> ## Documentation Index
> Fetch the complete documentation index at: https://synthetiq.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Trust commands

> Manage OIDC trusts — how CI authenticates as a service account

An OIDC trust lets tokens from an external issuer (e.g. GitHub Actions) authenticate as a [service account](/docs/platform-docs/cli/service-account): tokens whose issuer and subject exactly match the trust are exchanged for short-lived Synthetiq tokens. No credentials are stored anywhere.

All `trust` commands require the `org:trusts` scope on your organization role.

## create

Create a trust on a service account:

```bash theme={null}
synthetiq trust create \
  --service-account-id <service-account-id> \
  --issuer https://token.actions.githubusercontent.com \
  --subject "repo:acme/infra:ref:refs/heads/main"
```

| Flag                        | Description                                                                                                                                                                                                                  |
| --------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `--service-account-id <id>` | The service account this trust authenticates as                                                                                                                                                                              |
| `--issuer <url>`            | OIDC issuer URL (https, no default)                                                                                                                                                                                          |
| `--subject <subject>`       | Token subject, matched exactly (e.g. `repo:<owner>/<repo>:ref:refs/heads/main`)                                                                                                                                              |
| `--jwks <path>`             | Optional JWK Set file pinning the issuer's signing keys — verification then never contacts the issuer. Omit to resolve keys via OIDC discovery (issuer must be reachable from the Synthetiq platform; rotation is automatic) |
| `--description <text>`      | Optional description of the trust                                                                                                                                                                                            |
| `--json`                    | Output as JSON                                                                                                                                                                                                               |

```
Trust created.
  ID:       3c1f8a44-9b2d-4e07-8f1a-6d5c2e9b7a01
  Issuer:   https://token.actions.githubusercontent.com
  Subject:  repo:acme/infra:ref:refs/heads/main
```

One trust per (issuer, subject) pair per organization.

## list

List the organization's trusts:

```bash theme={null}
synthetiq trust list
```

```
ID                                     SERVICE ACCOUNT   ISSUER                                        SUBJECT
3c1f8a44-9b2d-4e07-8f1a-6d5c2e9b7a01   infra-apply       token.actions.githubusercontent.com          repo:acme/infra:ref:refs/heads/main
```

| Flag     | Description    |
| -------- | -------------- |
| `--json` | Output as JSON |

## update

Update an existing trust:

```bash theme={null}
synthetiq trust update <trust-id> [--issuer <url>] [--subject <subject>] [--service-account-id <id>] [--description <text>]
```

## delete

Delete a trust:

```bash theme={null}
synthetiq trust delete <trust-id>
```

Revocation is immediate — the next token exchange for this issuer and subject fails.