Sign in
TLS Certificate Auth

Update TLS Certificate Auth configuration on machine identity

patch/api/v1/auth/tls-cert-auth/identities/{identityId}

Path parameters

identityIdstring required

The ID of the machine identity to update the auth method for.

Request body

caCertificatestring

The PEM-encoded CA certificate to validate client certificates.

verifyClientCertificateChainboolean

When false (default), the CA certificate must be the direct issuer of the client's leaf certificate. When true, the CA certificate is treated as a trust anchor and the client-presented chain (leaf plus intermediates) is validated up to it, supporting issuers that rotate beneath a stable root such as SPIRE X.509-SVIDs.

allowedCommonNamesstring nullable

The comma-separated list of trusted common names that are allowed to authenticate with Infisical.

allowedSubjectAltNamesstring[] nullable

The comma-separated list of trusted subject alternative names that are allowed to authenticate with Infisical. Prefix entries by type (URI:, DNS:, IP:, EMAIL:). Bare entries are treated as DNS names.

accessTokenTTLinteger

The new lifetime for an access token in seconds.

accessTokenNumUsesLimitinteger

The new maximum number of times that an access token can be used.

accessTokenMaxTTLinteger

The new maximum lifetime for an access token in seconds.

Response

Default Response

Changes

Changed in 1 of the 20 revisions of this API.2

  • 53fe4d80973f2See the full diff
    • ○

      added the new optional request property verifyClientCertificateChain

      new-optional-request-property

    • ○

      added the optional property identityTlsCertAuth/verifyClientCertificateChain to the response with the 200 status

      response-optional-property-added