Arsenal broker
Actual router endpoints, credential policy, and deployment trust boundaries.
The broker is a separate service from the standalone identity server. In the published arsenal-broker@2.0.0 crate, BrokerServer::router mounts these routes:
| Method | Path | Purpose |
|---|---|---|
| POST | /v1/capabilities | Capability request |
| POST | /v1/secrets | Wrapped-secret request |
| POST | /v1/tokens/verify | Token verification |
| POST | /v1/tokens/revoke | Token revocation |
| POST | /v1/proxy | Credential-backed upstream proxy |
| POST | /v1/consent/approve | Approve consent |
| POST | /v1/consent/deny | Deny consent |
| POST | /v1/consent/revoke | Revoke consent |
| GET | /v1/consent | List consent |
| GET | /health, /v1/health | Health |
| GET | /metrics | Metrics |
Configure the broker
Connect tenant policy, identity/public-key resolution, credential storage, wrapping keys, consent/revocation state, audit, and transport security. Production mTLS, destination policy and DNS/address checks must be verified on the deployed ingress and proxy path; a router existing in source is not evidence of secure live configuration.
Use typed request and response definitions from the handler reference and broker modules. Do not send private seed material as an identity lookup or log wrapped-secret payloads.
Credential issue/use/refresh/revocation are separate operations. The TypeScript facade's handle refresh is explicit. Test wrong tenant, missing consent, revoked token, expired capability and denied upstream target.