Get workload identity

Read a service’s workload identity: whether it is on, and the issuer, subject and audience a cloud trust policy needs.

GET/api/services/{id}/workload-identityHTTPS

Request & response examples

Request exampleServer-side

curl --fail-with-body --request GET \
  'https://app.helicarrier.xyz/api/services/YOUR_ID/workload-identity' \
  -H "Authorization: Bearer $HELI_API_KEY"

const response = await fetch(
  "https://app.helicarrier.xyz/api/services/YOUR_ID/workload-identity",
  {
    method: "GET",
    headers: {
      Authorization: `Bearer ${process.env.HELI_API_KEY}`
    }
  }
);
const data = await response.json();
if (!response.ok) {
  throw new Error(`HTTP ${response.status}: ${data.error}`);
}
// Inspect data; avoid logging secret responses.

import os
import requests

response = requests.request(
    "GET",
    "https://app.helicarrier.xyz/api/services/YOUR_ID/workload-identity",
    headers={
        "Authorization": f"Bearer {os.environ['HELI_API_KEY']}"
    },
    timeout=30,
)
response.raise_for_status()
data = response.json()
# Inspect data; avoid logging secret responses.

Response example200

{
  "enabled": true,
  "issuer": "https://app.helicarrier.xyz/oidc/svc_example",
  "subject": "account:acct_example:project:prj_example:service:svc_example:env:env_example",
  "audience": "sts.amazonaws.com",
  "ttlSeconds": 900,
  "tokenPath": "/var/run/heli/oidc-token"
}

Illustrative values · selected fields

Response details OpenAPI

Authorization

An account key with access to the resource. Project and service keys do not authorize this operation.

Authorization: Bearer <key>Key setup

Path parameters

idstringrequired

Service id.

Response 200

Returns enabled: false when the service has not opted in. When on, put the issuer and subject in your cloud’s trust policy and require both; the token file is read-only inside the container.

Examples show selected response fields with illustrative values. Your response can contain additional fields.

enabledboolean

issuerstring

subjectstring

audiencestring

ttlSecondsinteger

tokenPathstring

Errors

401

The API key is missing, invalid, or revoked.

403

The caller or key scope does not permit this operation.

Error handling and safe retries

ALSO AVAILABLE VIA MCP

`get_workload_identity`

Required MCP arguments: id. Send path, query, and body fields together as tool arguments.

Connect your agent

import os import requests response = requests.request( "GET", "https://app.helicarrier.xyz/api/services/YOUR_ID/workload-identity", headers={ "Authorization": f"Bearer {os.environ['HELI_API_KEY']}" }, timeout=30, ) response.raise_for_status() data = response.json() # Inspect data; avoid logging secret responses.

{ "enabled": true, "issuer": "https://app.helicarrier.xyz/oidc/svc_example", "subject": "account:acct_example:project:prj_example:service:svc_example:env:env_example", "audience": "sts.amazonaws.com", "ttlSeconds": 900, "tokenPath": "/var/run/heli/oidc-token" }