Passport
Authenticate integration principals independently from end-customer credentials.
When to use it
Verify the workspace identity backing an API key and isolate multi-tenant integration calls.
Supported Operations & Data Contracts
Call this module with a key scoped to 'passport'. Provide the operation name and matching input dictionary.
identity · Identify Integration PrincipalPOST /api/v1/modules/passport
Returns the workspace tenant principal ID bound to the provided API key.
Output Fields
| Field | Type | Description |
|---|---|---|
principalId | string | Workspace tenant user or organization ID. |
authenticatedBy | string ('api-key') | Authentication mechanism used. |
customerAuthenticated | boolean (false) | Always false. Integration keys never prove customer credentials. |
Example Request Payload
JSON Request BodyContent-Type: application/json
{
"operation": "identity",
"input": {}
}Example Response
JSON Response (HTTP 200)Cache-Control: no-store
{
"module": "passport",
"output": {
"principalId": "usr_99f482a1",
"authenticatedBy": "api-key",
"customerAuthenticated": false
}
}Configuration in Graph Builder
When adding Passport into a visual component or graph workflow, configure its node runtime settings in the builder inspector:
Place Passport as an initial credential verification node in workflows that require tenant attribution before processing operations.
Direct API Code Examples
Invoke this module directly from your backend services without passing through the visual builder:
TypeScript / Node.js (Fetch)index.ts
const response = await fetch("https://api.sherlock.dev/api/v1/modules/passport", {
method: "POST",
headers: {
"Authorization": "Bearer " + process.env.SHERLOCK_API_KEY,
"Content-Type": "application/json",
},
body: JSON.stringify({ operation: "identity", input: {} }),
});
const { output } = await response.json();
console.log("Caller Principal ID:", output.principalId);cURL / Bashterminal
curl -X POST "$SHERLOCK_BASE_URL/api/v1/modules/passport" \
-H "Authorization: Bearer $SHERLOCK_API_KEY" \
-H "Content-Type: application/json" \
-d '{"operation":"identity","input":{}}'Current Boundaries & Guarantees
The API key identifies the integration owner, not an end customer. Customer step-up sessions and voice read-back verification remain separate.