ANanthropics

Update Federation Issuer

Changed on

Requires an OAuth access token with the org:admin scope, from ant auth login --scope org:admin or a workload identity federation rule; Admin API keys are not accepted. See Manage WIF with the Admin API.

Partially update a federation issuer.

Setting jwks replaces the full JWKS shape at once. Archived issuers cannot be updated; this returns 400. Create a new issuer instead.

Updating an issuer that backs a rule with a scope outside workspace:developer or workspace:inference requires a Console session.

post/v1/organizations/federation_issuers/{federation_issuer_id}

Request

  • Base URL
    https://api.anthropic.com
  • Auth
    none declared

Path parameters

federation_issuer_idstring required

ID of the federation issuer to update.

Headers

anthropic-versionstring

The version of the Claude API you want to use.

Read more about versioning and our version history here.

Request body

check_jtiboolean nullable

Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Applies only to assertions carrying a jti claim; tokens without one are accepted without single-use enforcement.

issuer_urlstring nullable

Replaces the iss claim value to match against. For discovery-mode issuers without a discovery_base, this is also the URL Anthropic fetches the OIDC discovery document and signing keys from, so changing it repoints the JWKS source. Changing the issuer URL to a well-known shared platform is rejected while any live rule under this issuer would not constrain tenant identity.

jwks_polling_disabledboolean nullable

Only false is accepted, to re-enable polling after the system pauses it. Polling is paused automatically; sending true is rejected.

max_jwt_lifetime_secondsinteger nullable

Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both iat and exp; a missing iat is rejected.

namestring nullable

Replaces the slug identifier (lowercase, digits, hyphens). Unique within the organization; a duplicate name returns 409.

Response

Successful Response

archived_atstring date-time nullable required

If set, all rules referencing this issuer reject token exchange.

archived_by_actor_idstring nullable required

Tagged ID (user_/svac_) of the actor that archived this issuer.

check_jtiboolean required

Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Applies only to assertions carrying a jti claim; tokens without one are accepted without single-use enforcement.

created_atstring date-time required

When this issuer was created.

created_by_actor_idstring nullable required

Tagged ID (user_/svac_) of the actor that created this issuer.

idstring required

Tagged ID of the federation issuer.

issuer_urlstring required

The iss claim value. Incoming JWTs must match exactly.

jwks_polling_disabled_atstring date-time nullable required

If set, Anthropic's JWKS poller has paused polling for this issuer after repeated fetch failures. Re-enable by sending jwks_polling_disabled: false via the issuer update endpoint (POST) once the upstream JWKS endpoint is fixed. An OAuth caller cannot send this when the issuer backs a rule with any scope other than workspace:developer or workspace:inference; use a Console session.

max_jwt_lifetime_secondsinteger required

Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both iat and exp; a missing iat is rejected.

namestring required

Admin-chosen slug identifier.

type'federation_issuer' required
updated_atstring date-time required

When this issuer was last updated.

updated_by_actor_idstring nullable required

Tagged ID (user_/svac_) of the actor that last updated this issuer.

Example response

{
  "created_at": "2024-10-30T23:58:27.427722Z",
  "id": "fdis_01SDCCSbTxrXDpWc1phhtcfK",
  "issuer_url": "https://token.actions.githubusercontent.com",
  "name": "github-actions",
  "updated_at": "2024-10-30T23:58:27.427722Z"
}

Changes