ANanthropics

Create Federation Issuer

Changed on

Requires an OAuth access token with the org:admin scope, from ant auth login --scope org:admin or a workload identity federation rule; Admin API keys are not accepted. See Manage WIF with the Admin API.

Register an OIDC issuer that Anthropic will trust for workload identity federation in your organization.

The jwks field controls how the issuer's signing keys are obtained and takes one of three shapes selected by type: discovery (resolve keys through OIDC discovery), explicit_url (fetch keys from a fixed JWKS URL), or inline (provide a static key set). When jwks.type is discovery and no discovery_base is set, the issuer URL must be publicly reachable over HTTPS so Anthropic can fetch the discovery document; for explicit_url and inline modes the issuer URL is only matched as the JWT's iss claim and is not fetched.

post/v1/organizations/federation_issuers?beta=true

Request

Headers

anthropic-versionstring

The version of the Claude API you want to use.

Read more about versioning and our version history here.

Request body

check_jtiboolean nullable

Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Defaults to true. Applies only to assertions carrying a jti claim; tokens without one are accepted without single-use enforcement.

issuer_urlstring required

The iss claim value to match against.

max_jwt_lifetime_secondsinteger nullable

Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Defaults to 3600 (1h). Assertions must carry both iat and exp; a missing iat is rejected.

namestring required

Slug identifier (lowercase, digits, hyphens). Unique within the organization; a duplicate name returns 409.

Response

Successful Response

archived_atstring date-time nullable required

If set, all rules referencing this issuer reject token exchange.

archived_by_actor_idstring nullable required

Tagged ID (user_/svac_) of the actor that archived this issuer.

check_jtiboolean required

Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Applies only to assertions carrying a jti claim; tokens without one are accepted without single-use enforcement.

created_atstring date-time required

When this issuer was created.

created_by_actor_idstring nullable required

Tagged ID (user_/svac_) of the actor that created this issuer.

idstring required

Tagged ID of the federation issuer.

issuer_urlstring required

The iss claim value. Incoming JWTs must match exactly.

jwks_polling_disabled_atstring date-time nullable required

If set, Anthropic's JWKS poller has paused polling for this issuer after repeated fetch failures. Re-enable by sending jwks_polling_disabled: false via the issuer update endpoint (POST) once the upstream JWKS endpoint is fixed. An OAuth caller cannot send this when the issuer backs a rule with any scope other than workspace:developer or workspace:inference; use a Console session.

max_jwt_lifetime_secondsinteger required

Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both iat and exp; a missing iat is rejected.

namestring required

Admin-chosen slug identifier.

type'federation_issuer' required
updated_atstring date-time required

When this issuer was last updated.

updated_by_actor_idstring nullable required

Tagged ID (user_/svac_) of the actor that last updated this issuer.

Example response

{
  "created_at": "2024-10-30T23:58:27.427722Z",
  "id": "fdis_01SDCCSbTxrXDpWc1phhtcfK",
  "issuer_url": "https://token.actions.githubusercontent.com",
  "name": "github-actions",
  "updated_at": "2024-10-30T23:58:27.427722Z"
}

Changes

  • 7ee042695927Revision changes
    • breaking

      the response's property type changed from no type to object for status

    • info

      added the optional property / to the response with the status

    • info

      removed discriminator from response property for the response status

    • info

      removed from the response property oneOf list for the response status

    • info

      added the required property / to the response with the status

    • info

      added the required property / to the response with the status

  • 037a593978dcRevision changes
    • info

      added the enum value admin-user-sign-out-2026-10-08 to the property items/anyOf[subschema #2]/ of the header request parameter anthropic-beta