--- title: "POST /api/v2/identity-project-additional-privilege" method: POST path: "/api/v2/identity-project-additional-privilege" tags: ["Identity Specific Privileges V2"] --- # POST /api/v2/identity-project-additional-privilege `POST /api/v2/identity-project-additional-privilege` Add an additional privilege for identity. ## Request body - object - `identityId` string, required — The ID of the machine identity to create the privilege for. - `projectId` string, required — The ID of the project of the identity in. - `slug` string — The slug of the privilege to create. - `permissions` union[], required — The permission for the privilege. - union - object - `subject` 'secrets', required — The entity this permission pertains to. - `inverted` boolean — Whether rule allows or forbids. - `action` union, required — Describe what action an entity can take. - 'read' | 'describeSecret' | 'readValue' | 'create' | 'edit' | 'delete' - string[] - `conditions` object — When specified, only matching conditions will be allowed to access given resource. - `environment` union - string - object - … - `secretPath` union - string - object - … - `secretName` union - string - object - … - `secretTags` object - `$in` string[] - `$all` string[] - `eventType` union - string - object - … - object - `subject` 'secret-folders', required — The entity this permission pertains to. - `inverted` boolean — Whether rule allows or forbids. - `action` union, required — Describe what action an entity can take. - 'read' | 'create' | 'edit' | 'delete' - string[] - `conditions` object — When specified, only matching conditions will be allowed to access given resource. - `environment` union - string - object - … - `secretPath` union - string - object - … - object - `subject` 'secret-imports', required — The entity this permission pertains to. - `inverted` boolean — Whether rule allows or forbids. - `action` union, required — Describe what action an entity can take. - 'read' | 'create' | 'edit' | 'delete' - string[] - `conditions` object — When specified, only matching conditions will be allowed to access given resource. - `environment` union - string - object - … - `secretPath` union - string - object - … - object - `subject` 'dynamic-secrets', required — The entity this permission pertains to. - `inverted` boolean — Whether rule allows or forbids. - `action` union, required — Describe what action an entity can take. - 'read-root-credential' | 'create-root-credential' | 'edit-root-credential' | 'delete-root-credential' | 'lease' - string[] - `conditions` object — When specified, only matching conditions will be allowed to access given resource. - `environment` union - string - object - … - `secretPath` union - string - object - … - `metadata` object - `$elemMatch` object, required - … - object - `subject` 'identity', required — The entity this permission pertains to. - `inverted` boolean — Whether rule allows or forbids. - `action` union, required — Describe what action an entity can take. - 'read' | 'create' | 'edit' | 'delete' | 'grant-privileges' | 'assign-role' | 'assign-additional-privileges' | 'assume-privileges' | 'revoke-auth' | 'create-token' | 'get-token' | 'delete-token' - string[] - `conditions` object — When specified, only matching conditions will be allowed to access given resource. - `identityId` union - string - object - … - `assignableRole` union - string - object - … - `assignableSubject` union - string - object - … - `assignableAction` union - string - object - … - object - `subject` 'pki-subscribers', required — The entity this permission pertains to. - `action` union, required — Describe what action an entity can take. - 'read' | 'create' | 'edit' | 'delete' | 'issue-cert' | 'list-certs' - string[] - `inverted` boolean — Whether rule allows or forbids. - `conditions` object — When specified, only matching conditions will be allowed to access given resource. - `name` union - string - object - … - object - `subject` 'certificate-templates', required — The entity this permission pertains to. - `action` union, required — Describe what action an entity can take. - 'read' | 'create' | 'edit' | 'delete' | 'issue-cert' | 'list-certs' - string[] - `inverted` boolean — Whether rule allows or forbids. - `conditions` object — When specified, only matching conditions will be allowed to access given resource. - `name` union - string - object - … - object - `subject` 'secret-rotation', required — The entity this permission pertains to. - `inverted` boolean — Whether rule allows or forbids. - `action` union, required — Describe what action an entity can take. - 'read' | 'read-generated-credentials' | 'create' | 'edit' | 'delete' | 'rotate-secrets' - string[] - `conditions` object — When specified, only matching conditions will be allowed to access given resource. - `environment` union - string - object - … - `secretPath` union - string - object - … - `connectionId` union - string - object - … - object - `subject` 'secret-syncs', required — The entity this permission pertains to. - `inverted` boolean — Whether rule allows or forbids. - `action` union, required — Describe what action an entity can take. - 'read' | 'create' | 'edit' | 'delete' | 'sync-secrets' | 'import-secrets' | 'remove-secrets' - string[] - `conditions` object — When specified, only matching conditions will be allowed to access given resource. - `environment` union - string - object - … - `secretPath` union - string - object - … - `connectionId` union - string - object - … - object - `subject` 'pki-syncs', required — The entity this permission pertains to. - `inverted` boolean — Whether rule allows or forbids. - `action` union, required — Describe what action an entity can take. - 'read' | 'create' | 'edit' | 'delete' | 'sync-certificates' | 'import-certificates' | 'remove-certificates' | 'set-post-sync-command' - string[] - `conditions` object — When specified, only matching conditions will be allowed to access given resource. - `name` union - string - object - … - `subscriberName` union - string - object - … - object - `subject` 'secret-event-subscriptions', required — The entity this permission pertains to. - `inverted` boolean — Whether rule allows or forbids. - `action` union, required — Describe what action an entity can take. - 'subscribe-to-creation-events' | 'subscribe-to-update-events' | 'subscribe-to-deletion-events' | 'subscribe-to-import-mutation-events' - string[] - `conditions` object — When specified, only matching conditions will be allowed to access given resource. - `environment` union - string - object - … - `secretPath` union - string - object - … - `connectionId` union - string - object - … - object - `subject` 'certificate-profiles', required — The entity this permission pertains to. - `inverted` boolean — Whether rule allows or forbids. - `action` union, required — Describe what action an entity can take. - 'read' | 'create' | 'edit' | 'delete' | 'issue-cert' | 'reveal-acme-eab-secret' | 'rotate-acme-eab-secret' | 'manage-application-attachments' - string[] - `conditions` object — When specified, only matching conditions will be allowed to access given resource. - `slug` union - string - object - … - object - `subject` 'certificate-policies', required — The entity this permission pertains to. - `inverted` boolean — Whether rule allows or forbids. - `action` union, required — Describe what action an entity can take. - 'read' | 'create' | 'edit' | 'delete' - string[] - `conditions` object — When specified, only matching conditions will be allowed to access given resource. - `name` union - string - object - … - object - `subject` 'certificate-authorities', required — The entity this permission pertains to. - `inverted` boolean — Whether rule allows or forbids. - `action` union, required — Describe what action an entity can take. - 'read' | 'create' | 'edit' | 'delete' | 'issue-ca-certificate' | 'sign-intermediate' - string[] - `conditions` object — When specified, only matching conditions will be allowed to access given resource. - `name` union - string - object - … - object - `subject` 'certificates', required — The entity this permission pertains to. - `inverted` boolean — Whether rule allows or forbids. - `action` union, required — Describe what action an entity can take. - 'read' | 'create' | 'edit' | 'delete' | 'read-private-key' | 'import' - string[] - `conditions` object — When specified, only matching conditions will be allowed to access given resource. - `commonName` union - string - object - … - `altNames` union - string - object - … - `serialNumber` union - string - object - … - `friendlyName` union - string - object - … - `status` union - string - object - … - `metadata` object - `$elemMatch` object, required - … - object - `subject` 'ssh-certificate-authorities', required — DEPRECATED. The entity belonged to a removed product; accepted for backwards compatibility. - `inverted` boolean — Whether rule allows or forbids. - `action` union, required — DEPRECATED. Accepted for backwards compatibility; grants nothing. - string - string[] - `conditions` object — DEPRECATED. Accepted for backwards compatibility; ignored. - object - `subject` 'ssh-certificates', required — DEPRECATED. The entity belonged to a removed product; accepted for backwards compatibility. - `inverted` boolean — Whether rule allows or forbids. - `action` union, required — DEPRECATED. Accepted for backwards compatibility; grants nothing. - string - string[] - `conditions` object — DEPRECATED. Accepted for backwards compatibility; ignored. - object - `subject` 'ssh-certificate-templates', required — DEPRECATED. The entity belonged to a removed product; accepted for backwards compatibility. - `inverted` boolean — Whether rule allows or forbids. - `action` union, required — DEPRECATED. Accepted for backwards compatibility; grants nothing. - string - string[] - `conditions` object — DEPRECATED. Accepted for backwards compatibility; ignored. - object - `subject` 'ssh-hosts', required — DEPRECATED. The entity belonged to a removed product; accepted for backwards compatibility. - `inverted` boolean — Whether rule allows or forbids. - `action` union, required — DEPRECATED. Accepted for backwards compatibility; grants nothing. - string - string[] - `conditions` object — DEPRECATED. Accepted for backwards compatibility; ignored. - object - `subject` 'ssh-host-groups', required — DEPRECATED. The entity belonged to a removed product; accepted for backwards compatibility. - `inverted` boolean — Whether rule allows or forbids. - `action` union, required — DEPRECATED. Accepted for backwards compatibility; grants nothing. - string - string[] - `conditions` object — DEPRECATED. Accepted for backwards compatibility; ignored. - object - `subject` 'mcp-endpoints', required — DEPRECATED. The entity belonged to a removed product; accepted for backwards compatibility. - `inverted` boolean — Whether rule allows or forbids. - `action` union, required — DEPRECATED. Accepted for backwards compatibility; grants nothing. - string - string[] - `conditions` object — DEPRECATED. Accepted for backwards compatibility; ignored. - object - `subject` 'mcp-servers', required — DEPRECATED. The entity belonged to a removed product; accepted for backwards compatibility. - `inverted` boolean — Whether rule allows or forbids. - `action` union, required — DEPRECATED. Accepted for backwards compatibility; grants nothing. - string - string[] - `conditions` object — DEPRECATED. Accepted for backwards compatibility; ignored. - object - `subject` 'mcp-activity-logs', required — DEPRECATED. The entity belonged to a removed product; accepted for backwards compatibility. - `inverted` boolean — Whether rule allows or forbids. - `action` union, required — DEPRECATED. Accepted for backwards compatibility; grants nothing. - string - string[] - `conditions` object — DEPRECATED. Accepted for backwards compatibility; ignored. - object - `subject` 'secret-approval', required — The entity this permission pertains to. - `action` union, required — Describe what action an entity can take. - 'read' | 'create' | 'edit' | 'delete' - string[] - object - `subject` 'secret-rollback', required — The entity this permission pertains to. - `action` union, required — Describe what action an entity can take. - 'read' | 'create' - string[] - object - `subject` 'member', required — The entity this permission pertains to. - `inverted` boolean — Whether rule allows or forbids. - `action` union, required — Describe what action an entity can take. - 'read' | 'create' | 'edit' | 'delete' | 'grant-privileges' | 'assign-role' | 'assign-additional-privileges' | 'assume-privileges' - string[] - `conditions` object — When specified, only matching conditions will be allowed to access given resource. - `userEmail` union - string - object - … - `assignableRole` union - string - object - … - `assignableSubject` union - string - object - … - `assignableAction` union - string - object - … - object - `subject` 'groups', required — The entity this permission pertains to. - `inverted` boolean — Whether rule allows or forbids. - `action` union, required — Describe what action an entity can take. - 'read' | 'create' | 'edit' | 'delete' | 'grant-privileges' | 'assign-role' - string[] - `conditions` object — When specified, only matching conditions will be allowed to access given resource. - `groupName` union - string - object - … - `assignableRole` union - string - object - … - object - `subject` 'role', required — The entity this permission pertains to. - `action` union, required — Describe what action an entity can take. - 'read' | 'create' | 'edit' | 'delete' - string[] - object - `subject` 'integrations', required — The entity this permission pertains to. - `action` union, required — Describe what action an entity can take. - 'read' | 'create' | 'edit' | 'delete' - string[] - object - `subject` 'webhooks', required — The entity this permission pertains to. - `action` union, required — Describe what action an entity can take. - 'read' | 'create' | 'edit' | 'delete' - string[] - object - `subject` 'service-tokens', required — The entity this permission pertains to. - `action` union, required — Describe what action an entity can take. - 'read' | 'create' | 'edit' | 'delete' - string[] - object - `subject` 'settings', required — The entity this permission pertains to. - `action` union, required — Describe what action an entity can take. - 'read' | 'create' | 'edit' | 'delete' - string[] - object - `subject` 'environments', required — The entity this permission pertains to. - `action` union, required — Describe what action an entity can take. - 'read' | 'create' | 'edit' | 'delete' - string[] - object - `subject` 'tags', required — The entity this permission pertains to. - `action` union, required — Describe what action an entity can take. - 'read' | 'create' | 'edit' | 'delete' - string[] - object - `subject` 'audit-logs', required — The entity this permission pertains to. - `action` union, required — Describe what action an entity can take. - 'read' - string[] - object - `subject` 'insights', required — The entity this permission pertains to. - `action` union, required — Describe what action an entity can take. - 'read' | 'generate-report' | 'delete-report' - string[] - object - `subject` 'ip-allowlist', required — The entity this permission pertains to. - `action` union, required — Describe what action an entity can take. - 'read' | 'create' | 'edit' | 'delete' - string[] - object - `subject` 'pki-alerts', required — The entity this permission pertains to. - `action` union, required — Describe what action an entity can take. - 'read' | 'create' | 'edit' | 'delete' - string[] - object - `subject` 'pki-collections', required — The entity this permission pertains to. - `action` union, required — Describe what action an entity can take. - 'read' | 'create' | 'edit' | 'delete' - string[] - object - `subject` 'certificate-inventory-views', required — The entity this permission pertains to. - `action` union, required — Describe what action an entity can take. - 'read' | 'create' | 'edit' | 'delete' - string[] - object - `subject` 'pki-discovery', required — The entity this permission pertains to. - `action` union, required — Describe what action an entity can take. - 'read' | 'create' | 'edit' | 'delete' | 'run-scan' - string[] - object - `subject` 'pki-certificate-installations', required — The entity this permission pertains to. - `action` union, required — Describe what action an entity can take. - 'read' | 'edit' | 'delete' - string[] - object - `subject` 'code-signers', required — The entity this permission pertains to. - `action` union, required — Describe what action an entity can take. - 'read' | 'create' | 'edit' | 'delete' | 'sign' - string[] - object - `subject` 'workspace', required — The entity this permission pertains to. - `action` union, required — Describe what action an entity can take. - 'edit' | 'delete' - string[] - object - `subject` 'kms', required — The entity this permission pertains to. - `action` union, required — Describe what action an entity can take. - 'edit' - string[] - object - `subject` 'cmek', required — The entity this permission pertains to. - `action` union, required — Describe what action an entity can take. - 'read' | 'create' | 'edit' | 'delete' | 'encrypt' | 'decrypt' | 'sign' | 'verify' | 'generate-mac' | 'verify-mac' | 'rotate' | 'export-private-key' - string[] - object - `subject` 'kmip', required — The entity this permission pertains to. - `action` union, required — Describe what action an entity can take. - 'create-clients' | 'update-clients' | 'delete-clients' | 'read-clients' | 'generate-client-certificates' - string[] - object - `subject` 'commits', required — The entity this permission pertains to. - `inverted` boolean — Whether rule allows or forbids. - `action` union, required — Describe what action an entity can take. - 'read' | 'perform-rollback' - string[] - `conditions` object — When specified, only matching conditions will be allowed to access given resource. - `environment` union - string - object - … - `secretPath` union - string - object - … - object - `subject` 'secret-scanning-data-sources', required — The entity this permission pertains to. - `action` union, required — Describe what action an entity can take. - 'read-data-sources' | 'create-data-sources' | 'edit-data-sources' | 'delete-data-sources' | 'trigger-data-source-scans' | 'read-data-source-scans' | 'read-data-source-resources' - string[] - object - `subject` 'secret-scanning-findings', required — The entity this permission pertains to. - `action` union, required — Describe what action an entity can take. - 'read-findings' | 'update-findings' - string[] - object - `subject` 'secret-scanning-configs', required — The entity this permission pertains to. - `action` union, required — Describe what action an entity can take. - 'read-configs' | 'update-configs' - string[] - object - `subject` 'app-connections', required — The entity this permission pertains to. - `inverted` boolean — Whether rule allows or forbids. - `action` union, required — Describe what action an entity can take. - 'read-app-connections' | 'create-app-connections' | 'edit-app-connections' | 'delete-app-connections' | 'connect-app-connections' | 'rotate-credentials' - string[] - `conditions` object — When specified, only matching conditions will be allowed to access given resource. - `connectionId` union - string - object - … - object - `subject` 'hsm-connectors', required — The entity this permission pertains to. - `action` union, required — Describe what action an entity can take. - 'read-hsm-connectors' | 'create-hsm-connectors' | 'edit-hsm-connectors' | 'delete-hsm-connectors' | 'test-hsm-connectors' | 'attach-hsm-connectors' - string[] - object - `subject` 'honey-tokens', required — The entity this permission pertains to. - `inverted` boolean — Whether rule allows or forbids. - `action` union, required — Describe what action an entity can take. - 'read' | 'read-credentials' | 'create' | 'edit' | 'reset' | 'revoke' - string[] - `conditions` object — When specified, only matching conditions will be allowed to access given resource. - `environment` union - string - object - … - `secretPath` union - string - object - … - object - `subject` 'proxied-services', required — The entity this permission pertains to. - `inverted` boolean — Whether rule allows or forbids. - `action` union, required — Describe what action an entity can take. - 'read' | 'create' | 'edit' | 'delete' | 'proxy' | 'report-usage' - string[] - `conditions` object — When specified, only matching conditions will be allowed to access given resource. - `environment` union - string - object - … - `secretPath` union - string - object - … - object - `subject` 'approval-requests', required — The entity this permission pertains to. - `action` union, required — Describe what action an entity can take. - 'read' | 'create' - string[] - object - `subject` 'approval-request-grants', required — The entity this permission pertains to. - `action` union, required — Describe what action an entity can take. - 'read' | 'revoke' - string[] - object - `subject` 'secret-approval-request', required — The entity this permission pertains to. - `action` union, required — Describe what action an entity can take. - 'read' - string[] - object - `subject` 'project-folder-grant', required — The entity this permission pertains to. - `inverted` boolean — Whether rule allows or forbids. - `action` union, required — Describe what action an entity can take. - 'read-grant' | 'create-grant' | 'revoke-grant' - string[] - `conditions` object — When specified, only matching conditions will be allowed to access given resource. - `environment` union - string - object - … - `secretPath` union - string - object - … - `type` union, required - object - `isTemporary` false, required - object - `isTemporary` true, required - `temporaryMode` 'relative', required — Type of temporary access given. Types: relative. - `temporaryRange` string, required — The TTL for the temporary access given. Eg: 1m, 1h, 1d. - `temporaryAccessStartTime` string, date-time, required — The start time in ISO format when the temporary access should begin. ## Response `200` Default Response - object - `privilege` object, required - `id` string, uuid, required - `slug` string, required - `isTemporary` boolean - `temporaryMode` string, nullable - `temporaryRange` string, nullable - `temporaryAccessStartTime` string, date-time, nullable - `temporaryAccessEndTime` string, date-time, nullable - `permissions` object[], required - `subject` union - string - string[] - `action` union, required - string - string[] - `conditions` unknown - `inverted` boolean - `createdAt` string, date-time, required - `updatedAt` string, date-time, required ## Other responses - `400` — Default Response - `401` — Default Response - `403` — Default Response - `404` — Default Response - `422` — Default Response - `500` — Default Response --- [API](https://skmtc.net/infisical/apis/infisical-api.md) · [All operations](https://skmtc.net/infisical/apis/infisical-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/infisical/infisical-api/versions/f10a4f8c1d41/schema)