Docs API reference
Bundles
Approved, immutable SPIFFE trust bundles.
1 operation. See the API overview for authentication, errors, idempotency and caching rules that apply to all of them.
Approved SPIFFE bundle
GET/v1/issuer-bindings/{id}/versions/{version}/bundle
The exact, approved public SPIFFE trust bundle bytes of one binding version (active or superseded). The bytes are
re-hashed on every request and compared with the approved digest; a mismatch is never served. The entity tag is the
digest, and If-None-Match returns 304 without touching storage. The digest is the assertion's bundle_sha256.
Successful responses are immutable; errors are no-store.
Parameters
| Name | In | Required | Type | Description |
|---|---|---|---|---|
id | path | Yes | BindingId | Issuer binding id. |
version | path | Yes | integer | The binding version number. 1 to 999999999 example 1 |
If-None-Match | header | No | string | Entity tag ("<bundle_sha256>") the client already holds. |
Responses
| Status | Description | Body |
|---|---|---|
| 200 | The SPIFFE bundle JSON. Headers: ETag: "q7Yd3nXk0aV2pLw9sT4uHc8BzE1mR6fJ5gN0oIxK2tA", Cache-Control: public, max-age=31536000, immutable, Repr-Digest: sha-256=:q7Yd3nXk0aV2pLw9sT4uHc8BzE1mR6fJ5gN0oIxK2tA=:, Digest | application/json SpiffeBundle |
| 304 | Not modified; the client already holds the approved bytes. Headers: ETag, Cache-Control: public, max-age=31536000, immutable | None |
| 404 | not_found. No such resource, or one the caller may not see (the two are indistinguishable by design). | application/json Error |
| 503 | unavailable (temporarily unavailable; also a feature that is not configured in this deployment) or
provider_unavailable (an identity provider is not configured). Both are 503. During maintenance (for example a database
recovery) every mutating request answers unavailable "The directory is under maintenance; try again later." Reads keep working. | application/json Error |
200 example
{
"spiffe_sequence": 1,
"spiffe_refresh_hint": 300,
"keys": [
{
"use": "x509-svid",
"kty": "EC",
"crv": "P-256",
"x": "f83OJ3D2xF1Bg8vub9tLe1gHMzV76e8Tus9uPHvRVEU",
"y": "x_FEzRu9m36HLN_tue659LNpXW6pCyStikYjKIWI5a0",
"x5c": [
"MIIBszCCAVmgAwIBAgIUExampleOnlyNotARealCertificateExampleOnly="
]
}
]
}404 example
{
"code": "not_found",
"message": "No such resource.",
"request_id": "req_3m6p9s2v5y8b1e4h7k0n3q6t9w"
}503 example
{
"code": "unavailable",
"message": "Temporarily unavailable.",
"request_id": "req_3m6p9s2v5y8b1e4h7k0n3q6t9w"
}