OpenAgentID documentation
Source referencesRust module referencearsenal-sdk

arsenal-sdk · client

Declared module signatures, types, configuration, and source documentation.

Source: arsenal/crates/arsenal-sdk/src/client.rs. SHA-256: 777c7783f6c127277d54e40c822d1b5b3916608a3306affde415af33ac66626c.

This source reference follows declared modules and preserves feature attributes. It includes public declarations and implementation methods in those modules. Private-module exports and trait resolution still require the compiler; not every declaration is a crate-root import. Function bodies and constant values are omitted. Source comments describe their implementation context and are not a production deployment claim.

client::ArsenalClient

Arsenal client for agent key management

pub struct ArsenalClient {

}

Source line: 26.

client::ClientConfig

Client configuration

#[derive(Debug, Clone)]
pub struct ClientConfig {
/// Broker URL (for remote broker)

pub broker_url: Option<String>,
/// Broker TLS configuration (required when `broker_url` is set)

pub broker_tls: Option<BrokerTlsConfig>,
/// Session configuration

pub session_config: SessionConfig,
/// Auto-renew tokens

pub auto_renew: bool,
/// Issuer

pub issuer: String,
/// Default audience for broker-issued tokens

pub default_audience: String
}

Source line: 45.

client::BrokerTlsConfig

Broker TLS configuration for mTLS + custom trust roots.

#[derive(Debug, Clone)]
pub struct BrokerTlsConfig {
/// PEM-encoded client certificate chain

pub client_cert_path: PathBuf,
/// PEM-encoded client private key

pub client_key_path: PathBuf,
/// Optional PEM-encoded CA certificate to trust for the broker server

pub ca_cert_path: Option<PathBuf>
}

Source line: 62.

client::ArsenalClientBuilder

Builder for Arsenal client

pub struct ArsenalClientBuilder {

}

Source line: 85.

client::ArsenalClientBuilder::new

Create a new Arsenal client builder

Returns

A new Arsenal client builder

#[must_use]
pub fn new() -> Self;

Source line: 96.

client::ArsenalClientBuilder::identity

Set the agent identity

Parameters

  • identity - The agent identity

Returns

A new Arsenal client builder

#[must_use]
pub fn identity(mut self, identity: AgentIdentityLoader) -> Self;

Source line: 111.

client::ArsenalClientBuilder::broker_url

Set the broker URL

Parameters

  • url - The broker URL

Returns

A new Arsenal client builder

#[must_use]
pub fn broker_url(mut self, url: impl Into<String>) -> Self;

Source line: 124.

client::ArsenalClientBuilder::broker_mtls

Configure mTLS for broker communication (required when using a broker).

#[must_use]
pub fn broker_mtls(
        mut self,
        client_cert_path: impl Into<PathBuf>,
        client_key_path: impl Into<PathBuf>,
    ) -> Self;

Source line: 131.

client::ArsenalClientBuilder::broker_ca_cert_path

Configure a custom CA bundle for broker server validation.

#[must_use]
pub fn broker_ca_cert_path(mut self, ca_cert_path: impl Into<PathBuf>) -> Self;

Source line: 153.

client::ArsenalClientBuilder::default_audience

Set the default audience for broker-issued tokens.

#[must_use]
pub fn default_audience(mut self, audience: impl Into<String>) -> Self;

Source line: 169.

client::ArsenalClientBuilder::session_config

Set session configuration

Parameters

  • config - The session configuration

Returns

A new Arsenal client builder

#[must_use]
pub fn session_config(mut self, config: SessionConfig) -> Self;

Source line: 182.

client::ArsenalClientBuilder::auto_renew

Set auto-renew

Parameters

  • auto_renew - Whether to auto-renew tokens

Returns

A new Arsenal client builder

#[must_use]
pub fn auto_renew(mut self, auto_renew: bool) -> Self;

Source line: 195.

client::ArsenalClientBuilder::issuer

Set issuer

Parameters

  • issuer - The issuer

Returns

A new Arsenal client builder

#[must_use]
pub fn issuer(mut self, issuer: impl Into<String>) -> Self;

Source line: 208.

client::ArsenalClientBuilder::build

Build the client

Errors

Returns an error if identity is not set

Returns

The Arsenal client

pub fn build(self) -> ArsenalResult<ArsenalClient>;

Source line: 220.

client::ArsenalClient::builder

Create a new Arsenal client builder

Returns

A new Arsenal client builder

#[must_use]
pub fn builder() -> ArsenalClientBuilder;

Source line: 319.

client::ArsenalClient::identity

Get the agent identity

Returns

The agent identity

#[must_use]
pub fn identity(&self) -> &AgentIdentityLoader;

Source line: 328.

client::ArsenalClient::tenant_id

Get the tenant ID

Returns

The tenant ID

#[must_use]
pub fn tenant_id(&self) -> &TenantId;

Source line: 337.

client::ArsenalClient::start_session

Start a new session

Errors

Returns an error if session creation fails

Returns

The session ID

pub async fn start_session(&self) -> ArsenalResult<SessionId>;

Source line: 348.

client::ArsenalClient::session_id

Get current session ID

Errors

Returns an error if no session is active

Returns

The session ID

pub async fn session_id(&self) -> ArsenalResult<SessionId>;

Source line: 359.

client::ArsenalClient::has_active_session

Check if a session is active

Returns

Whether a session is active

pub async fn has_active_session(&self) -> bool;

Source line: 367.

client::ArsenalClient::session_stats

Get session statistics

Returns

The session statistics

pub async fn session_stats(&self) -> SessionStats;

Source line: 375.

client::ArsenalClient::request_capability

Request a capability

Errors

Returns an error if the request fails

Returns

The capability handle

pub async fn request_capability(
        &self,
        request: CapabilityRequest,
    ) -> ArsenalResult<CapabilityHandle>;

Source line: 386.

client::ArsenalClient::request_capability_for_scopes

Request a capability with scope strings

Errors

Returns an error if the request fails

Parameters

  • scopes - The scopes
  • ttl_seconds - The TTL in seconds

Returns

The capability handle

pub async fn request_capability_for_scopes(
        &self,
        scopes: &[&str],
        ttl_seconds: i64,
    ) -> ArsenalResult<CapabilityHandle>;

Source line: 485.

client::ArsenalClient::current_token

Get current capability token

Returns

The current capability token

pub async fn current_token(&self) -> Option<AgentCapabilityToken>;

Source line: 501.

client::ArsenalClient::register_tool

Register a tool

Parameters

  • tool - The tool to register
pub fn register_tool(&mut self, tool: Arc<dyn Tool>);

Source line: 509.

client::ArsenalClient::call_tool

Call a tool

Errors

Returns an error if the call fails

Parameters

  • request - The tool call request

Returns

The tool call response

pub async fn call_tool(
        &mut self,
        request: &ToolCallRequest,
    ) -> ArsenalResult<ToolCallResponse>;

Source line: 523.

client::ArsenalClient::unwrap_secret_response

Unwrap a broker-wrapped secret using this agent's encryption key.

The broker encrypts secrets to the agent's derived X25519 public key and includes an ephemeral public key for DH key agreement. This helper performs the full decrypt locally.

Errors

Returns an error if decoding or decryption fails.

pub fn unwrap_secret_response(
        &self,
        wrapped: &SecretResponsePayload,
    ) -> ArsenalResult<Vec<u8>>;

Source line: 554.

client::ArsenalClient::call_tool_simple

Call a tool with simple interface

Errors

Returns an error if the call fails

pub async fn call_tool_simple(
        &mut self,
        tool_id: &str,
        method: &str,
        params: serde_json::Value,
    ) -> ArsenalResult<serde_json::Value>;

Source line: 645.

client::ArsenalClient::proxy_http

Send a proxy request through the broker's credential proxy.

The proxy resolves {{VARIABLE}} placeholders server-side, so agents never see raw credentials. Requires a valid capability token with appropriate proxy scopes.

Errors

Returns an error if no proxy client is configured, the request is invalid, or the broker rejects it.

pub async fn proxy_http(
        &self,
        request: arsenal_core::proxy::ProxyRequest,
    ) -> ArsenalResult<arsenal_core::proxy::ProxyResponse>;

Source line: 675.

client::ArsenalClient::proxy_client

Get a reference to the proxy client (if configured).

#[must_use]
pub fn proxy_client(&self) -> Option<&Arc<ProxyClient>>;

Source line: 691.

Approve a consent request for credential access.

Errors

Returns an error if no broker is configured or the approval fails.

pub async fn approve_consent(
        &self,
        payload: ConsentApprovalPayload,
    ) -> ArsenalResult<ConsentRecordPayload>;

Source line: 699.

client::ArsenalClient::list_consents

List consent records for this agent.

Errors

Returns an error if no broker is configured or the request fails.

pub async fn list_consents(&self) -> ArsenalResult<Vec<ConsentRecordPayload>>;

Source line: 717.

client::ArsenalClient::end_session

End the current session

Errors

Returns an error if ending fails

pub async fn end_session(&self) -> ArsenalResult<()>;

Source line: 733.

client::ArsenalClient::revoke_session

Revoke the current session

pub async fn revoke_session(&self);

Source line: 738.

arsenal-sdk · capability

Declared module signatures, types, configuration, and source documentation.

arsenal-sdk · crate

Declared module signatures, types, configuration, and source documentation.

On this page

client::ArsenalClientclient::ClientConfigclient::BrokerTlsConfigclient::ArsenalClientBuilderclient::ArsenalClientBuilder::newReturnsclient::ArsenalClientBuilder::identityParametersReturnsclient::ArsenalClientBuilder::broker_urlParametersReturnsclient::ArsenalClientBuilder::broker_mtlsclient::ArsenalClientBuilder::broker_ca_cert_pathclient::ArsenalClientBuilder::default_audienceclient::ArsenalClientBuilder::session_configParametersReturnsclient::ArsenalClientBuilder::auto_renewParametersReturnsclient::ArsenalClientBuilder::issuerParametersReturnsclient::ArsenalClientBuilder::buildErrorsReturnsclient::ArsenalClient::builderReturnsclient::ArsenalClient::identityReturnsclient::ArsenalClient::tenant_idReturnsclient::ArsenalClient::start_sessionErrorsReturnsclient::ArsenalClient::session_idErrorsReturnsclient::ArsenalClient::has_active_sessionReturnsclient::ArsenalClient::session_statsReturnsclient::ArsenalClient::request_capabilityErrorsReturnsclient::ArsenalClient::request_capability_for_scopesErrorsParametersReturnsclient::ArsenalClient::current_tokenReturnsclient::ArsenalClient::register_toolParametersclient::ArsenalClient::call_toolErrorsParametersReturnsclient::ArsenalClient::unwrap_secret_responseErrorsclient::ArsenalClient::call_tool_simpleErrorsclient::ArsenalClient::proxy_httpErrorsclient::ArsenalClient::proxy_clientclient::ArsenalClient::approve_consentErrorsclient::ArsenalClient::list_consentsErrorsclient::ArsenalClient::end_sessionErrorsclient::ArsenalClient::revoke_session