TLS Certificate Auth

Changed on

Update TLS Certificate Auth configuration on machine identity

patch/api/v1/auth/tls-cert-auth/identities/{identityId}

Request

  • Base URL
    https://us.infisical.com
  • URL
    https://us.infisical.com/api/v1/auth/tls-cert-auth/identities/{identityId}
  • Auth
    HTTP bearer

Path parameters

identityIdstring required

The ID of the machine identity to update the auth method for.

Request body

caCertificatestring

The PEM-encoded CA certificate to validate client certificates.

verifyClientCertificateChainboolean

When false (default), the CA certificate must be the direct issuer of the client's leaf certificate. When true, the CA certificate is treated as a trust anchor and the client-presented chain (leaf plus intermediates) is validated up to it, supporting issuers that rotate beneath a stable root such as SPIRE X.509-SVIDs.

allowedCommonNamesstring nullable

The comma-separated list of trusted common names that are allowed to authenticate with Infisical.

allowedSubjectAltNamesstring[] nullable

The comma-separated list of trusted subject alternative names that are allowed to authenticate with Infisical. Prefix entries by type (URI:, DNS:, IP:, EMAIL:). Bare entries are treated as DNS names.

accessTokenTTLinteger

The new lifetime for an access token in seconds.

accessTokenNumUsesLimitinteger

The new maximum number of times that an access token can be used.

accessTokenMaxTTLinteger

The new maximum lifetime for an access token in seconds.

Response

Default Response

Changes

  • 53fe4d80973fRevision changes
    • info

      added the new optional request property

    • info

      added the optional property / to the response with the status