Skip to content
GitHub

Trust one GitHub repository's workflows to deploy into a project. Exchanged tokens act with the creator's authority, capped at `role`.

POST
/api/v1/ci/trust-policies
curl --request POST \
  --url https://example.com/api/v1/ci/trust-policies \
  --header 'Content-Type: application/json' \
  --data '{ "name": "shop-deploy", "project": "shop", "environment": "example", "repository": "acme/shop", "repositoryId": 1, "repositoryOwnerId": 1, "refs": [ "example" ], "environments": [ "example" ], "events": [ "example" ], "role": "example", "tokenTtlSecs": 1 }'

Request Bodyrequired

Section titled “Request Bodyrequired”
Media typeapplication/json
object
name
required

Unique in the organization, 1–64 characters.

string
Example
shop-deploy
project
required
string
Example
shop
environment

Narrows the tokens to one environment of project.

string | null
repository
required

owner/name, for people; the ids decide.

string
Example
acme/shop
repositoryId
required

GitHub’s numeric repository id (repository_id claim).

integer format: int64
repositoryOwnerId
required

GitHub’s numeric owner id (repository_owner_id claim).

integer format: int64
refs
required

refs/heads/main, refs/tags/v*, …

Array<string>
environments

GitHub environments allowed; empty for any.

Array<string>
events

Workflow events allowed; push, workflow_dispatch and release when empty.

Array<string>
role

developer (deploy) or admin (deploy and promote).

string | null
tokenTtlSecs

Life of an exchanged token, 60–3600 seconds (default 900).

integer | null format: int32

Responses

Section titled “Responses”

201

Section titled “201”
Media typeapplication/json
object
id
required
string format: uuid
name
required
string
project
required
string format: uuid
environment
string | null format: uuid
repository
required
string
repositoryId
required
integer format: int64
repositoryOwnerId
required
integer format: int64
refs
required
Array<string>
environments
required
Array<string>
events
required
Array<string>
role
required
string
tokenTtlSecs
required
integer format: int32
createdBy
required
string
createdAt
required
integer format: int64
revokedAt
integer | null format: int64
Examplegenerated
{
  "id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
  "name": "example",
  "project": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
  "environment": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
  "repository": "example",
  "repositoryId": 1,
  "repositoryOwnerId": 1,
  "refs": [
    "example"
  ],
  "environments": [
    "example"
  ],
  "events": [
    "example"
  ],
  "role": "example",
  "tokenTtlSecs": 1,
  "createdBy": "example",
  "createdAt": 1,
  "revokedAt": 1
}

403

Section titled “403”
Media typeapplication/json

Problem Details body.

object
code
required

Stable machine-readable code, e.g. forbidden.

string
title
required

Short human readable title.

string
status
required

HTTP status.

integer format: int32
detail

Details, if safe to expose.

string | null
Example
{
  "code": "forbidden"
}

404

Section titled “404”
Media typeapplication/json

Problem Details body.

object
code
required

Stable machine-readable code, e.g. forbidden.

string
title
required

Short human readable title.

string
status
required

HTTP status.

integer format: int32
detail

Details, if safe to expose.

string | null
Example
{
  "code": "forbidden"
}

409

Section titled “409”

The name is taken

Media typeapplication/json

Problem Details body.

object
code
required

Stable machine-readable code, e.g. forbidden.

string
title
required

Short human readable title.

string
status
required

HTTP status.

integer format: int32
detail

Details, if safe to expose.

string | null
Example
{
  "code": "forbidden"
}

422

Section titled “422”
Media typeapplication/json

Problem Details body.

object
code
required

Stable machine-readable code, e.g. forbidden.

string
title
required

Short human readable title.

string
status
required

HTTP status.

integer format: int32
detail

Details, if safe to expose.

string | null
Example
{
  "code": "forbidden"
}