---
type: api
title: Get trusted environments
description: Returns the list of trusted environments for the organization. If no organization is passed in, the organization attached to the user is assumed.
url: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/cloud-enterprise/v4/operation/operation-get-trusted-envs
resource: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/cloud-enterprise/v4/operation/operation-get-trusted-envs
products:
  - Elastic Cloud Enterprise
---

# Get trusted environments

## Paths

- `GET` `/trusted-environments`

- [Basic auth](/elastic/docs-builder/docs/4371/api/doc/cloud-enterprise/v4/authentication#basicauth)
- [Api key auth](/elastic/docs-builder/docs/4371/api/doc/cloud-enterprise/v4/authentication#apikey)

## Description

Returns the list of trusted environments for the organization. If no organization is passed in, the organization attached to the user is assumed.

## Query String Parameters

- `organization_id` (string)
  (Optional) Organization Id for which to retrieve the trusted environments

## Responses

#### `200`

Trusted environments for this organization

`application/json`

- `accounts` ([] AccountTrustRelationship)
  The list of trust relationships with different accounts
  - `account_id` (string)
    the ID of the Account
  - `name` (string)
    A human readable name of the trust relationship
  - `trust_all` (boolean)
    If true, all clusters in this account will by default be trusted and the `trust_allowlist` is ignored.
  - `trust_allowlist` ([] string)
    The list of clusters to trust. Only used when `trust_all` is false.
- `external` ([] ExternalTrustRelationship)
  The list of trust relationships with external entities
  - `trust_relationship_id` (string)
    The ID of the external trust relationship
  - `name` (string)
    The name of the external trust relationship. Retrieved from the TrustRelationship and ignored on write.
  - `trust_all` (boolean)
    If true, all clusters in this external entity will be trusted and the `trust_allowlist` is ignored.
  - `trust_allowlist` ([] string)
    The list of clusters to trust. Only used when `trust_all` is false.
- `direct` ([] DirectTrustRelationship)
  The list of trust relationships where the certificate is bundled with the trust setting. Allows configuring trust for clusters running outside of an Elastic Cloud managed environment or in an Elastic Cloud environment without an environment level trust established.
  - `uid` (string)
    Auto generated identifier for this trust, allows distinguishing between update vs remove and add.
  - `name` (string)
    a human readable name of the trust relationship
  - `type` (enum)
    The type can either be ESS, ECE, generic or proxy. If none is specified, then generic is assumed. If proxy is specified, trust_all should be false and trust_allowlist, scope_id and additional_node_names should be omitted.
    Values: `ECE`, `ESS`, `generic`, `proxy`
  - `trust_all` (boolean)
    If true, scope_id is required and the `trust_allowlist` is ignored and all clusters matching the scope id will be trusted.
  - `trust_allowlist` ([] string)
    The list of clusters with matching scope to trust. Only used when `trust_all` is false. Providing one or more clusters makes scope_id mandatory.
  - `scope_id` (string)
    A lowercase alphanumerical string of max 32 characters. Usually an organization id or an environment id, but could really be any suitable suffix for clusters using the CA certificate of this trust. Required unless trust_all is false and trust_allowlist is empty.
  - `additional_node_names` ([] string)
    A list of node names trusted in addition to those deducible from trust_allowlist and scope id. Allows trusting nodes that don't have a scoped name at the cost of maintaining the list. Mandatory if scope id is not defined. Wildcards are not allowed.
  - `certificates` ([] TrustedCertificate)
    The public ca certificate(s) to trust. Only one is required, but it is possible to specify multiple certificates in order to facilitate key rotation.
    - `pem` (string)
      The public ca certificate as string in PEM format.
    - `metadata` ({} CertificateMetaData)
      The certificate MetaData
      - `fingerprint` (string)
        The fingerprint of the certificate
      - `valid_to` (string)
        The expiry date of the certificate in UTC
      - `valid_from` (string)
        The valid from date of the certificate in UTC
      - `also_trusted_by` ([] string)
        Other deployments also trusting this certificate
#### `404`

Organization not found. (code: `organization.not_found`)

`application/json`

- `errors` ([] BasicFailedReplyElement)
  A list of errors that occurred in the failing request
  - `code` (string)
    A structured code representing the error type that occurred
  - `message` (string)
    A human readable message describing the error that occurred
  - `fields` ([] string)
    If the error can be tied to a specific field or fields in the user request, this lists those fields
##### Response Headers

- `x-cloud-error-codes` (enum)
  The error codes associated with the response

## Code Examples

#### Console

```console
GET /trusted-environments
```

#### curl

```curl
curl -X GET "/trusted-environments"
```