Skip to content
CantoraAPI documentation
POST
/v1/organizations/{organizationId}/first-identity

Provision an Organization's first authenticated caller

Create the first Organization-scoped ServicePrincipal, Admin Grant, and API key, returning the key exactly once. This operation is for Cantora operators.

Authentication

Send an API key as a Bearer token in the Authorization header.

Parameters

NameLocationRequiredDescription
organizationIdpathYes
The Organization to address.
string
All of
  • maximum length 64
A Cantora Organization identifier, prefixed with `org_`.
  • pattern ^org_[\s\S]+$

Responses

201OrganizationIdentityProvisioned
application/json
OrganizationIdentityProvisionedJsonEncoding
401Unauthorized
application/json
UnauthorizedJsonEncoding
403Forbidden
application/json
ForbiddenJsonEncoding
404NotFound
application/json
NotFoundJsonEncoding
409Conflict
application/json
ConflictJsonEncoding

Reusable schemas

OrganizationIdentityProvisionedJsonEncoding

object
  • unknown properties allowed false
organizationIdrequired
stringThe Organization identifier.
All of
  • maximum length 64
A Cantora Organization identifier, prefixed with `org_`.
  • pattern ^org_[\s\S]+$
principalIdrequired
stringThe Principal identifier.
All of
  • maximum length 64
A Cantora Principal identifier, prefixed with `principal_`.
  • pattern ^principal_[\s\S]+$
grantIdrequired
stringThe identifier of the Grant issued with the identity.
All of
  • maximum length 64
A Cantora Grant identifier, prefixed with `grant_`.
  • pattern ^grant_[\s\S]+$
rolerequired
stringThe Organization role granted to the provisioned identity.
  • allowed values "admin"
apiKeyIdrequired
stringThe identifier of the issued API key.
All of
  • maximum length 64
A Cantora API key identifier, prefixed with `apikey_`.
  • pattern ^apikey_[\s\S]+$
apiKeyrequired
stringThe Organization's initial provisioning credential, returned exactly once
expiresAtrequired
stringWhen the issued API key expires, in UTC.
  • format date-time

UnauthorizedJsonEncoding

object
  • unknown properties allowed false
_tagrequired
stringThe stable machine-readable error type.
  • allowed values "Unauthorized"
reasonrequired
stringA safe explanation of why the credential was rejected.

ForbiddenJsonEncoding

object
  • unknown properties allowed false
_tagrequired
stringThe stable machine-readable error type.
  • allowed values "Forbidden"
permissionrequired
stringThe permission required by the refused operation.

NotFoundJsonEncoding

object
  • unknown properties allowed false
_tagrequired
stringThe stable machine-readable error type.
  • allowed values "NotFound"
resourcerequired
stringThe resource type relevant to the error.
idrequired
stringThe identifier supplied for the resource that was not found.

ConflictJsonEncoding

object
  • unknown properties allowed false
_tagrequired
stringThe stable machine-readable error type.
  • allowed values "Conflict"
resourcerequired
stringThe resource type relevant to the error.
reasonrequired
stringA safe explanation of the state conflict.