POST /api/v1/auth/tls-cert-auth/identities/:identityId

OpenAPI 3.0.32026-08-122,281012.1 MB

f1a4e29016fd

TLS Certificate Auth

Attach TLS Certificate Auth configuration onto machine identity

post/api/v1/auth/tls-cert-auth/identities/{identityId}

Path parameters

identityIdstring required

The ID of the machine identity to attach the configuration onto.

Request body

allowedCommonNamesstring nullable

The comma-separated list of trusted common names that are allowed to authenticate with Infisical.

allowedSubjectAltNamesstring[] nullable

The comma-separated list of trusted subject alternative names that are allowed to authenticate with Infisical. Prefix entries by type (URI:, DNS:, IP:, EMAIL:). Bare entries are treated as DNS names.

caCertificatestring required

The PEM-encoded CA certificate to validate client certificates.

verifyClientCertificateChainboolean

When false (default), the CA certificate must be the direct issuer of the client's leaf certificate. When true, the CA certificate is treated as a trust anchor and the client-presented chain (leaf plus intermediates) is validated up to it, supporting issuers that rotate beneath a stable root such as SPIRE X.509-SVIDs.

accessTokenTTLinteger

The lifetime for an access token in seconds.

accessTokenMaxTTLinteger

The maximum lifetime for an access token in seconds.

accessTokenNumUsesLimitinteger

The maximum number of times that an access token can be used.

Response

Default Response