Agent

Agent-authenticated endpoints

Create vended roles

post

Creates vended roles on-behalf-of a user across the requested platforms. Roles are provisioned asynchronously and torn down when the TTL expires.

Body

usernamestring · min: 1Required

Username of the user to vend roles on behalf of

iamIdstring · min: 1Optional

Identity provider to disambiguate the user with, when the username matches more than one identity

ttlanyOptional

How long the vended roles remain valid, in milliseconds. Between 1m and 24h. Defaults to 1h

Default: 3600000

Responses

201Success

application/json

requestIdstring · uuidRequired

Identifier of the vending request, used to fetch or tear down the roles

createdAtstring · date-timeRequired

When the roles were requested, as an ISO 8601 timestamp

expiresAtstring · date-timeRequired

When the roles are torn down, as an ISO 8601 timestamp

default

Error

application/json

post/agents/roles

POST /agents/roles HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 115

{
  "username": "text",
  "iamId": "text",
  "ttl": 3600000,
  "platforms": [
    {
      "technology": "Snowflake",
      "connectionKeys": [
        "text"
      ]
    }
  ]
}

{
  "requestId": "123e4567-e89b-12d3-a456-426614174000",
  "createdAt": "2026-01-01T00:00:00.000Z",
  "expiresAt": "2026-01-01T00:00:00.000Z",
  "roles": [
    {
      "id": "123e4567-e89b-12d3-a456-426614174000",
      "name": "text",
      "technology": "Snowflake",
      "connectionKey": "text",
      "status": "CREATING",
      "metadata": {
        "roleName": "text"
      }
    }
  ]
}

Get vended roles

get

Returns the roles vended for a request, including their current provisioning status.

Path parameters

idstring · uuidRequired

Identifier of the vending request, as returned when the roles were created

Responses

200Success

application/json

requestIdstring · uuidRequired

Identifier of the vending request, used to fetch or tear down the roles

createdAtstring · date-timeRequired

When the roles were requested, as an ISO 8601 timestamp

expiresAtstring · date-timeRequired

When the roles are torn down, as an ISO 8601 timestamp

default

Error

application/json

get/agents/roles/{id}

GET /agents/roles/{id} HTTP/1.1
Accept: */*

{
  "requestId": "123e4567-e89b-12d3-a456-426614174000",
  "createdAt": "2026-01-01T00:00:00.000Z",
  "expiresAt": "2026-01-01T00:00:00.000Z",
  "roles": [
    {
      "id": "123e4567-e89b-12d3-a456-426614174000",
      "name": "text",
      "technology": "Snowflake",
      "connectionKey": "text",
      "status": "CREATING",
      "metadata": {
        "roleName": "text"
      }
    }
  ]
}

Tear down vended roles

delete

Initiates teardown of the roles vended for a request, ahead of their TTL. Teardown proceeds asynchronously.

Path parameters

idstring · uuidRequired

Identifier of the vending request, as returned when the roles were created

Responses

204Success

No content

default

Error

application/json

delete/agents/roles/{id}

DELETE /agents/roles/{id} HTTP/1.1
Accept: */*

No content