---
title: "Add Binding"
method: POST
path: "/api/v1/service_principals/bindings"
tags: ["Service Principal Binding"]
---

# Add Binding

`POST /api/v1/service_principals/bindings`

AddBinding links a tenant-scoped subject (a function today; future kinds
 tomorrow) to a service principal. Outbound c1-api calls made on the
 subject's behalf can then be minted as user:<service_principal_id> via
 an RFC 8693 token-exchange (act-as) flow. Many-aware: a subject may
 hold multiple bindings at the storage layer. Idempotent on
 (subject, service_principal_id) — adds the row if missing,
 resurrects it if soft-deleted, no-op if already active. Consumers
 that need 0-or-1 cardinality (Functions today) enforce it
 client-side via ListBindings + DeleteBinding. Requires the
 SERVICE_PRINCIPALS feature flag.

## Request body

- C1ApiServicePrincipalV1ServicePrincipalServiceAddBindingRequest — The ServicePrincipalServiceAddBindingRequest message.
  - `servicePrincipalId` string — The servicePrincipalId field.
  - `subject` C1ApiServicePrincipalV1ServicePrincipalBindingSubject — ServicePrincipalBindingSubject identifies the entity that is bound to a service principal. Open-ended oneof so future subject kinds (workflows, connectors, etc.) can be added without changing the RPC shape. This message contains a oneof named kind. Only a single field of the following list may be set at a time: - functionId
    - `functionId` string, nullable — Function ID. The function authenticates outbound c1-api calls as user:<service_principal_id> instead of function:<function_id>. This field is part of the `kind` oneof. See the documentation for `c1.api.service_principal.v1.ServicePrincipalBindingSubject` for more details.

## Response `200`

Successful response

- C1ApiServicePrincipalV1ServicePrincipalServiceAddBindingResponse — The ServicePrincipalServiceAddBindingResponse message.

---

[API](https://skmtc.net/conductorone/apis/c1-api.md) · [All operations](https://skmtc.net/conductorone/apis/c1-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/conductorone/c1-api/revisions/f2cf3228f366/schema)