API-Edge-Schemas: API schemas reference for Aembit Edge # Aembit Edge API - Data Schemas > Data schemas and models for Aembit Edge API # Aembit Edge API - Data Schemas [Section titled “Aembit Edge API - Data Schemas”](#aembit-edge-api---data-schemas) **Version:** v1 ### ApiCredentialsRequest [Section titled “ApiCredentialsRequest”](#apicredentialsrequest) Request payload for retrieving credentials for a Client Workload **Type:** object **Properties:** * **client** *(required)*: ClientWorkloadDetails - Identity and attestation details for the client workload requesting credentials. Populate this object with the same workload identity context used for /edge/v1/auth, including any platform-specific attestation fields required for that workload type (for example, Kubernetes service account token, OIDC identity token, or cloud instance attestation data). These fields are evaluated as part of access policy matching for the credentials request. * **server** *(required)*: ServerWorkloadDetails - Target resource details for which the credential is being requested. * **credentialType** *(required)*: CredentialProviderTypes - Type of credential being requested from your configured Credential Provider * **connectionMetadata** *(optional)*: ConnectionMetadata - Filter values to be used if your access policy is configured with multiple credential providers * **certSigningRequest** *(optional)*: string | null ### ApiCredentialsResponse [Section titled “ApiCredentialsResponse”](#apicredentialsresponse) Response containing credentials that a Client Workload requests with expiration details **Type:** object **Properties:** * **credentialType** *(optional)*: CredentialProviderTypes - Type of credential returned by your configured Credential Provider * **expiresAt** *(optional)*: string (date-time) | null - Token expiration time in ISO 8601 format, null for non-expiring credentials * **data** *(optional)*: EdgeCredentials - Credential data returned by your configured Credential Provider ### AuthRequest [Section titled “AuthRequest”](#authrequest) Identity and attestation information for Client Workload authentication. This request initiates a session with the Aembit Edge API by providing proof of workload identity via a configured Trust Provider. **Type:** object **Properties:** * **clientId** *(required)*: string - The Aembit ARN of the Trust Provider configured to attest this workload. Format: ‘aembit:{stack}:{tenant}:identity:{type}:{uuid}’ Where to find it: In the Aembit Admin UI, navigate to ‘Trust Providers’, select your provider, and copy the value from the ‘ID’ field. * **client** *(required)*: ClientWorkloadDetails - Client Workload identifiers for authentication ### AwsDTO [Section titled “AwsDTO”](#awsdto) AWS-specific attestation data for Client Workload identification **Type:** object **Properties:** * **instanceIdentityDocument** *(optional)*: string | null - Base64-encoded AWS instance identity document * **instanceIdentityDocumentSignature** *(optional)*: string | null - Base64-encoded signature for AWS instance identity document verification * **lambda** *(optional)*: LambdaDTO - AWS Lambda function information for serverless workload attestation * **ecs** *(optional)*: AwsEcsDTO - AWS ECS container and task metadata for workload attestation * **stsGetCallerIdentity** *(optional)*: StsGetCallerIdentityDTO - AWS STS GetCallerIdentity request data for identity verification ### AwsEcsDTO [Section titled “AwsEcsDTO”](#awsecsdto) AWS ECS container and task metadata for workload attestation **Type:** object **Properties:** * **containerMetadata** *(optional)*: string | null - JSON string containing AWS ECS container metadata * **taskMetadata** *(optional)*: string | null - JSON string containing AWS ECS task metadata ### AzureAttestationDTO [Section titled “AzureAttestationDTO”](#azureattestationdto) Azure-specific attestation data for Client Workload identification **Type:** object **Properties:** * **attestedDocument** *(optional)*: AzureAttestedDocumentDTO - Azure Instance Metadata Service (IMDS) Attested Data document. ### AzureAttestedDocumentDTO [Section titled “AzureAttestedDocumentDTO”](#azureattesteddocumentdto) Azure Instance Metadata Service (IMDS) Attested Data document. **Type:** object **Properties:** * **encoding** *(optional)*: string | null - The encoding of the IMDS document. * **signature** *(optional)*: string | null - The Base64-encoded signature (PKCS7 container) returned by the Azure IMDS ‘document’ field. * **nonce** *(optional)*: string | null - The cryptographic nonce passed to the IMDS endpoint. ### ClientWorkloadDetails [Section titled “ClientWorkloadDetails”](#clientworkloaddetails) Identity and attestation information for a Client Workload requesting credentials **Type:** object **Properties:** * **sourceIP** *(optional)*: string | null - IP address of the requesting Client Workload * **aws** *(optional)*: AwsDTO - AWS-specific attestation data for Client Workload identification * **azure** *(optional)*: AzureAttestationDTO - Azure-specific attestation data for Client Workload identification * **gcp** *(optional)*: GcpAttestationDTO - GCP-specific attestation data for Client Workload identification * **os** *(optional)*: OsDTO - Operating system environment information for Client Workload attestation * **k8s** *(optional)*: K8sDTO - Kubernetes-specific attestation data for Kubernetes pod identification * **host** *(optional)*: HostDTO - Host system information for Client Workload attestation * **github** *(optional)*: IdentityTokenAttestationDTO - JWT-based identity token attestation for CI/CD platforms * **terraform** *(optional)*: IdentityTokenAttestationDTO - JWT-based identity token attestation for CI/CD platforms * **gitlab** *(optional)*: IdentityTokenAttestationDTO - JWT-based identity token attestation for CI/CD platforms * **oidc** *(optional)*: IdentityTokenAttestationDTO - JWT-based identity token attestation for CI/CD platforms ### ConnectionMetadata [Section titled “ConnectionMetadata”](#connectionmetadata) Filter for multi-credential provider access policy credential request **Type:** object **Properties:** * **accountName** *(optional)*: string | null - The Snowflake username to filter on * **accessKeyId** *(optional)*: string | null - The AWS access key ID to filter on * **headerName** *(optional)*: string | null - The Header Name to filter on * **headerValue** *(optional)*: string | null - The Header Value to filter on * **httpBodyFieldPath** *(optional)*: string | null - The HTTP Body Field Path to filter on * **httpBodyFieldValue** *(optional)*: string | null - The HTTP Body Field Value to filter on ### CredentialProviderTypes [Section titled “CredentialProviderTypes”](#credentialprovidertypes) Type of credential being requested from your configured Credential Provider. Note: Use ‘OAuthToken’ for Azure Entra ID, Microsoft, and generic OAuth2 providers. **Type:** string **Possible values:** `Unknown`, `ApiKey`, `UsernamePassword`, `GoogleWorkloadIdentityFederation`, `OAuthToken`, `AwsStsFederation`, `X509Svid` ### CrowdStrikeDTO [Section titled “CrowdStrikeDTO”](#crowdstrikedto) CrowdStrike agent information for endpoint security attestation **Type:** object **Properties:** * **agentId** *(optional)*: string | null - Unique identifier for the CrowdStrike agent ### EdgeCredentials [Section titled “EdgeCredentials”](#edgecredentials) ```plaintext Credential data returned to Client Workloads based on your configured Credential Providers For AWS (AwsStsFederation), look in the aws* fields. For API Key and Username/Password, look in their respective fields. For all other types (GCP, OAuth, OIDC, Aembit), the result is in the 'token' field. ``` **Type:** object **Properties:** * **apiKey** *(optional)*: string | null - API key credential for authenticating to target services * **token** *(optional)*: string | null - Bearer token credential for authenticating to target services/ This field contains the result for: GoogleWorkloadIdentityFederation (GCP WIF Token), GitLab, GitHub, and generic JWT/OIDC credentials. * **username** *(optional)*: string | null - Username for basic authentication credentials * **password** *(optional)*: string | null - Password for basic authentication credentials * **awsAccessKeyId** *(optional)*: string | null - AWS access key ID for programmatic access * **awsSecretAccessKey** *(optional)*: string | null - AWS secret access key for programmatic access * **awsSessionToken** *(optional)*: string | null - AWS session token for temporary credentials ### EnvironmentDTO [Section titled “EnvironmentDTO”](#environmentdto) Environment variables available to the Client Workload **Type:** object **Properties:** * **K8S\_POD\_NAME** *(optional)*: string | null - Kubernetes pod name environment variable * **CLIENT\_WORKLOAD\_ID** *(optional)*: string | null - Aembit Client Workload identifier environment variable * **KUBERNETES\_PROVIDER\_ID** *(optional)*: string | null - Kubernetes Trust Provider identifier environment variable * **AEMBIT\_RESOURCE\_SET\_ID** *(optional)*: string | null - Aembit Resource Set identifier environment variable ### GcpAttestationDTO [Section titled “GcpAttestationDTO”](#gcpattestationdto) GCP-specific attestation data for Client Workload identification **Type:** object **Properties:** * **identityToken** *(optional)*: string | null - Identity token for workload attestation * **instanceDocument** *(optional)*: string | null - Base64-encoded GCP instance identity document ### GenericResponseDTO [Section titled “GenericResponseDTO”](#genericresponsedto) DTO for a Generic API Response **Type:** object **Properties:** * **success** *(optional)*: boolean - True if the API call was successful, False otherwise * **message** *(optional)*: string | null - Message to indicate why the API call failed * **id** *(optional)*: integer (int32) - Unique identifier of the API response ### HostDTO [Section titled “HostDTO”](#hostdto) Host system information for Client Workload attestation **Type:** object **Properties:** * **hostname** *(optional)*: string | null - Client Workload hostname * **domainName** *(optional)*: string | null - Domain name of the Client Workload host * **process** *(optional)*: ProcessDTO - Process information for Client Workload identification * **sensors** *(optional)*: SensorsDTO - Security sensor data for enhanced Client Workload attestation * **systemSerialNumber** *(optional)*: string | null - Hardware serial number of the Client Workload system * **networkInterfaces** *(optional)*: Array | null ### IdentityTokenAttestationDTO [Section titled “IdentityTokenAttestationDTO”](#identitytokenattestationdto) JWT-based identity token attestation for CI/CD platforms **Type:** object **Properties:** * **identityToken** *(optional)*: string | null - Identity token for workload attestation ### K8sDTO [Section titled “K8sDTO”](#k8sdto) Kubernetes-specific attestation data for Kubernetes pod identification **Type:** object **Properties:** * **serviceAccountToken** *(optional)*: string | null - Kubernetes service account JWT token ### LambdaDTO [Section titled “LambdaDTO”](#lambdadto) AWS Lambda function information for serverless workload attestation **Type:** object **Properties:** * **arn** *(optional)*: string | null - AWS Lambda function ARN ### NetworkInterfacesDTO [Section titled “NetworkInterfacesDTO”](#networkinterfacesdto) **Type:** object **Properties:** * **name** *(optional)*: string | null - Name of the network interface * **macAddress** *(optional)*: string | null - MAC address of the network interface * **ipv4Addresses** *(optional)*: Array | null - List of IPv4 addresses * **ipv6Addresses** *(optional)*: Array | null - List of IPv6 addresses ### OsDTO [Section titled “OsDTO”](#osdto) Operating system environment information for Client Workload attestation **Type:** object **Properties:** * **environment** *(optional)*: EnvironmentDTO - Environment variables available to the Client Workload ### ProcessDTO [Section titled “ProcessDTO”](#processdto) Process information for Client Workload identification **Type:** object **Properties:** * **name** *(optional)*: string | null - Process name * **pid** *(optional)*: integer (int32) - Process identifier (PID) * **userId** *(optional)*: integer (int32) - User identifier running the process * **userName** *(optional)*: string | null - Username running the process * **exePath** *(optional)*: string | null - Executable file path of the process * **commandLine** *(optional)*: string | null - Command line running the process * **exeHash** *(optional)*: string | null - Executable hash of the process ### SensorsDTO [Section titled “SensorsDTO”](#sensorsdto) Security sensor data for enhanced Client Workload attestation **Type:** object **Properties:** * **crowdStrike** *(optional)*: CrowdStrikeDTO - CrowdStrike agent information for endpoint security attestation ### ServerWorkloadDetails [Section titled “ServerWorkloadDetails”](#serverworkloaddetails) Target resource details for which the credential is being requested. These fields are used to match the request against your configured Access Policies. **Type:** object **Properties:** * **transportProtocol** *(optional)*: TransportProtocol - The protocol used to connect to the target resource. Default is TCP. * **host** *(optional)*: string | null - The hostname, IP address, or FQDN of the target resource * **port** *(optional)*: integer (int32) - The port number of the target resource. ### StsGetCallerIdentityDTO [Section titled “StsGetCallerIdentityDTO”](#stsgetcalleridentitydto) AWS STS GetCallerIdentity request data for identity verification **Type:** object **Properties:** * **headers** *(optional)*: object | null - HTTP headers for AWS STS GetCallerIdentity request * **region** *(optional)*: string | null - AWS region for STS GetCallerIdentity request ### TokenDTO [Section titled “TokenDTO”](#tokendto) OAuth2-style access token response with expiration details **Type:** object **Properties:** * **accessToken** *(required)*: string - Bearer token for authenticating subsequent API requests * **refreshToken** *(optional)*: string | null - Refresh token to obtain new access tokens for future API authentication requests * **tokenType** *(required)*: string - Token type, typically ‘Bearer’ for OAuth2-style tokens * **expiresIn** *(required)*: integer (int32) - Token expiration time in seconds from issuance ### TransportProtocol [Section titled “TransportProtocol”](#transportprotocol) **Type:** string **Possible values:** `TCP`