> ## Documentation Index
> Fetch the complete documentation index at: https://bloodhound.specterops.io/llms.txt
> Use this file to discover all available pages before exploring further.

# GH_CanRequestOIDCTokenFor

> [Computed] Workflow job has a static upper-bound capability to request a GitHub OIDC token for its deployment environment — GH_WorkflowJob → GH_Environment

<img noZoom src="https://mintcdn.com/specterops/tTIczgde9H07oLXf/assets/enterprise-AND-community-edition-pill-tag.svg?fit=max&auto=format&n=tTIczgde9H07oLXf&q=85&s=ad49a576589f4d2a8081df77d07fdf56" alt="Applies to BloodHound Enterprise and CE" width="482" height="45" data-path="assets/enterprise-AND-community-edition-pill-tag.svg" />

## Edge Schema

* Traversable: ✅

| Start                                                                | Kind                       | End                                                                  |
| -------------------------------------------------------------------- | -------------------------- | -------------------------------------------------------------------- |
| [GH\_WorkflowJob](/opengraph/extensions/github/nodes/gh_workflowjob) | GH\_CanRequestOIDCTokenFor | [GH\_Environment](/opengraph/extensions/github/nodes/gh_environment) |

```mermaid theme={null}
flowchart LR
    GH_Environment["GH_Environment"]
    GH_WorkflowJob["GH_WorkflowJob"]
    GH_WorkflowJob -- GH_CanRequestOIDCTokenFor --> GH_Environment
```

## General Information

The traversable GH\_CanRequestOIDCTokenFor edge represents a static upper-bound capability: based on the collected workflow configuration, a GitHub Actions workflow job execution context may be able to request a GitHub-signed OIDC token containing claims for its associated GitHub Environment.

This edge is derived from the existing [GH\_DeploysTo](/opengraph/extensions/github/edges/gh_deploysto) relationship and the job's calculated `effective_github_token_permissions`. The collector emits it only when the job targets a statically resolved environment and its effective permissions include `id-token:write`.

This is a capability edge, not evidence that the workflow has historically requested a token or contains an explicit OIDC-related step. Code executing in a job with `id-token:write` can request the token directly.

The edge does not model run-specific permission recalculation. In particular, a `pull_request` run originating from a fork may receive downgraded `GITHUB_TOKEN` permissions at runtime and therefore may not be able to request an OIDC token even when this edge exists. The edge should not be interpreted as proof that every execution of the job can request OIDC.

## Edge Schema

| Source                                                               | Destination                                                          | Traversable |
| -------------------------------------------------------------------- | -------------------------------------------------------------------- | ----------- |
| [GH\_WorkflowJob](/opengraph/extensions/github/nodes/gh_workflowjob) | [GH\_Environment](/opengraph/extensions/github/nodes/gh_environment) | `true`      |

## Diagram

```mermaid theme={null}
graph LR
    n0["GH_WorkflowJob"]
    n1["GH_Environment"]
    n0 -->|GH_CanRequestOIDCTokenFor| n1
```