Update Federation Issuer changedapi/admin/federation_issuers/update
Nearest release: v2.1.245, published an hour after this site recorded the change. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Recorded here
Lines+57added
Lines−40removed
From line
1
where the diff opens
First seen
14 Aug 2026
this site's first read of the page
Recorded edits4to this page, all time
# Update Federation Issuer ## Path parameters ## Headers ## Body parameters ## Returns ## Example ### Response (200) ## Update Federation Issuer ### Path Parameters ### Header Parameters ### Body Parameters ### Returns ### Example #### Response
The whole hunk
from line 1, old and new numbered
/
from line 1
1---
2title: Update Federation Issuer
3url: https://platform.claude.com/docs/en/api/admin/federation_issuers/update
4---
1# Update Federation Issuer
52
6## Update Federation Issuer
3**POST** `/v1/organizations/federation_issuers/{federation_issuer_id}`
74
8**post** `/v1/organizations/federation_issuers/{federation_issuer_id}`
9
105Partially update a federation issuer.
116
127Setting `jwks` replaces the full JWKS shape at once. Archived issuers
from line 12
1712session. Requires an OAuth bearer or Console session; Admin API keys
1813are not accepted.
1914
20### Path Parameters
15## Path parameters
2116
2217- `federation_issuer_id: string`
2318
2419 ID of the federation issuer to update.
2520
26### Header Parameters
21## Headers
2722
2823- `"anthropic-beta": optional array of string`
2924
from line 26
3126
3227 To use multiple betas, use a comma separated list like `beta1,beta2` or specify the header multiple times for each beta.
3328
34### Body Parameters
29## Body parameters
3530
3631- `check_jti: optional boolean or null`
3732
from line 36
4136
4237 Replaces the `iss` claim value to match against. For discovery-mode issuers without a `discovery_base`, this is also the URL Anthropic fetches the OIDC discovery document and signing keys from, so changing it repoints the JWKS source. Changing the issuer URL to a well-known shared platform is rejected while any live rule under this issuer would not constrain tenant identity.
4338
44- `jwks: optional object { type, ca_cert_pem, discovery_base } or object { type, url, ca_cert_pem } or object { keys, type } or null`
39 minLength: 1
4540
41- `jwks: optional object or object or object or null`
42
4643 Replaces the entire JWKS configuration.
4744
48 - `Discovery object { type, ca_cert_pem, discovery_base }`
45 - `Discovery object`
4946
5047 JWKS via the issuer's OIDC discovery document.
5148
5249 - `type: "discovery"`
5350
54 - `"discovery"`
55
5651 - `ca_cert_pem: optional string or null`
5752
5853 Optional custom CA (PEM) for TLS verification of the JWKS fetch.
5954
55 maxLength: 8192
56
6057 - `discovery_base: optional string or null`
6158
6259 Set when the discovery URL differs from `issuer_url`.
6360
64 - `ExplicitURL object { type, url, ca_cert_pem }`
61 - `ExplicitURL object`
6562
6663 JWKS fetched from a fixed endpoint.
6764
6865 - `type: "explicit_url"`
6966
70 - `"explicit_url"`
71
7267 - `url: string`
7368
7469 JWKS endpoint.
7570
71 minLength: 1
72
7673 - `ca_cert_pem: optional string or null`
7774
7875 Optional custom CA (PEM) for TLS verification of the JWKS fetch.
7976
80 - `Inline object { keys, type }`
77 maxLength: 8192
8178
79 - `Inline object`
80
8281 JWKS supplied directly; no network fetch.
8382
8483 - `keys: array of map[unknown]`
from line 84
8584
8685 Inline JWK objects.
8786
87 minItems: 1
88
8889 - `type: "inline"`
8990
90 - `"inline"`
91
9291- `jwks_polling_disabled: optional boolean or null`
9392
9493 Only `false` is accepted, to re-enable polling after the system pauses it. Polling is paused automatically; sending `true` is rejected.
from line 96
9796
9897 Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected.
9998
99 maximum: 176400, exclusiveMinimum: 0
100
100101- `name: optional string or null`
101102
102103 Replaces the slug identifier (lowercase, digits, hyphens). Unique within the organization; a duplicate name returns 409.
103104
104### Returns
105 maxLength: 255, minLength: 1
105106
106- `FederationIssuer object { id, archived_at, archived_by_actor_id, 12 more }`
107## Returns
107108
109- `FederationIssuer object`
110
108111 Registered external OIDC identity provider.
109112
110113 Records an external IdP the organization trusts for the RFC 7523
from line 121
118121
119122 If set, all rules referencing this issuer reject token exchange.
120123
124 format: date-time
125
121126 - `archived_by_actor_id: string or null`
122127
123128 Tagged ID (`user_`/`svac_`) of the actor that archived this issuer.
from line 135
130135
131136 When this issuer was created.
132137
138 format: date-time
139
133140 - `created_by_actor_id: string or null`
134141
135142 Tagged ID (`user_`/`svac_`) of the actor that created this issuer.
from line 145
138145
139146 The `iss` claim value. Incoming JWTs must match exactly.
140147
141 - `jwks: object { type, ca_cert_pem, discovery_base } or object { type, url, ca_cert_pem } or object { keys, type }`
148 - `jwks: object or object or object`
142149
143150 How signing keys are obtained for signature verification.
144151
145 - `Discovery object { type, ca_cert_pem, discovery_base }`
152 - `Discovery object`
146153
147154 JWKS via the issuer's OIDC discovery document.
148155
149156 - `type: "discovery"`
150157
151 - `"discovery"`
152
153158 - `ca_cert_pem: optional string or null`
154159
155160 Optional custom CA (PEM) for TLS verification of the JWKS fetch.
156161
162 maxLength: 8192
163
157164 - `discovery_base: optional string or null`
158165
159166 Set when the discovery URL differs from `issuer_url`.
160167
161 - `ExplicitURL object { type, url, ca_cert_pem }`
168 - `ExplicitURL object`
162169
163170 JWKS fetched from a fixed endpoint.
164171
165172 - `type: "explicit_url"`
166173
167 - `"explicit_url"`
168
169174 - `url: string`
170175
171176 JWKS endpoint.
172177
178 minLength: 1
179
173180 - `ca_cert_pem: optional string or null`
174181
175182 Optional custom CA (PEM) for TLS verification of the JWKS fetch.
176183
177 - `Inline object { keys, type }`
184 maxLength: 8192
178185
186 - `Inline object`
187
179188 JWKS supplied directly; no network fetch.
180189
181190 - `keys: array of map[unknown]`
from line 191
182191
183192 Inline JWK objects.
184193
194 minItems: 1
195
185196 - `type: "inline"`
186197
187 - `"inline"`
188
189198 - `jwks_polling_disabled_at: string or null`
190199
191200 If set, Anthropic's JWKS poller has paused polling for this issuer after repeated fetch failures. Re-enable by sending `jwks_polling_disabled: false` via the issuer update endpoint (POST) once the upstream JWKS endpoint is fixed. An OAuth caller cannot send this when the issuer backs a rule with any scope other than `workspace:developer` or `workspace:inference`; use a Console session.
192201
202 format: date-time
203
193204 - `max_jwt_lifetime_seconds: number`
194205
195206 Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected.
from line 209
198209
199210 Admin-chosen slug identifier.
200211
201 - `poll_status: object { consecutive_failures, last_fetched_at, next_poll_at } or null`
212 - `poll_status: object or null`
202213
203214 Status of automatic JWKS polling for a federation issuer.
204215
from line 225
214225
215226 When the last successful fetch completed.
216227
228 format: date-time
229
217230 - `next_poll_at: string or null`
218231
219232 When the next fetch is scheduled. Null if paused.
220233
234 format: date-time
235
221236 - `type: "federation_issuer"`
222237
223 - `"federation_issuer"`
238 default: federation_issuer
224239
225240 - `updated_at: string`
226241
227242 When this issuer was last updated.
228243
244 format: date-time
245
229246 - `updated_by_actor_id: string or null`
230247
231248 Tagged ID (`user_`/`svac_`) of the actor that last updated this issuer.
232249
233### Example
250## Example
234251
235```http
252```bash
236253curl https://api.anthropic.com/v1/organizations/federation_issuers/$FEDERATION_ISSUER_ID \
237254 -H 'Content-Type: application/json' \
238255 -H 'anthropic-version: 2023-06-01' \
from line 257
240257 -d '{}'
241258```
242259
243#### Response
260### Response (200)
244261
245262```json
246263{
No line in this hunk matches that.