# EndpointAuthentication


[API catalog](/reference/api/) · [Docker Sandboxes overview](/reference/api/sandboxes/latest/) · [Product manual](https://docs.docker.com/ai/sandboxes-api/) · [OpenAPI specification](/reference/api/sandboxes/api.yaml)

API version: v1


> This API is experimental. Features, interfaces,
> and behavior may change.




Schema constraints and annotations:

```json
{
  "dependentSchemas": {
    "credentialTransports": {
      "allOf": [
        {
          "if": {
            "properties": {
              "scheme": {
                "const": "localSocket"
              }
            }
          },
          "then": {
            "properties": {
              "credentialTransports": {
                "maxItems": 0
              }
            }
          }
        }
      ]
    },
    "scheme": {
      "allOf": [
        {
          "oneOf": [
            {
              "properties": {
                "defaultTtl": {
                  "pattern": "^300([.]0{1,9})?s$"
                },
                "maxTtl": {
                  "pattern": "^300([.]0{1,9})?s$"
                },
                "scheme": {
                  "const": "scopedBearer"
                }
              },
              "required": [
                "defaultTtl",
                "maxTtl"
              ]
            },
            {
              "not": {
                "anyOf": [
                  {
                    "required": [
                      "defaultTtl"
                    ]
                  },
                  {
                    "required": [
                      "maxTtl"
                    ]
                  }
                ]
              },
              "properties": {
                "scheme": {
                  "const": "localSocket"
                }
              }
            }
          ]
        }
      ]
    }
  },
  "description": "EndpointAuthentication describes credential issuance without publishing a token.\nlocal sockets cannot advertise bearer credential transports\nscoped bearer discovery states the five-minute credential lifetime; local sockets carry no token lifetime",
  "properties": {
    "credentialTransports": {
      "description": "Omission retains Authorization-header clients; browsers require an explicit subprotocol offer.",
      "items": {
        "$ref": "#/components/schemas/EndpointCredentialTransport"
      },
      "type": "array",
      "uniqueItems": true
    },
    "defaultTtl": {
      "$ref": "#/components/schemas/Duration",
      "description": "default_ttl and max_ttl describe CreateEndpointCredential's provider policy."
    },
    "maxTtl": {
      "$ref": "#/components/schemas/Duration"
    },
    "scheme": {
      "$ref": "#/components/schemas/EndpointAuthenticationScheme",
      "not": {
        "enum": [
          "unspecified"
        ]
      }
    }
  },
  "required": [
    "scheme"
  ],
  "title": "EndpointAuthentication",
  "type": "object"
}
```