Make RAR optional

By default, Vault requires an authorization details claim in OAuth JWTs used with the agent registry. While not recommended, you ca make Rich Authorization Requests (RAR) optional during migrations or in cases where your identity provider does not support RAR.

When you make RAR optional, Vault uses standard ACL policies associated with the requesting entity to evaluate requests that omit the authorization_details claim. You can modify the RAR requirement at any time.

For more information about RAR enforcement modes and configuration options, refer to the RAR enforcement overview.

Assumptions

You have added at least one agent to the agent registery in Vault.
You have configured at least one OAuth server in Vault.
You have permission to modify OAuth resource server profiles and agent registration details in Vault.

Option 1: Modify the OAuth resource server profile

You can make RAR optional for all AI agents authorized by the OAuth resource server by setting the optional_authorization_details field to true on the OAuth resource server configuration:

Use vault write to call the /sys/config/oauth-resource-server/{profile_name} endpoint and update the optional_authorization_details field:

$ vault write /sys/config/oauth-resource-server/<profile_name> \
  optional_authorization_details=true

For example:

$ vault write /sys/config/oauth-resource-server/github-actions \
  optional_authorization_details=true

/sys/config/oauth-resource-server/{profile_name} does not return data on success.

Make a POST call to /sys/config/oauth-resource-server/{profile_name} to update the optional_authorization_details field:

$ curl                                                \
  --request POST                                      \
  --header    "X-Vault-Token: ${VAULT_TOKEN}"         \
  --namespace "X-Vault-Namespace: ${VAULT_NAMESPACE}" \
  --data '{"optional_authorization_details": "true"}' \
  ${VAULT_ADDR}/v1/sys/config/oauth-resource-server/<profile_name>

For example:

$ curl                                                \
  --request POST                                      \
  --header    "X-Vault-Token: ${VAULT_TOKEN}"         \
  --namespace "X-Vault-Namespace: ${VAULT_NAMESPACE}" \
  --data '{"optional_authorization_details": "true"}' \
  ${VAULT_ADDR}/v1/sys/config/oauth-resource-server/github-actions

/sys/config/oauth-resource-server/{profile_name} does not return data on success.

Option 2: Modify the agent registration

You can make RAR optional for a specific agent by setting the optional_authorization_details field to true on the agent registry record.

Call the /agent-registry/registration/display-name/{display_name} endpoint to fetch the registration ID for the agent:

$ vault read /agent-registry/registration/display-name/<display_name> \
  | jq '.data.id'

For example:

$ vault read --format json /agent-registry/registration/display-name/bob \
  | jq '.data.id'

$ curl                                                                     \
  --request GET                                                            \
  --header    "X-Vault-Token: ${VAULT_TOKEN}"                              \
  --namespace "X-Vault-Namespace: ${VAULT_NAMESPACE}"                      \
  ${VAULT_ADDR}/v1/agent-registry/registration/display-name/{display_name} \
  | jq '.data.id'

For example:

$ curl                                                          \
  --request GET                                                 \
  --header    "X-Vault-Token: ${VAULT_TOKEN}"                   \
  --namespace "X-Vault-Namespace: ${VAULT_NAMESPACE}"           \
  ${VAULT_ADDR}/v1/agent-registry/registration/display-name/bob \
  | jq '.data.id'

Use the fetched ID and the /agent-registry/registration/id/{registration_id} endpoint to update the optional_authorization_details field:

$ vault write /agent-registry/registration/id/<registration_id> \
  optional_authorization_details=true

For example:

$ vault write /agent-registry/registration/id/00000000-0000-0000-0000-000000000000 \
  optional_authorization_details=true

$ curl                                                \
  --request POST                                      \
  --header    "X-Vault-Token: ${VAULT_TOKEN}"         \
  --namespace "X-Vault-Namespace: ${VAULT_NAMESPACE}" \
  --data '{"optional_authorization_details": "true"}' \
  ${VAULT_ADDR}/v1/agent-registry/registration/id/<registration_id>

For example:

$ curl                                                \
  --request POST                                      \
  --header    "X-Vault-Token: ${VAULT_TOKEN}"         \
  --namespace "X-Vault-Namespace: ${VAULT_NAMESPACE}" \
  --data '{"optional_authorization_details": "true"}' \
  ${VAULT_ADDR}/v1/agent-registry/registration/id/00000000-0000-0000-0000-000000000000