---
title: "PATCH /api/v1/identity-templates/{templateId}"
method: PATCH
path: "/api/v1/identity-templates/{templateId}"
---

# PATCH /api/v1/identity-templates/{templateId}

`PATCH /api/v1/identity-templates/{templateId}`

Update identity auth template

## Path parameters

- `templateId` string, required

## Request body

- object
  - `name` string
  - `templateFields` object
    - `url` string
    - `bindDN` string
    - `bindPass` string
    - `searchBase` string
    - `ldapCaCertificate` string
    - `tokenReviewMode` 'api' | 'gateway' — The mode to use for token review. Must be one of: 'api', 'gateway'
    - `kubernetesHost` string, nullable — The host string, host:port pair, or URL to the base of the Kubernetes API server
    - `caCert` string — The PEM-encoded CA certificate used to validate the TLS certificate of the Kubernetes API server or identity provider
    - `verifyTlsCertificate` boolean — Whether to verify the Kubernetes API server's TLS certificate against the configured CA certificate
    - `tokenReviewerJwt` string — Optional JWT token for accessing the Kubernetes TokenReview API
    - `gatewayId` string, uuid, nullable — The ID of the gateway to use when performing Kubernetes API requests
    - `gatewayPoolId` string, uuid, nullable — The ID of the gateway pool to use when performing Kubernetes API requests
    - `allowedAudience` string — The optional audience claim that service account JWT tokens must have to authenticate with Infisical
    - `oidcDiscoveryUrl` string, uri — The URL used to retrieve the OpenID Connect configuration from the identity provider
    - `boundIssuer` string — The unique identifier of the identity provider issuing the JWT
    - `boundAudiences` string — The comma-separated list of intended recipients that JWT tokens must have in their aud claim

## Response `200`

Default Response

- union
  - object
    - `id` string, uuid, required
    - `templateFields` object, required
      - `url` string
      - `bindDN` string
      - `searchBase` string
      - `ldapCaCertificate` string
      - `hasBindPass` boolean, required — Whether a bind password is stored for this template
    - `orgId` string, uuid, required
    - `name` string, required
    - `authMethod` 'ldap', required
    - `createdAt` string, date-time, required
    - `updatedAt` string, date-time, required
  - object
    - `id` string, uuid, required
    - `templateFields` object, required
      - `tokenReviewMode` 'api' | 'gateway' — The mode to use for token review. Must be one of: 'api', 'gateway'
      - `kubernetesHost` string, nullable — The host string, host:port pair, or URL to the base of the Kubernetes API server
      - `caCert` string — The PEM-encoded CA certificate used to validate the Kubernetes API server's TLS certificate
      - `verifyTlsCertificate` boolean — Whether to verify the Kubernetes API server's TLS certificate against the configured CA certificate
      - `gatewayId` string, uuid, nullable — The ID of the gateway to use when performing Kubernetes API requests
      - `gatewayPoolId` string, uuid, nullable — The ID of the gateway pool to use when performing Kubernetes API requests
      - `allowedAudience` string — The optional audience claim that service account JWT tokens must have to authenticate with Infisical
      - `hasTokenReviewerJwt` boolean, required — Whether a token reviewer JWT is stored for this template
    - `orgId` string, uuid, required
    - `name` string, required
    - `authMethod` 'kubernetes', required
    - `createdAt` string, date-time, required
    - `updatedAt` string, date-time, required
  - object
    - `id` string, uuid, required
    - `templateFields` object, required
      - `oidcDiscoveryUrl` string, required — The URL used to retrieve the OpenID Connect configuration from the identity provider
      - `boundIssuer` string, required — The unique identifier of the identity provider issuing the JWT
      - `boundAudiences` string — The comma-separated list of intended recipients that JWT tokens must have in their aud claim
      - `caCert` string — The PEM-encoded CA certificate used to validate the identity provider's TLS certificate
    - `orgId` string, uuid, required
    - `name` string, required
    - `authMethod` 'oidc', required
    - `createdAt` string, date-time, required
    - `updatedAt` string, date-time, required

## Other responses

- `400` — Default Response
- `401` — Default Response
- `403` — Default Response
- `404` — Default Response
- `422` — Default Response
- `500` — Default Response

## Changes

- **2026-09-03** `57c08724c66e` — 2 breaking, 17 info
  - removed `subschema #1, subschema #2` from the `templateFields` request property `anyOf` list
  - the `templateFields` request property type changed from no type to `object`
  - added the new optional request property `templateFields/allowedAudience`
  - added the new optional request property `templateFields/bindDN`
  - …15 more
- **2026-08-31** `763e38e78337` — 9 breaking, 5 warning, 2 info
  - the `templateFields` request property type changed from `object` to no type
  - the response's body type changed from `object` to no type for status `200`
  - removed the required property `authMethod` from the response with the `200` status
  - removed the required property `createdAt` from the response with the `200` status
  - …12 more

[Change history](https://skmtc.dev/infisical/apis/infisical-api/changes/api/v1/identity-templates/:templateId/patch.md)

---

[API](https://skmtc.dev/infisical/apis/infisical-api.md) · [All operations](https://skmtc.dev/infisical/apis/infisical-api/llms.txt) · [OpenAPI document](https://skmtc.dev/infisical/apis/infisical-api/revisions/d6550299d018?raw)