Skip to content
Console
Menu

Getting Started

Authentication

KV Store

List token exchanges

Lists the credentials issued under a trust policy, newest first.

Lists the credentials issued under a trust policy, newest first.

  • Path GET https://api.sylphx.com/v1/orgs/acme/trust_policies/trust-policy/token_exchanges
  • Scope broker:read
  • Effect read — nothing is written.
  • Collection token_exchanges
  • Query page_size, page_token
  • Pagination the answer carries token_exchanges and, when there is more, next_page_token

#Request

FieldTypeWhat it is
parentstringThe trust policy to list under. Required.
page_sizeint32At most this many; default 50, clamped to 1000.
page_tokenstringnext_page_token of the previous page.

#Response

FieldTypeWhat it is
token_exchangesTokenExchange[]The page, newest first.
next_page_tokenstringThe token of the next page; empty on the last page.

#TokenExchange

FieldTypeWhat it is
namestringorgs/{org}/trust_policies/{trust_policy}/token_exchanges/{token_exchange}.
uidstringtkx_<cell><ulid>; also the {token_exchange} id. Output only.
metaResourceMetaResource metadata.
subjectstringThe accountable principal, orgs/{org}/principals/{id}. Output only.
actorstringThe Agent the subject's delegated grant acted for; empty when the subject exchanged for itself. Output only.
repositorystringThe one repository the credential covers, owner/name. Output only.
permissionsmap<string, string>The permissions the credential carries. Output only.
credential_kindCredentialKindWhat the credential is. Output only. One of access_token, runner_registration.
create_timetimestampWhen it was issued. Output only.
expire_timetimestampWhen the provider stops honoring it. Output only.
revoke_timetimestampWhen the provider confirmed it revoked; unset while live or when it simply expired. Output only.
token_sha256stringLowercase hex SHA-256 of the credential, to match a credential seen elsewhere to its record. Output only.
connectionstringThe Connection the credential was issued on. Output only.
issuerstringThe provider identity that signed it: for GitHub, github-apps/{app_id}. Output only.

#ResourceMeta

FieldTypeWhat it is
generationint64Increases by one on every change to spec. Output only.
etagstringStrong ETag (AIP-154): changes on any change to spec, status, or metadata. Send it back as If-Match or etag to make Update and Delete conditional; a mismatch fails with ABORTED / 409 ETAG_MISMATCH. Output only.
create_timetimestampWhen the Resource was created. Output only.
update_timetimestampWhen the Resource last changed. Output only.
delete_timetimestampSet while the Resource is being deleted. Output only.
labelsmap<string, string>Caller-writable, indexed labels (AIP-122 label rules).
annotationsmap<string, string>Caller-writable, unindexed annotations.
display_namestringCaller-writable human-readable name.
creatorstringThe principal that created the Resource. Output only.

#Errors

Every error arrives in the body Errors describes.

#Examples

curl "https://api.sylphx.com/v1/orgs/acme/trust_policies/trust-policy/token_exchanges" \
  -H "Authorization: Bearer $SYLPHX_API_KEY"