# Generated by API Evangelist (build-phrasing.py). Our phrasing, not observed demand.
overlay: 1.0.0
info:
  title: API Evangelist conversational phrasing for Dynatrace Account Management … … Workload Identity…
  version: 1.0.0
extends: openapi/dynatrace-workload-identity-federation-api-openapi.yml
actions:
- target: $.info
  update:
    x-apievangelist-phrasing:
      method: generated
      generated: '2026-09-26'
      generator: build-phrasing.py
      label: Generated by API Evangelist
      operations: 12
- target: $.paths['/iam/v1/accounts/{account-uuid}/wif/trust-policies'].get
  update:
    x-apievangelist-phrasing:
      intent: List workload identity trust policies
      effect: read
      questions:
      - Which external identity providers are trusted for workload identity federation?
      - Can I page through WIF trust policies?
      instructions:
      - text: List the WIF trust policies on account {account}.
        slots:
          account: path.account-uuid
      - text: Show page {page} of trust policies for {account}.
        slots:
          page: query.pageNumber
          account: path.account-uuid
      method: generated
      generated: '2026-09-26'
- target: $.paths['/iam/v1/accounts/{account-uuid}/wif/trust-policies'].post
  update:
    x-apievangelist-phrasing:
      intent: Create a workload identity trust policy
      effect: write
      questions:
      - How do I let CI jobs authenticate with OIDC tokens instead of secrets?
      - What issuer URL and audience does a new trust policy need?
      instructions:
      - text: Create trust policy {name} on {account} for issuer {issuer} and audience {audience}.
        slots:
          name: requestBody.name
          account: path.account-uuid
          issuer: requestBody.issuerUrl
          audience: requestBody.audience
      - text: Add a WIF trust policy {name} in {account} trusting {issuer}, audience {audience}, JWKS at {jwks}.
        slots:
          name: requestBody.name
          account: path.account-uuid
          issuer: requestBody.issuerUrl
          audience: requestBody.audience
          jwks: requestBody.jwksUri
      method: generated
      generated: '2026-09-26'
- target: $.paths['/iam/v1/accounts/{account-uuid}/wif/trust-policies/{trust-policy-uuid}'].get
  update:
    x-apievangelist-phrasing:
      intent: Get a workload identity trust policy
      effect: read
      questions:
      - What issuer and audience does a specific trust policy accept?
      - Can I look up one trust policy by UUID?
      instructions:
      - text: Get trust policy {policy} on account {account}.
        slots:
          policy: path.trust-policy-uuid
          account: path.account-uuid
      - text: Show the issuer and audience of trust policy {policy} in {account}.
        slots:
          policy: path.trust-policy-uuid
          account: path.account-uuid
      method: generated
      generated: '2026-09-26'
- target: $.paths['/iam/v1/accounts/{account-uuid}/wif/trust-policies/{trust-policy-uuid}'].put
  update:
    x-apievangelist-phrasing:
      intent: Update a workload identity trust policy
      effect: write
      questions:
      - Can I change the issuer or audience on an existing trust policy?
      - Where do I update a trust policy's JWKS URI?
      instructions:
      - text: 'Update trust policy {policy} on {account}: name {name}, issuer {issuer}, audience {audience}.'
        slots:
          policy: path.trust-policy-uuid
          account: path.account-uuid
          name: requestBody.name
          issuer: requestBody.issuerUrl
          audience: requestBody.audience
      - text: Point trust policy {policy} in {account} at JWKS {jwks}, keeping name {name}, issuer {issuer}, audience {audience}.
        slots:
          policy: path.trust-policy-uuid
          account: path.account-uuid
          jwks: requestBody.jwksUri
          name: requestBody.name
          issuer: requestBody.issuerUrl
          audience: requestBody.audience
      method: generated
      generated: '2026-09-26'
- target: $.paths['/iam/v1/accounts/{account-uuid}/wif/trust-policies/{trust-policy-uuid}'].delete
  update:
    x-apievangelist-phrasing:
      intent: Delete a workload identity trust policy
      effect: destructive
      questions:
      - How do I stop trusting an identity provider permanently?
      - Can a WIF trust policy be deleted outright?
      instructions:
      - text: Delete trust policy {policy} from account {account}.
        slots:
          policy: path.trust-policy-uuid
          account: path.account-uuid
      - text: Remove the WIF trust policy {policy} on {account}.
        slots:
          policy: path.trust-policy-uuid
          account: path.account-uuid
      method: generated
      generated: '2026-09-26'
- target: $.paths['/iam/v1/accounts/{account-uuid}/wif/trust-policies/{trust-policy-uuid}'].patch
  update:
    x-apievangelist-phrasing:
      intent: Enable or disable a trust policy
      effect: write
      questions:
      - Can I temporarily switch off a trust policy without deleting it?
      - Is there a way to re-enable a disabled WIF trust policy?
      instructions:
      - text: Set trust policy {policy} on {account} to status {status}.
        slots:
          policy: path.trust-policy-uuid
          account: path.account-uuid
          status: requestBody.status
      - text: Disable WIF trust policy {policy} in {account} by setting its status to {status}.
        slots:
          policy: path.trust-policy-uuid
          account: path.account-uuid
          status: requestBody.status
      method: generated
      generated: '2026-09-26'
- target: $.paths['/iam/v1/accounts/{account-uuid}/wif/trust-policies/{trust-policy-uuid}/mappings'].get
  update:
    x-apievangelist-phrasing:
      intent: List service user mappings for a trust policy
      effect: read
      questions:
      - Which service users can federated workloads assume under a trust policy?
      - Can I page through a trust policy's mappings?
      instructions:
      - text: List service user mappings for trust policy {policy} on {account}.
        slots:
          policy: path.trust-policy-uuid
          account: path.account-uuid
      - text: Show {size} mappings per page under trust policy {policy} in {account}.
        slots:
          size: query.pageSize
          policy: path.trust-policy-uuid
          account: path.account-uuid
      method: generated
      generated: '2026-09-26'
- target: $.paths['/iam/v1/accounts/{account-uuid}/wif/trust-policies/{trust-policy-uuid}/mappings'].post
  update:
    x-apievangelist-phrasing:
      intent: Map federated identities to a service user
      effect: write
      questions:
      - How do I map claims from an external token to a service user and scopes?
      - Can a mapping restrict federated access to one environment?
      instructions:
      - text: Map trust policy {policy} on {account} to service user {serviceUser} in environment {environment} with scopes {scopes} and claims {claims}.
        slots:
          policy: path.trust-policy-uuid
          account: path.account-uuid
          serviceUser: requestBody.serviceUserUuid
          environment: requestBody.environmentId
          scopes: requestBody.scopes
          claims: requestBody.claimMappings
      - text: 'Create a mapping under {policy} in {account}: claims {claims} become {serviceUser} on {environment}, scopes {scopes}.'
        slots:
          policy: path.trust-policy-uuid
          account: path.account-uuid
          claims: requestBody.claimMappings
          serviceUser: requestBody.serviceUserUuid
          environment: requestBody.environmentId
          scopes: requestBody.scopes
      method: generated
      generated: '2026-09-26'
- target: $.paths['/iam/v1/accounts/{account-uuid}/wif/trust-policies/{trust-policy-uuid}/mappings/{mapping-uuid}'].get
  update:
    x-apievangelist-phrasing:
      intent: Get a service user mapping
      effect: read
      questions:
      - Which claims and scopes does a specific mapping grant?
      - Can I read one WIF mapping by UUID?
      instructions:
      - text: Get mapping {mapping} under trust policy {policy} on {account}.
        slots:
          mapping: path.mapping-uuid
          policy: path.trust-policy-uuid
          account: path.account-uuid
      - text: Show the claims and scopes of mapping {mapping} in trust policy {policy}, account {account}.
        slots:
          mapping: path.mapping-uuid
          policy: path.trust-policy-uuid
          account: path.account-uuid
      method: generated
      generated: '2026-09-26'
- target: $.paths['/iam/v1/accounts/{account-uuid}/wif/trust-policies/{trust-policy-uuid}/mappings/{mapping-uuid}'].put
  update:
    x-apievangelist-phrasing:
      intent: Update a service user mapping
      effect: write
      questions:
      - Can I change the scopes an existing federated mapping grants?
      - Where do I edit the claim rules on a WIF mapping?
      instructions:
      - text: Update mapping {mapping} in trust policy {policy} on {account} to service user {serviceUser}, environment {environment}, scopes {scopes}, claims {claims}.
        slots:
          mapping: path.mapping-uuid
          policy: path.trust-policy-uuid
          account: path.account-uuid
          serviceUser: requestBody.serviceUserUuid
          environment: requestBody.environmentId
          scopes: requestBody.scopes
          claims: requestBody.claimMappings
      - text: Change the scopes of mapping {mapping} ({policy}, {account}) to {scopes} for {serviceUser} on {environment}, claims {claims}.
        slots:
          mapping: path.mapping-uuid
          policy: path.trust-policy-uuid
          account: path.account-uuid
          scopes: requestBody.scopes
          serviceUser: requestBody.serviceUserUuid
          environment: requestBody.environmentId
          claims: requestBody.claimMappings
      method: generated
      generated: '2026-09-26'
- target: $.paths['/iam/v1/accounts/{account-uuid}/wif/trust-policies/{trust-policy-uuid}/mappings/{mapping-uuid}'].delete
  update:
    x-apievangelist-phrasing:
      intent: Delete a service user mapping
      effect: destructive
      questions:
      - How do I revoke a federated workload's access to a service user?
      - Can I delete one mapping but keep the trust policy?
      instructions:
      - text: Delete mapping {mapping} from trust policy {policy} on {account}.
        slots:
          mapping: path.mapping-uuid
          policy: path.trust-policy-uuid
          account: path.account-uuid
      - text: Remove the WIF mapping {mapping} under {policy} in {account}.
        slots:
          mapping: path.mapping-uuid
          policy: path.trust-policy-uuid
          account: path.account-uuid
      method: generated
      generated: '2026-09-26'
- target: $.paths['/iam/v1/accounts/{account-uuid}/wif/trust-policies/{trust-policy-uuid}/mappings/{mapping-uuid}'].patch
  update:
    x-apievangelist-phrasing:
      intent: Enable or disable a service user mapping
      effect: write
      questions:
      - Can I pause one federated mapping without deleting it?
      - Is there a status toggle on individual WIF mappings?
      instructions:
      - text: Set mapping {mapping} in trust policy {policy} on {account} to status {status}.
        slots:
          mapping: path.mapping-uuid
          policy: path.trust-policy-uuid
          account: path.account-uuid
          status: requestBody.status
      - text: Disable the mapping {mapping} under {policy} in {account} with status {status}.
        slots:
          mapping: path.mapping-uuid
          policy: path.trust-policy-uuid
          account: path.account-uuid
          status: requestBody.status
      method: generated
      generated: '2026-09-26'