> ## Documentation Index > Fetch the complete documentation index at: https://docs.mountthor.com/llms.txt > Use this file to discover all available pages before exploring further. # Create Principal > Creates a binding from a verified external OIDC token to Mount Thor session scopes. The request must reference an existing IdP or provide inline IdP material that Mount Thor can register or reuse. ## OpenAPI ````yaml /api-reference/customer-api.v1.openapi.json post /v1/admin/identity/principals openapi: 3.1.0 info: title: Mount Thor Customer API version: v1 servers: - description: Mount Thor customer API edge url: https://api.mountthor.com security: [] paths: /v1/admin/identity/principals: post: tags: - identity-workload summary: Create Principal description: >- Creates a binding from a verified external OIDC token to Mount Thor session scopes. The request must reference an existing IdP or provide inline IdP material that Mount Thor can register or reuse. operationId: create_workload_principal requestBody: content: application/json: schema: $ref: '#/components/schemas/WorkloadPrincipalCreateRequest' required: true responses: '201': content: application/json: schema: $ref: '#/components/schemas/WorkloadPrincipalResponse' description: Principal registered '400': description: Request body failed validation '401': description: Missing or invalid customer API key '403': description: API key is missing principals:write scope '404': description: Referenced tenant or trusted issuer does not exist for this customer '409': description: A principal already exists for this (issuer, subject) binding '429': content: text/plain: schema: type: string description: Rate limit exceeded headers: Retry-After: description: Seconds before retry. schema: minimum: 1 type: integer security: - api_key_bearer: - principals:write components: schemas: WorkloadPrincipalCreateRequest: additionalProperties: false description: >- Request body for `POST /v1/admin/identity/principals`. Exactly one of `trusted_issuer_id` (reference an already-registered issuer) or `issuer` (inline material, de-duplicated into the issuer registry) is required. properties: claim_constraints: type: object display_name: description: Customer-facing principal label. example: ci-prod-deploy maxLength: 200 type: string issuer: description: Inline IdP material. Mutually exclusive with trusted_issuer_id. oneOf: - type: 'null' - $ref: '#/components/schemas/InlineTrustedIssuer' description: >- Inline issuer material. Mutually exclusive with `trusted_issuer_id`. max_session_ttl_seconds: description: >- Maximum TTL (seconds) for sessions minted via this binding [300, 3600]. example: 900 format: int64 type: - integer - 'null' scopes: example: - compute:read - compute:write items: type: string type: array subject_match_type: description: '`exact` (match on `sub`) or `claim-constraints`.' example: exact type: string subject_match_value: example: repo:Mount-Thor/mount-thor:ref:refs/heads/main maxLength: 512 type: string tenant_id: description: >- Tenant the minted sessions are bound to. Must belong to the customer. format: uuid type: string trusted_issuer_id: description: >- Reference to an existing trusted issuer. Mutually exclusive with `issuer`. format: uuid type: - string - 'null' required: - display_name - tenant_id - subject_match_value type: object WorkloadPrincipalResponse: allOf: - $ref: '#/components/schemas/WorkloadPrincipalMetadata' - additionalProperties: false properties: customer_id: description: Stable UUID for the customer account. type: string required: - customer_id type: object description: Principal detail response. InlineTrustedIssuer: additionalProperties: false properties: allowed_clock_skew_seconds: description: Clock skew allowed when validating token time claims. format: int64 type: - integer - 'null' audiences: description: Accepted token audiences. example: - api.mountthor.com items: type: string type: array display_name: description: Customer-facing label used if a new IdP is created. maxLength: 200 type: string issuer: description: Canonical OIDC issuer URL. example: https://token.actions.githubusercontent.com maxLength: 512 type: string jwks_document_ref: description: Stored JWKS reference when `jwks_source_type` is `stored-jwks`. type: - string - 'null' jwks_source_type: description: 'JWKS resolution mode: `discovery`, `https`, or `stored-jwks`.' type: string jwks_uri: description: Explicit JWKS URI when `jwks_source_type` is `https`. type: - string - 'null' required: - issuer - audiences type: object WorkloadPrincipalMetadata: additionalProperties: false description: Principal metadata. properties: claim_constraints: description: >- Additional claim constraints used when `subject_match_type` is `claim-constraints`. type: object created_at: description: RFC 3339 creation timestamp. example: '2026-05-25T17:20:00Z' type: string display_name: description: Customer-facing principal label. example: ci-prod-deploy type: string id: description: Stable principal UUID. type: string max_session_ttl_seconds: example: 900 format: int64 type: integer scopes: example: - compute:read - compute:write items: type: string type: array status: description: Principal lifecycle state. Disabled principals cannot mint sessions. example: active type: string subject_match_type: description: 'Subject matching mode: `exact` or `claim-constraints`.' example: exact type: string subject_match_value: description: Required subject value or descriptor for the claim constraint. example: repo:Mount-Thor/mount-thor:ref:refs/heads/main type: string tenant_id: type: string trusted_issuer_id: type: string updated_at: description: RFC 3339 update timestamp. example: '2026-05-25T17:30:00Z' type: string required: - id - tenant_id - trusted_issuer_id - display_name - subject_match_type - subject_match_value - claim_constraints - scopes - max_session_ttl_seconds - status - created_at - updated_at type: object securitySchemes: api_key_bearer: bearerFormat: mthr_live_* description: Bearer scheme name used by typed customer admin operations. scheme: bearer type: http ````