Feature
Service-account PATs
Long-lived machine credentials for an Org, with the dg_ prefix, shown once and stored only as a hash.
An org:admin creates a service-account PAT. The raw token is returned exactly once; Rolodex keeps only its SHA-256 hash.
A PAT holds the ci:agent role, which is off the Org role ladder. The directory lookup routes refuse PATs, so a machine credential never reads personal fields.
More features
All features →- 01
Directory lookups
The LDAP Sync Cache contract: find a directory user by any of five identifiers, search, list, and get groups with nested groups expanded.
- 02
SSH keys lookup
Fetch the public SSH keys of one directory user, or of every member of a directory group, by name.
- 03
Directory sync
Sync sources feed the directory. Each sync run upserts users and groups and keeps users who left as inactive tombstones.