List trust rules

⚠️
Preview — this feature is being built; the design below is the spec.
GET https://app.syntic.ai/v1/organizations/service_accounts/{service_account_id}/trust_rules

Return a service account’s trust rules.

For how this fits into a full workflow, see Workload identity.

Headers

HeaderRequiredValue
AuthorizationYesBearer <admin key>: an Admin API key (sk_admin_...). Inference keys are refused with 403 admin_key_required. See Admin API keys.
syntic-betaYes, while in previewadmin-2026-11-01. Without it the call fails with 400 beta_required. See Versioning.

Path parameters

ParameterTypeDescription
service_account_idstringThe service account id, starting with svcacct_.

Query parameters

ParameterTypeDefaultDescription
limitinteger201 to 100.
after_idstringNext page: the previous page’s last_id.
before_idstringPrevious page: the previous page’s first_id.

Response

200 OK, Content-Type: application/json

{
  "data": [
    {
      "id": "frule_01JCK9M1P3R5T7V9X1Z3",
      "type": "trust_rule",
      "service_account_id": "svcacct_01JCH7K9M1P3R5T7V9X1",
      "issuer": "https://token.actions.githubusercontent.com",
      "audience": "https://app.syntic.ai",
      "conditions": {
        "repository": "acme/billing",
        "ref": "refs/heads/main"
      },
      "max_token_lifetime_seconds": 900,
      "status": "enabled",
      "last_matched_at": "2026-11-05T09:58:10Z",
      "created_at": "2026-10-20T09:05:00Z"
    }
  ],
  "has_more": false,
  "first_id": "frule_01JCK9M1P3R5T7V9X1Z3",
  "last_id": "frule_01JCK9M1P3R5T7V9X1Z3"
}
FieldTypeDescription
dataarrayThe objects on this page, newest first.
has_morebooleantrue when another page exists after this one.
first_idstring or nullPass as before_id to go back a page.
last_idstring or nullPass as after_id to get the next page.

Examples

curl -sS "https://app.syntic.ai/v1/organizations/service_accounts/svcacct_01JCH7K9M1P3R5T7V9X1/trust_rules" \
  -H "Authorization: Bearer $SYNTIC_ADMIN_KEY" \
  -H "syntic-beta: admin-2026-11-01"

Errors

Errors use the error envelope and carry a request_id. Codes specific to this operation:

StatustypecodeWhen
400invalid_request_errorbeta_requiredThe syntic-beta header is missing.
404not_found_errorservice_account_not_foundNo service account with this id in the organization.
401authentication_errorinvalid_api_keyThe admin key is missing, unknown, revoked or expired.
403permission_erroradmin_key_requiredAn inference key was used.
429rate_limit_errorrate_limitedToo many requests; wait for Retry-After. See Rate-limit headers.
Was this page helpful?