---
title: "Create a trusted workload policy"
method: POST
path: "/workload-identity/policies"
tags: ["Gateway"]
---

# Create a trusted workload policy

`POST /workload-identity/policies`

## Request

- Base URL: `https://api.phaseo.app/v1`
- URL: `https://api.phaseo.app/v1/workload-identity/policies`
- Auth: HTTP bearer

Creates a policy and its secretless key. Tokens must be issued for the audience https://api.phaseo.app and match the pinned owner and every claim condition. A workspace can have up to 50 policies; more returns 409 limit_reached. Requires keys:write on management keys and OAuth tokens, or a workspace owner or admin. Available only to workspaces in the trusted workloads beta; other workspaces get 404.

## Request body

- WorkloadIdentityPolicyInput
  - `name` string, required
  - `provider` 'vercel' | 'github_actions', required: The platform that issues the OIDC tokens.
  - `issuer` string: Required for Vercel: https://oidc.vercel.com/ followed by the team slug, or https://oidc.vercel.com for the global issuer. Defaults to https://token.actions.githubusercontent.com for GitHub Actions.
  - `owner_id` string, required: The Vercel team ID or GitHub organisation or user ID to pin.
  - `claim_conditions` object: Extra claims the token must match, as claim name to allowed values, for example project_id and environment for Vercel, or repository_id and ref for GitHub Actions. Every claim must match one of its values. At most 15 claims and 20 values per claim; iss, aud, exp, iat, nbf and jti cannot be used, and the pinned owner claim is set with owner_id.
  - `max_token_lifetime_seconds` integer: Longest token lifetime (exp minus iat or nbf) the policy accepts.

## Response `201`

Trusted workload policy created

- WorkloadIdentityPolicyResponse
  - `data` WorkloadIdentityPolicy, required: A trusted workload: tokens from this issuer, for the pinned owner and matching every claim condition, authenticate as the policy's key.
    - `id` string, uuid, required
    - `name` string, required
    - `provider` 'vercel' | 'github_actions', required: The platform that issues the OIDC tokens.
    - `issuer` string, required: Token issuer, for example https://oidc.vercel.com/acme or https://token.actions.githubusercontent.com.
    - `owner_id` string, required: The pinned Vercel team ID (owner_id claim) or GitHub organisation or user ID (repository_owner_id claim).
    - `claim_conditions` object, required: Extra claims the token must match, as claim name to allowed values, for example project_id and environment for Vercel, or repository_id and ref for GitHub Actions. Every claim must match one of its values. At most 15 claims and 20 values per claim; iss, aud, exp, iat, nbf and jti cannot be used, and the pinned owner claim is set with owner_id.
    - `max_token_lifetime_seconds` integer, required: Longest token lifetime (exp minus iat or nbf) the policy accepts.
    - `status` 'active' | 'disabled', required
    - `audience` string, required: The audience tokens must be issued for.
    - `key_id` string, uuid, required: The policy's key. Requests, usage and limits are recorded against it.
    - `last_used_at` string, date-time, nullable, required
    - `created_by` string, uuid, nullable, required
    - `created_at` string, date-time, required
    - `updated_at` string, date-time, required

## Other responses

- `default`: Request failed

## Changes

- **2026-10-27** `f48fc6c1db25`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/phaseo/apis/phaseo-gateway-api/changes/workload-identity/policies/post.md)

---

[API](https://skmtc.dev/phaseo/apis/phaseo-gateway-api.md) - [All operations](https://skmtc.dev/phaseo/apis/phaseo-gateway-api/llms.txt) - [OpenAPI document](https://skmtc.dev/phaseo/apis/phaseo-gateway-api/revisions/5ca9bb220d25?raw)