curl --request POST \
--url https://api.example.com/api/registry/identities \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"slug": "<string>",
"roles": [
"<string>"
],
"description": "",
"allowed_users": [
"<string>"
],
"allowed_roles": [
"<string>"
]
}
'import requests
url = "https://api.example.com/api/registry/identities"
payload = {
"slug": "<string>",
"roles": ["<string>"],
"description": "",
"allowed_users": ["<string>"],
"allowed_roles": ["<string>"]
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
slug: '<string>',
roles: ['<string>'],
description: '',
allowed_users: ['<string>'],
allowed_roles: ['<string>']
})
};
fetch('https://api.example.com/api/registry/identities', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.example.com/api/registry/identities",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'slug' => '<string>',
'roles' => [
'<string>'
],
'description' => '',
'allowed_users' => [
'<string>'
],
'allowed_roles' => [
'<string>'
]
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.example.com/api/registry/identities"
payload := strings.NewReader("{\n \"slug\": \"<string>\",\n \"roles\": [\n \"<string>\"\n ],\n \"description\": \"\",\n \"allowed_users\": [\n \"<string>\"\n ],\n \"allowed_roles\": [\n \"<string>\"\n ]\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.example.com/api/registry/identities")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"slug\": \"<string>\",\n \"roles\": [\n \"<string>\"\n ],\n \"description\": \"\",\n \"allowed_users\": [\n \"<string>\"\n ],\n \"allowed_roles\": [\n \"<string>\"\n ]\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.example.com/api/registry/identities")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"slug\": \"<string>\",\n \"roles\": [\n \"<string>\"\n ],\n \"description\": \"\",\n \"allowed_users\": [\n \"<string>\"\n ],\n \"allowed_roles\": [\n \"<string>\"\n ]\n}"
response = http.request(request)
puts response.read_body{
"id": "<string>",
"slug": "<string>",
"description": "<string>",
"roles": [
"<string>"
],
"allowed_users": [
"<string>"
],
"allowed_roles": [
"<string>"
],
"enabled": true,
"client_id": "<string>",
"service_account_name": "<string>",
"schedules": 123,
"can_use": true,
"created_by": "<string>",
"created_at": "<string>",
"updated_at": "<string>"
}{
"error": "<string>",
"code": 500
}{
"error": "<string>",
"code": 500
}{
"error": "<string>",
"code": 500
}{
"error": "<string>",
"code": 500
}{
"error": "<string>",
"code": 500
}Create a service identity
Creates a Keycloak service account that holds existing realm roles.
A crew schedule set to run as it reads what those roles allow, under the account’s own name. You must hold every role, and none may be built in or carry a Ranger super group. You’re added to the people who may use it.
curl --request POST \
--url https://api.example.com/api/registry/identities \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"slug": "<string>",
"roles": [
"<string>"
],
"description": "",
"allowed_users": [
"<string>"
],
"allowed_roles": [
"<string>"
]
}
'import requests
url = "https://api.example.com/api/registry/identities"
payload = {
"slug": "<string>",
"roles": ["<string>"],
"description": "",
"allowed_users": ["<string>"],
"allowed_roles": ["<string>"]
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
slug: '<string>',
roles: ['<string>'],
description: '',
allowed_users: ['<string>'],
allowed_roles: ['<string>']
})
};
fetch('https://api.example.com/api/registry/identities', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.example.com/api/registry/identities",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'slug' => '<string>',
'roles' => [
'<string>'
],
'description' => '',
'allowed_users' => [
'<string>'
],
'allowed_roles' => [
'<string>'
]
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.example.com/api/registry/identities"
payload := strings.NewReader("{\n \"slug\": \"<string>\",\n \"roles\": [\n \"<string>\"\n ],\n \"description\": \"\",\n \"allowed_users\": [\n \"<string>\"\n ],\n \"allowed_roles\": [\n \"<string>\"\n ]\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.example.com/api/registry/identities")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"slug\": \"<string>\",\n \"roles\": [\n \"<string>\"\n ],\n \"description\": \"\",\n \"allowed_users\": [\n \"<string>\"\n ],\n \"allowed_roles\": [\n \"<string>\"\n ]\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.example.com/api/registry/identities")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"slug\": \"<string>\",\n \"roles\": [\n \"<string>\"\n ],\n \"description\": \"\",\n \"allowed_users\": [\n \"<string>\"\n ],\n \"allowed_roles\": [\n \"<string>\"\n ]\n}"
response = http.request(request)
puts response.read_body{
"id": "<string>",
"slug": "<string>",
"description": "<string>",
"roles": [
"<string>"
],
"allowed_users": [
"<string>"
],
"allowed_roles": [
"<string>"
],
"enabled": true,
"client_id": "<string>",
"service_account_name": "<string>",
"schedules": 123,
"can_use": true,
"created_by": "<string>",
"created_at": "<string>",
"updated_at": "<string>"
}{
"error": "<string>",
"code": 500
}{
"error": "<string>",
"code": 500
}{
"error": "<string>",
"code": 500
}{
"error": "<string>",
"code": 500
}{
"error": "<string>",
"code": 500
}Authorizations
The access token received from the authorization server in the OAuth 2.0 flow.
Body
Make a service identity: a Keycloak service account holding existing realm roles, that crew schedules can run as.
Lowercase letters, digits and hyphens, up to 40. Names the Keycloak client nx1-agent-<slug>; never reused.
^[a-z0-9](?:[a-z0-9-]{0,38}[a-z0-9])?$Existing realm roles it reads as. You must hold each one; built-in roles and Ranger super groups are refused.
1 - 20 elements2000Usernames who may set a schedule to run as it. You are added.
100Realm roles whose holders may set a schedule to run as it.
50Response
Successful Response
A service identity.
The Keycloak client.
The name its runs act as in Trino, Ranger and the AI Router.
Crew schedules set to run as it, enabled or not.
Whether you may set a schedule to run as it.
Username of the admin who made it.
ISO 8601, UTC.
ISO 8601, UTC.
Was this page helpful?

