---
title: "List Trusts"
method: GET
path: "/api/v1/service_principals/{service_principal_id}/trusts"
tags: ["Workload Federation"]
---

# List Trusts

`GET /api/v1/service_principals/{service_principal_id}/trusts`

ListTrusts lists trusts for a service principal.

## Path parameters

- `service_principal_id` string, required — The service principal ID to list trusts for (from URL path).

## Response `200`

Successful response

- C1ApiWorkloadFederationV1WorkloadFederationServiceListTrustsResponse — The WorkloadFederationServiceListTrustsResponse message.
  - `list` C1ApiWorkloadFederationV1WorkloadFederationTrust[], nullable — The list field.
    - `allowSourceCidrs` string[], nullable — IP allowlist for token exchange requests matching this trust.
    - `clientId` string — The full client ID of the trust (e.g., "clever-fox-42195@acme.conductorone.com/wfe"). Used as the client_id parameter in RFC 8693 token exchange requests.
    - `conditionExpression` string — CEL expression evaluated against JWT claims. Must return bool. Example: claims.sub.startsWith("repo:acme/infra:") && claims.environment == "production"
    - `createdAt` string, date-time
    - `description` string — A description of what this trust policy matches.
    - `disabled` boolean — Whether the trust is disabled.
    - `displayName` string — The display name of the trust.
    - `passthroughClaims` string[], nullable — JWT claim names from the subject token to copy into the issued C1 token. Values are placed in the "c1wfc" claim as a map[string]string. Only string-valued claims are copied; non-string claims are silently skipped. Example: ["repository", "repository_owner", "job_workflow_ref"]
    - `providerId` string — The provider ID this trust references. Immutable after creation.
    - `scopedRoleIds` string[], nullable — Scoped role IDs. Effective permissions = min(SP roles, trust.scoped_role_ids).
    - `servicePrincipalId` string — The service principal user ID this trust belongs to.
    - `updatedAt` string, date-time
  - `nextPageToken` string — The nextPageToken field.

---

[API](https://skmtc.net/conductorone/apis/c1-api.md) · [All operations](https://skmtc.net/conductorone/apis/c1-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/conductorone/c1-api/versions/d391405a35d3/schema)