API reference
Request controlled custody for a proposed owned-client credential
A current approved project owner with exact active sponsorship and recent strong authentication records an audited, short-lived intent for the configured runtime. Idempotency-Key scopes retries to the exact actor and body. This response contains only the intent ID and pending custody status. Controlled private delivery and independent registration review remain required.
POST/v1/projects/{project_id}/owned-clients/credential-intents
Authentication Bearer access token with audience taifa-management. Roles and local eligibility are reviewed separately from the OpenAPI bearer scheme.
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
project_id | path | string | Yes | |
idempotency-key | header | string | Yes |
Request body
application/jsonRequiredIntentRequest
| Field | Type | Required | Description |
|---|---|---|---|
reason | string | Yes | Trimmed printable reason recorded in the accepted Audit Validation: min length 8; max length 500 |
client_id | string | Yes | Exact client ID for the proposed registration Validation: min length 1; max length 128 |
client_version | integer | Yes | Proposed registration version, greater than approved history Validation: minimum 1; maximum 9223372036854775807 |
destination_runtime | string | Yes | Exact locally configured custody runtime Validation: min length 1; max length 128 |
Responses
201Successful Response
Content type: application/jsonIntentResponse
| Field | Type | Required | Description |
|---|---|---|---|
id | string · uuid | Yes | Server-generated canonical intent UUID |
custody_status | pending | Yes | Awaiting controlled private custody delivery |
Other responses
| Status | Description | Schema |
|---|---|---|
| 400 | Empty or oversized idempotency key | |
| 401 | Workforce authentication required | |
| 403 | Current owner, sponsorship or recent strong authentication required | |
| 409 | Ambiguous sponsorship, client/version binding or concurrent authority conflict | |
| 410 | Original replayed intent expired, cancelled or authority revoked | |
| 422 | Missing required fields or header, invalid exact payload or audit reason | |
| 503 | Disabled custody source or current local key profile unavailable |
Request example
Illustrative only. TypeScript runs in Node.js on the server. Keep management tokens out of browser bundles. Replace the host, token, path values, and any header or required body placeholders before use. Examples do not send requests.
curl -X POST 'https://YOUR_IDENTITY_HOST/v1/projects/REPLACE_WITH_PROJECT_ID/owned-clients/credential-intents' \
-H 'Authorization: Bearer YOUR_ACCESS_TOKEN' \
-H 'idempotency-key: REPLACE_WITH_IDEMPOTENCY_KEY' \
-H 'Content-Type: application/json' \
--data '{
"reason": "REPLACE_WITH_REASON",
"client_id": "REPLACE_WITH_CLIENT_ID",
"client_version": 0,
"destination_runtime": "REPLACE_WITH_DESTINATION_RUNTIME"
}'Response example
No response example in the current specification.