client Workload **Type:** object **Properties:** * **client** *(required)*: any - Identity and attestation details for the client workload requesting credentials.\nPopulate this object with the same workload identity context used for /edge/v1/auth,\nincluding any platform-specific attestation fields required for that workload type (for\nexample, Kubernetes service account token, OIDC identity token, or cloud instance attestation data).\nThese fields are evaluated as part of access policy matching for the credentials request. * **server** *(required)*: any - Target resource details for which the credential is being requested. * **credentialType** *(required)*: any - Type of credential being requested from your configured Credential Provider * **connectionMetadata** *(optional)*: any - Filter values to be used if your access policy is configured with multiple credential providers * **certSigningRequest** *(optional)*: null,string ### ApiCredentialsResponse [Section titled “ApiCredentialsResponse”](#apicredentialsresponse) Response containing credentials that a Client Workload requests with expiration details **Type:** object **Properties:** * **credentialType** *(optional)*: any - Type of credential returned by your configured Credential Provider * **expiresAt** *(optional)*: null,string (date-time) - Token expiration time in ISO 8601 format, null for non-expiring credentials * **data** *(optional)*: any - Credential data returned by your configured Credential Provider ### AuthRequest [Section titled “AuthRequest”](#authrequest) Identity and attestation information for Client Workload authentication. \nThis request initiates a session with the Aembit Edge API by providing proof of \nworkload identity via a configured Trust Provider. **Type:** object **Properties:** * **clientId** *(required)*: string - The Aembit ARN of the Trust Provider configured to attest this workload.\nFormat: ‘aembit:{stack}:{tenant}:identity:{type}:{uuid}‘\nWhere to find it:\nIn the Aembit Admin UI, navigate to ‘Trust Providers’, select your provider, \nand copy the value from the ‘ID’ field. * **client** *(required)*: any - Client Workload identifiers for authentication ### AwsDTO [Section titled “AwsDTO”](#awsdto) AWS-specific attestation data for Client Workload identification **Type:** object **Properties:** * **instanceIdentityDocument** *(optional)*: null,string - Base64-encoded AWS instance identity document * **instanceIdentityDocumentSignature** *(optional)*: null,string - Base64-encoded signature for AWS instance identity document verification * **lambda** *(optional)*: any - AWS Lambda function information for serverless workload attestation * **ecs** *(optional)*: any - AWS ECS container and task metadata for workload attestation * **stsGetCallerIdentity** *(optional)*: any - AWS STS GetCallerIdentity request data for identity verification ### AwsEcsDTO [Section titled “AwsEcsDTO”](#awsecsdto) AWS ECS container and task metadata for workload attestation **Type:** object **Properties:** * **containerMetadata** *(optional)*: null,string - JSON string containing AWS ECS container metadata * **taskMetadata** *(optional)*: null,string - JSON string containing AWS ECS task metadata ### AzureAttestationDTO [Section titled “AzureAttestationDTO”](#azureattestationdto) Azure-specific attestation data for Client Workload identification **Type:** object **Properties:** * **attestedDocument** *(optional)*: any - Azure Instance Metadata Service (IMDS) Attested Data document. ### AzureAttestedDocumentDTO [Section titled “AzureAttestedDocumentDTO”](#azureattesteddocumentdto) Azure Instance Metadata Service (IMDS) Attested Data document. **Type:** object **Properties:** * **encoding** *(optional)*: null,string - The encoding of the IMDS document. * **signature** *(optional)*: null,string - The Base64-encoded signature (PKCS7 container) returned by the Azure IMDS ‘document’ field. * **nonce** *(optional)*: null,string - The cryptographic nonce passed to the IMDS endpoint. ### ClientWorkloadDetails [Section titled “ClientWorkloadDetails”](#clientworkloaddetails) Identity and attestation information for a Client Workload requesting credentials **Type:** object **Properties:** * **sourceIP** *(optional)*: null,string - IP address of the requesting Client Workload * **aws** *(optional)*: any - AWS-specific attestation data for Client Workload identification * **azure** *(optional)*: any - Azure-specific attestation data for Client Workload identification * **gcp** *(optional)*: any - GCP-specific attestation data for Client Workload identification * **os** *(optional)*: any - Operating system environment information for Client Workload attestation * **k8s** *(optional)*: any - Kubernetes-specific attestation data for Kubernetes pod identification * **host** *(optional)*: any - Host system information for Client Workload attestation * **github** *(optional)*: any - JWT-based identity token attestation for CI/CD platforms * **terraform** *(optional)*: any - JWT-based identity token attestation for CI/CD platforms * **gitlab** *(optional)*: any - JWT-based identity token attestation for CI/CD platforms * **oidc** *(optional)*: any - JWT-based identity token attestation for CI/CD platforms ### ConnectionMetadata [Section titled “ConnectionMetadata”](#connectionmetadata) Filter for multi-credential provider access policy credential request **Type:** object **Properties:** * **accountName** *(optional)*: null,string - The Snowflake username to filter on * **accessKeyId** *(optional)*: null,string - The AWS access key ID to filter on * **headerName** *(optional)*: null,string - The Header Name to filter on * **headerValue** *(optional)*: null,string - The Header Value to filter on * **httpBodyFieldPath** *(optional)*: null,string - The HTTP Body Field Path to filter on * **httpBodyFieldValue** *(optional)*: null,string - The HTTP Body Field Value to filter on ### CredentialProviderTypes [Section titled “CredentialProviderTypes”](#credentialprovidertypes) Type of credential being requested from your configured Credential Provider.\r\nNote: Use ‘OAuthToken’ for Azure Entra ID, Microsoft, and generic OAuth2 providers. **Type:** string **Possible values:** `Unknown`, `ApiKey`, `UsernamePassword`, `GoogleWorkloadIdentityFederation`, `OAuthToken`, `AwsStsFederation`, `X509Svid` ### CrowdStrikeDTO [Section titled “CrowdStrikeDTO”](#crowdstrikedto) CrowdStrike agent information for endpoint security attestation **Type:** object **Properties:** * **agentId** *(optional)*: null,string - Unique identifier for the CrowdStrike agent ### EdgeCredentials [Section titled “EdgeCredentials”](#edgecredentials) ```plaintext Credential data returned to Client Workloads based on your configured Credential Providers\n For AWS (AwsStsFederation), look in the aws* fields.\n For API Key and Username/Password, look in their respective fields.\n For all other types (GCP, OAuth, OIDC, Aembit), the result is in the 'token' field. ``` **Type:** object **Properties:** * **apiKey** *(optional)*: null,string - API key credential for authenticating to target services * **token** *(optional)*: null,string - Bearer token credential for authenticating to target services/\nThis field contains the result for: \nGoogleWorkloadIdentityFederation (GCP WIF Token), GitLab, GitHub,\nand generic JWT/OIDC credentials. * **username** *(optional)*: null,string - Username for basic authentication credentials * **password** *(optional)*: null,string - Password for basic authentication credentials * **awsAccessKeyId** *(optional)*: null,string - AWS access key ID for programmatic access * **awsSecretAccessKey** *(optional)*: null,string - AWS secret access key for programmatic access * **awsSessionToken** *(optional)*: null,string - AWS session token for temporary credentials ### EnvironmentDTO [Section titled “EnvironmentDTO”](#environmentdto) Environment variables available to the Client Workload **Type:** object **Properties:** * **K8S\_POD\_NAME** *(optional)*: null,string - Kubernetes pod name environment variable * **CLIENT\_WORKLOAD\_ID** *(optional)*: null,string - Aembit Client Workload identifier environment variable * **KUBERNETES\_PROVIDER\_ID** *(optional)*: null,string - Kubernetes Trust Provider identifier environment variable * **AEMBIT\_RESOURCE\_SET\_ID** *(optional)*: null,string - Aembit Resource Set identifier environment variable ### GcpAttestationDTO [Section titled “GcpAttestationDTO”](#gcpattestationdto) GCP-specific attestation data for Client Workload identification **Type:** object **Properties:** * **identityToken** *(optional)*: null,string - Identity token for workload attestation * **instanceDocument** *(optional)*: null,string - Base64-encoded GCP instance identity document ### GenericResponseDTO [Section titled “GenericResponseDTO”](#genericresponsedto) DTO for a Generic API Response **Type:** object **Properties:** * **success** *(optional)*: boolean - True if the API call was successful, False otherwise * **message** *(optional)*: null,string - Message to indicate why the API call failed * **id** *(optional)*: integer (int32) - Unique identifier of the API response ### HostDTO [Section titled “HostDTO”](#hostdto) Host system information for Client Workload attestation **Type:** object **Properties:** * **hostname** *(optional)*: null,string - Client Workload hostname * **domainName** *(optional)*: null,string - Domain name of the Client Workload host * **process** *(optional)*: any - Process information for Client Workload identification * **sensors** *(optional)*: any - Security sensor data for enhanced Client Workload attestation * **systemSerialNumber** *(optional)*: null,string - Hardware serial number of the Client Workload system * **networkInterfaces** *(optional)*: null,array ### IdentityTokenAttestationDTO [Section titled “IdentityTokenAttestationDTO”](#identitytokenattestationdto) JWT-based identity token attestation for CI/CD platforms **Type:** object **Properties:** * **identityToken** *(optional)*: null,string - Identity token for workload attestation ### K8sDTO [Section titled “K8sDTO”](#k8sdto) Kubernetes-specific attestation data for Kubernetes pod identification **Type:** object **Properties:** * **serviceAccountToken** *(optional)*: null,string - Kubernetes service account JWT token ### LambdaDTO [Section titled “LambdaDTO”](#lambdadto) AWS Lambda function information for serverless workload attestation **Type:** object **Properties:** * **arn** *(optional)*: null,string - AWS Lambda function ARN ### NetworkInterfacesDTO [Section titled “NetworkInterfacesDTO”](#networkinterfacesdto) **Type:** object **Properties:** * **name** *(optional)*: null,string - Name of the network interface * **macAddress** *(optional)*: null,string - MAC address of the network interface * **ipv4Addresses** *(optional)*: null,array - List of IPv4 addresses * **ipv6Addresses** *(optional)*: null,array - List of IPv6 addresses ### OsDTO [Section titled “OsDTO”](#osdto) Operating system environment information for Client Workload attestation **Type:** object **Properties:** * **environment** *(optional)*: any - Environment variables available to the Client Workload ### ProcessDTO [Section titled “ProcessDTO”](#processdto) Process information for Client Workload identification **Type:** object **Properties:** * **name** *(optional)*: null,string - Process name * **pid** *(optional)*: integer (int32) - Process identifier (PID) * **userId** *(optional)*: integer (int32) - User identifier running the process * **userName** *(optional)*: null,string - Username running the process * **exePath** *(optional)*: null,string - Executable file path of the process * **commandLine** *(optional)*: null,string - Command line running the process * **exeHash** *(optional)*: null,string - Executable hash of the process ### SensorsDTO [Section titled “SensorsDTO”](#sensorsdto) Security sensor data for enhanced Client Workload attestation **Type:** object **Properties:** * **crowdStrike** *(optional)*: any - CrowdStrike agent information for endpoint security attestation ### ServerWorkloadDetails [Section titled “ServerWorkloadDetails”](#serverworkloaddetails) Target resource details for which the credential is being requested. These fields are used to match the request against your configured Access Policies. **Type:** object **Properties:** * **transportProtocol** *(optional)*: any - The protocol used to connect to the target resource. Default is TCP. * **host** *(optional)*: null,string - The hostname, IP address, or FQDN of the target resource * **port** *(optional)*: integer (int32) - The port number of the target resource. ### StsGetCallerIdentityDTO [Section titled “StsGetCallerIdentityDTO”](#stsgetcalleridentitydto) AWS STS GetCallerIdentity request data for identity verification **Type:** object **Properties:** * **headers** *(optional)*: null,object - HTTP headers for AWS STS GetCallerIdentity request * **region** *(optional)*: null,string - AWS region for STS GetCallerIdentity request ### TokenDTO [Section titled “TokenDTO”](#tokendto) OAuth2-style access token response with expiration details **Type:** object **Properties:** * **accessToken** *(required)*: string - Bearer token for authenticating subsequent API requests * **refreshToken** *(optional)*: null,string - Refresh token to obtain new access tokens for future API authentication requests * **tokenType** *(required)*: string - Token type, typically ”Bearer” for OAuth2-style tokens * **expiresIn** *(required)*: integer (int32) - Token expiration time in seconds from issuance ### TransportProtocol [Section titled “TransportProtocol”](#transportprotocol) **Type:** string **Possible values:** `TCP`