---
title: "POST /templates/{TemplateArn}/accessControlEntries"
method: POST
path: "/templates/{TemplateArn}/accessControlEntries"
---

# POST /templates/{TemplateArn}/accessControlEntries

`POST /templates/{TemplateArn}/accessControlEntries`

Create a group access control entry. Allow or deny Active Directory groups from enrolling and/or autoenrolling with the template based on the group security identifiers (SIDs).

## Path parameters

- `TemplateArn` string, required

## Request body

- object
  - `AccessRights` object, required — Allow or deny permissions for an Active Directory group to enroll or autoenroll certificates for a template.
    - `AutoEnroll` 'ALLOW' | 'DENY' — Allow or deny an Active Directory group from autoenrolling certificates issued against a template. The Active Directory group must be allowed to enroll to allow autoenrollment
    - `Enroll` 'ALLOW' | 'DENY' — Allow or deny an Active Directory group from enrolling certificates issued against a template.
  - `ClientToken` string — Idempotency token.
  - `GroupDisplayName` string, required — Name of the Active Directory group. This name does not need to match the group name in Active Directory.
  - `GroupSecurityIdentifier` string, required — Security identifier (SID) of the group object from Active Directory. The SID starts with "S-".

## Response `200`

Success

## Other responses

- `480` — AccessDeniedException
- `481` — ValidationException
- `482` — ResourceNotFoundException
- `483` — ThrottlingException
- `484` — ServiceQuotaExceededException
- `485` — InternalServerException
- `486` — ConflictException

---

[API](https://skmtc.net/aws/apis/pca-connector-ad.md) · [All operations](https://skmtc.net/aws/apis/pca-connector-ad/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/aws/pca-connector-ad/versions/ab51ba01ae5f/schema)