Skip to main content

Vouch named workers

Worker vouching lets your platform bind its own stable subject to a real named person in one customer organization. Vouching is the trust action: it takes effect immediately and does not add an acceptance ceremony.

Vouch​

POST /api/partner/v1/organizations/{orgId}/workers
Authorization: Bearer ykp_00000000-0000-4000-8000-000000000001.AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Content-Type: application/json

{
  "partnerSubject": "operator-1842",
  "email": "[email protected]",
  "name": "Example Operator",
  "domains": [
    { "domainId": "00000000-0000-4000-8000-000000000030", "domainRole": "operator" }
  ]
}

Domain roles are owner | editor | operator | viewer. Repeating a live vouch for the same subject and person preserves identity and reconciles the requested domain roles. Attribution is immutable: every mapping records whether a machine credential or an authenticated Console operator vouched and revoked it.

Mint worker authority​

POST /api/partner/v1/worker-token
Authorization: Bearer ykp_00000000-0000-4000-8000-000000000001.AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Content-Type: application/json

{
  "orgId": "00000000-0000-4000-8000-000000000010",
  "appId": "00000000-0000-4000-8000-000000000020",
  "partnerSubject": "operator-1842"
}

The ykp_ credentials above are obviously fake, structurally valid examples.

The returned ykt_ lease is bounded to that customer, App, and named membership. Approval decisions resolve to that human rather than to the machine key that minted the lease.

Approvals​

Use the worker token with:

  • GET /api/partner/v1/worker/approvals?limit=50&offset=0
  • POST /api/partner/v1/worker/approvals/runs/{runId}
  • POST /api/partner/v1/worker/approvals/sessions/{sessionId}

Decision bodies accept decision: "approved" | "rejected", optional comment, and optional approvalId. Authorization and target visibility share a neutral refusal; a compare-and-set conflict remains visible so clients can refresh safely.

Revoke​

DELETE /api/partner/v1/organizations/{orgId}/workers/{mappingId}

Revocation preserves the mapping record and ends its standing. Existing worker leases stop validating within the standing-cache bound. Customer login visibility is a separate partner-wide policy; hiding ordinary tenant login does not erase worker identity or its audit history.