---
title: "Create Trust Anchor [EXPERIMENTAL]"
method: POST
path: "/trustAnchors"
tags: ["Trust Anchors"]
---

# Create Trust Anchor \[EXPERIMENTAL\]

`POST /trustAnchors`

## Request

- Base URL: `https://eu-west-1.api.silverflow.com/v1`
- URL: `https://eu-west-1.api.silverflow.com/v1/trustAnchors`
- Auth: one of:
  - HTTP basic
  - HTTP bearer
- TypeScript: <https://skmtc.dev/silverflow/apis/silverflow-api/docs/trustAnchors/post.ts> (a function with typed inputs; its response is checked against the schema)

This operation registers a CA certificate as a Trust Anchor for the Agent. Client certificates bound to the
Agent's API keys must chain to one of its Trust Anchors.

**An Agent can have at most two active Trust Anchors.** The limit exists so that a CA can be rotated without
downtime: register the new CA as the second Trust Anchor, move your client certificates over to it, then archive
the old one. If two Trust Anchors are already active, archive one before creating another.

The fingerprint and validity period are taken from the certificate. Changes can take up to 15 minutes to take
effect.

Requires `trustAnchors:Create` permission.

## Request body

- TrustAnchorCreate
  - `certificate` string, required: A single PEM-encoded X.509 v3 CA certificate, including the `-----BEGIN CERTIFICATE-----` and `-----END CERTIFICATE-----` lines. The certificate must be valid now, have an RSA 2048, 3072 or 4096 key or an ECDSA P-256 or P-384 key, be signed with SHA-256, SHA-384 or SHA-512, and be at most 16384 bytes when DER-encoded.
  - `description` string

## Response `201`

The created Trust Anchor

- TrustAnchor
  - `key` string, required
  - `agentKey` string, required: Uniquely identifies an Agent
  - `fingerprint` string, required: The SHA-256 hash of the DER-encoded certificate, as URL-safe base64 with padding (44 characters, using `-` and `_`, ending in `=`). This is the value of the `CloudFront-Viewer-Cert-Sha256` header for the certificate. To compute it from a certificate file: `openssl x509 -in cert.pem -outform der | openssl dgst -sha256 -binary | openssl base64 -A | tr '+/' '-_'`.
  - `status` 'active' | 'archived', required: The status of the Trust Anchor
  - `description` string
  - `notBefore` string, date-time, required: The start of the certificate's validity period, taken from the certificate
  - `notAfter` string, date-time, required: The end of the certificate's validity period, taken from the certificate
  - `created` string, date-time, required: The date and time this object was created
  - `lastModified` string, date-time: The date and time this object was last modified
  - `version` integer, required: The version of this object

## Other responses

- `400`: The request was malformed. See the response body for details
- `401`: Authentication information is missing or invalid
- `403`: The authenticated client is forbidden to make the request for the resource identified.
- `404`: The requested resource was not found
- `409`: The request could not be completed due to a conflict with the current state of the resources involved in the request.
- `429`: The number of requests (per minute) has exceeded the configured maximum

---

[API](https://skmtc.dev/silverflow/apis/silverflow-api.md) - [All operations](https://skmtc.dev/silverflow/apis/silverflow-api/llms.txt) - [OpenAPI document](https://skmtc.dev/silverflow/apis/silverflow-api/revisions/43ecbe4fd6ea?raw)