Start

Platform

Agents

App store purchases

Auth

Builds

Credits

Database

Flags

Generated Assets

Hosting

Jobs and cron

Knowledge

Localization

Monitoring

Network

Notifications

Organizations

Queues

Realtime

Runners

Sandboxes

Storage

Webhooks

Workflows

Getting Started

Installation

Authentication

AI Services

KV Store

Overview

Webhooks

Deploy & Infrastructure

Reference

On this page

get
list
create
update
delete
exchange-token

Reference

sylphx broker trust_policies

Every sylphx broker trust_policies command: its argument, its flags and a run line.

Checked 2026-09-28

This method is not served on the public API. api.sylphx.com does not route this call: its backend is not deployed behind the public API, or does not implement the call. This page documents the contract. It is kept out of the sidebar and of search engines.

The trust_policies commands of Sylphx Broker, as the CLI spells them: the same calls as the trust_policies API page, typed for the shell. Install, sign in and the grammar are on the CLI index.

Not available yet. Sylphx Broker is declared in the registry but no backend serves it: every command answers 501 with the problem code UNIMPLEMENTED.

#get

Gets a trust policy.

NAME — the resource's name; a bare id is enough below the linked project.

CLI

Shell

sylphx broker trust-policies get orgs/acme/trust_policies/trust-policy

GET https://api.sylphx.com/v1/orgs/acme/trust_policies/trust-policy · scope broker:read · effect read · Request, response and examples

#list

Lists an org's trust policies.

PARENT — optional: the CLI fills it from the linked project or the key's scope when it is left out.

CLI

Shell

sylphx broker trust-policies list orgs/acme

GET https://api.sylphx.com/v1/orgs/acme/trust_policies · scope broker:read · effect read · Request, response and examples

Flags

Flag	Type	What it does
`--page-size`	`int`	At most this many; default 50, clamped to 1000.
`--page-token`	`string`	`next_page_token` of the previous page.
`--filter`	`string`	AIP-160 filter over labels and filterable fields.
`--order-by`	`string`	AIP-132 ordering over filterable fields.

#create

Creates a trust policy.

ID — The id segment of the new Resource's name; the server assigns one when omitted.

CLI

Shell

sylphx broker trust-policies create --parent orgs/acme --spec.connection … --spec.credential-kind access_token

POST https://api.sylphx.com/v1/orgs/acme/trust_policies · scope broker:admin · effect write · Request, response and examples

Flags

Flag	Type	What it does
`--parent`	`string`	The parent to create in; defaults to the linked project or the key's scope.
`--meta.labels`	`key=value`	Caller-writable, indexed labels (AIP-122 label rules). Repeat the flag for each value.
`--meta.annotations`	`key=value`	Caller-writable, unindexed annotations. Repeat the flag for each value.
`--meta.display-name`	`string`	Caller-writable human-readable name.
`--spec.connection`	`string`	The Connection credentials are issued on. Required.
`--spec.subjects`	`string`	The identities allowed to exchange: SPIFFE ids (`spiffe://<trust-domain>/cell/<cell>/role/<role>`, `*` matching one segment) or Sylphx Access principal names. The cell segment is never stripped. Required. Repeat the flag for each value.
`--spec.permissions`	`key=value`	The most a credential may carry, in the provider's permission names, for example `{"contents": "read", "checks": "write"}`. Required. Repeat the flag for each value.
`--spec.repositories`	`string`	The most repositories a credential may cover; empty means every repository the Connection covers. Repeat the flag for each value.
`--spec.credential-kind`	`enum`	What the credential service issues. Required. One of `access_token`, `runner_registration`.
`--spec.max-ttl`	`duration`	The longest a credential lives; default and maximum 1 hour.
`--dry-run`	`bool`	Validate and print the result without writing (validate_only).

#update

Updates a trust policy.

NAME — the resource's name; a bare id is enough below the linked project.

CLI

Shell

sylphx broker trust-policies update orgs/acme/trust_policies/trust-policy --spec.connection … --spec.credential-kind access_token

PATCH https://api.sylphx.com/v1/orgs/acme/trust_policies/trust-policy · scope broker:admin · effect write · Request, response and examples

Flags

Flag	Type	What it does
`--meta.labels`	`key=value`	Caller-writable, indexed labels (AIP-122 label rules). Repeat the flag for each value.
`--meta.annotations`	`key=value`	Caller-writable, unindexed annotations. Repeat the flag for each value.
`--meta.display-name`	`string`	Caller-writable human-readable name.
`--spec.connection`	`string`	The Connection credentials are issued on. Required.
`--spec.subjects`	`string`	The identities allowed to exchange: SPIFFE ids (`spiffe://<trust-domain>/cell/<cell>/role/<role>`, `*` matching one segment) or Sylphx Access principal names. The cell segment is never stripped. Required. Repeat the flag for each value.
`--spec.permissions`	`key=value`	The most a credential may carry, in the provider's permission names, for example `{"contents": "read", "checks": "write"}`. Required. Repeat the flag for each value.
`--spec.repositories`	`string`	The most repositories a credential may cover; empty means every repository the Connection covers. Repeat the flag for each value.
`--spec.credential-kind`	`enum`	What the credential service issues. Required. One of `access_token`, `runner_registration`.
`--spec.max-ttl`	`duration`	The longest a credential lives; default and maximum 1 hour.
`--dry-run`	`bool`	Validate and print the result without writing (validate_only).

#delete

Deletes a trust policy.

NAME — the resource's name; a bare id is enough below the linked project.

CLI

Shell

sylphx broker trust-policies delete orgs/acme/trust_policies/trust-policy --yes

DELETE https://api.sylphx.com/v1/orgs/acme/trust_policies/trust-policy · scope broker:admin · effect destructive · Request, response and examples

Flags

Flag	Type	What it does
`--etag`	`string`	Delete only if the current etag matches.
`--dry-run`	`bool`	Validate and print the result without writing (validate_only).
`--yes`	`bool`	Do not ask before this destructive call.

#exchange-token

Exchanges the caller's workload identity for a short-lived provider credential under a trust policy (RFC 8693 token exchange). The credential is narrowed to the request and cached per installation and permission set; a permission the Connection lacks is PERMISSION_DENIED with reason CapabilityMissing, never an outage.

NAME — the resource's name; a bare id is enough below the linked project.

CLI

Shell

sylphx broker trust-policies exchange-token orgs/acme/trust_policies/trust-policy

POST https://api.sylphx.com/v1/orgs/acme/trust_policies/trust-policy:exchangeToken · scope broker:exchange · effect write · Request, response and examples

Flags

Flag	Type	What it does
`--subject-token`	`string`	The caller's identity: a SPIFFE JWT-SVID or an Access-issued workload OIDC token, with audience `broker.sylphx.com`. Required. The value is never returned.
`--permissions`	`key=value`	The permissions this call needs, at most the policy's; empty means the policy's. Repeat the flag for each value.
`--repositories`	`string`	The repositories this call needs, at most the policy's; empty means the policy's. Repeat the flag for each value.
`--ttl`	`duration`	How long the credential should live, at most the policy's `max_ttl`.

Was this page helpful?

Tell us what is missing, wrong, or unclear — this opens a real inbox.

Send feedback

Platform links