---
title: "Creating an OCI Identity Propagation Trust (REST)"
slug: "creating-an-oci-identity-propagation-trust-rest"
updated: 2026-09-09T05:08:56Z
published: 2026-09-09T05:08:56Z
canonical: "docs.britive.com/creating-an-oci-identity-propagation-trust-rest"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.britive.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Creating an OCI Identity Propagation Trust (REST)

Use the following cURL command to create an OCI Identity Propagation Trust:

```shell
curl -X POST <DOMAIN_URL>/admin/v1/IdentityPropagationTrusts \
  -H "Authorization: Bearer <ACCESS_TOKEN>" \
  -H "Content-Type: application/scim+json" \
  -d '{
    "schemas": ["urn:ietf:params:scim:schemas:oracle:idcs:IdentityPropagationTrust"],
    "name": "britive-wif",
    "issuer": "<BRITIVE_ISSUER_URL>",
    "type": "JWT",
    "active": true,
    "allowImpersonation": true,
    "oauthClients": ["<CLIENT_ID>"],
    "publicCertificate": "<BRITIVE_WIF_CERTIFICATE>",
    "impersonationServiceUsers": [ { "rule": "sub eq *", "value": "<USER_ID>" } ]
  }'
```

Replace the following fields in the above cURL:

| Parameter | Value |
| --- | --- |
| **<DOMAIN_URL>** | The domain URL of your Oracle Cloud. |
| **<ACCESS_TOKEN>** | The access token created in this step: [Getting an OCI access token (REST)](/v1/docs/getting-an-oci-access-token-rest) |
| **<BRITIVE_ISSUER_URL>** | Get the Britive Issuer URL during the creation of the Britive WIF application in this step ([Onboarding OCI WIF Application in Britive](/v1/docs/oracle-cloud-infrastructure-oci-wif-onboarding-guide). |
| **<CLIENT_ID>** | Client ID of the confidential app created in this step [Creating a Confidential Application in Oracle Cloud](/v1/docs/creating-confidential-application-in-oracle-cloud) |
| **<BRITIVE_WIF_CERTIFICATE>** | It must be base64, with no BEGIN/END lines and no newlines. Run the below command in the Linux terminal: ```shell openssl x509 -in <path_to_downloaded_britive_wif_certificate> -outform DER \| base64 -w 0 ``` |
| **<USER_ID>** | The ID of the service user created in this step: [Creating an OCI Service User (REST)](/v1/docs/creating-an-oci-service-user-rest) |

> [!NOTE]
> Note:
> 
> *publicCertificate* must be the cert body only (strip the *-----BEGIN/END-----* lines and newlines). *rule* must be exactly *sub eq **. *value* is the service user *id* created in this step:[Creating an OCI Service User (REST)](/v1/docs/creating-an-oci-service-user-rest)