---
title: "PATCH /api/v1/auth/jwt-auth/identities/{identityId}"
method: PATCH
path: "/api/v1/auth/jwt-auth/identities/{identityId}"
tags: ["JWT Auth"]
---

# PATCH /api/v1/auth/jwt-auth/identities/{identityId}

`PATCH /api/v1/auth/jwt-auth/identities/{identityId}`

Update JWT Auth configuration on machine identity

## Path parameters

- `identityId` string, required

## Request body

- union
  - object
    - `configurationType` 'jwks', required — The configuration for validating JWTs. Must be one of: 'jwks', 'static'
    - `jwksUrl` string, uri, required — The URL of the JWKS endpoint. Required if configurationType is 'jwks'. This endpoint must serve JSON Web Key Sets (JWKS) containing the public keys used to verify JWT signatures.
    - `jwksCaCert` string — The PEM-encoded CA certificate for validating the TLS connection to the JWKS endpoint.
    - `publicKeys` string[] — A list of PEM-encoded public keys used to verify JWT signatures. Required if configurationType is 'static'. Each key must be in RSA or ECDSA format and properly PEM-encoded with BEGIN/END markers.
    - `boundIssuer` string — The new unique identifier of the JWT provider.
    - `boundAudiences` string — The new list of intended recipients.
    - `boundClaims` object — The new attributes that should be present in the JWT for it to be valid.
    - `boundSubject` string — The new expected principal that is the subject of the JWT.
    - `accessTokenTrustedIps` object[] — The new IPs or CIDR ranges that access tokens can be used from.
      - `ipAddress` string, required
    - `accessTokenTTL` integer — The new lifetime for an access token in seconds.
    - `accessTokenMaxTTL` integer — The new maximum lifetime for an access token in seconds.
    - `accessTokenNumUsesLimit` integer — The new maximum number of times that an access token can be used.
  - object
    - `configurationType` 'static', required — The configuration for validating JWTs. Must be one of: 'jwks', 'static'
    - `jwksUrl` string — The URL of the JWKS endpoint. Required if configurationType is 'jwks'. This endpoint must serve JSON Web Key Sets (JWKS) containing the public keys used to verify JWT signatures.
    - `jwksCaCert` string — The PEM-encoded CA certificate for validating the TLS connection to the JWKS endpoint.
    - `publicKeys` string[], required — A list of PEM-encoded public keys used to verify JWT signatures. Required if configurationType is 'static'. Each key must be in RSA or ECDSA format and properly PEM-encoded with BEGIN/END markers.
    - `boundIssuer` string — The new unique identifier of the JWT provider.
    - `boundAudiences` string — The new list of intended recipients.
    - `boundClaims` object — The new attributes that should be present in the JWT for it to be valid.
    - `boundSubject` string — The new expected principal that is the subject of the JWT.
    - `accessTokenTrustedIps` object[] — The new IPs or CIDR ranges that access tokens can be used from.
      - `ipAddress` string, required
    - `accessTokenTTL` integer — The new lifetime for an access token in seconds.
    - `accessTokenMaxTTL` integer — The new maximum lifetime for an access token in seconds.
    - `accessTokenNumUsesLimit` integer — The new maximum number of times that an access token can be used.

## Response `200`

Default Response

- object
  - `identityJwtAuth` object, required
    - `id` string, uuid, required
    - `accessTokenTTL` number
    - `accessTokenMaxTTL` number
    - `accessTokenNumUsesLimit` number
    - `accessTokenTrustedIps` unknown
    - `identityId` string, uuid, required
    - `configurationType` string, required
    - `jwksUrl` string, required
    - `boundIssuer` string, required
    - `boundAudiences` string, required
    - `boundClaims` unknown
    - `boundSubject` string, required
    - `createdAt` string, date-time, required
    - `updatedAt` string, date-time, required
    - `accessTokenPeriod` number
    - `jwksCaCert` string, required
    - `publicKeys` string[], required

## Other responses

- `400` — Default Response
- `401` — Default Response
- `403` — Default Response
- `404` — Default Response
- `422` — Default Response
- `500` — Default Response

---

[API](https://skmtc.net/infisical/apis/infisical-api.md) · [All operations](https://skmtc.net/infisical/apis/infisical-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/infisical/infisical-api/versions/885aef3e6c11/schema)