---
title: "List trusted token issuers"
method: GET
path: "/v2/trusted_token_issuers"
tags: ["Trusted Token Issuers"]
---

# List trusted token issuers

`GET /v2/trusted_token_issuers`

Lists the customer's trusted token issuer registrations.

## Query parameters

- `limit` integer
- `page_key` string

## Headers

- `Request-Timeout` integer
- `Request-Timeout-Millis` integer

## Response `200`

The customer's trusted token issuers. Empty when none are registered.

- ListTrustedTokenIssuersResponse — Response containing a list of trusted token issuers.
  - `trusted_token_issuers` TrustedTokenIssuer[], required — List of trusted token issuers.
    - `id` string, required — The unique identifier of a trusted token issuer.
    - `name` string, required — The human-readable name of the trusted issuer.
    - `description` string — A detailed description of what this trust registration is for.
    - `issuer` string, required — The issuer URL exactly as it appears in the `iss` claim of the identity provider's tokens. Immutable after creation. A customer may register an issuer once; a duplicate registration returns `409`.
    - `jwks_uri` string, required — The HTTPS URL of the issuer's JSON Web Key Set. The platform fetches it server-side and refreshes it periodically, so new signing keys become effective on the next refresh. A token signed with a key the platform has not yet seen triggers one immediate refresh. When a refresh fails, previously fetched keys remain in use until a refresh succeeds.
    - `enabled` boolean, required — Whether the registration currently accepts tokens. Disabling refuses every future sign-in immediately.
    - `last_jwks_fetch_at` string, date-time — Timestamp of the most recent successful fetch of the issuer's JWKS. Absent until the first successful fetch.
    - `jwks_key_count` integer — The number of signing keys in the most recent successful JWKS fetch.
    - `jwks_fetch_error` string — The most recent JWKS fetch error, absent while fetching is healthy.
    - `created_at` string, date-time, required — Timestamp when the registration was created.
    - `updated_at` string, date-time — Timestamp when the registration was last updated.
  - `metadata` ListMetadata, required — The standard metadata in the response of a list operation.
    - `page_key` string — The page key for the next page of results. Pass it as a query parameter to request the next page.

## Other responses

- `403` — Permissions do not allow listing trusted token issuers.

## Changes

- **2026-08-27** `0d51a9e3a0b3` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/vectara/apis/vectara-rest-api-v2/changes/v2/trusted_token_issuers/get.md)

---

[API](https://skmtc.dev/vectara/apis/vectara-rest-api-v2.md) · [All operations](https://skmtc.dev/vectara/apis/vectara-rest-api-v2/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/vectara/vectara-rest-api-v2/revisions/05ae305c8d84/schema)