---
title: "POST /api/v1/additional-privilege/identity/temporary"
method: POST
path: "/api/v1/additional-privilege/identity/temporary"
tags: ["Identity Specific Privileges"]
---

# POST /api/v1/additional-privilege/identity/temporary

`POST /api/v1/additional-privilege/identity/temporary`

Create a temporary or a expiring specific privilege for identity.

## Request body

- object
  - `identityId` string, required — The ID of the machine identity to create.
  - `projectSlug` string, required — The slug of the project of the identity in.
  - `slug` string — The slug of the privilege to create.
  - `permissions` object[] — @deprecated - use privilegePermission The permission object for the privilege. - Read secrets ``` { "permissions": [{"action": "read", "subject": "secrets"]} ``` - Read and Write secrets ``` { "permissions": [{"action": "read", "subject": "secrets"], {"action": "write", "subject": "secrets"]} ``` - Read secrets scoped to an environment and secret path ``` - { "permissions": [{"action": "read", "subject": "secrets", "conditions": { "environment": "dev", "secretPath": { "$glob": "/" } }}] } ```
    - `action` 'read' | 'create' | 'edit' | 'delete', required — Describe what action an entity can take. Possible actions: create, edit, delete, and read
    - `subject` 'role' | 'member' | 'groups' | 'settings' | 'integrations' | 'webhooks' | 'service-tokens' | 'environments' | 'tags' | 'audit-logs' | 'ip-allowlist' | 'workspace' | 'secrets' | 'secret-folders' | 'secret-imports' | 'dynamic-secrets' | 'secret-rollback' | 'secret-approval' | 'secret-approval-request' | 'secret-rotation' | 'commits' | 'identity' | 'certificate-authorities' | 'certificates' | 'certificate-templates' | 'pki-subscribers' | 'pki-alerts' | 'pki-collections' | 'certificate-inventory-views' | 'kms' | 'cmek' | 'secret-syncs' | 'pki-syncs' | 'pki-discovery' | 'pki-certificate-installations' | 'code-signers' | 'kmip' | 'secret-scanning-data-sources' | 'secret-scanning-findings' | 'secret-scanning-configs' | 'secret-event-subscriptions' | 'app-connections' | 'hsm-connectors' | 'certificate-profiles' | 'certificate-policies' | 'certificate-application' | 'approval-requests' | 'approval-request-grants' | 'project-folder-grant' | 'honey-tokens' | 'proxied-services' | 'insights', required — The entity this permission pertains to. Possible options: secrets, environments
    - `conditions` object — When specified, only matching conditions will be allowed to access given resource.
      - `environment` string — The environment slug this permission should allow.
      - `secretPath` object
        - `$glob` string, required — The secret path this permission should allow. Can be a glob pattern such as /folder-name/*/**
  - `privilegePermission` object — The permission object for the privilege.
    - `actions` string[], required
    - `subject` 'secrets', required — The entity this permission pertains to. Possible options: secrets, environments
    - `conditions` object, required — When specified, only matching conditions will be allowed to access given resource.
      - `environment` string, required — The environment slug this permission should allow.
      - `secretPath` object
        - `$glob` string, required — The secret path this permission should allow. Can be a glob pattern such as /folder-name/*/**
  - `temporaryMode` 'relative', required — Type of temporary access given. Types: relative.
  - `temporaryRange` string, required — TTL for the temporary time. Eg: 1m, 1h, 1d.
  - `temporaryAccessStartTime` string, date-time, required — ISO time for which temporary access should begin.

## Response `200`

Default Response

- object
  - `privilege` object, required
    - `id` string, uuid, required
    - `slug` string, required
    - `projectMembershipId` string, uuid, required
    - `isTemporary` boolean
    - `temporaryMode` string, nullable
    - `temporaryRange` string, nullable
    - `temporaryAccessStartTime` string, date-time, nullable
    - `temporaryAccessEndTime` string, date-time, nullable
    - `permissions` object[], required
      - `subject` union
        - string
        - string[]
      - `action` union, required
        - string
        - string[]
      - `conditions` unknown
      - `inverted` boolean
    - `createdAt` string, date-time, required
    - `updatedAt` string, date-time, required

## Other responses

- `400` — Default Response
- `401` — Default Response
- `403` — Default Response
- `404` — Default Response
- `422` — Default Response
- `500` — Default Response

---

[API](https://skmtc.net/infisical/apis/infisical-api.md) · [All operations](https://skmtc.net/infisical/apis/infisical-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/infisical/infisical-api/versions/885aef3e6c11/schema)