> ## Documentation Index
> Fetch the complete documentation index at: https://namespace.so/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# nsc auth trust-relationships update

Update an existing trust relationship by ID.

`nsc auth trust-relationships update` modifies an existing trust relationship. You identify the relationship with its `--id` and provide only the flags you want to change. Fields whose flags are not set keep their current values.

## Usage

```bash theme={null}
nsc auth trust-relationships update --id string [--issuer string] [--subject-match string] [--audience string] [--grant string] [--default_token_duration string]
```

First, find the ID of the relationship you want to change:

```bash theme={null}
nsc auth trust-relationships list
```

```text nocopy Output theme={null}
Trust Relationships:

ID: tr_abc123
  Issuer: https://accounts.google.com
  Subject Match: projects/123456789/serviceAccounts/my-service@my-project.iam.gserviceaccount.com
```

You can also copy the ID from the [Trust Relationships settings page](https://cloud.namespace.so) in the Namespace dashboard.

### Examples

**Change the subject match pattern:**

```bash theme={null}
nsc auth trust-relationships update \
  --id tr_abc123 \
  --subject-match "projects/123456789/serviceAccounts/*"
```

**Change the issuer:**

```bash theme={null}
nsc auth trust-relationships update \
  --id tr_abc123 \
  --issuer "https://accounts.google.com"
```

**Replace the granted permissions:**

```bash theme={null}
nsc auth trust-relationships update \
  --id tr_abc123 \
  --grant '{"resource_type":"instance","resource_id":"*","actions":["create","list","get","destroy"]}' \
  --grant '{"resource_type":"artifact","resource_id":"*","actions":["create","resolve","list"]}'
```

**Set a default token duration:**

```bash theme={null}
nsc auth trust-relationships update \
  --id tr_abc123 \
  --default_token_duration "3600s"
```

## Required Flags

<h3 id="--id-string">
  \--id string
</h3>

The unique identifier of the trust relationship to update. You can find this ID by running [`nsc auth trust-relationships list`](/docs/reference/cli/auth-trust-relationships-list) or from the Trust Relationships settings page in the dashboard.

## Optional Flags

You must provide at least one of the following flags. Only the fields you set are changed; everything else is left as-is.

<h3 id="--issuer-string">
  \--issuer string
</h3>

The token issuer URL that identifies the external identity provider. See [`add`](/docs/reference/cli/auth-trust-relationships-add) for the list of supported issuers.

<h3 id="--subject-match-string">
  \--subject-match string
</h3>

Subject match pattern that defines which subjects from the issuer are trusted. Supports wildcards (`*`). See [`add`](/docs/reference/cli/auth-trust-relationships-add) for pattern examples.

<h3 id="--audience-string">
  \--audience string
</h3>

Expected audience (`aud`) value for the trusted tokens.

<h3 id="--grant-stringarray-can-be-repeated">
  \--grant stringArray (can be repeated)
</h3>

Replaces all existing grants for the relationship with the permissions you provide. Each grant is a JSON object:

```json theme={null}
{"resource_type":"...","resource_id":"...","actions":["..."]}
```

When set, the previous grants are discarded and replaced by the new set. See [Permissions](/docs/security/permissions) for the full list of resource types and actions.

<h3 id="--default_token_duration-string">
  \--default\_token\_duration string
</h3>

Default validity duration for tokens issued via this relationship (e.g. `3600s`).

## Important Notes

* **Partial updates**: Only the flags you pass are changed. Unset fields retain their current values.
* **Grants are replaced**: Passing `--grant` overwrites the existing grants rather than appending to them.
* **Immediate effect**: Updates take effect immediately for new authentications; existing sessions remain valid until they expire.

## Related Topics

* [nsc auth trust-relationships](/docs/reference/cli/auth-trust-relationships) - Main command overview
* [nsc auth trust-relationships add](/docs/reference/cli/auth-trust-relationships-add) - Add new relationships
* [nsc auth trust-relationships list](/docs/reference/cli/auth-trust-relationships-list) - List existing relationships
* [nsc auth trust-relationships remove](/docs/reference/cli/auth-trust-relationships-remove) - Remove relationships
* [Permissions](/docs/security/permissions) - Full list of resource types and actions