---
title: "List a service account's OIDC trust rules."
method: GET
path: "/organizations/{organizationId}/service-accounts/{serviceAccountId}/trust-rules"
tags: ["service-accounts"]
---

# List a service account's OIDC trust rules.

`GET /organizations/{organizationId}/service-accounts/{serviceAccountId}/trust-rules`

## Request

- Base URL: `https://api.shorebird.dev/api/v1`
- URL: `https://api.shorebird.dev/api/v1/organizations/{organizationId}/service-accounts/{serviceAccountId}/trust-rules`
- Auth: one of:
  - HTTP bearer
  - HTTP bearer

The trust rules that let a CI workflow authenticate as the service
account with a token from its own identity provider, oldest first.
Listing needs no particular plan, so an organization that moves to a
plan without OIDC federation still sees the rules it has.

Requires the `serviceAccountTrustRules.view` permission, which only
the `admin` and `owner` roles hold.

## Query parameters

- `per_page` integer
- `cursor` string
- `page` integer

## Response `200`

The service account's trust rules.

- GetServiceAccountTrustRulesResponse: The response body for GET /organizations/{organizationId}/service-accounts/{serviceAccountId}/trust-rules.
  - `trust_rules` ServiceAccountTrustRule[], required: The service account's trust rules, oldest first.
    - `id` integer, required: The trust rule's ID.
    - `provider` 'github', required: The identity provider whose tokens an OIDC trust rule accepts.
    - `created_at` string, date-time, required: When the rule was added.
    - `created_by_user_id` integer, nullable, required: The user who added the rule, or null once that user has been deleted.
    - `last_used_at` string, date-time, nullable, required: When a token was last exchanged under the rule, or null if never.
    - `github` GithubTrustRule, required: The GitHub Actions workflow an OIDC trust rule lets in. A token matches when its repository (ignoring case), owner id and workflow file match, and its environment and ref match when the rule names them.
      - `repository_owner` string, required: The repository owner's GitHub login, as entered.
      - `repository_owner_id` integer, required: GitHub's numeric id for the repository owner, resolved when the rule was added and matched against the token's `repository_owner_id` claim.
      - `repository_name` string, required: The repository's name, as entered.
      - `workflow_path` string, required: The workflow file, such as `.github/workflows/release.yml`, matched against the path in the token's `job_workflow_ref` claim.
      - `environment` string, nullable, required: The GitHub environment the job must run in, compared ignoring case, or null for any.
      - `ref_pattern` string, nullable, required: The ref the job must run on: exact (`refs/heads/main`), or a prefix ending in `*` (`refs/tags/*`). Null for any.
  - `next_cursor` string: The opaque cursor of the next page; send it back as `cursor` to get that page. Present only when the request was paginated (sent `per_page`, `cursor` or `page`) and another page follows. Absent on the last page and on unpaginated responses.
  - `total_count` integer: How many items the whole list holds. Present only when the request was paginated.

## Other responses

- `400`: The organization id (`organization_id_malformed`) or the service account id (`service_account_bad_request`) is not an integer.
- `403`: The caller lacks the `serviceAccountTrustRules.view` permission.
- `404`: No such organization or the caller is not a member of it (`organization_membership_guard_error`), or the organization has no service account with that id (`service_account_not_found`).
- `424`: A database read failed (`service_account_database_error`).
- `default`: Standard error response. Emitted for any non-2xx status where a body can be decoded into an [ErrorResponse].

---

[API](https://skmtc.dev/shorebird/apis/shorebird-codepush-api.md) - [All operations](https://skmtc.dev/shorebird/apis/shorebird-codepush-api/llms.txt) - [OpenAPI document](https://skmtc.dev/shorebird/apis/shorebird-codepush-api/revisions/941da8871d10?raw)