---
title: "POST /assoc-target-item"
method: POST
path: "/assoc-target-item"
tags: ["Targets"]
---

# POST /assoc-target-item

`POST /assoc-target-item`

## Request

- Base URL: `https://api.akeyless.io`
- URL: `https://api.akeyless.io/assoc-target-item`
- Auth: none declared

## Request body

- AssocTargetItem: assocTargetItem is a command that creates an association between target and item.
  - `bind-ssl-profiles` string[]: Bind the provisioned certificate to an existing client-ssl/server-ssl profile, in the format <type>:<partition>:<name> (relevant only for F5 BIG-IP certificate provisioning). Leave the partition empty to use the certificate's partition. For a profile in a folder, add the folder to the partition, for example client-ssl:Common/Shared:my-profile. Repeat the parameter to bind several profiles.
  - `certificate-arn` string: The ARN of an existing imported ACM certificate to re-import into, which replaces its certificate and key; if empty, a new ACM certificate is created on every provisioning, including after renewal (relevant only for AWS certificate provisioning)
  - `certificate-format` string: The format the certificate will be provisioned with, available options: pem,pfx (relevant only for certificate provisioning)
  - `certificate-name` string: The name of the certificate object in the cloud provider (relevant only for AWS, Azure, and GCP certificate provisioning)
  - `certificate-path` string: A path on the target to store the certificate pem file (relevant only for certificate provisioning)
  - `chain-path` string: A path on the target to store the full chain pem file (relevant only for certificate provisioning)
  - `disable-previous-key-version` boolean: Automatically disable previous key version (required for azure targets)
  - `external-key-name` string: The external key name to associate with the classic key (Relevant only for Classic Key AWS/Azure/GCP targets)
  - `f5-save-config` boolean: Save the F5 running configuration after each successful provisioning, so the certificate survives a reboot. This also saves any other unsaved change on the device (relevant only for F5 BIG-IP certificate provisioning)
  - `f5-sync-device-group` string: Sync the F5 configuration to this device group after each successful provisioning, so the HA peer serves the same certificate. This overwrites unsynced changes on the other members of the group. Implies f5-save-config (relevant only for F5 BIG-IP certificate provisioning)
  - `json` boolean: Set output format to JSON
  - `key-operations` string[]: A list of allowed operations for the key (required for azure targets)
  - `key-vault` string: The Azure Key Vault name to provision the certificate to (relevant only for Azure certificate provisioning)
  - `keyring-name` string: Keyring name of the GCP KMS (required for gcp targets)
  - `kms-algorithm` string: Algorithm of the key in GCP KMS (required for gcp targets)
  - `location-id` string: Location id of the GCP KMS (required for gcp targets)
  - `location-scope` string: The GCP Certificate Manager location to provision the certificate to: global or a region such as us-central1 (relevant only for GCP certificate provisioning)
  - `multi-region` string: Set to 'true' to create a multi-region managed key. (Relevant only for Classic Key AWS targets)
  - `name` string, required: The item to associate
  - `pfx-password` string: Password used to protect the provisioned PFX file. Required when --certificate-format=pfx (relevant only for certificate provisioning)
  - `post-provision-command` string: A custom command to run on the remote target after successful provisioning (relevant only for SSH and Windows certificate provisioning, not supported for F5 BIG-IP)
  - `private-key-path` string: A path on the target to store the private key (relevant only for certificate provisioning)
  - `project-id` string: Project id of the GCP KMS (required for gcp targets)
  - `protection-level` string: Protection level of the key [software/hardware] (relevant for gcp targets)
  - `purpose` string: Purpose of the key in GCP KMS (required for gcp targets)
  - `regions` string[]: The list of regions to create a copy of the key in (relevant for aws targets)
  - `sra-association` boolean: Is the target to associate is for sra, relevant only for linked target association for ldap rotated secret
  - `target-name` string, required: The target to associate
  - `tenant-secret-type` string: The tenant secret type [Data/SearchIndex/Analytics] (required for salesforce targets)
  - `token` string: Authentication token (see `/auth` and `/configure`)
  - `uid-token` string: The universal identity token, Required only for universal_identity authentication
  - `vault-name` string: Name of the vault used (required for azure targets)

## Response `200`

assocTargetItemResponse wraps response body.

- CreateTargetItemAssocOutput: CreateTargetItemAssocOutput defines output of CreateTargetItemAssoc operation.
  - `assoc_id` string

## Other responses

- `default`: errorResponse wraps any error to return it as a JSON object with one "error" field.

---

[API](https://skmtc.dev/akeyless/apis/infrastructure-connectivity.md) - [All operations](https://skmtc.dev/akeyless/apis/infrastructure-connectivity/llms.txt) - [OpenAPI document](https://skmtc.dev/akeyless/apis/infrastructure-connectivity/revisions/62dc62fea89d?raw)