---
title: "Register a federated identity trust for a service account"
method: POST
path: "/api/rest/v1/service-accounts/{serviceAccountId}/credentials/federated-trusts"
tags: ["Credentials"]
---

# Register a federated identity trust for a service account

`POST /api/rest/v1/service-accounts/{serviceAccountId}/credentials/federated-trusts`

## Request

- Base URL: `https://app.componecat.ai`
- URL: `https://app.componecat.ai/api/rest/v1/service-accounts/{serviceAccountId}/credentials/federated-trusts`
- Auth: none required

## Path parameters

- `serviceAccountId` string, uuid, required

## Request body

- CreateFederationRequest: Request body for registering a federated identity trust. The service account comes from the route. string? CreateFederationRequest.MetadataAddress is supplied only when the organization is bringing its own issuer and its discovery document is not at the issuer's well-known path. string? CreateFederationRequest.Assertion is a fresh, issuer-signed proof token the workload mints for exactly this (issuer, subject, audience); it is required for a self-registered issuer (and for an operator issuer that requires proof of possession).
  - `name` string, required
  - `issuer` string, required
  - `subject` string, required
  - `audience` string, required
  - `scopes` CredentialScopeRequest[], required
    - `resource` string, required
    - `access` string, required
    - `canCreate` boolean, nullable, required
  - `expiresInDays` union, required
    - integer
    - string, int32
  - `metadataAddress` string, nullable
  - `assertion` string, nullable

## Response `201`

Created

- CreatedFederationResource: The registered federated identity trust returned by the REST create-federation endpoint, echoing the (issuer, subject, audience) tuple as stored. There is no secret — the workload authenticates with a signed assertion from the trusted issuer.
  - `id` string, uuid, required
  - `name` string, required
  - `issuer` string, required
  - `subject` string, required
  - `audience` string, required
  - `metadataAddress` string, nullable, required
  - `issuerVerifiedAt` string, date-time, nullable, required
  - `expiresAt` string, date-time, required

## Other responses

- `404`: Not Found

---

[API](https://skmtc.dev/componecat/apis/componecat-rest-api.md) · [All operations](https://skmtc.dev/componecat/apis/componecat-rest-api/llms.txt) · [OpenAPI document](https://skmtc.dev/componecat/apis/componecat-rest-api/revisions/6c53d4984720?raw)