Changes for README.md: 4 added lines, 0 removed lines.
Original line number
Diff line number
Diff line
@@ -110,6 +110,10 @@ Endpoints acting on behalf of the logged-in user. They require a valid access to
- Onboards an API invoker in CAPIF for the logged-in user: generates a key pair and CSR, onboards via CCF using the user's CAPIF token, and stores the private key and certificate bundle in Vault under `secret/backoffice/users/{uuid}/invokers/{apiInvokerId}`.
- Responses: `201``{"apiInvokerId": "..."}`; `400` missing fields; `403` account has no CAPIF credentials; `502` CCF could not be reached, rejected the onboarding, or returned an unexpected response; `500` credentials could not be stored in Vault. On `500` a rollback of the invoker in CCF is attempted; if it fails, the invoker remains in CCF and is logged for admin cleanup.
- GET /api/me/invokers/{apiInvokerId}/apis
- Discovers the APIs visible to one of the user's invokers, calling CCF over mTLS with the invoker's certificate stored in Vault. Another user's invoker id returns `404`.
- Requires `/dev/shm`: the key and certificate are written there only for the duration of the call. If it is missing, the call fails with `500` and never falls back to disk.
- A CCF `404` with cause "No API Published accomplish filter conditions" is deliberately returned as `200` with an empty `serviceAPIDescriptions` list.
