> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Attach

> Attach OIDC Auth configuration onto machine identity



## OpenAPI

````yaml POST /api/v1/auth/oidc-auth/identities/{identityId}
openapi: 3.0.3
info:
  title: Infisical API
  description: List of all available APIs that can be consumed
  version: 0.0.1
servers:
  - url: https://us.infisical.com
    description: Production server (US)
  - url: https://eu.infisical.com
    description: Production server (EU)
  - url: http://localhost:8080
    description: Local server
security: []
paths:
  /api/v1/auth/oidc-auth/identities/{identityId}:
    post:
      tags:
        - OIDC Auth
      description: Attach OIDC Auth configuration onto machine identity
      operationId: attachOidcAuth
      parameters:
        - schema:
            type: string
          in: path
          name: identityId
          required: true
          description: The ID of the machine identity to attach the configuration onto.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                templateId:
                  type: string
                  format: uuid
                  description: >-
                    The ID of the OIDC auth template to source identity provider
                    settings from. When provided, the OIDC discovery URL,
                    issuer, audiences, and CA certificate are taken from the
                    template and cannot be set individually.
                oidcDiscoveryUrl:
                  type: string
                  format: uri
                  minLength: 1
                  description: >-
                    The URL used to retrieve the OpenID Connect configuration
                    from the identity provider.
                caCert:
                  type: string
                  description: >-
                    The PEM-encoded CA cert for establishing secure
                    communication with the Identity Provider endpoints.
                boundIssuer:
                  type: string
                  minLength: 1
                  description: >-
                    The unique identifier of the identity provider issuing the
                    JWT.
                boundAudiences:
                  type: string
                  description: The list of intended recipients.
                boundClaims:
                  type: object
                  additionalProperties:
                    type: string
                  description: >-
                    The attributes that should be present in the JWT for it to
                    be valid.
                claimMetadataMapping:
                  type: object
                  additionalProperties:
                    type: string
                  description: >-
                    The attributes that should be present in the permission
                    metadata from the JWT.
                boundSubject:
                  type: string
                  default: ''
                  description: The expected principal that is the subject of the JWT.
                accessTokenTrustedIps:
                  type: array
                  items:
                    type: object
                    properties:
                      ipAddress:
                        type: string
                    required:
                      - ipAddress
                    additionalProperties: false
                  minItems: 1
                  default:
                    - ipAddress: 0.0.0.0/0
                    - ipAddress: '::/0'
                  description: The IPs or CIDR ranges that access tokens can be used from.
                accessTokenTTL:
                  type: integer
                  minimum: 0
                  maximum: 315360000
                  default: 2592000
                  description: The lifetime for an access token in seconds.
                accessTokenMaxTTL:
                  type: integer
                  minimum: 0
                  maximum: 315360000
                  default: 2592000
                  description: The maximum lifetime for an access token in seconds.
                accessTokenNumUsesLimit:
                  type: integer
                  minimum: 0
                  default: 0
                  description: >-
                    The maximum number of times that an access token can be
                    used.
              required:
                - boundClaims
              additionalProperties: false
      responses:
        '200':
          description: Default Response
          content:
            application/json:
              schema:
                type: object
                properties:
                  identityOidcAuth:
                    type: object
                    properties:
                      id:
                        type: string
                        format: uuid
                      accessTokenTTL:
                        type: number
                        default: 7200
                      accessTokenMaxTTL:
                        type: number
                        default: 7200
                      accessTokenNumUsesLimit:
                        type: number
                        default: 0
                      accessTokenTrustedIps: {}
                      identityId:
                        type: string
                        format: uuid
                      oidcDiscoveryUrl:
                        type: string
                      boundIssuer:
                        type: string
                      boundAudiences:
                        type: string
                      boundClaims: {}
                      claimMetadataMapping:
                        nullable: true
                      boundSubject:
                        type: string
                        nullable: true
                      templateId:
                        type: string
                        format: uuid
                        nullable: true
                      createdAt:
                        type: string
                        format: date-time
                      updatedAt:
                        type: string
                        format: date-time
                      caCert:
                        type: string
                    required:
                      - id
                      - identityId
                      - oidcDiscoveryUrl
                      - boundIssuer
                      - boundAudiences
                      - createdAt
                      - updatedAt
                      - caCert
                    additionalProperties: false
                required:
                  - identityOidcAuth
                additionalProperties: false
        '400':
          description: Default Response
          content:
            application/json:
              schema:
                type: object
                properties:
                  reqId:
                    type: string
                  statusCode:
                    type: number
                    enum:
                      - 400
                  message:
                    type: string
                  error:
                    type: string
                  details: {}
                required:
                  - reqId
                  - statusCode
                  - message
                  - error
                additionalProperties: false
        '401':
          description: Default Response
          content:
            application/json:
              schema:
                type: object
                properties:
                  reqId:
                    type: string
                  statusCode:
                    type: number
                    enum:
                      - 401
                  message:
                    type: string
                  error:
                    type: string
                required:
                  - reqId
                  - statusCode
                  - message
                  - error
                additionalProperties: false
        '403':
          description: Default Response
          content:
            application/json:
              schema:
                type: object
                properties:
                  reqId:
                    type: string
                  statusCode:
                    type: number
                    enum:
                      - 403
                  message:
                    type: string
                  details: {}
                  error:
                    type: string
                required:
                  - reqId
                  - statusCode
                  - message
                  - error
                additionalProperties: false
        '404':
          description: Default Response
          content:
            application/json:
              schema:
                type: object
                properties:
                  reqId:
                    type: string
                  statusCode:
                    type: number
                    enum:
                      - 404
                  message:
                    type: string
                  error:
                    type: string
                required:
                  - reqId
                  - statusCode
                  - message
                  - error
                additionalProperties: false
        '422':
          description: Default Response
          content:
            application/json:
              schema:
                type: object
                properties:
                  reqId:
                    type: string
                  statusCode:
                    type: number
                    enum:
                      - 422
                  message: {}
                  error:
                    type: string
                required:
                  - reqId
                  - statusCode
                  - error
                additionalProperties: false
        '500':
          description: Default Response
          content:
            application/json:
              schema:
                type: object
                properties:
                  reqId:
                    type: string
                  statusCode:
                    type: number
                    enum:
                      - 500
                  message:
                    type: string
                  error:
                    type: string
                required:
                  - reqId
                  - statusCode
                  - message
                  - error
                additionalProperties: false
      security:
        - bearerAuth: []
components:
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: An access token in Infisical

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.