<SYSTEM>This is the API-Edge-Endpoints section of the Aembit Documentation documentation, as Markdown.</SYSTEM>

# Aembit Edge API - API Endpoints

> API endpoints reference for Aembit Edge API

# Aembit Edge API - API Endpoints

**Version:** v1

**Base URL:** https\://{tenant}.aembit.io

## Auth

### POST /edge/v1/auth

**Summary:** Authenticate to the Edge API

**Description:** Bootstraps a session with the Aembit Edge API. This endpoint authenticates a Client Workload by verifying its identity against a specific Aembit Trust Provider. The Trust Provider must be configured in the Aembit Console to match the environment where the workload is running. Supported Trust Provider types include AWS Metadata Service, AWS Role, GCP Identity Token, GitHub Action ID Token, GitLab Job ID Token, Kubernetes Service Account, OIDC ID Token, and Terraform Cloud Identity Token.

**Operation ID:** edge-api-auth

**Parameters:**

* **X-Aembit-ResourceSet** (header) *(optional)*: string (uuid) - The Resource Set ID corresponding to the Trust Provider you want to authenticate with. If not specified, the default Resource Set will be used.

**Request Body:**

* Content-Type: application/json
* Schema: AuthRequest

**Responses:**

* **200**: Successfully retrieved access token

  * Content-Type: application/json
  * Schema: TokenDTO

* **400**: Invalid request or missing parameters

  * Content-Type: application/json
  * Schema: GenericResponseDTO

* **401**: Unauthorized

  * Content-Type: application/json
  * Schema: GenericResponseDTO

* **429**: Too many authentication requests

  * Content-Type: application/json
  * Schema: GenericResponseDTO

* **500**: Internal server error

  * Content-Type: application/json
  * Schema: GenericResponseDTO

**cURL Example:**

```bash
curl -X POST \
  -H "X-Aembit-ResourceSet: your-resource-set-id" -H "Authorization: Bearer your-access-token" -H "Content-Type: application/json" \
  -d '{"example": "data"}' \
  "https://your-tenant.aembit.io/edge/v1/auth"
```

## Credentials

### POST /edge/v1/credentials

**Summary:** Get credentials for a Client Workload

**Description:** Retrieves credentials for a Client Workload based on configured Access Policies

**Operation ID:** edge-api-get-credentials

**Parameters:**

* **X-Aembit-ResourceSet** (header) *(optional)*: string (uuid) - The Resource Set ID of the Access Policy to be used for this credential request. If not specified, the default Resource Set will be used.

**Request Body:**

* Content-Type: application/json
* Schema: ApiCredentialsRequest

**Responses:**

* **200**: Credentials returned for specified Client Workload

  * Content-Type: application/json
  * Schema: ApiCredentialsResponse

* **400**: Invalid request or missing parameters

  * Content-Type: application/json
  * Schema: GenericResponseDTO

* **401**: Unauthorized access

  * Content-Type: application/json
  * Schema: GenericResponseDTO

* **403**: Not applicable for this request

  * Content-Type: application/json
  * Schema: GenericResponseDTO

* **404**: No client/server workload or access policy was found. Response will be of type ApiCredentialsResponse with credential type set to Unknown

  * Content-Type: application/json
  * Schema: ApiCredentialsResponse

* **429**: Too many credential requests

  * Content-Type: application/json
  * Schema: GenericResponseDTO

* **500**: Internal server error

  * Content-Type: application/json
  * Schema: GenericResponseDTO

**cURL Example:**

```bash
curl -X POST \
  -H "X-Aembit-ResourceSet: your-resource-set-id" -H "Content-Type: application/json" \
  -d '{"example": "data"}' \
  "https://your-tenant.aembit.io/edge/v1/credentials"
```