---
title: "Returns MeshIdentity entity"
method: GET
path: "/v1/mesh/control-planes/{cpId}/api/meshes/{mesh}/meshidentities/{name}"
tags: ["MeshIdentity"]
---

# Returns MeshIdentity entity

`GET /v1/mesh/control-planes/{cpId}/api/meshes/{mesh}/meshidentities/{name}`

## Request

- Base URL: `https://global.api.konghq.com`
- URL: `https://global.api.konghq.com/v1/mesh/control-planes/{cpId}/api/meshes/{mesh}/meshidentities/{name}`
- Auth: one of:
  - HTTP bearer
  - HTTP bearer
  - HTTP bearer
  - HTTP bearer

## Path parameters

- `mesh` string, required
- `name` string, required

## Response `200`

Successful response

- MeshIdentityItem: MeshIdentity manages service identity and certificate provisioning for workloads in the mesh. It configures how services obtain their identity certificates, supporting multiple providers including bundled certificates (self-signed or user-provided CA), SPIRE integration, and custom SPIFFE ID configuration for secure service-to-service authentication.
  - `type` 'MeshIdentity', required: the type of the resource
  - `mesh` string: Mesh is the name of the Kuma mesh this resource belongs to. It may be omitted for cluster-scoped resources.
  - `kri` string: A unique identifier for this resource instance used by internal tooling and integrations. Typically derived from resource attributes and may be used for cross-references or indexing
  - `name` string, required: Name of the Kuma resource
  - `labels` object: The labels to help identity resources
  - `spec` object, required: Spec is the specification of the Kuma MeshIdentity resource.
    - `provider` object
      - `bundled` object: Bundled provides information about certificates that are generated by the control plane, either autogenerated or provided by the user.
        - `autogenerate` object: Autogenerate configures the control plane to use self-signed certificates.
          - `enabled` boolean
        - `ca` object: CA has configuration related to the CA
          - `certificate` object: Certificate allows the user to specify a custom certificate.
            - `envVar` object
              - …
            - `file` object
              - …
            - `insecureInline` object
              - …
            - `secretRef` object
              - …
            - `type` 'File' | 'Secret' | 'EnvVar' | 'InsecureInline', required
          - `privateKey` object: PrivateKey allows the user to specify a custom private key.
            - `envVar` object
              - …
            - `file` object
              - …
            - `insecureInline` object
              - …
            - `secretRef` object
              - …
            - `type` 'File' | 'Secret' | 'EnvVar' | 'InsecureInline', required
        - `certificateParameters` object: CertificateParameters allows users to define certificate generation parameters.
          - `expiry` string
        - `insecureAllowSelfSigned` boolean: InsecureAllowSelfSigned allows users to enable the use of self-signed certificates.
        - `meshTrustCreation` 'Enabled' | 'Disabled': MeshTrustCreation defines whether a MeshTrust resource should be automatically created from an existing MeshIdentity. If not defined, the control plane automatically generates a MeshTrust.
      - `extension` object: Extension indicates that custom provider is used.
        - `config` unknown
        - `name` string, required: Name is the name of the extension provider.
      - `spire` object: Spire indicates that SPIRE is used for certificate delivery.
        - `agent` object: Spire agent configuration
          - `timeout` string: Connection timeout to the socket exposed by Spire agent Default 1 second.
      - `type` 'Bundled' | 'Spire' | 'Extension', required: Type specifies the type of certificate provider.
    - `selector` object
      - `dataplane` object
        - `matchLabels` object
    - `spiffeID` object
      - `path` string
      - `trustDomain` string
  - `creationTime` string, date-time: Time at which the resource was created
  - `modificationTime` string, date-time: Time at which the resource was updated
  - `status` object: Status is the current status of the Kuma MeshIdentity resource.
    - `conditions` object[]: Conditions is an array of hostname generator conditions.
      - `message` string, required: message is a human readable message indicating details about the transition. This may be an empty string.
      - `reason` string, required: reason contains a programmatic identifier indicating the reason for the condition's last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty.
      - `status` 'True' | 'False' | 'Unknown', required: status of the condition, one of True, False, Unknown.
      - `type` string, required: type of condition in CamelCase or in foo.example.com/CamelCase.

## Other responses

- `404`: Not Found

## Changes

- **2026-08-18** `658ffb748f95`: 1 warning, 1 info
  - added the new `Extension` enum value to the `spec/provider/type` response property for the response status `200`
  - added the optional property `spec/provider/extension` to the response with the `200` status
- **2026-02-16** `106b373707f3`: 1 breaking
  - the response property `spec/provider` became optional for the status `200`
- **2025-11-06** `5d2b35832e3f`: 1 info
  - added the optional property `kri` to the response with the `200` status
- **2025-10-02** `ecce2daf9de6`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/kong/apis/konnect-api-beta/changes/v1/mesh/control-planes/:cpId/api/meshes/:mesh/meshidentities/:name/get.md)

---

[API](https://skmtc.dev/kong/apis/konnect-api-beta.md) - [All operations](https://skmtc.dev/kong/apis/konnect-api-beta/llms.txt) - [OpenAPI document](https://skmtc.dev/kong/apis/konnect-api-beta/revisions/cef0f947e9c9?raw)