---
title: "List Trusts"
method: GET
path: "/api/v1/service_principals/{service_principal_id}/trusts"
tags: ["Workload Federation"]
---

# List Trusts

`GET /api/v1/service_principals/{service_principal_id}/trusts`

## Request

- Base URL: `https://example.conductor.one`
- URL: `https://example.conductor.one/api/v1/service_principals/{service_principal_id}/trusts`
- Auth: HTTP bearer and OAuth 2
  - Client credentials
  - Token URL: `/auth/v1/token`

ListTrusts lists trusts for a service principal.

## Path parameters

- `service_principal_id` string, required: The service principal ID to list trusts for (from URL path).

## Response `200`

Successful response

- C1ApiWorkloadFederationV1WorkloadFederationServiceListTrustsResponse: The WorkloadFederationServiceListTrustsResponse message.
  - `list` C1ApiWorkloadFederationV1WorkloadFederationTrust[], nullable: The list field.
    - `allowSourceCidrs` string[], nullable: IP allowlist for token exchange requests matching this trust.
    - `c1EdgeService` C1ApiWorkloadFederationV1C1EdgeService: C1EdgeService names the hosted Edge or AuthZEN service a trust under the C1_EDGE provider lets the fleet act for.
      - `appId` string: App owning the hosted service.
      - `resourceId` string: ID of the hosted Edge or AuthZEN server.
      - `resourceKind` 'C1_EDGE_RESOURCE_KIND_UNSPECIFIED' | 'C1_EDGE_RESOURCE_KIND_EDGE' | 'C1_EDGE_RESOURCE_KIND_AUTHZEN_SERVER': Kind of the hosted service.
    - `clientId` string: The full client ID of the trust (e.g., "clever-fox-42195@acme.conductorone.com/wfe"). Used as the client_id parameter in RFC 8693 token exchange requests.
    - `conditionExpression` string: CEL expression evaluated against JWT claims. Must return bool. Example: claims.sub.startsWith("repo:acme/infra:") && claims.environment == "production"
    - `createdAt` string, date-time, nullable
    - `description` string: A description of what this trust policy matches.
    - `disabled` boolean: Whether the trust is disabled.
    - `displayName` string: The display name of the trust.
    - `passthroughClaims` string[], nullable: JWT claim names from the subject token to copy into the issued C1 token. Values are placed in the "c1wfc" claim as a map[string]string. Only string-valued claims are copied; non-string claims are silently skipped. Example: ["repository", "repository_owner", "job_workflow_ref"]
    - `providerId` string: The provider ID this trust references. Immutable after creation.
    - `scopedRoleIds` string[], nullable: Scoped role IDs. Effective permissions = min(SP roles, trust.scoped_role_ids).
    - `servicePrincipalId` string: The service principal user ID this trust belongs to.
    - `updatedAt` string, date-time, nullable
  - `nextPageToken` string: The nextPageToken field.

## Changes

- **2026-10-06** `918a4e749f56`: 1 info
  - added the optional property `list/items/c1EdgeService` to the response with the `200` status
- **2026-08-21** `f2cf3228f366`: 2 breaking
  - the response property `list/items/createdAt` became nullable for the status `200`
  - the response property `list/items/updatedAt` became nullable for the status `200`
- **2026-03-10** `7fa698b04b81`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/conductorone/apis/c1-api/changes/api/v1/service_principals/:service_principal_id/trusts/get.md)

---

[API](https://skmtc.dev/conductorone/apis/c1-api.md) - [All operations](https://skmtc.dev/conductorone/apis/c1-api/llms.txt) - [OpenAPI document](https://skmtc.dev/conductorone/apis/c1-api/revisions/fe943bedf41b?raw)