Aembit Edge API - Data Schemas
Section titled “Aembit Edge API - Data Schemas”Version: v1
ApiCredentialsRequest
Section titled “ApiCredentialsRequest”Request payload for retrieving credentials for a Client Workload
Type: object
Properties:
- client (optional): any
- server (optional): any
- credentialType (optional): any
ApiCredentialsResponse
Section titled “ApiCredentialsResponse”Response containing credentials that a Client Workload requests with expiration details
Type: object
Properties:
- credentialType (optional): any
- expiresAt (optional): string (date-time) | null - Token expiration time in ISO 8601 format, null for non-expiring credentials
- data (optional): any
AuthRequest
Section titled “AuthRequest”Identity and attestation information for Client Workload authentication
Type: object
Properties:
- clientId (optional): string | null - Trust Provider Client Id for authentication
- client (optional): any
AwsDTO
Section titled “AwsDTO”AWS-specific attestation data for Client Workload identification
Type: object
Properties:
- instanceIdentityDocument (optional): string | null - Base64-encoded AWS instance identity document
- instanceIdentityDocumentSignature (optional): string | null - Base64-encoded signature for AWS instance identity document verification
- lambda (optional): any
- ecs (optional): any
- stsGetCallerIdentity (optional): any
AwsEcsDTO
Section titled “AwsEcsDTO”AWS ECS container and task metadata for workload attestation
Type: object
Properties:
- containerMetadata (optional): string | null - JSON string containing AWS ECS container metadata
- taskMetadata (optional): string | null - JSON string containing AWS ECS task metadata
AzureAttestationDTO
Section titled “AzureAttestationDTO”Azure-specific attestation data for Client Workload identification
Type: object
Properties:
- attestedDocument (optional): any
AzureAttestedDocumentDTO
Section titled “AzureAttestedDocumentDTO”Azure attested document with signature and nonce for verification
Type: object
Properties:
- encoding (optional): string | null - Encoding format of the Azure attestation document
- signature (optional): string | null - Digital signature for Azure attestation document verification
- nonce (optional): string | null - Cryptographic nonce for Azure attestation document freshness
ClientWorkloadDetails
Section titled “ClientWorkloadDetails”Identity and attestation information for a Client Workload requesting credentials
Type: object
Properties:
- sourceIP (optional): string | null - IP address of the requesting Client Workload
- aws (optional): any
- azure (optional): any
- gcp (optional): any
- os (optional): any
- k8s (optional): any
- host (optional): any
- github (optional): any
- terraform (optional): any
- gitlab (optional): any
- oidc (optional): any
CredentialProviderTypes
Section titled “CredentialProviderTypes”Type of credential being requested from your configured Credential Provider
Type: string
Possible values: Unknown, ApiKey, UsernamePassword, GoogleWorkloadIdentityFederation, OAuthToken, AwsStsFederation
CrowdStrikeDTO
Section titled “CrowdStrikeDTO”CrowdStrike agent information for endpoint security attestation
Type: object
Properties:
- agentId (optional): string | null - Unique identifier for the CrowdStrike agent
EdgeCredentials
Section titled “EdgeCredentials”Credential data returned to Client Workloads based on your configured Credential Providers
Type: object
Properties:
- apiKey (optional): string | null - API key credential for authenticating to target services
- token (optional): string | null - Bearer token credential for authenticating to target services
- username (optional): string | null - Username for basic authentication credentials
- password (optional): string | null - Password for basic authentication credentials
- awsAccessKeyId (optional): string | null - AWS access key ID for programmatic access
- awsSecretAccessKey (optional): string | null - AWS secret access key for programmatic access
- awsSessionToken (optional): string | null - AWS session token for temporary credentials
EnvironmentDTO
Section titled “EnvironmentDTO”Environment variables available to the Client Workload
Type: object
Properties:
- K8S_POD_NAME (optional): string | null - Kubernetes pod name environment variable
- CLIENT_WORKLOAD_ID (optional): string | null - Aembit Client Workload identifier environment variable
- KUBERNETES_PROVIDER_ID (optional): string | null - Kubernetes Trust Provider identifier environment variable
- AEMBIT_RESOURCE_SET_ID (optional): string | null - Aembit Resource Set identifier environment variable
GcpAttestationDTO
Section titled “GcpAttestationDTO”GCP-specific attestation data for Client Workload identification
Type: object
Properties:
- identityToken (optional): string | null - Identity token for workload attestation
- instanceDocument (optional): string | null - Base64-encoded GCP instance identity document
GenericResponseDTO
Section titled “GenericResponseDTO”DTO for a Generic API Response
Type: object
Properties:
- success (optional): boolean - True if the API call was successful, False otherwise
- message (optional): string | null - Message to indicate why the API call failed
- id (optional): integer (int32) - Unique identifier of the API response
HostDTO
Section titled “HostDTO”Host system information for Client Workload attestation
Type: object
Properties:
- hostname (optional): string | null - Client Workload hostname
- domainName (optional): string | null - Domain name of the Client Workload host
- process (optional): any
- sensors (optional): any
- systemSerialNumber (optional): string | null - Hardware serial number of the Client Workload system
- networkInterfaces (optional): Array
IdentityTokenAttestationDTO
Section titled “IdentityTokenAttestationDTO”JWT-based identity token attestation for CI/CD platforms
Type: object
Properties:
- identityToken (optional): string | null - Identity token for workload attestation
K8sDTO
Section titled “K8sDTO”Kubernetes-specific attestation data for Kubernetes pod identification
Type: object
Properties:
- serviceAccountToken (optional): string | null - Kubernetes service account JWT token
LambdaDTO
Section titled “LambdaDTO”AWS Lambda function information for serverless workload attestation
Type: object
Properties:
- arn (optional): string | null - AWS Lambda function ARN
NetworkInterfacesDTO
Section titled “NetworkInterfacesDTO”Type: object
Properties:
- name (optional): string | null
- macAddress (optional): string | null
- ipv4Addresses (optional): Array
- ipv6Addresses (optional): Array
Operating system environment information for Client Workload attestation
Type: object
Properties:
- environment (optional): any
ProcessDTO
Section titled “ProcessDTO”Process information for Client Workload identification
Type: object
Properties:
- name (optional): string | null - Process name
- pid (optional): integer (int32) - Process identifier (PID)
- userId (optional): integer (int32) - User identifier running the process
- userName (optional): string | null - Username running the process
- exePath (optional): string | null - Executable file path of the process
SensorsDTO
Section titled “SensorsDTO”Security sensor data for enhanced Client Workload attestation
Type: object
Properties:
- crowdStrike (optional): any
ServerWorkloadDetails
Section titled “ServerWorkloadDetails”Target server connection details for credential requests
Type: object
Properties:
- transportProtocol (optional): any
- host (optional): string | null - Target server hostname or IP address
- port (optional): integer (int32) - Target server port number
StsGetCallerIdentityDTO
Section titled “StsGetCallerIdentityDTO”AWS STS GetCallerIdentity request data for identity verification
Type: object
Properties:
- headers (optional): object | null - HTTP headers for AWS STS GetCallerIdentity request
- region (optional): string | null - AWS region for STS GetCallerIdentity request
TokenDTO
Section titled “TokenDTO”OAuth2-style access token response with expiration details
Type: object
Properties:
- accessToken (optional): string | null - Bearer token for authenticating subsequent API requests
- tokenType (optional): string | null - Token type, typically ”Bearer” for OAuth2-style tokens
- expiresIn (optional): integer (int32) - Token expiration time in seconds from issuance
TransportProtocol
Section titled “TransportProtocol”Type: string
Possible values: TCP