> ## Documentation Index > Fetch the complete documentation index at: https://docs.replicas.dev/llms.txt > Use this file to discover all available pages before exploring further. # Get Workspace Identity Configuration > Returns the issuer, discovery and JWKS URLs, the reserved `replicas:workspace` audience, and the audiences registered on this environment. Requires a paid Team or Enterprise plan and the `workspace_identity` flag. ## OpenAPI ````yaml /openapi.json get /v1/environments/{environmentId}/workload-identity openapi: 3.1.0 info: title: Replica API version: 2.0.0 description: >- The Replica API allows you to programmatically manage cloud workspaces for AI agents. Use this API to manage environments (the org-scoped primitive workspaces are created from — including variables, files, skills, MCPs, warm hooks, start hooks, and warm pools), create and manage replicas, send messages, manage chats, stream events, read connected repositories and repository sets, and configure automations. servers: - url: https://api.replicas.dev description: Production API security: - apiKey: [] tags: - name: Workspace Identity description: >- Public OpenID Connect discovery and signing keys for verifying short-lived workspace identity tokens. Audiences are managed per environment under the Environments tag. - name: Environments description: >- Manage environments — the primitive that workspaces are created from. Variables, files, skills, MCPs, warm-hooks, and warm-pools are all scoped to an environment. Every organization has a singleton Global environment whose values apply to every workspace. Personal environments are scoped to the authenticated user and can be standalone or source-backed by a team environment. - name: Repository description: >- Read repositories and repository sets connected to your organization. Repositories are the underlying GitHub-connection layer; bind them to an environment to use them in workspaces. - name: Replica description: >- Manage replicas (workspaces) for AI agents. Workspace creation with `POST /v1/replica` accepts API keys and workspace engine-secret authentication. Other Replica operations also accept logged-in user JWTs from first-party clients. - name: Slack description: Attach Slack threads to Replicas workspaces - name: Automation description: >- Create and manage automations that trigger replicas on a schedule or in response to events - name: Media description: >- Read workspace media and obtain short-lived download or inline preview URLs paths: /v1/environments/{environmentId}/workload-identity: get: tags: - Environments summary: Get Workspace Identity Configuration description: >- Returns the issuer, discovery and JWKS URLs, the reserved `replicas:workspace` audience, and the audiences registered on this environment. Requires a paid Team or Enterprise plan and the `workspace_identity` flag. operationId: getWorkloadIdentity parameters: - name: environmentId in: path required: true description: Environment UUID, or `global`. schema: type: string responses: '200': description: Identity configuration content: application/json: schema: $ref: '#/components/schemas/WorkloadIdentityResponse' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/Forbidden' '404': $ref: '#/components/responses/NotFound' '500': $ref: '#/components/responses/InternalServerError' components: schemas: WorkloadIdentityResponse: type: object description: >- Issuer configuration and registered audiences for an environment. Contains no token values. properties: configured: type: boolean issuer: type: string nullable: true discovery_url: type: string nullable: true jwks_url: type: string nullable: true default_audience: type: string description: >- Effective default audience for this environment after inheritance; the reserved `replicas:workspace` audience when no enabled registered audience is marked default. audiences: type: array description: Audiences registered directly on this environment. items: $ref: '#/components/schemas/WorkloadAudience' effective_audiences: type: array description: >- Enabled audiences after inheritance, including parents. These are the values an MCP `auth.audience` may reference. items: type: string required: - configured - issuer - discovery_url - jwks_url - default_audience - audiences - effective_audiences WorkloadAudience: type: object description: A registered audience for workspace identity tokens. properties: id: type: string format: uuid environment_id: type: string format: uuid name: type: string audience: type: string description: >- Exact `aud` value minted into tokens and verified by the receiving server. enabled: type: boolean is_default: type: boolean description: >- Default audience for REPLICAS_WORKSPACE_TOKEN. When no enabled registered audience is marked default, the reserved `replicas:workspace` audience is used. required: - id - environment_id - name - audience - enabled - is_default Error: type: object properties: error: type: string description: Error message details: type: - string - 'null' description: Additional error details code: type: string description: Machine-readable error code when available required: - error responses: Unauthorized: description: Unauthorized - Invalid or missing API key content: application/json: schema: $ref: '#/components/schemas/Error' Forbidden: description: Forbidden - The authenticated account cannot access this resource content: application/json: schema: $ref: '#/components/schemas/Error' NotFound: description: Resource not found content: application/json: schema: $ref: '#/components/schemas/Error' InternalServerError: description: Internal server error content: application/json: schema: $ref: '#/components/schemas/Error' securitySchemes: apiKey: type: http scheme: bearer description: >- API key authentication. Obtain your API key from the Replicas dashboard under Organization → Settings → API Keys. ````