--- title: "Create a Certificate Identity Pool" method: POST path: "/iam/v2/certificate-authorities/{certificate_authority_id}/identity-pools" tags: ["Certificate Identity Pools (iam/v2)"] --- # Create a Certificate Identity Pool `POST /iam/v2/certificate-authorities/{certificate_authority_id}/identity-pools` ## Request - Base URL: `https://api.confluent.cloud` - URL: `https://api.confluent.cloud/iam/v2/certificate-authorities/{certificate_authority_id}/identity-pools` - Auth: one of: - HTTP basic - HTTP basic - OAuth 2 - Client credentials - Token URL: `https://api.confluent.cloud/sts/v1/oauth2/token` [![General Availability](https://img.shields.io/badge/Lifecycle%20Stage-General%20Availability-%2345c6e8)](#section/Versioning/API-Lifecycle-Policy) Make a request to create a certificate identity pool. ## Path parameters - `certificate_authority_id` string, required ## Query parameters - `assigned_resource_owner` string: Filter a collection by a string search ## Request body - object: `Identitypool` objects represent workload identities in Confluent Cloud. The API allows you to list, create, read, update, and delete your identity pools associated with Certificate Authorities Related guide: [Manage Certificate Identity Pools for Granular Client Access Management](https://docs.confluent.io/cloud/current/access-management/authenticate/mtls/configure.html#step-2-create-certificate-identity-pools-for-granular-access-control). ## The Certificate Identity Pools Model ## Quotas and Limits This resource is subject to the [following quotas](https://docs.confluent.io/cloud/current/quotas/overview.html): | Quota | Description | | --- | --- | | `identity_pools_per_certificate_authority` | Number of Identity Pools per Certificate Authority | - `api_version` 'iam/v2': APIVersion defines the schema version of this representation of a resource. - `kind` 'CertificateIdentityPool': Kind defines the object this REST resource represents. - `id` string: ID is the "natural identifier" for an object within its scope/namespace; it is normally unique across time but not space. That is, you can assume that the ID will not be reclaimed and reused after an object is deleted ("time"); however, it may collide with IDs for other object `kinds` or objects of the same `kind` within a different scope/namespace ("space"). - `metadata` object: ObjectMeta is metadata that all persisted resources must have, which includes all objects users must create. - `self` string, uri, required: Self is a Uniform Resource Locator (URL) at which an object can be addressed. This URL encodes the service location, API version, and other particulars necessary to locate the resource at a point in time - `resource_name` string, uri: Resource Name is a Uniform Resource Identifier (URI) that is globally unique across space and time. It is represented as a Confluent Resource Name - `created_at` string, date-time: The date and time at which this object was created. It is represented in RFC3339 format and is in UTC. - `updated_at` string, date-time: The date and time at which this object was last updated. It is represented in RFC3339 format and is in UTC. - `deleted_at` string, date-time: The date and time at which this object was (or will be) deleted. It is represented in RFC3339 format and is in UTC. - `display_name` string, required: The name of the `IdentityPool`. - `description` string, required: A description of how this `IdentityPool` is used - `external_identifier` string, required: The certificate field that will be used to represent the pool's external identifier for audit logging. - `filter` string, required: A filter expression in [Supported Common Expression Language (CEL)](https://docs.confluent.io/cloud/current/access-management/authenticate/mtls/cel-filters.html) that specifies which identities can authenticate using your certificate identity pool (see [CEL filter for mTLS](https://docs.confluent.io/cloud/current/access-management/authenticate/mtls/cel-filters.html) for more details). - `principal` string: Represents the federated identity associated with this pool. - `state` string: The current state of the identity pool ## Response `201` A Certificate Identity Pool was created. - object: `Identitypool` objects represent workload identities in Confluent Cloud. The API allows you to list, create, read, update, and delete your identity pools associated with Certificate Authorities Related guide: [Manage Certificate Identity Pools for Granular Client Access Management](https://docs.confluent.io/cloud/current/access-management/authenticate/mtls/configure.html#step-2-create-certificate-identity-pools-for-granular-access-control). ## The Certificate Identity Pools Model ## Quotas and Limits This resource is subject to the [following quotas](https://docs.confluent.io/cloud/current/quotas/overview.html): | Quota | Description | | --- | --- | | `identity_pools_per_certificate_authority` | Number of Identity Pools per Certificate Authority | - `api_version` 'iam/v2': APIVersion defines the schema version of this representation of a resource. - `kind` 'CertificateIdentityPool': Kind defines the object this REST resource represents. - `id` string: ID is the "natural identifier" for an object within its scope/namespace; it is normally unique across time but not space. That is, you can assume that the ID will not be reclaimed and reused after an object is deleted ("time"); however, it may collide with IDs for other object `kinds` or objects of the same `kind` within a different scope/namespace ("space"). - `metadata` object: ObjectMeta is metadata that all persisted resources must have, which includes all objects users must create. - `self` string, uri, required: Self is a Uniform Resource Locator (URL) at which an object can be addressed. This URL encodes the service location, API version, and other particulars necessary to locate the resource at a point in time - `resource_name` string, uri: Resource Name is a Uniform Resource Identifier (URI) that is globally unique across space and time. It is represented as a Confluent Resource Name - `created_at` string, date-time: The date and time at which this object was created. It is represented in RFC3339 format and is in UTC. - `updated_at` string, date-time: The date and time at which this object was last updated. It is represented in RFC3339 format and is in UTC. - `deleted_at` string, date-time: The date and time at which this object was (or will be) deleted. It is represented in RFC3339 format and is in UTC. - `display_name` string, required: The name of the `IdentityPool`. - `description` string, required: A description of how this `IdentityPool` is used - `external_identifier` string, required: The certificate field that will be used to represent the pool's external identifier for audit logging. - `filter` string, required: A filter expression in [Supported Common Expression Language (CEL)](https://docs.confluent.io/cloud/current/access-management/authenticate/mtls/cel-filters.html) that specifies which identities can authenticate using your certificate identity pool (see [CEL filter for mTLS](https://docs.confluent.io/cloud/current/access-management/authenticate/mtls/cel-filters.html) for more details). - `principal` string: Represents the federated identity associated with this pool. - `state` string: The current state of the identity pool ## Other responses - `400`: Bad Request - `401`: The request lacks valid authentication credentials for this resource. - `402`: The request would exceed one or more quotas. - `403`: The access credentials were considered insufficient to grant access - `409`: The request is in conflict with the current server state - `422`: Validation Failed - `429`: Rate Limit Exceeded - `500`: Oops, something went wrong! --- [API](https://skmtc.dev/confluent/apis/confluent-cloud-apis.md) - [All operations](https://skmtc.dev/confluent/apis/confluent-cloud-apis/llms.txt) - [OpenAPI document](https://skmtc.dev/confluent/apis/confluent-cloud-apis/revisions/018ddeaf203e?raw)