Create Principal
curl --request POST \
--url https://api.mountthor.com/v1/admin/identity/principals \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"display_name": "ci-prod-deploy",
"subject_match_value": "repo:Mount-Thor/mount-thor:ref:refs/heads/main",
"tenant_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"claim_constraints": {},
"issuer": {
"audiences": [
"api.mountthor.com"
],
"issuer": "https://token.actions.githubusercontent.com",
"allowed_clock_skew_seconds": 123,
"display_name": "<string>",
"jwks_document_ref": "<string>",
"jwks_source_type": "<string>",
"jwks_uri": "<string>"
},
"max_session_ttl_seconds": 900,
"scopes": [
"compute:read",
"compute:write"
],
"subject_match_type": "exact",
"trusted_issuer_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
}
'import requests
url = "https://api.mountthor.com/v1/admin/identity/principals"
payload = {
"display_name": "ci-prod-deploy",
"subject_match_value": "repo:Mount-Thor/mount-thor:ref:refs/heads/main",
"tenant_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"claim_constraints": {},
"issuer": {
"audiences": ["api.mountthor.com"],
"issuer": "https://token.actions.githubusercontent.com",
"allowed_clock_skew_seconds": 123,
"display_name": "<string>",
"jwks_document_ref": "<string>",
"jwks_source_type": "<string>",
"jwks_uri": "<string>"
},
"max_session_ttl_seconds": 900,
"scopes": ["compute:read", "compute:write"],
"subject_match_type": "exact",
"trusted_issuer_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
display_name: 'ci-prod-deploy',
subject_match_value: 'repo:Mount-Thor/mount-thor:ref:refs/heads/main',
tenant_id: '3c90c3cc-0d44-4b50-8888-8dd25736052a',
claim_constraints: {},
issuer: {
audiences: ['api.mountthor.com'],
issuer: 'https://token.actions.githubusercontent.com',
allowed_clock_skew_seconds: 123,
display_name: '<string>',
jwks_document_ref: '<string>',
jwks_source_type: '<string>',
jwks_uri: '<string>'
},
max_session_ttl_seconds: 900,
scopes: ['compute:read', 'compute:write'],
subject_match_type: 'exact',
trusted_issuer_id: '3c90c3cc-0d44-4b50-8888-8dd25736052a'
})
};
fetch('https://api.mountthor.com/v1/admin/identity/principals', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.mountthor.com/v1/admin/identity/principals",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'display_name' => 'ci-prod-deploy',
'subject_match_value' => 'repo:Mount-Thor/mount-thor:ref:refs/heads/main',
'tenant_id' => '3c90c3cc-0d44-4b50-8888-8dd25736052a',
'claim_constraints' => [
],
'issuer' => [
'audiences' => [
'api.mountthor.com'
],
'issuer' => 'https://token.actions.githubusercontent.com',
'allowed_clock_skew_seconds' => 123,
'display_name' => '<string>',
'jwks_document_ref' => '<string>',
'jwks_source_type' => '<string>',
'jwks_uri' => '<string>'
],
'max_session_ttl_seconds' => 900,
'scopes' => [
'compute:read',
'compute:write'
],
'subject_match_type' => 'exact',
'trusted_issuer_id' => '3c90c3cc-0d44-4b50-8888-8dd25736052a'
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.mountthor.com/v1/admin/identity/principals"
payload := strings.NewReader("{\n \"display_name\": \"ci-prod-deploy\",\n \"subject_match_value\": \"repo:Mount-Thor/mount-thor:ref:refs/heads/main\",\n \"tenant_id\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"claim_constraints\": {},\n \"issuer\": {\n \"audiences\": [\n \"api.mountthor.com\"\n ],\n \"issuer\": \"https://token.actions.githubusercontent.com\",\n \"allowed_clock_skew_seconds\": 123,\n \"display_name\": \"<string>\",\n \"jwks_document_ref\": \"<string>\",\n \"jwks_source_type\": \"<string>\",\n \"jwks_uri\": \"<string>\"\n },\n \"max_session_ttl_seconds\": 900,\n \"scopes\": [\n \"compute:read\",\n \"compute:write\"\n ],\n \"subject_match_type\": \"exact\",\n \"trusted_issuer_id\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.mountthor.com/v1/admin/identity/principals")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"display_name\": \"ci-prod-deploy\",\n \"subject_match_value\": \"repo:Mount-Thor/mount-thor:ref:refs/heads/main\",\n \"tenant_id\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"claim_constraints\": {},\n \"issuer\": {\n \"audiences\": [\n \"api.mountthor.com\"\n ],\n \"issuer\": \"https://token.actions.githubusercontent.com\",\n \"allowed_clock_skew_seconds\": 123,\n \"display_name\": \"<string>\",\n \"jwks_document_ref\": \"<string>\",\n \"jwks_source_type\": \"<string>\",\n \"jwks_uri\": \"<string>\"\n },\n \"max_session_ttl_seconds\": 900,\n \"scopes\": [\n \"compute:read\",\n \"compute:write\"\n ],\n \"subject_match_type\": \"exact\",\n \"trusted_issuer_id\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.mountthor.com/v1/admin/identity/principals")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"display_name\": \"ci-prod-deploy\",\n \"subject_match_value\": \"repo:Mount-Thor/mount-thor:ref:refs/heads/main\",\n \"tenant_id\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"claim_constraints\": {},\n \"issuer\": {\n \"audiences\": [\n \"api.mountthor.com\"\n ],\n \"issuer\": \"https://token.actions.githubusercontent.com\",\n \"allowed_clock_skew_seconds\": 123,\n \"display_name\": \"<string>\",\n \"jwks_document_ref\": \"<string>\",\n \"jwks_source_type\": \"<string>\",\n \"jwks_uri\": \"<string>\"\n },\n \"max_session_ttl_seconds\": 900,\n \"scopes\": [\n \"compute:read\",\n \"compute:write\"\n ],\n \"subject_match_type\": \"exact\",\n \"trusted_issuer_id\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\"\n}"
response = http.request(request)
puts response.read_body{
"claim_constraints": {},
"created_at": "2026-05-25T17:20:00Z",
"display_name": "ci-prod-deploy",
"id": "<string>",
"max_session_ttl_seconds": 900,
"scopes": [
"compute:read",
"compute:write"
],
"status": "active",
"subject_match_type": "exact",
"subject_match_value": "repo:Mount-Thor/mount-thor:ref:refs/heads/main",
"tenant_id": "<string>",
"trusted_issuer_id": "<string>",
"updated_at": "2026-05-25T17:30:00Z",
"customer_id": "<string>"
}"<string>"Principals
Create Principal
Creates a binding from a verified external OIDC token to Mount Thor session scopes. The request must reference an existing IdP or provide inline IdP material that Mount Thor can register or reuse.
POST
/
v1
/
admin
/
identity
/
principals
Create Principal
curl --request POST \
--url https://api.mountthor.com/v1/admin/identity/principals \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"display_name": "ci-prod-deploy",
"subject_match_value": "repo:Mount-Thor/mount-thor:ref:refs/heads/main",
"tenant_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"claim_constraints": {},
"issuer": {
"audiences": [
"api.mountthor.com"
],
"issuer": "https://token.actions.githubusercontent.com",
"allowed_clock_skew_seconds": 123,
"display_name": "<string>",
"jwks_document_ref": "<string>",
"jwks_source_type": "<string>",
"jwks_uri": "<string>"
},
"max_session_ttl_seconds": 900,
"scopes": [
"compute:read",
"compute:write"
],
"subject_match_type": "exact",
"trusted_issuer_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
}
'import requests
url = "https://api.mountthor.com/v1/admin/identity/principals"
payload = {
"display_name": "ci-prod-deploy",
"subject_match_value": "repo:Mount-Thor/mount-thor:ref:refs/heads/main",
"tenant_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"claim_constraints": {},
"issuer": {
"audiences": ["api.mountthor.com"],
"issuer": "https://token.actions.githubusercontent.com",
"allowed_clock_skew_seconds": 123,
"display_name": "<string>",
"jwks_document_ref": "<string>",
"jwks_source_type": "<string>",
"jwks_uri": "<string>"
},
"max_session_ttl_seconds": 900,
"scopes": ["compute:read", "compute:write"],
"subject_match_type": "exact",
"trusted_issuer_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
display_name: 'ci-prod-deploy',
subject_match_value: 'repo:Mount-Thor/mount-thor:ref:refs/heads/main',
tenant_id: '3c90c3cc-0d44-4b50-8888-8dd25736052a',
claim_constraints: {},
issuer: {
audiences: ['api.mountthor.com'],
issuer: 'https://token.actions.githubusercontent.com',
allowed_clock_skew_seconds: 123,
display_name: '<string>',
jwks_document_ref: '<string>',
jwks_source_type: '<string>',
jwks_uri: '<string>'
},
max_session_ttl_seconds: 900,
scopes: ['compute:read', 'compute:write'],
subject_match_type: 'exact',
trusted_issuer_id: '3c90c3cc-0d44-4b50-8888-8dd25736052a'
})
};
fetch('https://api.mountthor.com/v1/admin/identity/principals', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.mountthor.com/v1/admin/identity/principals",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'display_name' => 'ci-prod-deploy',
'subject_match_value' => 'repo:Mount-Thor/mount-thor:ref:refs/heads/main',
'tenant_id' => '3c90c3cc-0d44-4b50-8888-8dd25736052a',
'claim_constraints' => [
],
'issuer' => [
'audiences' => [
'api.mountthor.com'
],
'issuer' => 'https://token.actions.githubusercontent.com',
'allowed_clock_skew_seconds' => 123,
'display_name' => '<string>',
'jwks_document_ref' => '<string>',
'jwks_source_type' => '<string>',
'jwks_uri' => '<string>'
],
'max_session_ttl_seconds' => 900,
'scopes' => [
'compute:read',
'compute:write'
],
'subject_match_type' => 'exact',
'trusted_issuer_id' => '3c90c3cc-0d44-4b50-8888-8dd25736052a'
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.mountthor.com/v1/admin/identity/principals"
payload := strings.NewReader("{\n \"display_name\": \"ci-prod-deploy\",\n \"subject_match_value\": \"repo:Mount-Thor/mount-thor:ref:refs/heads/main\",\n \"tenant_id\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"claim_constraints\": {},\n \"issuer\": {\n \"audiences\": [\n \"api.mountthor.com\"\n ],\n \"issuer\": \"https://token.actions.githubusercontent.com\",\n \"allowed_clock_skew_seconds\": 123,\n \"display_name\": \"<string>\",\n \"jwks_document_ref\": \"<string>\",\n \"jwks_source_type\": \"<string>\",\n \"jwks_uri\": \"<string>\"\n },\n \"max_session_ttl_seconds\": 900,\n \"scopes\": [\n \"compute:read\",\n \"compute:write\"\n ],\n \"subject_match_type\": \"exact\",\n \"trusted_issuer_id\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.mountthor.com/v1/admin/identity/principals")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"display_name\": \"ci-prod-deploy\",\n \"subject_match_value\": \"repo:Mount-Thor/mount-thor:ref:refs/heads/main\",\n \"tenant_id\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"claim_constraints\": {},\n \"issuer\": {\n \"audiences\": [\n \"api.mountthor.com\"\n ],\n \"issuer\": \"https://token.actions.githubusercontent.com\",\n \"allowed_clock_skew_seconds\": 123,\n \"display_name\": \"<string>\",\n \"jwks_document_ref\": \"<string>\",\n \"jwks_source_type\": \"<string>\",\n \"jwks_uri\": \"<string>\"\n },\n \"max_session_ttl_seconds\": 900,\n \"scopes\": [\n \"compute:read\",\n \"compute:write\"\n ],\n \"subject_match_type\": \"exact\",\n \"trusted_issuer_id\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.mountthor.com/v1/admin/identity/principals")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"display_name\": \"ci-prod-deploy\",\n \"subject_match_value\": \"repo:Mount-Thor/mount-thor:ref:refs/heads/main\",\n \"tenant_id\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"claim_constraints\": {},\n \"issuer\": {\n \"audiences\": [\n \"api.mountthor.com\"\n ],\n \"issuer\": \"https://token.actions.githubusercontent.com\",\n \"allowed_clock_skew_seconds\": 123,\n \"display_name\": \"<string>\",\n \"jwks_document_ref\": \"<string>\",\n \"jwks_source_type\": \"<string>\",\n \"jwks_uri\": \"<string>\"\n },\n \"max_session_ttl_seconds\": 900,\n \"scopes\": [\n \"compute:read\",\n \"compute:write\"\n ],\n \"subject_match_type\": \"exact\",\n \"trusted_issuer_id\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\"\n}"
response = http.request(request)
puts response.read_body{
"claim_constraints": {},
"created_at": "2026-05-25T17:20:00Z",
"display_name": "ci-prod-deploy",
"id": "<string>",
"max_session_ttl_seconds": 900,
"scopes": [
"compute:read",
"compute:write"
],
"status": "active",
"subject_match_type": "exact",
"subject_match_value": "repo:Mount-Thor/mount-thor:ref:refs/heads/main",
"tenant_id": "<string>",
"trusted_issuer_id": "<string>",
"updated_at": "2026-05-25T17:30:00Z",
"customer_id": "<string>"
}"<string>"Authorizations
Bearer scheme name used by typed customer admin operations.
Body
application/json
Request body for POST /v1/admin/identity/principals.
Exactly one of trusted_issuer_id (reference an already-registered issuer)
or issuer (inline material, de-duplicated into the issuer registry) is
required.
Customer-facing principal label.
Maximum string length:
200Example:
"ci-prod-deploy"
Maximum string length:
512Example:
"repo:Mount-Thor/mount-thor:ref:refs/heads/main"
Tenant the minted sessions are bound to. Must belong to the customer.
Inline IdP material. Mutually exclusive with trusted_issuer_id.
Show child attributes
Show child attributes
Maximum TTL (seconds) for sessions minted via this binding [300, 3600].
Example:
900
Example:
["compute:read", "compute:write"]
exact (match on sub) or claim-constraints.
Example:
"exact"
Reference to an existing trusted issuer. Mutually exclusive with issuer.
Response
Principal registered
Principal detail response.
Additional claim constraints used when subject_match_type is claim-constraints.
RFC 3339 creation timestamp.
Example:
"2026-05-25T17:20:00Z"
Customer-facing principal label.
Example:
"ci-prod-deploy"
Stable principal UUID.
Example:
900
Example:
["compute:read", "compute:write"]
Principal lifecycle state. Disabled principals cannot mint sessions.
Example:
"active"
Subject matching mode: exact or claim-constraints.
Example:
"exact"
Required subject value or descriptor for the claim constraint.
Example:
"repo:Mount-Thor/mount-thor:ref:refs/heads/main"
RFC 3339 update timestamp.
Example:
"2026-05-25T17:30:00Z"
Stable UUID for the customer account.