---
title: "POST /v1/{+parent}/clientTlsPolicies"
method: POST
path: "/v1/{+parent}/clientTlsPolicies"
tags: ["projects"]
---

# POST /v1/{+parent}/clientTlsPolicies

`POST /v1/{+parent}/clientTlsPolicies`

Creates a new ClientTlsPolicy in a given project and location.

## Path parameters

- `parent` string, required

## Query parameters

- `clientTlsPolicyId` string

## Request body

- ClientTlsPolicy — ClientTlsPolicy is a resource that specifies how a client should authenticate connections to backends of a service. This resource itself does not affect configuration unless it is attached to a backend service resource.
  - `labels` object — Optional. Set of label tags associated with the resource.
  - `serverValidationCa` ValidationCA[] — Optional. Defines the mechanism to obtain the Certificate Authority certificate to validate the server certificate. If empty, client does not validate the server certificate.
    - `grpcEndpoint` GoogleCloudNetworksecurityV1GrpcEndpoint — Specification of the GRPC Endpoint.
      - `targetUri` string — Required. The target URI of the gRPC endpoint. Only UDS path is supported, and should start with "unix:".
    - `certificateProviderInstance` CertificateProviderInstance — Specification of a TLS certificate provider instance. Workloads may have one or more CertificateProvider instances (plugins) and one of them is enabled and configured by specifying this message. Workloads use the values from this message to locate and load the CertificateProvider instance configuration.
      - `pluginInstance` string — Required. Plugin instance name, used to locate and load CertificateProvider instance configuration. Set to "google_cloud_private_spiffe" to use Certificate Authority Service certificate provider instance.
  - `description` string — Optional. Free-text description of the resource.
  - `createTime` string, google-datetime — Output only. The timestamp when the resource was created.
  - `clientCertificate` GoogleCloudNetworksecurityV1CertificateProvider — Specification of certificate provider. Defines the mechanism to obtain the certificate and private key for peer to peer authentication.
    - `grpcEndpoint` GoogleCloudNetworksecurityV1GrpcEndpoint — Specification of the GRPC Endpoint.
      - `targetUri` string — Required. The target URI of the gRPC endpoint. Only UDS path is supported, and should start with "unix:".
    - `certificateProviderInstance` CertificateProviderInstance — Specification of a TLS certificate provider instance. Workloads may have one or more CertificateProvider instances (plugins) and one of them is enabled and configured by specifying this message. Workloads use the values from this message to locate and load the CertificateProvider instance configuration.
      - `pluginInstance` string — Required. Plugin instance name, used to locate and load CertificateProvider instance configuration. Set to "google_cloud_private_spiffe" to use Certificate Authority Service certificate provider instance.
  - `updateTime` string, google-datetime — Output only. The timestamp when the resource was updated.
  - `name` string — Required. Name of the ClientTlsPolicy resource. It matches the pattern `projects/{project}/locations/{location}/clientTlsPolicies/{client_tls_policy}`
  - `sni` string — Optional. Server Name Indication string to present to the server during TLS handshake. E.g: "secure.example.com".

## Response `200`

Successful response

---

[API](https://skmtc.net/google/apis/networksecurity.md) · [All operations](https://skmtc.net/google/apis/networksecurity/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/google/networksecurity/versions/4afd54463fe6/schema)