aid: aembit name: Aembit description: Aembit is a Workload Identity and Access Management (Workload IAM) platform for non-human identities — AI agents, applications, microservices, CI/CD pipelines, scripts and service accounts. Instead of long-lived, hard-coded secrets, Aembit cryptographically attests a workload against a Trust Provider (AWS, Azure, GCP, GitHub Actions, GitLab, Kubernetes, Terraform Cloud, OIDC, SPIFFE, Kerberos), evaluates an Access Policy with optional conditional-access signals from CrowdStrike and Wiz, and injects a short-lived credential just-in-time so the application never stores one. The platform is delivered as a SaaS control plane (Aembit Cloud) plus a distributed enforcement layer (Aembit Edge — Agent Proxy, Agent Injector, AWS Lambda extension, CLI and Edge SDKs). Aembit publishes two OpenAPI 3.1.1 contracts — the Aembit Cloud API for managing every platform resource and the Aembit Edge API for workload authentication and credential retrieval — alongside a hosted, read-only MCP Server for querying audit, authorization and workload events, an MCP Identity Gateway and an MCP Authorization Server for governing AI-agent access to MCP servers. image: https://aembit.io/wp-content/uploads/2023/08/aembit-favicon-300x300.png url: https://raw.githubusercontent.com/api-evangelist/aembit/refs/heads/main/apis.yml specificationVersion: '0.20' created: '2026-09-09' modified: '2026-09-09' position: Producing tags: - Security - Identity - Access Management - Workload Identity - Non-Human Identity - Secrets Management - Zero Trust - Agentic AI - Model Context Protocol - Authentication - Authorization - DevSecOps - Cloud Security maintainers: - FN: Kin Lane email: kin@apievangelist.com - FN: APIs.json email: info@apis.io apis: - name: Aembit Cloud API description: The Aembit Cloud API is the management and control plane contract for the Aembit platform. It exposes 165 operations across 74 paths for Access Policies, Access Conditions, Client and Server Workloads, Credential Providers, Trust Providers, Trust Provider Secrets, Content Security, Resource Sets, Roles, Users, SSO Identity Providers, Sign-On Policies, Integrations, Discovery Integrations, Log Streams, Certificate Authorities, Routing, Agent Controllers, and the Audit Log, Authorization Event and Workload Event reporting surfaces. Authentication is a bearer API token issued from the Aembit Admin UI; the host is tenant-scoped. humanURL: https://docs.aembit.io/dev-guide/api/cloud/api-reference-cloud/ baseURL: https://{tenant}.aembit.io tags: - Access Management - Workload Identity - Administration properties: - type: OpenAPI url: openapi/_original/aembit-cloud-openapi-original.yml - type: Overlay url: overlays/aembit-cloud-overlay.yaml - type: Documentation url: https://docs.aembit.io/dev-guide/api/cloud/ - type: APIReference url: https://docs.aembit.io/dev-guide/api/cloud/api-reference-cloud/ - name: Aembit Edge API description: The Aembit Edge API is the workload-facing runtime contract. Two operations let a Client Workload bootstrap a session by presenting attestation evidence to a configured Trust Provider (POST /edge/v1/auth) and then retrieve a short-lived credential for a Server Workload (POST /edge/v1/credentials). It is the contract the Aembit Edge SDKs and the Aembit CLI wrap, and the path applications use when they cannot run Agent Proxy. humanURL: https://docs.aembit.io/dev-guide/api/edge/api-reference-edge/ baseURL: https://{tenant}.aembit.io tags: - Workload Identity - Authentication - Credentials properties: - type: OpenAPI url: openapi/_original/aembit-edge-openapi-original.yml - type: Overlay url: overlays/aembit-edge-overlay.yaml - type: Documentation url: https://docs.aembit.io/dev-guide/api/edge/ - type: APIReference url: https://docs.aembit.io/dev-guide/api/edge/api-reference-edge/ - type: SDKs url: https://docs.aembit.io/dev-guide/sdk/edge/ - name: Aembit MCP Server description: A first-party hosted Model Context Protocol server that gives AI agents and MCP clients read-only access to a tenant's Aembit event logs. Three tools — get_audit_logs, get_auth_events and get_workload_events — expose the same audit, authorization-event and workload-event data as the Cloud API reporting endpoints, with filtering, ordering and pagination. Authentication is an Aembit API token as a bearer, optionally scoped with an X-Aembit-ResourceSet header. The server is read-only by design and must be enabled per tenant. humanURL: https://docs.aembit.io/ai-guide/mcp/mcp-server/ baseURL: https://{tenantId}.mcp.useast2.aembit.io/mcp tags: - Model Context Protocol - Agentic AI - Audit properties: - type: MCPServer url: mcp/aembit-mcp.yml - type: ToolCrosswalk url: mcp/aembit-tool-crosswalk.yml - type: Documentation url: https://docs.aembit.io/ai-guide/mcp/mcp-server/ - type: APIReference url: https://docs.aembit.io/ai-guide/mcp/mcp-server/reference-mcp-server/ common: - type: Website url: https://aembit.io/ - type: DeveloperPortal url: https://docs.aembit.io/dev-guide/ - type: Documentation url: https://docs.aembit.io/ - type: APIReference url: https://docs.aembit.io/dev-guide/api/ - type: GettingStarted url: https://docs.aembit.io/get-started/quickstart/ - type: Support url: https://support.aembit.io/hc/en-us - type: Blog url: https://aembit.io/blog/ - type: GitHubOrganization url: https://github.com/Aembit - type: Pricing url: https://aembit.io/pricing/ - type: SignUp url: https://useast2.aembit.io/signup - type: TermsOfService url: https://aembit.io/terms-of-service/ - type: PrivacyPolicy url: https://aembit.io/privacy-policy/ - type: StatusPage url: https://status.aembit.io/ - type: Deprecation url: lifecycle/aembit-lifecycle.yml - type: TrustCenter url: https://trust.aembit.io/ - type: Compliance url: https://docs.aembit.io/get-started/security-posture/security-compliance/ - type: Security url: https://docs.aembit.io/get-started/security-posture/security-compliance/ - type: VulnerabilityDisclosure url: security/aembit-vulnerability-disclosure.yml - type: DomainSecurity url: security/aembit-domain-security.yml - type: ChangeLog url: https://docs.aembit.io/changelog/ - type: CLI url: cli/aembit-cli.yml - type: Packages url: packages/aembit-packages.yml - type: SDKs url: packages/aembit-packages.yml - type: MCPServer url: mcp/aembit-mcp.yml - type: ToolCrosswalk url: mcp/aembit-tool-crosswalk.yml - type: AgentSkill url: skills/_index.yml - type: LLMsTxt url: llms/aembit-llms.txt - type: AgenticAccess url: agentic-access/aembit-agentic-access.yml - type: Authentication url: authentication/aembit-authentication.yml - type: Conventions url: conventions/aembit-conventions.yml - type: ErrorCatalog url: errors/aembit-problem-types.yml - type: Lifecycle url: lifecycle/aembit-lifecycle.yml - type: Conformance url: conformance/aembit-conformance.yml - type: DataModel url: data-model/aembit-data-model.yml - type: Plans url: plans/aembit-plans-pricing.yml - type: RateLimits url: rate-limits/aembit-rate-limits.yml - type: Sandbox url: sandbox/aembit-sandbox.yml - type: Console url: https://useast2.aembit.io/ - type: Overlay url: overlays/aembit-cloud-overlay.yaml - type: Overlay url: overlays/aembit-edge-overlay.yaml x-enrichment: date: '2026-09-09' status: enriched artifacts_added: 37 pass: local-v3