---
title: "POST /api/v1/auth/spiffe-auth/identities/{identityId}"
method: POST
path: "/api/v1/auth/spiffe-auth/identities/{identityId}"
tags: ["SPIFFE Auth"]
---

# POST /api/v1/auth/spiffe-auth/identities/{identityId}

`POST /api/v1/auth/spiffe-auth/identities/{identityId}`

Attach SPIFFE Auth configuration onto machine identity

## Path parameters

- `identityId` string, required

## Request body

- object
  - `trustDomain` string, required — The SPIFFE trust domain (e.g. prod.example.com).
  - `allowedSpiffeIds` string, required — Comma-separated list of allowed SPIFFE ID patterns. Supports picomatch glob patterns (e.g. spiffe://prod.example.com/**).
  - `allowedAudiences` string, required — Comma-separated list of allowed audiences for JWT-SVID validation.
  - `trustBundleDistribution` union, required
    - object
      - `profile` 'static', required — The trust bundle distribution profile. Must be one of: 'static' (admin uploads JWKS), 'https_web_bundle' (auto-refresh from HTTPS endpoint).
      - `bundle` string, required — The JWKS JSON containing public keys for JWT-SVID verification. Required when profile is 'static'.
    - object
      - `profile` 'https_web_bundle', required — The trust bundle distribution profile. Must be one of: 'static' (admin uploads JWKS), 'https_web_bundle' (auto-refresh from HTTPS endpoint).
      - `endpointUrl` string, uri, required — The SPIRE bundle endpoint URL for automatic trust bundle retrieval. Required when profile is 'https_web_bundle'.
      - `caCert` string — Optional PEM-encoded root CA certificate for verifying the bundle endpoint TLS connection. Defaults to system root CAs when not provided.
      - `refreshHintSeconds` integer — The interval in seconds between bundle refresh attempts. Defaults to 3600.
  - `accessTokenTrustedIps` object[] — The IPs or CIDR ranges that access tokens can be used from.
    - `ipAddress` string, required
  - `accessTokenTTL` integer — The lifetime for an access token in seconds.
  - `accessTokenMaxTTL` integer — The maximum lifetime for an access token in seconds.
  - `accessTokenNumUsesLimit` integer — The maximum number of times that an access token can be used.

## Response `200`

Default Response

- object
  - `identitySpiffeAuth` object, required
    - `id` string, uuid, required
    - `identityId` string, uuid, required
    - `trustDomain` string, required
    - `allowedSpiffeIds` string, required
    - `allowedAudiences` string, required
    - `accessTokenTTL` number
    - `accessTokenMaxTTL` number
    - `accessTokenNumUsesLimit` number
    - `accessTokenTrustedIps` unknown
    - `createdAt` string, date-time, required
    - `updatedAt` string, date-time, required
    - `trustBundleDistribution` union, required
      - object
        - `profile` 'static', required
        - `bundle` string, required
      - object
        - `profile` 'https_web_bundle', required
        - `endpointUrl` string, required
        - `caCert` string, required
        - `refreshHintSeconds` number, required
        - `cachedBundleLastRefreshedAt` string, date-time, nullable

## Other responses

- `400` — Default Response
- `401` — Default Response
- `403` — Default Response
- `404` — Default Response
- `422` — Default Response
- `500` — Default Response

---

[API](https://skmtc.net/infisical/apis/infisical-api.md) · [All operations](https://skmtc.net/infisical/apis/infisical-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/infisical/infisical-api/revisions/885aef3e6c11/schema)