---
title: "Create"
method: POST
path: "/api/v1/decoys"
tags: ["Decoy"]
---

# Create

`POST /api/v1/decoys`

Create mints a decoy credential and returns the one-time vending
 material exactly once. The Decoy id is server-set; the credential's
 secret cannot be retrieved again after this response.

## Request body

- C1ApiDecoyV1DecoyServiceCreateRequest — The DecoyServiceCreateRequest message. This message contains a oneof named create_input. Only a single field of the following list may be set at a time: - userClientCredential - connectorClient - workloadFed - accessToken
  - `accessToken` C1ApiDecoyV1DecoyAccessTokenInput, nullable — DecoyAccessTokenInput requests a freestanding session access-token decoy minted under an existing User.
    - `expiresIn` string, duration
    - `subjectUserId` string — Existing User the access token's subject claim references.
  - `annotations` object — The annotations field.
  - `connectorClient` C1ApiDecoyV1DecoyConnectorClientInput, nullable — DecoyConnectorClientInput requests a ConnectorClientCredential decoy planted under an existing app+connector.
    - `appId` string — The appId field.
    - `connectorId` string — The connectorId field.
  - `description` string — The description field.
  - `displayName` string — The displayName field.
  - `userClientCredential` C1ApiDecoyV1DecoyUserClientCredentialInput, nullable — DecoyUserClientCredentialInput requests a UserClientCredential decoy planted under an existing User. The User's typ selects the credential usage: HUMAN -> pcc, SERVICE -> spc. Any other typ (SYSTEM, AGENT) is rejected at the handler.
    - `userId` string — Existing User to plant the decoy credential under. Must be typ=HUMAN or typ=SERVICE.
  - `workloadFed` C1ApiDecoyV1DecoyWorkloadFederationInput, nullable — DecoyWorkloadFederationInput requests a WorkloadFederationTrust decoy bound to an existing Provider. Decoys reuse an already-registered Provider because Trust matching requires a real JWKS for JWT signature verification before the decoy_id check fires. `condition_expression` is the same CEL shape the regular WF Trust API takes -- operators express whatever matching they want against the JWT claims map (`claims.aud`, `claims.sub`, custom claims). Compiled + validated by the WF controller's CreateTrust at create time.
    - `conditionExpression` string — CEL boolean evaluated against the presented JWT's claims map. Example: `claims.sub.startsWith("repo:acme/fake-infra:")`.
    - `providerId` string — Existing WorkloadFederationProvider to bind the decoy Trust under.
    - `servicePrincipalUserId` string — Existing SERVICE-typed User the Trust binds to. An attacker tripping the decoy would otherwise be act-as'ing this principal.

## Response `200`

Successful response

- C1ApiDecoyV1DecoyServiceCreateResponse — The DecoyServiceCreateResponse message.
  - `decoy` C1ApiDecoyV1Decoy — Decoy is the public projection of a planted honey-credential. Read-only surface; the variant-specific back-references live in c1models and are not exposed here.
    - `annotations` object — Customer-defined grouping/filtering bag. PATCH semantics on Update: keys in the request overwrite, keys missing stay, keys set to empty string delete. Copied into the resulting Finding's custom_tags so routing rules can condition on the same keys.
    - `createdAt` string, date-time
    - `description` string — The description field.
    - `disabled` boolean — Admin-disabled.
    - `displayName` string — The displayName field.
    - `id` string — The id field.
    - `kind` 'DECOY_KIND_UNSPECIFIED' | 'DECOY_KIND_USER_CLIENT_CREDENTIAL' | 'DECOY_KIND_CONNECTOR_CLIENT' | 'DECOY_KIND_WORKLOAD_FEDERATION' | 'DECOY_KIND_ACCESS_TOKEN' — The kind field.
    - `updatedAt` string, date-time
  - `material` C1ApiDecoyV1DecoyVendingMaterial — DecoyVendingMaterial carries the freshly-vended secret material returned exactly once at Create or Rotate. This message contains a oneof named material. Only a single field of the following list may be set at a time: - clientCredential - accessToken - workloadFederation
    - `accessToken` C1ApiDecoyV1DecoyAccessTokenMaterial, nullable — DecoyAccessTokenMaterial is returned for AccessToken decoys.
      - `accessToken` string — The accessToken field.
    - `clientCredential` C1ApiDecoyV1DecoyClientCredentialMaterial, nullable — DecoyClientCredentialMaterial is returned for UserClientCredential and ConnectorClient decoys.
      - `clientId` string — The clientId field.
      - `clientSecret` string — The clientSecret field.
    - `workloadFederation` C1ApiDecoyV1DecoyWorkloadFederationMaterial, nullable — DecoyWorkloadFederationMaterial is returned for WorkloadFederation decoys. No vended secret; the operator binds the trust on the IdP side.
      - `workloadFederationTrustId` string — The workloadFederationTrustId field.

---

[API](https://skmtc.net/conductorone/apis/c1-api.md) · [All operations](https://skmtc.net/conductorone/apis/c1-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/conductorone/c1-api/revisions/d391405a35d3/schema)