Trustplane HTTP Request icon

Trustplane HTTP Request

Send Trustplane-signed HTTP requests and auto-enroll via trust anchors

Actions2

Auto Enroll (Trust Anchor)

AI-generated

Summary

Auto-enroll trust anchor via Trustplane control plane, generating or reusing Ed25519 credentials

Inputs

  • controlBaseUrl (required) — Base URL that exposes POST /enroll-requests
  • enrollTenantId (required) — Must already exist under tenant
  • enrollClientId (required) — Must already exist under tenant
  • enrollApiId — Included in output tpAuth for downstream signed requests
  • enrollScopes — Optional. Example: contacts:read,deals:read
  • proofKind — Proof kind for trust anchor
  • proofPayload — Trust-anchor proof token/payload. For OIDC, JWT. If empty and OIDC, TP_OIDC_TOKEN env is used when enabled.
  • useEnvProofFallback — Use TP_OIDC_TOKEN env or IMDS fallback when proofPayload is empty
  • autoApprove — Auto-approve the enrollment request
  • expectedKeyTTLSeconds — Used by cache reuse logic; after this window a new enrollment is performed
  • refreshSkewSeconds — Refresh a little before expiry to avoid edge failures
  • reuseExistingEnrollment — Reuse cached or credential auth material if present instead of creating a new key
  • forceReEnroll — Ignore cached/credential key and always generate a new key + enrollment request

Output shape

tpAuth enrollment metadata pair

Returns ok, reused flag, reuseSource, enrollment {requestId, status, approved, keyId, reason}, and tpAuth {tenantId, apiId, clientId, keyId, privateKey, publicKey, bucketSeconds, enrolledAt, keyTtlSeconds, keyExpiresAt}. If reusable enrollment exists and is fresh (within TTL minus skew), returns cached auth; otherwise generates Ed25519 key pair, POSTs to {controlBaseUrl}/enroll-requests, validates approval and key_id, caches result, and returns the pair. proofPayload falls back to TP_OIDC_TOKEN env or IMDS when enabled and empty.

Links

Discussion