Manage AI Identities

Treat every AI agent and workload as a first-class enterprise identity with an owner, auth method and lifecycle.

An AI Identity is the enterprise identity behind an agent or workload — the thing that authenticates, carries a trust score, and moves through a lifecycle. It is how AuthSpoke brings AI into the same identity fabric as your humans and services.

1. Provision an identity#

curl -X POST "https://your-company.authspoke.com/api/v1/ai/identities" \
  -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
  -d '{
    "name": "svc-support-copilot",
    "identityType": "SERVICE",
    "authMethod": "OAUTH",
    "owner": "[email protected]",
    "lifecycleState": "ACTIVE",
    "federated": false,
    "description": "Service identity backing the support copilot"
  }'

identityType — SERVICE, WORKLOAD, OIDC, or HUMAN_DELEGATED. authMethod — OAUTH, MTLS, API_KEY, or JWT. lifecycleState — PROVISIONED → ACTIVE → SUSPENDED → RETIRED.

2. Federated / workload identities#

For workloads that already have an external identity (SPIFFE, an OIDC subject, or an mTLS certificate), record it so AuthSpoke can correlate:

curl -X POST "https://your-company.authspoke.com/api/v1/ai/identities" \
  -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
  -d '{
    "name": "wl-code-review-bot",
    "identityType": "WORKLOAD",
    "authMethod": "MTLS",
    "owner": "[email protected]",
    "federated": true,
    "oidcSubject": "spiffe://acme.example/ns/ci/sa/code-review",
    "certificateThumbprint": "A1:B2:C3:…",
    "lifecycleState": "ACTIVE"
  }'

You can also link an identity to a registered agent by setting agentId, and to a machine credential via clientId.

3. List, update, retire#

curl -s "https://your-company.authspoke.com/api/v1/ai/identities" -H "Authorization: Bearer $TOKEN"
curl -s -X PUT "https://your-company.authspoke.com/api/v1/ai/identities/$ID" -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" -d '{ "name":"svc-support-copilot", "lifecycleState":"SUSPENDED" }'
curl -s -X DELETE "https://your-company.authspoke.com/api/v1/ai/identities/$ID" -H "Authorization: Bearer $TOKEN"

Create emits IDENTITY_CREATED; update emits IDENTITY_UPDATED; delete emits IDENTITY_DELETED.

Console#

Enterprise AI → Identities lists every AI identity with its type, auth method, owner and lifecycle state.