The trust rule object

⚠️

Preview — this feature is being built; the design below is the spec.

The trust_rule object as the API returns it. Every field below appears in every response that returns this object; fields with no value are null rather than missing.

Example

{
  "id": "frule_01JCK9M1P3R5T7V9X1Z3",
  "type": "trust_rule",
  "service_account_id": "svcacct_01JCH7K9M1P3R5T7V9X1",
  "issuer": "https://token.actions.githubusercontent.com",
  "audience": "https://app.syntic.ai",
  "conditions": {
    "repository": "acme/billing",
    "ref": "refs/tags/v*"
  },
  "max_token_lifetime_seconds": 900,
  "status": "enabled",
  "last_matched_at": "2026-11-05T09:58:10Z",
  "created_at": "2026-10-20T09:05:00Z"
}

Fields

Field	Type	Description
`id`	string	Unique id of this object.
`type`	string	The object type, always `trust_rule`.
`service_account_id`	string	See the endpoint pages below.
`issuer`	string	Must be a preset issuer or one registered under federation issuers.
`audience`	string	The `aud` the incoming token must carry.
`conditions`	object	Claim name to required value. A trailing `*` matches any suffix. At least one condition is required.
`max_token_lifetime_seconds`	integer	60 to 3,600. Syntic tokens issued under this rule never outlive it.
`status`	string	`enabled` or `disabled`.
`last_matched_at`	string or null	Last successful exchange under this rule.
`created_at`	string	When it was created, RFC 3339 UTC (some older objects use Unix seconds).

Returned by

token_count tunnel

Was this page helpful?