identity.app.provision

Provision an identity tenant for a customer app

Provision an identity tenant for a customer app ("Sign in with Orkestia").

ONE-CALL SETUP (no human, no follow-up): pass your app's redirect_uris here and this returns everything needed to wire auth — client_key (public, goes in your app source), plus integration with the authorize/token/jwks endpoints. An MCP agent can call this and immediately wire a PKCE "Sign in with Orkestia" flow.

Inputs:

• actor: Cognito sub or user UUID (auto-injected from your token)
• organization_uuid: owning organization (auto-injected from your token)
• name: human-readable app name (required)
• redirect_uris: your app's OAuth callback URLs, e.g. ["https://myapp.com/callback"] (optional but recommended — absolute http(s), no wildcards; registering them here means the origin is accepted immediately, no configure-client call needed)
• project_uuid: the customer project this tenant serves (optional)

Outputs (terminal state_data):

• client_key: public OIDC client identifier (no secret — PKCE only); put this in your app
• client_uuid: the OIDC client's uuid (for later identity.app.configure-client calls)
• redirect_uris: the registered callback URLs
• identity_app_uuid: public uuid of the identity tenant
• integration:
• name, created_at

Overview

Property	Value
Workflow type	Linear
Library	App-identity
Version	1.0

Input Schema

Field	Type	Required	Default	Description
actor	string	Yes	—	Authenticated Cognito subject or user UUID provisioning the app.
organization_uuid	uuid	Yes	—	Organization that will own the identity app.
name	string	Yes	—	Human-readable name for the identity app.
project_uuid	uuid	No	—	Optional customer project served by this identity app.
redirect_uris	list	No	—	OAuth callback URLs allowed for the hosted PKCE login flow.
mode	string	No	—	App lifecycle mode controlling redirect and sign-in policy.
dev_allowed_emails	list	No	—	Email allowlist used while the identity app is in dev mode.
org_owned_enabled	boolean	No	False	Whether organization-owned end-user accounts are enabled.

Output Schema

Field	Type	Required	Default	Description
identity_app_uuid	uuid	Yes	—	Public UUID of the provisioned identity app.
client_uuid	uuid	No	—	UUID of the initial public OIDC client.
client_key	string	Yes	—	Public PKCE OIDC client identifier; this is not a secret.
redirect_uris	list	No	—	OAuth callback URLs registered for the client.
name	string	Yes	—	Human-readable identity app name.
created_at	string	Yes	—	ISO-8601 creation timestamp.
integration	dict	No	—	Hosted-login endpoints, flow, and SDK integration settings.
actor	string	No	—	Authenticated principal that provisioned the app.
organization_uuid	uuid	No	—	Organization that owns the identity app.
project_uuid	uuid	No	—	Customer project served by the identity app, when supplied.
failure_reason	string	No	—	Human-readable explanation when provisioning fails.
failure_type	string	No	—	Stable category for a provisioning failure.
failed_action	string	No	—	Action that failed during provisioning.
failed_at_state	string	No	—	Workflow state in which provisioning failed.

States

State	Initial	Terminal	Success	Auto-advance	Description
initiated	Yes	No	—	validate	—
persisting	No	No	—	complete	—
validating	No	No	—	persist	—
completed	No	Yes	Yes	—	—
failed	No	Yes	No	—	—

State Diagram

Transitions

From	Action	To	Description
initiated	validate	validating	—
validating	persist	persisting	—
persisting	complete	completed	—
* (any state)	fail	failed	—

API Usage

POST /api/workflows/start
Content-Type: application/json

{
  "workflow_type": "identity.app.provision",
  "initial_data": {
    "actor": "value",
    "organization_uuid": "value",
    "name": "value"
  }
}