---
title: "POST /v1/{+parent}/trustConfigs"
method: POST
path: "/v1/{+parent}/trustConfigs"
tags: ["projects"]
---

# POST /v1/{+parent}/trustConfigs

`POST /v1/{+parent}/trustConfigs`

Creates a new TrustConfig in a given project and location.

## Path parameters

- `parent` string, required

## Query parameters

- `trustConfigId` string

## Request body

- TrustConfig — Defines a trust config.
  - `updateTime` string, google-datetime — Output only. The last update timestamp of a TrustConfig.
  - `createTime` string, google-datetime — Output only. The creation timestamp of a TrustConfig.
  - `name` string — Identifier. A user-defined name of the trust config. TrustConfig names must be unique globally and match pattern `projects/*/locations/*/trustConfigs/*`.
  - `allowlistedCertificates` AllowlistedCertificate[] — Optional. A certificate matching an allowlisted certificate is always considered valid as long as the certificate is parseable, proof of private key possession is established, and constraints on the certificate's SAN field are met.
    - `pemCertificate` string — Required. PEM certificate that is allowlisted. The certificate can be up to 5k bytes, and must be a parseable X.509 certificate.
  - `spiffeTrustStores` object — Optional. Defines a mapping from a trust domain to a TrustStore. This is used for SPIFFE certificate validation.
  - `etag` string — This checksum is computed by the server based on the value of other fields, and may be sent on update and delete requests to ensure the client has an up-to-date value before proceeding.
  - `tags` object — Optional. Input only. Immutable. Tag keys/values directly bound to this resource. For example: "123/environment": "production", "123/costCenter": "marketing"
  - `trustStores` TrustStore[] — Optional. Set of trust stores to perform validation against. This field is supported when TrustConfig is configured with Load Balancers, currently not supported for SPIFFE certificate validation. Only one TrustStore specified is currently allowed.
    - `intermediateCas` IntermediateCA[] — Optional. Set of intermediate CA certificates used for the path building phase of chain validation. The field is currently not supported if TrustConfig is used for the workload certificate feature.
      - `pemCertificate` string — PEM intermediate certificate used for building up paths for validation. Each certificate provided in PEM format may occupy up to 5kB.
    - `trustAnchors` TrustAnchor[] — Optional. List of Trust Anchors to be used while performing validation against a given TrustStore.
      - `pemCertificate` string — PEM root certificate of the PKI used for validation. Each certificate provided in PEM format may occupy up to 5kB.
  - `labels` object — Optional. Set of labels associated with a TrustConfig.
  - `description` string — Optional. One or more paragraphs of text description of a TrustConfig.

## Response `200`

Successful response

---

[API](https://skmtc.net/google/apis/certificatemanager.md) · [All operations](https://skmtc.net/google/apis/certificatemanager/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/google/certificatemanager/versions/2a5bf0361fcc/schema)