List Claim Mappings

GET /environments/{env_id}/claim_mappings

List Claim Mappings

Return every claim mapping in the environment. The response is not paginated.

Parameters

• env_id (path, string, required): Environment ID that scopes the request.

Responses

• 200: OK

• data (array, required): Claim mappings configured in the environment.

• data[].id (string, required): Unique claim mapping ID.

• data[].env_id (string, required): Environment the mapping belongs to.

• data[].name (string, required): Human-readable mapping name, unique within the environment. Fixed at creation.

• data[].jwt_provider (string, required): Name of the OIDC provider whose tokens this mapping applies to. A mapping never matches a token verified by a different provider.

• data[].priority (integer, required): Evaluation order among the provider's mappings: lower values are evaluated first, ties are broken by name.

• data[].match (array, required): Claim conditions, all of which must hold for the mapping to match.

• data[].match[].claim (string, required): Claim to inspect. Dots traverse nested objects (for example realm_access.roles). A missing claim never matches.

• data[].match[].op (string, required): Comparison operator. exact requires a string claim equal to one of values; contains requires an array claim containing one of them. A claim whose type does not fit the operator never matches.

• data[].match[].values (array, required): Accepted values; the condition holds when any one matches.

• data[].resolve (object, required): What a matched mapping resolves to.

• data[].resolve.api_key_id (string, required): ID of the API key the request runs as. The key's model and tool access, rate limits, and budget apply exactly as if the caller had presented the key itself.

• data[].enabled (boolean, required): Whether the mapping participates in evaluation. A disabled mapping is kept but skipped.

• data[].created_at (string, required): Creation timestamp.

• data[].updated_at (string, required): Last update timestamp.

• 400: Request body or parameters failed validation.

• error (object, required): Error details.

• error.code (string, required): Machine-readable identifier. Examples: UNAUTHENTICATED, INVALID_REQUEST, MASTER_KEY_UNSET, INTERNAL.

• error.message (string, required): Human-readable explanation; safe to surface to operators.

• 401: Missing or invalid bearer. Response fields (application/json): identical to GET /environments/{env_id}/claim_mappings, response 400 above.

• 404: Resource not found. Response fields (application/json): identical to GET /environments/{env_id}/claim_mappings, response 400 above.

cURL

curl -X GET '$AISIX_CP/environments/{env_id}/claim_mappings' -H 'Authorization: Bearer $AISIX_TOKEN'