Create Federation Issuer changedapi/admin/federation_issuers/create
Nearest release: v2.1.245, published an hour after this site recorded the change. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Recorded here
Lines+56added
Lines−39removed
From line
1
where the diff opens
First seen
14 Aug 2026
this site's first read of the page
Recorded edits4to this page, all time
# Create Federation Issuer ## Headers ## Body parameters ## Returns ## Example ### Response (200) ## Create Federation Issuer ### Header Parameters ### Body Parameters ### Returns ### Example #### Response
The whole hunk
from line 1, old and new numbered
/
from line 1
1---
2title: Create Federation Issuer
3url: https://platform.claude.com/docs/en/api/admin/federation_issuers/create
4---
1# Create Federation Issuer
52
6## Create Federation Issuer
3**POST** `/v1/organizations/federation_issuers`
74
8**post** `/v1/organizations/federation_issuers`
9
105Register an OIDC issuer that Anthropic will trust for workload identity
116federation in your organization.
127
from line 17
2217Requires an OAuth bearer or Console session; Admin API keys are not
2318accepted.
2419
25### Header Parameters
20## Headers
2621
2722- `"anthropic-beta": optional array of string`
2823
from line 25
3025
3126 To use multiple betas, use a comma separated list like `beta1,beta2` or specify the header multiple times for each beta.
3227
33### Body Parameters
28## Body parameters
3429
3530- `issuer_url: string`
3631
3732 The `iss` claim value to match against.
3833
34 minLength: 1
35
3936- `name: string`
4037
4138 Slug identifier (lowercase, digits, hyphens). Unique within the organization; a duplicate name returns 409.
4239
40 maxLength: 255, minLength: 1
41
4342- `check_jti: optional boolean or null`
4443
4544 Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Defaults to true. Applies only to assertions carrying a `jti` claim; tokens without one are accepted without single-use enforcement.
4645
47- `jwks: optional object { type, ca_cert_pem, discovery_base } or object { type, url, ca_cert_pem } or object { keys, type }`
46- `jwks: optional object or object or object`
4847
4948 How signing keys are obtained. Defaults to OIDC discovery.
5049
51 - `Discovery object { type, ca_cert_pem, discovery_base }`
50 - `Discovery object`
5251
5352 JWKS via the issuer's OIDC discovery document.
5453
5554 - `type: "discovery"`
5655
57 - `"discovery"`
58
5956 - `ca_cert_pem: optional string or null`
6057
6158 Optional custom CA (PEM) for TLS verification of the JWKS fetch.
6259
60 maxLength: 8192
61
6362 - `discovery_base: optional string or null`
6463
6564 Set when the discovery URL differs from `issuer_url`.
6665
67 - `ExplicitURL object { type, url, ca_cert_pem }`
66 - `ExplicitURL object`
6867
6968 JWKS fetched from a fixed endpoint.
7069
7170 - `type: "explicit_url"`
7271
73 - `"explicit_url"`
74
7572 - `url: string`
7673
7774 JWKS endpoint.
7875
76 minLength: 1
77
7978 - `ca_cert_pem: optional string or null`
8079
8180 Optional custom CA (PEM) for TLS verification of the JWKS fetch.
8281
83 - `Inline object { keys, type }`
82 maxLength: 8192
8483
84 - `Inline object`
85
8586 JWKS supplied directly; no network fetch.
8687
8788 - `keys: array of map[unknown]`
from line 89
8889
8990 Inline JWK objects.
9091
92 minItems: 1
93
9194 - `type: "inline"`
9295
93 - `"inline"`
94
9596- `max_jwt_lifetime_seconds: optional number or null`
9697
9798 Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Defaults to 3600 (1h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected.
9899
99### Returns
100 maximum: 176400, exclusiveMinimum: 0
100101
101- `FederationIssuer object { id, archived_at, archived_by_actor_id, 12 more }`
102## Returns
102103
104- `FederationIssuer object`
105
103106 Registered external OIDC identity provider.
104107
105108 Records an external IdP the organization trusts for the RFC 7523
from line 116
113116
114117 If set, all rules referencing this issuer reject token exchange.
115118
119 format: date-time
120
116121 - `archived_by_actor_id: string or null`
117122
118123 Tagged ID (`user_`/`svac_`) of the actor that archived this issuer.
from line 130
125130
126131 When this issuer was created.
127132
133 format: date-time
134
128135 - `created_by_actor_id: string or null`
129136
130137 Tagged ID (`user_`/`svac_`) of the actor that created this issuer.
from line 140
133140
134141 The `iss` claim value. Incoming JWTs must match exactly.
135142
136 - `jwks: object { type, ca_cert_pem, discovery_base } or object { type, url, ca_cert_pem } or object { keys, type }`
143 - `jwks: object or object or object`
137144
138145 How signing keys are obtained for signature verification.
139146
140 - `Discovery object { type, ca_cert_pem, discovery_base }`
147 - `Discovery object`
141148
142149 JWKS via the issuer's OIDC discovery document.
143150
144151 - `type: "discovery"`
145152
146 - `"discovery"`
147
148153 - `ca_cert_pem: optional string or null`
149154
150155 Optional custom CA (PEM) for TLS verification of the JWKS fetch.
151156
157 maxLength: 8192
158
152159 - `discovery_base: optional string or null`
153160
154161 Set when the discovery URL differs from `issuer_url`.
155162
156 - `ExplicitURL object { type, url, ca_cert_pem }`
163 - `ExplicitURL object`
157164
158165 JWKS fetched from a fixed endpoint.
159166
160167 - `type: "explicit_url"`
161168
162 - `"explicit_url"`
163
164169 - `url: string`
165170
166171 JWKS endpoint.
167172
173 minLength: 1
174
168175 - `ca_cert_pem: optional string or null`
169176
170177 Optional custom CA (PEM) for TLS verification of the JWKS fetch.
171178
172 - `Inline object { keys, type }`
179 maxLength: 8192
173180
181 - `Inline object`
182
174183 JWKS supplied directly; no network fetch.
175184
176185 - `keys: array of map[unknown]`
from line 186
177186
178187 Inline JWK objects.
179188
189 minItems: 1
190
180191 - `type: "inline"`
181192
182 - `"inline"`
183
184193 - `jwks_polling_disabled_at: string or null`
185194
186195 If set, Anthropic's JWKS poller has paused polling for this issuer after repeated fetch failures. Re-enable by sending `jwks_polling_disabled: false` via the issuer update endpoint (POST) once the upstream JWKS endpoint is fixed. An OAuth caller cannot send this when the issuer backs a rule with any scope other than `workspace:developer` or `workspace:inference`; use a Console session.
187196
197 format: date-time
198
188199 - `max_jwt_lifetime_seconds: number`
189200
190201 Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected.
from line 204
193204
194205 Admin-chosen slug identifier.
195206
196 - `poll_status: object { consecutive_failures, last_fetched_at, next_poll_at } or null`
207 - `poll_status: object or null`
197208
198209 Status of automatic JWKS polling for a federation issuer.
199210
from line 220
209220
210221 When the last successful fetch completed.
211222
223 format: date-time
224
212225 - `next_poll_at: string or null`
213226
214227 When the next fetch is scheduled. Null if paused.
215228
229 format: date-time
230
216231 - `type: "federation_issuer"`
217232
218 - `"federation_issuer"`
233 default: federation_issuer
219234
220235 - `updated_at: string`
221236
222237 When this issuer was last updated.
223238
239 format: date-time
240
224241 - `updated_by_actor_id: string or null`
225242
226243 Tagged ID (`user_`/`svac_`) of the actor that last updated this issuer.
227244
228### Example
245## Example
229246
230```http
247```bash
231248curl https://api.anthropic.com/v1/organizations/federation_issuers \
232249 -H 'Content-Type: application/json' \
233250 -H 'anthropic-version: 2023-06-01' \
from line 255
238255 }'
239256```
240257
241#### Response
258### Response (200)
242259
243260```json
244261{
No line in this hunk matches that.