Service identities

IMPLEMENTED in 0.4.0. See Authorization model for the full capability matrix.

Production applications and CI should never hold a person's credential. Create a service identity scoped to one Project:

# Application: resolve, expand, report consumption and outcome — in named environments only
curl -X POST "$REGISTRY/v1/service-identities" -H "authorization: Bearer $ADMIN" -H 'content-type: application/json' \
  -d '{"id":"support-backend","type":"application","name":"Support backend","project":"cp-…","environments":["production"]}'
curl -X POST "$REGISTRY/v1/service-identities/support-backend/credentials" -H "authorization: Bearer $ADMIN" -H 'content-type: application/json' -d '{}'
# → {"token":"scw_app_…","credential":{"id":"cred_…","hint":"…1sJQ"},"notice":"Shown once…"}

The token is returned once. Store it in your application's secret manager; the Registry keeps only its digest. Then:

client = ContextClient.for_environment(REGISTRY, PROJECT, "production", APP_TOKEN)
context = client.resolve("support-agent", "answer-customer", {"message": msg, "customerId": "CUST-1042"})

const client = ContextClient.forEnvironment(REGISTRY, PROJECT, 'production', APP_TOKEN);

The same credential is refused (403, audited as access.denied) for registration, promotion, deployment, rollback, approval, bindings, members, traces and audit.

Automation identities ("type":"automation") default to build.view, build.register, regression.run, environment.view, binding.view; add environment.promote/environment.deploy with an environment scope if CI may advance development. Approval, break-glass, access, policy and binding management cannot be granted to automation.

Rotation: issue with {"replaces":"cred_…"} (old credential revoked in the same transaction) or issue a second credential, roll it out, then revoke the first (max two active). Expiry: {"expiresInDays": 90}. Disable: POST …/disable revokes all credentials immediately.

In the Workstation: Deploy → Access lists people, applications and automation, issues credentials (one-time reveal with copy), rotates, revokes, disables and shows denied machine attempts.