Set or replace a tenant's own keys for a provider (instance admin)
The tenant's users then connect the provider through the tenant's OAuth application
(their consent screen shows it) instead of the instance's; other tenants keep the
instance's keys. The provider becomes available to the tenant even when the instance has
no keys for it. The body replaces every key: give the required ones (400 otherwise); the
provider's own rules check them before anything is stored (422 with the reason). They are
sealed with OHS_ENCRYPTION_KEY and apply at once in the process that answers, within 30
seconds in the others. A connection keeps the keys it was made with: keys with the same
CLIENT_ID, REGION and ENVIRONMENT (a secret rotated) keep the tenant's connections,
keys naming another application set the connections made with the old ones
needs_reauth (counted in reauth_required). The callback URL stays the instance's.
Recorded as tenant.provider_keys in the caller's audit log and in the tenant's, together
with the change.
tenantKeyAuthorizationBearer <token>Tenant API key, ohs_sk_ + 43 base62 characters.
tenant_id*stringThe id of a tenant; any other value is a 404.
uuidprovider*stringConnector slug, see GET /v1/providers.
application/json- body
keys*Every key of the tenant's application by name, such as CLIENT_ID and
CLIENT_SECRET; the provider's keys lists them. Replaces the previous ones whole.
The tenant's keys after the change.
application/json- response
provider*stringset*booleanTrue while the tenant has keys of its own for the provider.
status*stringactive: the tenant's new connections use these keys. error: they do not run (they no
longer open with the configured encryption keys, or the provider refused them, see
error); the tenant cannot connect the provider until they are set again or removed.
not_set: the tenant uses the instance's keys.
"active""error""not_set"error*string|nullclient_id*|The first and last four characters of CLIENT_ID, never all of it.
keys*array<>Every key the provider takes. No value is ever served.
urls*The addresses to register in the tenant's application at the provider: the instance's, the same for every tenant.
created_at*|date-timeupdated_at*|date-timeupdated_by*|The id of the admin key that saved the keys.
reauth_required?integerOnly in the answers of PUT and DELETE: how many connections of the tenant the change
set needs_reauth.
curl -X PUT 'http://localhost:8080/v1/admin/tenants/497f6eca-6276-4993-bfeb-53cbbbba6f08/providers/withings/keys' \ -H 'Authorization: Bearer ohs_sk_...' \ -H 'Content-Type: application/json' \ -d '{ "keys": { "CLIENT_ID": "your-client-id", "CLIENT_SECRET": "your-client-secret" }}'{ "provider": "withings", "set": true, "status": "active", "error": "string", "client_id": "abcd...wxyz", "keys": [ { "name": "CLIENT_SECRET", "required": true, "secret": true, "set": true } ], "urls": { "redirect": "string", "inbound": "string" }, "created_at": "2019-08-24T14:15:22Z", "updated_at": "2019-08-24T14:15:22Z", "updated_by": "string", "reauth_required": 0}