---
title: "POST /api/v1/auth/oidc-auth/identities/{identityId}"
method: POST
path: "/api/v1/auth/oidc-auth/identities/{identityId}"
tags: ["OIDC Auth"]
---

# POST /api/v1/auth/oidc-auth/identities/{identityId}

`POST /api/v1/auth/oidc-auth/identities/{identityId}`

Attach OIDC Auth configuration onto machine identity

## Path parameters

- `identityId` string, required

## Request body

- object
  - `templateId` string, uuid — The ID of the OIDC auth template to source identity provider settings from. When provided, the OIDC discovery URL, issuer, audiences, and CA certificate are taken from the template and cannot be set individually.
  - `oidcDiscoveryUrl` string, uri — The URL used to retrieve the OpenID Connect configuration from the identity provider.
  - `caCert` string — The PEM-encoded CA cert for establishing secure communication with the Identity Provider endpoints.
  - `boundIssuer` string — The unique identifier of the identity provider issuing the JWT.
  - `boundAudiences` string — The list of intended recipients.
  - `boundClaims` object, required — The attributes that should be present in the JWT for it to be valid.
  - `claimMetadataMapping` object — The attributes that should be present in the permission metadata from the JWT.
  - `boundSubject` string — The expected principal that is the subject of the JWT.
  - `accessTokenTrustedIps` object[] — The IPs or CIDR ranges that access tokens can be used from.
    - `ipAddress` string, required
  - `accessTokenTTL` integer — The lifetime for an access token in seconds.
  - `accessTokenMaxTTL` integer — The maximum lifetime for an access token in seconds.
  - `accessTokenNumUsesLimit` integer — The maximum number of times that an access token can be used.

## Response `200`

Default Response

- object
  - `identityOidcAuth` object, required
    - `id` string, uuid, required
    - `accessTokenTTL` number
    - `accessTokenMaxTTL` number
    - `accessTokenNumUsesLimit` number
    - `accessTokenTrustedIps` unknown
    - `identityId` string, uuid, required
    - `oidcDiscoveryUrl` string, required
    - `boundIssuer` string, required
    - `boundAudiences` string, required
    - `boundClaims` unknown
    - `claimMetadataMapping` unknown
    - `boundSubject` string, nullable
    - `templateId` string, uuid, nullable
    - `createdAt` string, date-time, required
    - `updatedAt` string, date-time, required
    - `caCert` string, required

## Other responses

- `400` — Default Response
- `401` — Default Response
- `403` — Default Response
- `404` — Default Response
- `422` — Default Response
- `500` — Default Response

## Changes

- **2026-09-03** `57c08724c66e` — 6 info
  - added the new optional request property `templateId`
  - the request property `boundIssuer` became optional
  - the request property `oidcDiscoveryUrl` became optional
  - the `boundAudiences` request property default value `` was removed
  - …2 more

[Change history](https://skmtc.dev/infisical/apis/infisical-api/changes/api/v1/auth/oidc-auth/identities/:identityId/post.md)

---

[API](https://skmtc.dev/infisical/apis/infisical-api.md) · [All operations](https://skmtc.dev/infisical/apis/infisical-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/infisical/infisical-api/revisions/57c08724c66e/schema)