Federation Issuers changedapi/admin/federation_issuers
Nearest release: v2.1.245, published an hour after this site recorded the change. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Recorded here
Lines+228added
Lines−129removed
From line
1
where the diff opens
First seen
14 Aug 2026
this site's first read of the page
Recorded edits4to this page, all time
### Headers ### Body parameters #### Response (200) ### Path parameters ### Headers #### Response (200) ### Query parameters ### Headers #### Response (200) ### Path parameters ### Headers ### Body parameters #### Response (200) ### Path parameters ### Headers #### Response (200) ## Domain types ### Header Parameters ### Body Parameters #### Response ### Path Parameters ### Header Parameters #### Response ### Query Parameters ### Header Parameters #### Response ### Path Parameters ### Header Parameters ### Body Parameters #### Response ### Path Parameters ### Header Parameters #### Response ## Domain Types
The whole hunk
from line 1, old and new numbered
/
from line 1
1---
2title: Federation Issuers
3url: https://platform.claude.com/docs/en/api/admin/federation_issuers
4---
5
61# Federation Issuers
72
83## Create Federation Issuer
94
10**post** `/v1/organizations/federation_issuers`
5**POST** `/v1/organizations/federation_issuers`
116
127Register an OIDC issuer that Anthropic will trust for workload identity
138federation in your organization.
from line 19
2419Requires an OAuth bearer or Console session; Admin API keys are not
2520accepted.
2621
27### Header Parameters
22### Headers
2823
2924- `"anthropic-beta": optional array of string`
3025
from line 27
3227
3328 To use multiple betas, use a comma separated list like `beta1,beta2` or specify the header multiple times for each beta.
3429
35### Body Parameters
30### Body parameters
3631
3732- `issuer_url: string`
3833
3934 The `iss` claim value to match against.
4035
36 minLength: 1
37
4138- `name: string`
4239
4340 Slug identifier (lowercase, digits, hyphens). Unique within the organization; a duplicate name returns 409.
4441
42 maxLength: 255, minLength: 1
43
4544- `check_jti: optional boolean or null`
4645
4746 Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Defaults to true. Applies only to assertions carrying a `jti` claim; tokens without one are accepted without single-use enforcement.
4847
49- `jwks: optional object { type, ca_cert_pem, discovery_base } or object { type, url, ca_cert_pem } or object { keys, type }`
48- `jwks: optional object or object or object`
5049
5150 How signing keys are obtained. Defaults to OIDC discovery.
5251
53 - `Discovery object { type, ca_cert_pem, discovery_base }`
52 - `Discovery object`
5453
5554 JWKS via the issuer's OIDC discovery document.
5655
5756 - `type: "discovery"`
5857
59 - `"discovery"`
60
6158 - `ca_cert_pem: optional string or null`
6259
6360 Optional custom CA (PEM) for TLS verification of the JWKS fetch.
6461
62 maxLength: 8192
63
6564 - `discovery_base: optional string or null`
6665
6766 Set when the discovery URL differs from `issuer_url`.
6867
69 - `ExplicitURL object { type, url, ca_cert_pem }`
68 - `ExplicitURL object`
7069
7170 JWKS fetched from a fixed endpoint.
7271
7372 - `type: "explicit_url"`
7473
75 - `"explicit_url"`
76
7774 - `url: string`
7875
7976 JWKS endpoint.
8077
78 minLength: 1
79
8180 - `ca_cert_pem: optional string or null`
8281
8382 Optional custom CA (PEM) for TLS verification of the JWKS fetch.
8483
85 - `Inline object { keys, type }`
84 maxLength: 8192
8685
86 - `Inline object`
87
8788 JWKS supplied directly; no network fetch.
8889
8990 - `keys: array of map[unknown]`
from line 91
9091
9192 Inline JWK objects.
9293
94 minItems: 1
95
9396 - `type: "inline"`
9497
95 - `"inline"`
96
9798- `max_jwt_lifetime_seconds: optional number or null`
9899
99100 Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Defaults to 3600 (1h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected.
100101
102 maximum: 176400, exclusiveMinimum: 0
103
101104### Returns
102105
103- `FederationIssuer object { id, archived_at, archived_by_actor_id, 12 more }`
106- `FederationIssuer object`
104107
105108 Registered external OIDC identity provider.
106109
from line 118
115118
116119 If set, all rules referencing this issuer reject token exchange.
117120
121 format: date-time
122
118123 - `archived_by_actor_id: string or null`
119124
120125 Tagged ID (`user_`/`svac_`) of the actor that archived this issuer.
from line 132
127132
128133 When this issuer was created.
129134
135 format: date-time
136
130137 - `created_by_actor_id: string or null`
131138
132139 Tagged ID (`user_`/`svac_`) of the actor that created this issuer.
from line 142
135142
136143 The `iss` claim value. Incoming JWTs must match exactly.
137144
138 - `jwks: object { type, ca_cert_pem, discovery_base } or object { type, url, ca_cert_pem } or object { keys, type }`
145 - `jwks: object or object or object`
139146
140147 How signing keys are obtained for signature verification.
141148
142 - `Discovery object { type, ca_cert_pem, discovery_base }`
149 - `Discovery object`
143150
144151 JWKS via the issuer's OIDC discovery document.
145152
146153 - `type: "discovery"`
147154
148 - `"discovery"`
149
150155 - `ca_cert_pem: optional string or null`
151156
152157 Optional custom CA (PEM) for TLS verification of the JWKS fetch.
153158
159 maxLength: 8192
160
154161 - `discovery_base: optional string or null`
155162
156163 Set when the discovery URL differs from `issuer_url`.
157164
158 - `ExplicitURL object { type, url, ca_cert_pem }`
165 - `ExplicitURL object`
159166
160167 JWKS fetched from a fixed endpoint.
161168
162169 - `type: "explicit_url"`
163170
164 - `"explicit_url"`
165
166171 - `url: string`
167172
168173 JWKS endpoint.
169174
175 minLength: 1
176
170177 - `ca_cert_pem: optional string or null`
171178
172179 Optional custom CA (PEM) for TLS verification of the JWKS fetch.
173180
174 - `Inline object { keys, type }`
181 maxLength: 8192
175182
183 - `Inline object`
184
176185 JWKS supplied directly; no network fetch.
177186
178187 - `keys: array of map[unknown]`
from line 188
179188
180189 Inline JWK objects.
181190
191 minItems: 1
192
182193 - `type: "inline"`
183194
184 - `"inline"`
185
186195 - `jwks_polling_disabled_at: string or null`
187196
188197 If set, Anthropic's JWKS poller has paused polling for this issuer after repeated fetch failures. Re-enable by sending `jwks_polling_disabled: false` via the issuer update endpoint (POST) once the upstream JWKS endpoint is fixed. An OAuth caller cannot send this when the issuer backs a rule with any scope other than `workspace:developer` or `workspace:inference`; use a Console session.
189198
199 format: date-time
200
190201 - `max_jwt_lifetime_seconds: number`
191202
192203 Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected.
from line 206
195206
196207 Admin-chosen slug identifier.
197208
198 - `poll_status: object { consecutive_failures, last_fetched_at, next_poll_at } or null`
209 - `poll_status: object or null`
199210
200211 Status of automatic JWKS polling for a federation issuer.
201212
from line 222
211222
212223 When the last successful fetch completed.
213224
225 format: date-time
226
214227 - `next_poll_at: string or null`
215228
216229 When the next fetch is scheduled. Null if paused.
217230
231 format: date-time
232
218233 - `type: "federation_issuer"`
219234
220 - `"federation_issuer"`
235 default: federation_issuer
221236
222237 - `updated_at: string`
223238
224239 When this issuer was last updated.
225240
241 format: date-time
242
226243 - `updated_by_actor_id: string or null`
227244
228245 Tagged ID (`user_`/`svac_`) of the actor that last updated this issuer.
from line 246
229246
230247### Example
231248
232```http
249```bash
233250curl https://api.anthropic.com/v1/organizations/federation_issuers \
234251 -H 'Content-Type: application/json' \
235252 -H 'anthropic-version: 2023-06-01' \
from line 257
240257 }'
241258```
242259
243#### Response
260#### Response (200)
244261
245262```json
246263{
from line 289
272289
273290## Get Federation Issuer
274291
275**get** `/v1/organizations/federation_issuers/{federation_issuer_id}`
292**GET** `/v1/organizations/federation_issuers/{federation_issuer_id}`
276293
277294Retrieve a federation issuer by its ID (`fdis_...`).
278295
279### Path Parameters
296### Path parameters
280297
281298- `federation_issuer_id: string`
282299
283300 ID of the federation issuer.
284301
285### Header Parameters
302### Headers
286303
287304- `"anthropic-beta": optional array of string`
288305
from line 309
292309
293310### Returns
294311
295- `FederationIssuer object { id, archived_at, archived_by_actor_id, 12 more }`
312- `FederationIssuer object`
296313
297314 Registered external OIDC identity provider.
298315
from line 324
307324
308325 If set, all rules referencing this issuer reject token exchange.
309326
327 format: date-time
328
310329 - `archived_by_actor_id: string or null`
311330
312331 Tagged ID (`user_`/`svac_`) of the actor that archived this issuer.
from line 338
319338
320339 When this issuer was created.
321340
341 format: date-time
342
322343 - `created_by_actor_id: string or null`
323344
324345 Tagged ID (`user_`/`svac_`) of the actor that created this issuer.
from line 348
327348
328349 The `iss` claim value. Incoming JWTs must match exactly.
329350
330 - `jwks: object { type, ca_cert_pem, discovery_base } or object { type, url, ca_cert_pem } or object { keys, type }`
351 - `jwks: object or object or object`
331352
332353 How signing keys are obtained for signature verification.
333354
334 - `Discovery object { type, ca_cert_pem, discovery_base }`
355 - `Discovery object`
335356
336357 JWKS via the issuer's OIDC discovery document.
337358
338359 - `type: "discovery"`
339360
340 - `"discovery"`
341
342361 - `ca_cert_pem: optional string or null`
343362
344363 Optional custom CA (PEM) for TLS verification of the JWKS fetch.
345364
365 maxLength: 8192
366
346367 - `discovery_base: optional string or null`
347368
348369 Set when the discovery URL differs from `issuer_url`.
349370
350 - `ExplicitURL object { type, url, ca_cert_pem }`
371 - `ExplicitURL object`
351372
352373 JWKS fetched from a fixed endpoint.
353374
354375 - `type: "explicit_url"`
355376
356 - `"explicit_url"`
357
358377 - `url: string`
359378
360379 JWKS endpoint.
361380
381 minLength: 1
382
362383 - `ca_cert_pem: optional string or null`
363384
364385 Optional custom CA (PEM) for TLS verification of the JWKS fetch.
365386
366 - `Inline object { keys, type }`
387 maxLength: 8192
367388
389 - `Inline object`
390
368391 JWKS supplied directly; no network fetch.
369392
370393 - `keys: array of map[unknown]`
from line 394
371394
372395 Inline JWK objects.
373396
397 minItems: 1
398
374399 - `type: "inline"`
375400
376 - `"inline"`
377
378401 - `jwks_polling_disabled_at: string or null`
379402
380403 If set, Anthropic's JWKS poller has paused polling for this issuer after repeated fetch failures. Re-enable by sending `jwks_polling_disabled: false` via the issuer update endpoint (POST) once the upstream JWKS endpoint is fixed. An OAuth caller cannot send this when the issuer backs a rule with any scope other than `workspace:developer` or `workspace:inference`; use a Console session.
381404
405 format: date-time
406
382407 - `max_jwt_lifetime_seconds: number`
383408
384409 Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected.
from line 412
387412
388413 Admin-chosen slug identifier.
389414
390 - `poll_status: object { consecutive_failures, last_fetched_at, next_poll_at } or null`
415 - `poll_status: object or null`
391416
392417 Status of automatic JWKS polling for a federation issuer.
393418
from line 428
403428
404429 When the last successful fetch completed.
405430
431 format: date-time
432
406433 - `next_poll_at: string or null`
407434
408435 When the next fetch is scheduled. Null if paused.
409436
437 format: date-time
438
410439 - `type: "federation_issuer"`
411440
412 - `"federation_issuer"`
441 default: federation_issuer
413442
414443 - `updated_at: string`
415444
416445 When this issuer was last updated.
417446
447 format: date-time
448
418449 - `updated_by_actor_id: string or null`
419450
420451 Tagged ID (`user_`/`svac_`) of the actor that last updated this issuer.
from line 452
421452
422453### Example
423454
424```http
455```bash
425456curl https://api.anthropic.com/v1/organizations/federation_issuers/$FEDERATION_ISSUER_ID \
426457 -H 'anthropic-version: 2023-06-01' \
427458 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
428459```
429460
430#### Response
461#### Response (200)
431462
432463```json
433464{
from line 490
459490
460491## List Federation Issuers
461492
462**get** `/v1/organizations/federation_issuers`
493**GET** `/v1/organizations/federation_issuers`
463494
464495List federation issuers in your organization.
465496
466497Archived issuers are excluded unless `include_archived=true`.
467498
468### Query Parameters
499### Query parameters
469500
470501- `include_archived: optional boolean`
471502
472503 Include archived resources. Defaults to false.
473504
505 default: false
506
474507- `limit: optional number`
475508
476509 Number of results per page.
477510
511 default: 20, maximum: 100, minimum: 1
512
478513- `page: optional string`
479514
480515 Opaque cursor from a previous response's `next_page`.
481516
482### Header Parameters
517### Headers
483518
484519- `"anthropic-beta": optional array of string`
485520
from line 534
499534
500535 If set, all rules referencing this issuer reject token exchange.
501536
537 format: date-time
538
502539 - `archived_by_actor_id: string or null`
503540
504541 Tagged ID (`user_`/`svac_`) of the actor that archived this issuer.
from line 548
511548
512549 When this issuer was created.
513550
551 format: date-time
552
514553 - `created_by_actor_id: string or null`
515554
516555 Tagged ID (`user_`/`svac_`) of the actor that created this issuer.
from line 558
519558
520559 The `iss` claim value. Incoming JWTs must match exactly.
521560
522 - `jwks: object { type, ca_cert_pem, discovery_base } or object { type, url, ca_cert_pem } or object { keys, type }`
561 - `jwks: object or object or object`
523562
524563 How signing keys are obtained for signature verification.
525564
526 - `Discovery object { type, ca_cert_pem, discovery_base }`
565 - `Discovery object`
527566
528567 JWKS via the issuer's OIDC discovery document.
529568
530569 - `type: "discovery"`
531570
532 - `"discovery"`
533
534571 - `ca_cert_pem: optional string or null`
535572
536573 Optional custom CA (PEM) for TLS verification of the JWKS fetch.
537574
575 maxLength: 8192
576
538577 - `discovery_base: optional string or null`
539578
540579 Set when the discovery URL differs from `issuer_url`.
541580
542 - `ExplicitURL object { type, url, ca_cert_pem }`
581 - `ExplicitURL object`
543582
544583 JWKS fetched from a fixed endpoint.
545584
546585 - `type: "explicit_url"`
547586
548 - `"explicit_url"`
549
550587 - `url: string`
551588
552589 JWKS endpoint.
553590
591 minLength: 1
592
554593 - `ca_cert_pem: optional string or null`
555594
556595 Optional custom CA (PEM) for TLS verification of the JWKS fetch.
557596
558 - `Inline object { keys, type }`
597 maxLength: 8192
559598
599 - `Inline object`
600
560601 JWKS supplied directly; no network fetch.
561602
562603 - `keys: array of map[unknown]`
from line 604
563604
564605 Inline JWK objects.
565606
607 minItems: 1
608
566609 - `type: "inline"`
567610
568 - `"inline"`
569
570611 - `jwks_polling_disabled_at: string or null`
571612
572613 If set, Anthropic's JWKS poller has paused polling for this issuer after repeated fetch failures. Re-enable by sending `jwks_polling_disabled: false` via the issuer update endpoint (POST) once the upstream JWKS endpoint is fixed. An OAuth caller cannot send this when the issuer backs a rule with any scope other than `workspace:developer` or `workspace:inference`; use a Console session.
573614
615 format: date-time
616
574617 - `max_jwt_lifetime_seconds: number`
575618
576619 Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected.
from line 622
579622
580623 Admin-chosen slug identifier.
581624
582 - `poll_status: object { consecutive_failures, last_fetched_at, next_poll_at } or null`
625 - `poll_status: object or null`
583626
584627 Status of automatic JWKS polling for a federation issuer.
585628
from line 638
595638
596639 When the last successful fetch completed.
597640
641 format: date-time
642
598643 - `next_poll_at: string or null`
599644
600645 When the next fetch is scheduled. Null if paused.
601646
647 format: date-time
648
602649 - `type: "federation_issuer"`
603650
604 - `"federation_issuer"`
651 default: federation_issuer
605652
606653 - `updated_at: string`
607654
608655 When this issuer was last updated.
609656
657 format: date-time
658
610659 - `updated_by_actor_id: string or null`
611660
612661 Tagged ID (`user_`/`svac_`) of the actor that last updated this issuer.
from line 666
617666
618667### Example
619668
620```http
669```bash
621670curl https://api.anthropic.com/v1/organizations/federation_issuers \
622671 -H 'anthropic-version: 2023-06-01' \
623672 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
624673```
625674
626#### Response
675#### Response (200)
627676
628677```json
629678{
from line 709
660709
661710## Update Federation Issuer
662711
663**post** `/v1/organizations/federation_issuers/{federation_issuer_id}`
712**POST** `/v1/organizations/federation_issuers/{federation_issuer_id}`
664713
665714Partially update a federation issuer.
666715
from line 721
672721session. Requires an OAuth bearer or Console session; Admin API keys
673722are not accepted.
674723
675### Path Parameters
724### Path parameters
676725
677726- `federation_issuer_id: string`
678727
679728 ID of the federation issuer to update.
680729
681### Header Parameters
730### Headers
682731
683732- `"anthropic-beta": optional array of string`
684733
from line 735
686735
687736 To use multiple betas, use a comma separated list like `beta1,beta2` or specify the header multiple times for each beta.
688737
689### Body Parameters
738### Body parameters
690739
691740- `check_jti: optional boolean or null`
692741
from line 745
696745
697746 Replaces the `iss` claim value to match against. For discovery-mode issuers without a `discovery_base`, this is also the URL Anthropic fetches the OIDC discovery document and signing keys from, so changing it repoints the JWKS source. Changing the issuer URL to a well-known shared platform is rejected while any live rule under this issuer would not constrain tenant identity.
698747
699- `jwks: optional object { type, ca_cert_pem, discovery_base } or object { type, url, ca_cert_pem } or object { keys, type } or null`
748 minLength: 1
700749
750- `jwks: optional object or object or object or null`
751
701752 Replaces the entire JWKS configuration.
702753
703 - `Discovery object { type, ca_cert_pem, discovery_base }`
754 - `Discovery object`
704755
705756 JWKS via the issuer's OIDC discovery document.
706757
707758 - `type: "discovery"`
708759
709 - `"discovery"`
710
711760 - `ca_cert_pem: optional string or null`
712761
713762 Optional custom CA (PEM) for TLS verification of the JWKS fetch.
714763
764 maxLength: 8192
765
715766 - `discovery_base: optional string or null`
716767
717768 Set when the discovery URL differs from `issuer_url`.
718769
719 - `ExplicitURL object { type, url, ca_cert_pem }`
770 - `ExplicitURL object`
720771
721772 JWKS fetched from a fixed endpoint.
722773
723774 - `type: "explicit_url"`
724775
725 - `"explicit_url"`
726
727776 - `url: string`
728777
729778 JWKS endpoint.
730779
780 minLength: 1
781
731782 - `ca_cert_pem: optional string or null`
732783
733784 Optional custom CA (PEM) for TLS verification of the JWKS fetch.
734785
735 - `Inline object { keys, type }`
786 maxLength: 8192
736787
788 - `Inline object`
789
737790 JWKS supplied directly; no network fetch.
738791
739792 - `keys: array of map[unknown]`
from line 793
740793
741794 Inline JWK objects.
742795
796 minItems: 1
797
743798 - `type: "inline"`
744799
745 - `"inline"`
746
747800- `jwks_polling_disabled: optional boolean or null`
748801
749802 Only `false` is accepted, to re-enable polling after the system pauses it. Polling is paused automatically; sending `true` is rejected.
from line 805
752805
753806 Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected.
754807
808 maximum: 176400, exclusiveMinimum: 0
809
755810- `name: optional string or null`
756811
757812 Replaces the slug identifier (lowercase, digits, hyphens). Unique within the organization; a duplicate name returns 409.
758813
814 maxLength: 255, minLength: 1
815
759816### Returns
760817
761- `FederationIssuer object { id, archived_at, archived_by_actor_id, 12 more }`
818- `FederationIssuer object`
762819
763820 Registered external OIDC identity provider.
764821
from line 830
773830
774831 If set, all rules referencing this issuer reject token exchange.
775832
833 format: date-time
834
776835 - `archived_by_actor_id: string or null`
777836
778837 Tagged ID (`user_`/`svac_`) of the actor that archived this issuer.
from line 844
785844
786845 When this issuer was created.
787846
847 format: date-time
848
788849 - `created_by_actor_id: string or null`
789850
790851 Tagged ID (`user_`/`svac_`) of the actor that created this issuer.
from line 854
793854
794855 The `iss` claim value. Incoming JWTs must match exactly.
795856
796 - `jwks: object { type, ca_cert_pem, discovery_base } or object { type, url, ca_cert_pem } or object { keys, type }`
857 - `jwks: object or object or object`
797858
798859 How signing keys are obtained for signature verification.
799860
800 - `Discovery object { type, ca_cert_pem, discovery_base }`
861 - `Discovery object`
801862
802863 JWKS via the issuer's OIDC discovery document.
803864
804865 - `type: "discovery"`
805866
806 - `"discovery"`
807
808867 - `ca_cert_pem: optional string or null`
809868
810869 Optional custom CA (PEM) for TLS verification of the JWKS fetch.
811870
871 maxLength: 8192
872
812873 - `discovery_base: optional string or null`
813874
814875 Set when the discovery URL differs from `issuer_url`.
815876
816 - `ExplicitURL object { type, url, ca_cert_pem }`
877 - `ExplicitURL object`
817878
818879 JWKS fetched from a fixed endpoint.
819880
820881 - `type: "explicit_url"`
821882
822 - `"explicit_url"`
823
824883 - `url: string`
825884
826885 JWKS endpoint.
827886
887 minLength: 1
888
828889 - `ca_cert_pem: optional string or null`
829890
830891 Optional custom CA (PEM) for TLS verification of the JWKS fetch.
831892
832 - `Inline object { keys, type }`
893 maxLength: 8192
833894
895 - `Inline object`
896
834897 JWKS supplied directly; no network fetch.
835898
836899 - `keys: array of map[unknown]`
from line 900
837900
838901 Inline JWK objects.
839902
903 minItems: 1
904
840905 - `type: "inline"`
841906
842 - `"inline"`
843
844907 - `jwks_polling_disabled_at: string or null`
845908
846909 If set, Anthropic's JWKS poller has paused polling for this issuer after repeated fetch failures. Re-enable by sending `jwks_polling_disabled: false` via the issuer update endpoint (POST) once the upstream JWKS endpoint is fixed. An OAuth caller cannot send this when the issuer backs a rule with any scope other than `workspace:developer` or `workspace:inference`; use a Console session.
847910
911 format: date-time
912
848913 - `max_jwt_lifetime_seconds: number`
849914
850915 Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected.
from line 918
853918
854919 Admin-chosen slug identifier.
855920
856 - `poll_status: object { consecutive_failures, last_fetched_at, next_poll_at } or null`
921 - `poll_status: object or null`
857922
858923 Status of automatic JWKS polling for a federation issuer.
859924
from line 934
869934
870935 When the last successful fetch completed.
871936
937 format: date-time
938
872939 - `next_poll_at: string or null`
873940
874941 When the next fetch is scheduled. Null if paused.
875942
943 format: date-time
944
876945 - `type: "federation_issuer"`
877946
878 - `"federation_issuer"`
947 default: federation_issuer
879948
880949 - `updated_at: string`
881950
882951 When this issuer was last updated.
883952
953 format: date-time
954
884955 - `updated_by_actor_id: string or null`
885956
886957 Tagged ID (`user_`/`svac_`) of the actor that last updated this issuer.
from line 958
887958
888959### Example
889960
890```http
961```bash
891962curl https://api.anthropic.com/v1/organizations/federation_issuers/$FEDERATION_ISSUER_ID \
892963 -H 'Content-Type: application/json' \
893964 -H 'anthropic-version: 2023-06-01' \
from line 966
895966 -d '{}'
896967```
897968
898#### Response
969#### Response (200)
899970
900971```json
901972{
from line 998
927998
928999## Archive Federation Issuer
9291000
930**post** `/v1/organizations/federation_issuers/{federation_issuer_id}/archive`
1001**POST** `/v1/organizations/federation_issuers/{federation_issuer_id}/archive`
9311002
9321003Archive a federation issuer.
9331004
from line 1010
9391010Requires an OAuth bearer or Console session; Admin API keys are not
9401011accepted.
9411012
942### Path Parameters
1013### Path parameters
9431014
9441015- `federation_issuer_id: string`
9451016
9461017 ID of the federation issuer to archive.
9471018
948### Header Parameters
1019### Headers
9491020
9501021- `"anthropic-beta": optional array of string`
9511022
from line 1026
9551026
9561027### Returns
9571028
958- `FederationIssuer object { id, archived_at, archived_by_actor_id, 12 more }`
1029- `FederationIssuer object`
9591030
9601031 Registered external OIDC identity provider.
9611032
from line 1041
9701041
9711042 If set, all rules referencing this issuer reject token exchange.
9721043
1044 format: date-time
1045
9731046 - `archived_by_actor_id: string or null`
9741047
9751048 Tagged ID (`user_`/`svac_`) of the actor that archived this issuer.
from line 1055
9821055
9831056 When this issuer was created.
9841057
1058 format: date-time
1059
9851060 - `created_by_actor_id: string or null`
9861061
9871062 Tagged ID (`user_`/`svac_`) of the actor that created this issuer.
from line 1065
9901065
9911066 The `iss` claim value. Incoming JWTs must match exactly.
9921067
993 - `jwks: object { type, ca_cert_pem, discovery_base } or object { type, url, ca_cert_pem } or object { keys, type }`
1068 - `jwks: object or object or object`
9941069
9951070 How signing keys are obtained for signature verification.
9961071
997 - `Discovery object { type, ca_cert_pem, discovery_base }`
1072 - `Discovery object`
9981073
9991074 JWKS via the issuer's OIDC discovery document.
10001075
10011076 - `type: "discovery"`
10021077
1003 - `"discovery"`
1004
10051078 - `ca_cert_pem: optional string or null`
10061079
10071080 Optional custom CA (PEM) for TLS verification of the JWKS fetch.
10081081
1082 maxLength: 8192
1083
10091084 - `discovery_base: optional string or null`
10101085
10111086 Set when the discovery URL differs from `issuer_url`.
10121087
1013 - `ExplicitURL object { type, url, ca_cert_pem }`
1088 - `ExplicitURL object`
10141089
10151090 JWKS fetched from a fixed endpoint.
10161091
10171092 - `type: "explicit_url"`
10181093
1019 - `"explicit_url"`
1020
10211094 - `url: string`
10221095
10231096 JWKS endpoint.
10241097
1098 minLength: 1
1099
10251100 - `ca_cert_pem: optional string or null`
10261101
10271102 Optional custom CA (PEM) for TLS verification of the JWKS fetch.
10281103
1029 - `Inline object { keys, type }`
1104 maxLength: 8192
10301105
1106 - `Inline object`
1107
10311108 JWKS supplied directly; no network fetch.
10321109
10331110 - `keys: array of map[unknown]`
from line 1111
10341111
10351112 Inline JWK objects.
10361113
1114 minItems: 1
1115
10371116 - `type: "inline"`
10381117
1039 - `"inline"`
1040
10411118 - `jwks_polling_disabled_at: string or null`
10421119
10431120 If set, Anthropic's JWKS poller has paused polling for this issuer after repeated fetch failures. Re-enable by sending `jwks_polling_disabled: false` via the issuer update endpoint (POST) once the upstream JWKS endpoint is fixed. An OAuth caller cannot send this when the issuer backs a rule with any scope other than `workspace:developer` or `workspace:inference`; use a Console session.
10441121
1122 format: date-time
1123
10451124 - `max_jwt_lifetime_seconds: number`
10461125
10471126 Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected.
from line 1129
10501129
10511130 Admin-chosen slug identifier.
10521131
1053 - `poll_status: object { consecutive_failures, last_fetched_at, next_poll_at } or null`
1132 - `poll_status: object or null`
10541133
10551134 Status of automatic JWKS polling for a federation issuer.
10561135
from line 1145
10661145
10671146 When the last successful fetch completed.
10681147
1148 format: date-time
1149
10691150 - `next_poll_at: string or null`
10701151
10711152 When the next fetch is scheduled. Null if paused.
10721153
1154 format: date-time
1155
10731156 - `type: "federation_issuer"`
10741157
1075 - `"federation_issuer"`
1158 default: federation_issuer
10761159
10771160 - `updated_at: string`
10781161
10791162 When this issuer was last updated.
10801163
1164 format: date-time
1165
10811166 - `updated_by_actor_id: string or null`
10821167
10831168 Tagged ID (`user_`/`svac_`) of the actor that last updated this issuer.
from line 1169
10841169
10851170### Example
10861171
1087```http
1172```bash
10881173curl https://api.anthropic.com/v1/organizations/federation_issuers/$FEDERATION_ISSUER_ID/archive \
10891174 -X POST \
10901175 -H 'anthropic-version: 2023-06-01' \
from line 1176
10911176 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
10921177```
10931178
1094#### Response
1179#### Response (200)
10951180
10961181```json
10971182{
from line 1206
11211206}
11221207```
11231208
1124## Domain Types
1209## Domain types
11251210
11261211### Federation Issuer
11271212
1128- `FederationIssuer object { id, archived_at, archived_by_actor_id, 12 more }`
1213- `FederationIssuer object`
11291214
11301215 Registered external OIDC identity provider.
11311216
from line 1225
11401225
11411226 If set, all rules referencing this issuer reject token exchange.
11421227
1228 format: date-time
1229
11431230 - `archived_by_actor_id: string or null`
11441231
11451232 Tagged ID (`user_`/`svac_`) of the actor that archived this issuer.
from line 1239
11521239
11531240 When this issuer was created.
11541241
1242 format: date-time
1243
11551244 - `created_by_actor_id: string or null`
11561245
11571246 Tagged ID (`user_`/`svac_`) of the actor that created this issuer.
from line 1249
11601249
11611250 The `iss` claim value. Incoming JWTs must match exactly.
11621251
1163 - `jwks: object { type, ca_cert_pem, discovery_base } or object { type, url, ca_cert_pem } or object { keys, type }`
1252 - `jwks: object or object or object`
11641253
11651254 How signing keys are obtained for signature verification.
11661255
1167 - `Discovery object { type, ca_cert_pem, discovery_base }`
1256 - `Discovery object`
11681257
11691258 JWKS via the issuer's OIDC discovery document.
11701259
11711260 - `type: "discovery"`
11721261
1173 - `"discovery"`
1174
11751262 - `ca_cert_pem: optional string or null`
11761263
11771264 Optional custom CA (PEM) for TLS verification of the JWKS fetch.
11781265
1266 maxLength: 8192
1267
11791268 - `discovery_base: optional string or null`
11801269
11811270 Set when the discovery URL differs from `issuer_url`.
11821271
1183 - `ExplicitURL object { type, url, ca_cert_pem }`
1272 - `ExplicitURL object`
11841273
11851274 JWKS fetched from a fixed endpoint.
11861275
11871276 - `type: "explicit_url"`
11881277
1189 - `"explicit_url"`
1190
11911278 - `url: string`
11921279
11931280 JWKS endpoint.
11941281
1282 minLength: 1
1283
11951284 - `ca_cert_pem: optional string or null`
11961285
11971286 Optional custom CA (PEM) for TLS verification of the JWKS fetch.
11981287
1199 - `Inline object { keys, type }`
1288 maxLength: 8192
12001289
1290 - `Inline object`
1291
12011292 JWKS supplied directly; no network fetch.
12021293
12031294 - `keys: array of map[unknown]`
from line 1295
12041295
12051296 Inline JWK objects.
12061297
1298 minItems: 1
1299
12071300 - `type: "inline"`
12081301
1209 - `"inline"`
1210
12111302 - `jwks_polling_disabled_at: string or null`
12121303
12131304 If set, Anthropic's JWKS poller has paused polling for this issuer after repeated fetch failures. Re-enable by sending `jwks_polling_disabled: false` via the issuer update endpoint (POST) once the upstream JWKS endpoint is fixed. An OAuth caller cannot send this when the issuer backs a rule with any scope other than `workspace:developer` or `workspace:inference`; use a Console session.
12141305
1306 format: date-time
1307
12151308 - `max_jwt_lifetime_seconds: number`
12161309
12171310 Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected.
from line 1313
12201313
12211314 Admin-chosen slug identifier.
12221315
1223 - `poll_status: object { consecutive_failures, last_fetched_at, next_poll_at } or null`
1316 - `poll_status: object or null`
12241317
12251318 Status of automatic JWKS polling for a federation issuer.
12261319
from line 1329
12361329
12371330 When the last successful fetch completed.
12381331
1332 format: date-time
1333
12391334 - `next_poll_at: string or null`
12401335
12411336 When the next fetch is scheduled. Null if paused.
12421337
1338 format: date-time
1339
12431340 - `type: "federation_issuer"`
12441341
1245 - `"federation_issuer"`
1342 default: federation_issuer
12461343
12471344 - `updated_at: string`
12481345
12491346 When this issuer was last updated.
1347
1348 format: date-time
12501349
12511350 - `updated_by_actor_id: string or null`
12521351
No line in this hunk matches that.