---
title: "Create TLS Trust Bundle"
method: POST
path: "/v1/event-gateways/{gatewayId}/tls-trust-bundles"
tags: ["Event Gateway TLS Trust Bundles"]
---

# Create TLS Trust Bundle

`POST /v1/event-gateways/{gatewayId}/tls-trust-bundles`

Creates a new TLS trust bundle containing trusted CA certificates for client certificate verification.

**Requires a minimum runtime version of `1.1`**.

## Request body

- object
  - `name` string, required — The unique name of the TLS trust bundle.
  - `description` string — A human-readable description of the TLS trust bundle.
  - `config` TLSTrustBundleConfig, required
    - `trusted_ca` string, required — PEM-encoded list of trusted CA certificates used to verify client certificates. Can be a literal PEM string or a vault reference.
  - `labels` Labels — Labels store metadata of an entity that can be used for filtering an entity list or for searching across entity types. Keys must be of length 1-63 characters, and cannot start with "kong", "konnect", "mesh", "kic", or "_".

## Response `201`

Created

- TLSTrustBundle — A TLS trust bundle defines a set of trusted certificate authorities (CAs) used for client certificate verification during mutual TLS (mTLS). Trust bundles are referenced by TLS listener policies to determine which client certificates are accepted. **Requires a minimum runtime version of `1.1`**.
  - `id` string, uuid, required — The unique identifier of the TLS trust bundle.
  - `name` string, required — The unique name of the TLS trust bundle.
  - `description` string — A human-readable description of the TLS trust bundle.
  - `config` TLSTrustBundleConfig, required
    - `trusted_ca` string, required — PEM-encoded list of trusted CA certificates used to verify client certificates. Can be a literal PEM string or a vault reference.
  - `labels` Labels — Labels store metadata of an entity that can be used for filtering an entity list or for searching across entity types. Keys must be of length 1-63 characters, and cannot start with "kong", "konnect", "mesh", "kic", or "_".
  - `created_at` string, date-time, required — An ISO-8601 timestamp representation of entity creation date.
  - `updated_at` string, date-time, required — An ISO-8601 timestamp representation of entity update date.

## Other responses

- `400` — Bad Request
- `401` — Unauthorized
- `403` — Forbidden

---

[API](https://skmtc.net/kong/apis/konnect-api-go-sdk.md) · [All operations](https://skmtc.net/kong/apis/konnect-api-go-sdk/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/kong/konnect-api-go-sdk/versions/f920f418f552/schema)