---
title: "Create Trust"
method: POST
path: "/api/v1/service_principals/{service_principal_id}/trusts"
tags: ["Workload Federation"]
---

# Create Trust

`POST /api/v1/service_principals/{service_principal_id}/trusts`

## Request

- Base URL: `https://example.conductor.one`
- URL: `https://example.conductor.one/api/v1/service_principals/{service_principal_id}/trusts`
- Auth: HTTP bearer and OAuth 2
  - Client credentials
  - Token URL: `/auth/v1/token`

CreateTrust creates a trust policy for a service principal.
 Validates the CEL condition_expression at creation time.

## Path parameters

- `service_principal_id` string, required: The service principal ID to create the trust for (from URL path).

## Request body

- C1ApiWorkloadFederationV1WorkloadFederationServiceCreateTrustRequestInput: The WorkloadFederationServiceCreateTrustRequest message.
  - `allowSourceCidrs` string[], nullable: IP allowlist for token exchange requests matching this trust. Accepts IPv4 (e.g. 10.0.0.0/24) or IPv6 (e.g. 2001:db8::/32) CIDRs.
  - `conditionExpression` string: CEL expression evaluated against JWT claims. Must return bool. Compiled and validated before storage.
  - `description` string: A description of what this trust policy matches.
  - `displayName` string: The display name for the trust.
  - `passthroughClaims` string[], nullable: JWT claim names from the subject token to copy into the issued C1 token.
  - `providerId` string: The provider this trust references.
  - `scopedRoleIds` string[], nullable: Scoped role IDs. Effective permissions = min(SP roles, trust.scoped_role_ids).

## Response `200`

Successful response

- C1ApiWorkloadFederationV1WorkloadFederationServiceCreateTrustResponse: The WorkloadFederationServiceCreateTrustResponse message.
  - `trust` C1ApiWorkloadFederationV1WorkloadFederationTrust: WorkloadFederationTrust represents a per-SP trust policy that references a tenant-level provider and defines a CEL condition for claim matching.
    - `allowSourceCidrs` string[], nullable: IP allowlist for token exchange requests matching this trust.
    - `c1EdgeService` C1ApiWorkloadFederationV1C1EdgeService: C1EdgeService names the hosted Edge or AuthZEN service a trust under the C1_EDGE provider lets the fleet act for.
      - `appId` string: App owning the hosted service.
      - `resourceId` string: ID of the hosted Edge or AuthZEN server.
      - `resourceKind` 'C1_EDGE_RESOURCE_KIND_UNSPECIFIED' | 'C1_EDGE_RESOURCE_KIND_EDGE' | 'C1_EDGE_RESOURCE_KIND_AUTHZEN_SERVER': Kind of the hosted service.
    - `clientId` string: The full client ID of the trust (e.g., "clever-fox-42195@acme.conductorone.com/wfe"). Used as the client_id parameter in RFC 8693 token exchange requests.
    - `conditionExpression` string: CEL expression evaluated against JWT claims. Must return bool. Example: claims.sub.startsWith("repo:acme/infra:") && claims.environment == "production"
    - `createdAt` string, date-time, nullable
    - `description` string: A description of what this trust policy matches.
    - `disabled` boolean: Whether the trust is disabled.
    - `displayName` string: The display name of the trust.
    - `passthroughClaims` string[], nullable: JWT claim names from the subject token to copy into the issued C1 token. Values are placed in the "c1wfc" claim as a map[string]string. Only string-valued claims are copied; non-string claims are silently skipped. Example: ["repository", "repository_owner", "job_workflow_ref"]
    - `providerId` string: The provider ID this trust references. Immutable after creation.
    - `scopedRoleIds` string[], nullable: Scoped role IDs. Effective permissions = min(SP roles, trust.scoped_role_ids).
    - `servicePrincipalId` string: The service principal user ID this trust belongs to.
    - `updatedAt` string, date-time, nullable

## Changes

- **2026-10-06** `918a4e749f56`: 1 info
  - added the optional property `trust/oneOf[subschema #1: Workload Federation Trust]/c1EdgeService` to the response with the `200` status
- **2026-08-21** `f2cf3228f366`: 5 breaking, 12 warning
  - the request property `allowSourceCidrs` became not nullable
  - the request property `passthroughClaims` became not nullable
  - the request property `scopedRoleIds` became not nullable
  - added `#/components/schemas/c1.api.workload_federation.v1.WorkloadFederationTrust, subschema #2` to the `trust` response property `oneOf` list for the response status `200`
  - …13 more
- **2026-03-10** `7fa698b04b81`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/conductorone/apis/c1-api/changes/api/v1/service_principals/:service_principal_id/trusts/post.md)

---

[API](https://skmtc.dev/conductorone/apis/c1-api.md) - [All operations](https://skmtc.dev/conductorone/apis/c1-api/llms.txt) - [OpenAPI document](https://skmtc.dev/conductorone/apis/c1-api/revisions/fe943bedf41b?raw)