Add Binding

AddBinding links a tenant-scoped subject (a function today; future kinds tomorrow) to a service principal. Outbound c1-api calls made on the subject's behalf can then be minted as user:<service_principal_id> via an RFC 8693 token-exchange (act-as) flow. Many-aware: a subject may hold multiple bindings at the storage layer. Idempotent on (subject, service_principal_id) — adds the row if missing, resurrects it if soft-deleted, no-op if already active. Consumers that need 0-or-1 cardinality (Functions today) enforce it client-side via ListBindings + DeleteBinding. Requires the SERVICE_PRINCIPALS feature flag.

POST /api/v1/service_principals/bindings

AddBinding

Go

package main

import(
	"context"
	"github.com/conductorone/conductorone-sdk-go/pkg/models/shared"
	conductoronesdkgo "github.com/conductorone/conductorone-sdk-go"
	"log"
)

func main() {
    ctx := context.Background()

    s := conductoronesdkgo.New(
        conductoronesdkgo.WithSecurity(shared.Security{
            BearerAuth: "<YOUR_BEARER_TOKEN_HERE>",
            Oauth: "<YOUR_OAUTH_HERE>",
        }),
    )

    res, err := s.Principal.AddBinding(ctx, nil)
    if err != nil {
        log.Fatal(err)
    }
    if res.ServicePrincipalServiceAddBindingResponse != nil {
        // handle response
    }
}

200

{}

Authorizations

Authorization · string · header · required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Authorization · string · header · required

This API uses OAuth2 with the Client Credential flow. Client Credentials must be sent in the BODY, not the headers. For an example of how to implement this, refer to the c1TokenSource.Token() function.

Body

application/json

The ServicePrincipalServiceAddBindingRequest message.

servicePrincipalId · string

The servicePrincipalId field.

subject · Service Principal Binding Subject · object

ServicePrincipalBindingSubject identifies the entity that is bound to a service principal. Open-ended oneof so future subject kinds (workflows, connectors, etc.) can be added without changing the RPC shape.

This message contains a oneof named kind. Only a single field of the following list may be set at a time:

• functionId

Show child attributes

Response

200 - application/json

Successful response

The ServicePrincipalServiceAddBindingResponse message.