---
title: "Add a trusted issuer"
method: POST
path: "/v1/trusted-issuers"
tags: ["Trust Registry"]
---

# Add a trusted issuer

`POST /v1/trusted-issuers`

Register an issuer this tenant will trust when verifying credentials. After registration, credentials whose `iss` matches an active trusted issuer pass the verification trust gate. The new entry is always created with status `active` and `added_by` set to the calling API principal. Scoped to the caller's tenant via the API key.

## Request body

- object
  - `name` string, required — Display name for the trusted issuer.
  - `iss` string, required — The HTTPS `iss` identifier of the issuer to trust. Must be unique within the tenant.
  - `trust_anchor` 'https-jwks' | 'did-web' | 'x509' — How the issuer's signing key is anchored. Defaults to `https-jwks` when omitted.
  - `jwks_uri` string — JWKS endpoint used to fetch the issuer's public keys. Provide when `trust_anchor` is `https-jwks`.
  - `did` string — Decentralized identifier of the issuer. Provide when `trust_anchor` is `did-web`.
  - `framework` string — Trust framework slug (from GET /v1/trust-frameworks) to associate with this issuer (e.g. eidas2). Resolved to a framework if it exists; ignored if no match is found.

## Response `200`

No response body

## Other responses

- `201` — The trusted issuer was registered. Returns the full trusted issuer object.

## Changes

- **2026-06-30** `1ee4908e9af4` — 1 breaking
  - request body became required

[Change history](https://skmtc.dev/didit-protocol/apis/didit-credentials-api/changes/v1/trusted-issuers/post.md)

---

[API](https://skmtc.dev/didit-protocol/apis/didit-credentials-api.md) · [All operations](https://skmtc.dev/didit-protocol/apis/didit-credentials-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/didit-protocol/didit-credentials-api/revisions/2eeb13158ffa/schema)