Skip to main content

Vouch named workers

Worker vouching lets your platform bind its own stable subject to a real named person in one customer organization. Vouching is the trust action: it takes effect immediately and does not add an acceptance ceremony.

Vouch​

POST /api/partner/v1/organizations/{orgId}/workers
Authorization: Bearer ykp_00000000-0000-4000-8000-000000000001.AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Content-Type: application/json

{
  "partnerSubject": "operator-1842",
  "email": "[email protected]",
  "name": "Example Operator",
  "domains": [
    { "domainId": "00000000-0000-4000-8000-000000000030", "domainRole": "operator" }
  ]
}

Domain roles are owner | editor | operator | viewer. An optional orgRole of admin or member (default member) sets the person's organization role; see Customer tenant API for which role each job needs. Repeating a live vouch for the same subject and person preserves identity and reconciles the requested domain roles. Two requests are refused with 409 rather than partly applied: a live subject vouched again with a different person's email, and any orgRole for the organization owner, whose seat is minted once at provisioning. Attribution is immutable: every mapping records whether a machine credential or an authenticated Console operator vouched and revoked it.

Mint worker authority​

POST /api/partner/v1/worker-token
Authorization: Bearer ykp_00000000-0000-4000-8000-000000000001.AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Content-Type: application/json

{
  "orgId": "00000000-0000-4000-8000-000000000010",
  "partnerSubject": "operator-1842"
}

The ykp_ credentials above are obviously fake, structurally valid examples.

The returned ykt_ lease is bounded to that customer and that named membership. Approval decisions resolve to that human rather than to the machine key that minted the lease.

Approvals​

Use the worker token with:

  • GET /api/partner/v1/worker/approvals?limit=50&offset=0
  • POST /api/partner/v1/worker/approvals/runs/{runId}
  • POST /api/partner/v1/worker/approvals/sessions/{sessionId}

Decision bodies accept decision: "approved" | "rejected", optional comment, and optional approvalId. Authorization and target visibility share a neutral refusal; a compare-and-set conflict remains visible so clients can refresh safely.

Revoke​

DELETE /api/partner/v1/organizations/{orgId}/workers/{mappingId}

Revocation preserves the mapping record and ends its standing. Existing worker leases stop validating within the standing-cache bound. Customer login visibility is a separate partner-wide policy; hiding ordinary tenant login does not erase worker identity or its audit history.