--- title: Issuers url: https://platform.claude.com/docs/en/api/java/beta/organization/federation/issuers --- # Issuers ## Create Federation Issuer `BetaFederationIssuer beta().organization().federation().issuers().create(params, requestOptions = RequestOptions.none())` **POST** `/v1/organizations/federation_issuers` **Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=java). Register an OIDC issuer that Anthropic will trust for workload identity federation in your organization. The `jwks` field controls how the issuer's signing keys are obtained and takes one of three shapes selected by `type`: `discovery` (resolve keys through OIDC discovery), `explicit_url` (fetch keys from a fixed JWKS URL), or `inline` (provide a static key set). When `jwks.type` is `discovery` and no `discovery_base` is set, the issuer URL must be publicly reachable over HTTPS so Anthropic can fetch the discovery document; for `explicit_url` and `inline` modes the issuer URL is only matched as the JWT's `iss` claim and is not fetched. ### Parameters - `IssuerCreateParams params` - `Optional> betas` (header parameter) Optional header to specify the beta version(s) you want to use. - `MESSAGE_BATCHES_2024_09_24("message-batches-2024-09-24")` - `PROMPT_CACHING_2024_07_31("prompt-caching-2024-07-31")` - `COMPUTER_USE_2024_10_22("computer-use-2024-10-22")` - `COMPUTER_USE_2025_01_24("computer-use-2025-01-24")` - `PDFS_2024_09_25("pdfs-2024-09-25")` - `TOKEN_COUNTING_2024_11_01("token-counting-2024-11-01")` - `TOKEN_EFFICIENT_TOOLS_2025_02_19("token-efficient-tools-2025-02-19")` - `OUTPUT_128K_2025_02_19("output-128k-2025-02-19")` - `FILES_API_2025_04_14("files-api-2025-04-14")` - `MCP_CLIENT_2025_04_04("mcp-client-2025-04-04")` - `MCP_CLIENT_2025_11_20("mcp-client-2025-11-20")` - `DEV_FULL_THINKING_2025_05_14("dev-full-thinking-2025-05-14")` - `INTERLEAVED_THINKING_2025_05_14("interleaved-thinking-2025-05-14")` - `CODE_EXECUTION_2025_05_22("code-execution-2025-05-22")` - `EXTENDED_CACHE_TTL_2025_04_11("extended-cache-ttl-2025-04-11")` - `CONTEXT_1M_2025_08_07("context-1m-2025-08-07")` - `CONTEXT_MANAGEMENT_2025_06_27("context-management-2025-06-27")` - `MODEL_CONTEXT_WINDOW_EXCEEDED_2025_08_26("model-context-window-exceeded-2025-08-26")` - `SKILLS_2025_10_02("skills-2025-10-02")` - `FAST_MODE_2026_02_01("fast-mode-2026-02-01")` - `OUTPUT_300K_2026_03_24("output-300k-2026-03-24")` - `USER_PROFILES_2026_03_24("user-profiles-2026-03-24")` - `USER_PROFILES_2026_08_18("user-profiles-2026-08-18")` - `USER_PROFILES_2026_09_04("user-profiles-2026-09-04")` - `ADVISOR_TOOL_2026_03_01("advisor-tool-2026-03-01")` - `MANAGED_AGENTS_2026_04_01("managed-agents-2026-04-01")` - `CACHE_DIAGNOSIS_2026_04_07("cache-diagnosis-2026-04-07")` - `DREAMING_2026_04_21("dreaming-2026-04-21")` - `THINKING_TOKEN_COUNT_2026_05_13("thinking-token-count-2026-05-13")` - `SERVER_SIDE_FALLBACK_2026_06_01("server-side-fallback-2026-06-01")` - `SERVER_SIDE_FALLBACK_2026_07_01("server-side-fallback-2026-07-01")` - `FALLBACK_CREDIT_2026_06_01("fallback-credit-2026-06-01")` - `FALLBACK_CREDIT_2026_07_01("fallback-credit-2026-07-01")` - `AGENT_MEMORY_2026_07_22("agent-memory-2026-07-22")` - `MID_CONVERSATION_TOOL_CHANGES_2026_07_01("mid-conversation-tool-changes-2026-07-01")` - `COMPACT_2026_01_12("compact-2026-01-12")` - `COMPUTER_USE_2025_11_24("computer-use-2025-11-24")` - `MCP_TUNNELS_2026_06_22("mcp-tunnels-2026-06-22")` - `STRUCTURED_OUTPUTS_2025_11_13("structured-outputs-2025-11-13")` - `TASK_BUDGETS_2026_03_13("task-budgets-2026-03-13")` - `THINKING_DISPLAY_UPDATES_2026_08_18("thinking-display-updates-2026-08-18")` - `CE_USER_MANAGEMENT_2026_07_13("ce-user-management-2026-07-13")` - `MID_CONVERSATION_OUTPUT_CONFIG_2026_07_01("mid-conversation-output-config-2026-07-01")` - `THINKING_BINDING_CONTROLS_2026_08_01("thinking-binding-controls-2026-08-01")` - `MID_CONVERSATION_SYSTEM_CLEAR_AT_2026_08_21("mid-conversation-system-clear-at-2026-08-21")` - `COMPACT_2026_09_04("compact-2026-09-04")` - `INLINE_TOOLS_2026_09_15("inline-tools-2026-09-15")` - `MCP_CLIENT_2026_09_15("mcp-client-2026-09-15")` - `CE_PLUGINS_2026_09_01("ce-plugins-2026-09-01")` - `SPEND_LIMIT_READS_2026_09_26("spend-limit-reads-2026-09-26")` - `TELEMETRY_DESTINATIONS_2026_08_11("telemetry-destinations-2026-08-11")` - `String issuerUrl` The `iss` claim value to match against. minLength: 1 - `String name` Slug identifier (lowercase, digits, hyphens). Unique within the organization; a duplicate name returns 409. minLength: 1, maxLength: 255 - `Optional checkJti` Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Defaults to true. Applies only to assertions carrying a `jti` claim; tokens without one are accepted without single-use enforcement. - `Optional jwks` How signing keys are obtained. Defaults to OIDC discovery. - `class BetaJwksDiscovery` JWKS via the issuer's OIDC discovery document. - `JsonValue type = "discovery"` - `Optional caCertPem` Optional custom CA (PEM) for TLS verification of the JWKS fetch. maxLength: 8192 - `Optional discoveryBase` Set when the discovery URL differs from `issuer_url`. - `class BetaJwksExplicitUrl` JWKS fetched from a fixed endpoint. - `JsonValue type = "explicit_url"` - `String url` JWKS endpoint. minLength: 1 - `Optional caCertPem` Optional custom CA (PEM) for TLS verification of the JWKS fetch. maxLength: 8192 - `class BetaJwksInline` JWKS supplied directly; no network fetch. - `JsonValue type = "inline"` - `List keys` Inline JWK objects. minItems: 1 - `Optional maxJwtLifetimeSeconds` Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Defaults to 3600 (1h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected. minimum: 1, maximum: 176400 ### Returns - `class BetaFederationIssuer` Registered external OIDC identity provider. Records an external IdP the organization trusts for the RFC 7523 jwt-bearer grant. The `issuer_url` must match the JWT `iss` claim exactly. - `JsonValue type = "federation_issuer"` - `String id` Tagged ID of the federation issuer. - `Optional archivedAt` If set, all rules referencing this issuer reject token exchange. format: date-time - `Optional archivedByActorId` Tagged ID (`user_`/`svac_`) of the actor that archived this issuer. - `boolean checkJti` Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Applies only to assertions carrying a `jti` claim; tokens without one are accepted without single-use enforcement. - `LocalDateTime createdAt` When this issuer was created. format: date-time - `Optional createdByActorId` Tagged ID (`user_`/`svac_`) of the actor that created this issuer. - `String issuerUrl` The `iss` claim value. Incoming JWTs must match exactly. - `Jwks jwks` How signing keys are obtained for signature verification. - `class BetaJwksDiscovery` JWKS via the issuer's OIDC discovery document. - `JsonValue type = "discovery"` - `Optional caCertPem` Optional custom CA (PEM) for TLS verification of the JWKS fetch. maxLength: 8192 - `Optional discoveryBase` Set when the discovery URL differs from `issuer_url`. - `class BetaJwksExplicitUrl` JWKS fetched from a fixed endpoint. - `JsonValue type = "explicit_url"` - `String url` JWKS endpoint. minLength: 1 - `Optional caCertPem` Optional custom CA (PEM) for TLS verification of the JWKS fetch. maxLength: 8192 - `class BetaJwksInline` JWKS supplied directly; no network fetch. - `JsonValue type = "inline"` - `List keys` Inline JWK objects. minItems: 1 - `Optional jwksPollingDisabledAt` If set, Anthropic's JWKS poller has paused polling for this issuer after repeated fetch failures. Re-enable by sending `jwks_polling_disabled: false` via the issuer update endpoint (POST) once the upstream JWKS endpoint is fixed. An OAuth caller cannot send this when the issuer backs a rule with any scope other than `workspace:developer` or `workspace:inference`; use a Console session. format: date-time - `long maxJwtLifetimeSeconds` Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected. - `String name` Admin-chosen slug identifier. - `Optional pollStatus` Live state of Anthropic's JWKS polling for this issuer. Populated on both single-issuer retrieval and list responses, including archived issuers. Typically null for inline-key issuers (no polling), or when poll status is temporarily unavailable or polling has not started yet. - `long consecutiveFailures` Consecutive fetch failures since the last success. - `Optional lastFetchedAt` When the last successful fetch completed. format: date-time - `Optional nextPollAt` When the next fetch is scheduled. Null if paused. format: date-time - `LocalDateTime updatedAt` When this issuer was last updated. format: date-time - `Optional updatedByActorId` Tagged ID (`user_`/`svac_`) of the actor that last updated this issuer. ### Example ```java package com.anthropic.example; import com.anthropic.client.AnthropicClient; import com.anthropic.client.okhttp.AnthropicOkHttpClient; import com.anthropic.models.beta.organization.federation.issuers.BetaFederationIssuer; import com.anthropic.models.beta.organization.federation.issuers.IssuerCreateParams; public final class Main { private Main() {} public static void main(String[] args) { AnthropicClient client = AnthropicOkHttpClient.fromEnv(); IssuerCreateParams params = IssuerCreateParams.builder() .issuerUrl("x") .name("x") .build(); BetaFederationIssuer betaFederationIssuer = client.beta().organization().federation().issuers().create(params); } } ``` #### Response (200) ```json { "id": "fdis_01SDCCSbTxrXDpWc1phhtcfK", "archived_at": "2019-12-27T18:11:19.117Z", "archived_by_actor_id": "archived_by_actor_id", "check_jti": true, "created_at": "2024-10-30T23:58:27.427722Z", "created_by_actor_id": "created_by_actor_id", "issuer_url": "https://token.actions.githubusercontent.com", "jwks": { "type": "discovery", "ca_cert_pem": "ca_cert_pem", "discovery_base": "discovery_base" }, "jwks_polling_disabled_at": "2019-12-27T18:11:19.117Z", "max_jwt_lifetime_seconds": 0, "name": "github-actions", "poll_status": { "consecutive_failures": 0, "last_fetched_at": "2019-12-27T18:11:19.117Z", "next_poll_at": "2019-12-27T18:11:19.117Z" }, "type": "federation_issuer", "updated_at": "2024-10-30T23:58:27.427722Z", "updated_by_actor_id": "updated_by_actor_id" } ``` ## List Federation Issuers `IssuerListPage beta().organization().federation().issuers().list(params = IssuerListParams.none(), requestOptions = RequestOptions.none())` **GET** `/v1/organizations/federation_issuers` **Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=java). List federation issuers in your organization. Archived issuers are excluded unless `include_archived=true`. ### Parameters - `IssuerListParams params` - `Optional includeArchived` (query parameter) Include archived resources. Defaults to false. - `Optional limit` (query parameter) Number of results per page. minimum: 1, maximum: 100 - `Optional page` (query parameter) Opaque cursor from a previous response's `next_page`. - `Optional> betas` (header parameter) Optional header to specify the beta version(s) you want to use. - `MESSAGE_BATCHES_2024_09_24("message-batches-2024-09-24")` - `PROMPT_CACHING_2024_07_31("prompt-caching-2024-07-31")` - `COMPUTER_USE_2024_10_22("computer-use-2024-10-22")` - `COMPUTER_USE_2025_01_24("computer-use-2025-01-24")` - `PDFS_2024_09_25("pdfs-2024-09-25")` - `TOKEN_COUNTING_2024_11_01("token-counting-2024-11-01")` - `TOKEN_EFFICIENT_TOOLS_2025_02_19("token-efficient-tools-2025-02-19")` - `OUTPUT_128K_2025_02_19("output-128k-2025-02-19")` - `FILES_API_2025_04_14("files-api-2025-04-14")` - `MCP_CLIENT_2025_04_04("mcp-client-2025-04-04")` - `MCP_CLIENT_2025_11_20("mcp-client-2025-11-20")` - `DEV_FULL_THINKING_2025_05_14("dev-full-thinking-2025-05-14")` - `INTERLEAVED_THINKING_2025_05_14("interleaved-thinking-2025-05-14")` - `CODE_EXECUTION_2025_05_22("code-execution-2025-05-22")` - `EXTENDED_CACHE_TTL_2025_04_11("extended-cache-ttl-2025-04-11")` - `CONTEXT_1M_2025_08_07("context-1m-2025-08-07")` - `CONTEXT_MANAGEMENT_2025_06_27("context-management-2025-06-27")` - `MODEL_CONTEXT_WINDOW_EXCEEDED_2025_08_26("model-context-window-exceeded-2025-08-26")` - `SKILLS_2025_10_02("skills-2025-10-02")` - `FAST_MODE_2026_02_01("fast-mode-2026-02-01")` - `OUTPUT_300K_2026_03_24("output-300k-2026-03-24")` - `USER_PROFILES_2026_03_24("user-profiles-2026-03-24")` - `USER_PROFILES_2026_08_18("user-profiles-2026-08-18")` - `USER_PROFILES_2026_09_04("user-profiles-2026-09-04")` - `ADVISOR_TOOL_2026_03_01("advisor-tool-2026-03-01")` - `MANAGED_AGENTS_2026_04_01("managed-agents-2026-04-01")` - `CACHE_DIAGNOSIS_2026_04_07("cache-diagnosis-2026-04-07")` - `DREAMING_2026_04_21("dreaming-2026-04-21")` - `THINKING_TOKEN_COUNT_2026_05_13("thinking-token-count-2026-05-13")` - `SERVER_SIDE_FALLBACK_2026_06_01("server-side-fallback-2026-06-01")` - `SERVER_SIDE_FALLBACK_2026_07_01("server-side-fallback-2026-07-01")` - `FALLBACK_CREDIT_2026_06_01("fallback-credit-2026-06-01")` - `FALLBACK_CREDIT_2026_07_01("fallback-credit-2026-07-01")` - `AGENT_MEMORY_2026_07_22("agent-memory-2026-07-22")` - `MID_CONVERSATION_TOOL_CHANGES_2026_07_01("mid-conversation-tool-changes-2026-07-01")` - `COMPACT_2026_01_12("compact-2026-01-12")` - `COMPUTER_USE_2025_11_24("computer-use-2025-11-24")` - `MCP_TUNNELS_2026_06_22("mcp-tunnels-2026-06-22")` - `STRUCTURED_OUTPUTS_2025_11_13("structured-outputs-2025-11-13")` - `TASK_BUDGETS_2026_03_13("task-budgets-2026-03-13")` - `THINKING_DISPLAY_UPDATES_2026_08_18("thinking-display-updates-2026-08-18")` - `CE_USER_MANAGEMENT_2026_07_13("ce-user-management-2026-07-13")` - `MID_CONVERSATION_OUTPUT_CONFIG_2026_07_01("mid-conversation-output-config-2026-07-01")` - `THINKING_BINDING_CONTROLS_2026_08_01("thinking-binding-controls-2026-08-01")` - `MID_CONVERSATION_SYSTEM_CLEAR_AT_2026_08_21("mid-conversation-system-clear-at-2026-08-21")` - `COMPACT_2026_09_04("compact-2026-09-04")` - `INLINE_TOOLS_2026_09_15("inline-tools-2026-09-15")` - `MCP_CLIENT_2026_09_15("mcp-client-2026-09-15")` - `CE_PLUGINS_2026_09_01("ce-plugins-2026-09-01")` - `SPEND_LIMIT_READS_2026_09_26("spend-limit-reads-2026-09-26")` - `TELEMETRY_DESTINATIONS_2026_08_11("telemetry-destinations-2026-08-11")` ### Returns - `class BetaFederationIssuer` Registered external OIDC identity provider. Records an external IdP the organization trusts for the RFC 7523 jwt-bearer grant. The `issuer_url` must match the JWT `iss` claim exactly. - `JsonValue type = "federation_issuer"` - `String id` Tagged ID of the federation issuer. - `Optional archivedAt` If set, all rules referencing this issuer reject token exchange. format: date-time - `Optional archivedByActorId` Tagged ID (`user_`/`svac_`) of the actor that archived this issuer. - `boolean checkJti` Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Applies only to assertions carrying a `jti` claim; tokens without one are accepted without single-use enforcement. - `LocalDateTime createdAt` When this issuer was created. format: date-time - `Optional createdByActorId` Tagged ID (`user_`/`svac_`) of the actor that created this issuer. - `String issuerUrl` The `iss` claim value. Incoming JWTs must match exactly. - `Jwks jwks` How signing keys are obtained for signature verification. - `class BetaJwksDiscovery` JWKS via the issuer's OIDC discovery document. - `JsonValue type = "discovery"` - `Optional caCertPem` Optional custom CA (PEM) for TLS verification of the JWKS fetch. maxLength: 8192 - `Optional discoveryBase` Set when the discovery URL differs from `issuer_url`. - `class BetaJwksExplicitUrl` JWKS fetched from a fixed endpoint. - `JsonValue type = "explicit_url"` - `String url` JWKS endpoint. minLength: 1 - `Optional caCertPem` Optional custom CA (PEM) for TLS verification of the JWKS fetch. maxLength: 8192 - `class BetaJwksInline` JWKS supplied directly; no network fetch. - `JsonValue type = "inline"` - `List keys` Inline JWK objects. minItems: 1 - `Optional jwksPollingDisabledAt` If set, Anthropic's JWKS poller has paused polling for this issuer after repeated fetch failures. Re-enable by sending `jwks_polling_disabled: false` via the issuer update endpoint (POST) once the upstream JWKS endpoint is fixed. An OAuth caller cannot send this when the issuer backs a rule with any scope other than `workspace:developer` or `workspace:inference`; use a Console session. format: date-time - `long maxJwtLifetimeSeconds` Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected. - `String name` Admin-chosen slug identifier. - `Optional pollStatus` Live state of Anthropic's JWKS polling for this issuer. Populated on both single-issuer retrieval and list responses, including archived issuers. Typically null for inline-key issuers (no polling), or when poll status is temporarily unavailable or polling has not started yet. - `long consecutiveFailures` Consecutive fetch failures since the last success. - `Optional lastFetchedAt` When the last successful fetch completed. format: date-time - `Optional nextPollAt` When the next fetch is scheduled. Null if paused. format: date-time - `LocalDateTime updatedAt` When this issuer was last updated. format: date-time - `Optional updatedByActorId` Tagged ID (`user_`/`svac_`) of the actor that last updated this issuer. ### Example ```java package com.anthropic.example; import com.anthropic.client.AnthropicClient; import com.anthropic.client.okhttp.AnthropicOkHttpClient; import com.anthropic.models.beta.organization.federation.issuers.IssuerListPage; import com.anthropic.models.beta.organization.federation.issuers.IssuerListParams; public final class Main { private Main() {} public static void main(String[] args) { AnthropicClient client = AnthropicOkHttpClient.fromEnv(); IssuerListPage page = client.beta().organization().federation().issuers().list(); } } ``` #### Response (200) ```json { "data": [ { "id": "fdis_01SDCCSbTxrXDpWc1phhtcfK", "archived_at": "2019-12-27T18:11:19.117Z", "archived_by_actor_id": "archived_by_actor_id", "check_jti": true, "created_at": "2024-10-30T23:58:27.427722Z", "created_by_actor_id": "created_by_actor_id", "issuer_url": "https://token.actions.githubusercontent.com", "jwks": { "type": "discovery", "ca_cert_pem": "ca_cert_pem", "discovery_base": "discovery_base" }, "jwks_polling_disabled_at": "2019-12-27T18:11:19.117Z", "max_jwt_lifetime_seconds": 0, "name": "github-actions", "poll_status": { "consecutive_failures": 0, "last_fetched_at": "2019-12-27T18:11:19.117Z", "next_poll_at": "2019-12-27T18:11:19.117Z" }, "type": "federation_issuer", "updated_at": "2024-10-30T23:58:27.427722Z", "updated_by_actor_id": "updated_by_actor_id" } ], "next_page": "next_page" } ``` ## Get Federation Issuer `BetaFederationIssuer beta().organization().federation().issuers().retrieve(params = IssuerRetrieveParams.none(), requestOptions = RequestOptions.none())` **GET** `/v1/organizations/federation_issuers/{federation_issuer_id}` **Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=java). Retrieve a federation issuer by its ID (`fdis_...`). ### Parameters - `IssuerRetrieveParams params` - `Optional federationIssuerId` (path parameter) ID of the federation issuer. - `Optional> betas` (header parameter) Optional header to specify the beta version(s) you want to use. - `MESSAGE_BATCHES_2024_09_24("message-batches-2024-09-24")` - `PROMPT_CACHING_2024_07_31("prompt-caching-2024-07-31")` - `COMPUTER_USE_2024_10_22("computer-use-2024-10-22")` - `COMPUTER_USE_2025_01_24("computer-use-2025-01-24")` - `PDFS_2024_09_25("pdfs-2024-09-25")` - `TOKEN_COUNTING_2024_11_01("token-counting-2024-11-01")` - `TOKEN_EFFICIENT_TOOLS_2025_02_19("token-efficient-tools-2025-02-19")` - `OUTPUT_128K_2025_02_19("output-128k-2025-02-19")` - `FILES_API_2025_04_14("files-api-2025-04-14")` - `MCP_CLIENT_2025_04_04("mcp-client-2025-04-04")` - `MCP_CLIENT_2025_11_20("mcp-client-2025-11-20")` - `DEV_FULL_THINKING_2025_05_14("dev-full-thinking-2025-05-14")` - `INTERLEAVED_THINKING_2025_05_14("interleaved-thinking-2025-05-14")` - `CODE_EXECUTION_2025_05_22("code-execution-2025-05-22")` - `EXTENDED_CACHE_TTL_2025_04_11("extended-cache-ttl-2025-04-11")` - `CONTEXT_1M_2025_08_07("context-1m-2025-08-07")` - `CONTEXT_MANAGEMENT_2025_06_27("context-management-2025-06-27")` - `MODEL_CONTEXT_WINDOW_EXCEEDED_2025_08_26("model-context-window-exceeded-2025-08-26")` - `SKILLS_2025_10_02("skills-2025-10-02")` - `FAST_MODE_2026_02_01("fast-mode-2026-02-01")` - `OUTPUT_300K_2026_03_24("output-300k-2026-03-24")` - `USER_PROFILES_2026_03_24("user-profiles-2026-03-24")` - `USER_PROFILES_2026_08_18("user-profiles-2026-08-18")` - `USER_PROFILES_2026_09_04("user-profiles-2026-09-04")` - `ADVISOR_TOOL_2026_03_01("advisor-tool-2026-03-01")` - `MANAGED_AGENTS_2026_04_01("managed-agents-2026-04-01")` - `CACHE_DIAGNOSIS_2026_04_07("cache-diagnosis-2026-04-07")` - `DREAMING_2026_04_21("dreaming-2026-04-21")` - `THINKING_TOKEN_COUNT_2026_05_13("thinking-token-count-2026-05-13")` - `SERVER_SIDE_FALLBACK_2026_06_01("server-side-fallback-2026-06-01")` - `SERVER_SIDE_FALLBACK_2026_07_01("server-side-fallback-2026-07-01")` - `FALLBACK_CREDIT_2026_06_01("fallback-credit-2026-06-01")` - `FALLBACK_CREDIT_2026_07_01("fallback-credit-2026-07-01")` - `AGENT_MEMORY_2026_07_22("agent-memory-2026-07-22")` - `MID_CONVERSATION_TOOL_CHANGES_2026_07_01("mid-conversation-tool-changes-2026-07-01")` - `COMPACT_2026_01_12("compact-2026-01-12")` - `COMPUTER_USE_2025_11_24("computer-use-2025-11-24")` - `MCP_TUNNELS_2026_06_22("mcp-tunnels-2026-06-22")` - `STRUCTURED_OUTPUTS_2025_11_13("structured-outputs-2025-11-13")` - `TASK_BUDGETS_2026_03_13("task-budgets-2026-03-13")` - `THINKING_DISPLAY_UPDATES_2026_08_18("thinking-display-updates-2026-08-18")` - `CE_USER_MANAGEMENT_2026_07_13("ce-user-management-2026-07-13")` - `MID_CONVERSATION_OUTPUT_CONFIG_2026_07_01("mid-conversation-output-config-2026-07-01")` - `THINKING_BINDING_CONTROLS_2026_08_01("thinking-binding-controls-2026-08-01")` - `MID_CONVERSATION_SYSTEM_CLEAR_AT_2026_08_21("mid-conversation-system-clear-at-2026-08-21")` - `COMPACT_2026_09_04("compact-2026-09-04")` - `INLINE_TOOLS_2026_09_15("inline-tools-2026-09-15")` - `MCP_CLIENT_2026_09_15("mcp-client-2026-09-15")` - `CE_PLUGINS_2026_09_01("ce-plugins-2026-09-01")` - `SPEND_LIMIT_READS_2026_09_26("spend-limit-reads-2026-09-26")` - `TELEMETRY_DESTINATIONS_2026_08_11("telemetry-destinations-2026-08-11")` ### Returns - `class BetaFederationIssuer` Registered external OIDC identity provider. Records an external IdP the organization trusts for the RFC 7523 jwt-bearer grant. The `issuer_url` must match the JWT `iss` claim exactly. - `JsonValue type = "federation_issuer"` - `String id` Tagged ID of the federation issuer. - `Optional archivedAt` If set, all rules referencing this issuer reject token exchange. format: date-time - `Optional archivedByActorId` Tagged ID (`user_`/`svac_`) of the actor that archived this issuer. - `boolean checkJti` Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Applies only to assertions carrying a `jti` claim; tokens without one are accepted without single-use enforcement. - `LocalDateTime createdAt` When this issuer was created. format: date-time - `Optional createdByActorId` Tagged ID (`user_`/`svac_`) of the actor that created this issuer. - `String issuerUrl` The `iss` claim value. Incoming JWTs must match exactly. - `Jwks jwks` How signing keys are obtained for signature verification. - `class BetaJwksDiscovery` JWKS via the issuer's OIDC discovery document. - `JsonValue type = "discovery"` - `Optional caCertPem` Optional custom CA (PEM) for TLS verification of the JWKS fetch. maxLength: 8192 - `Optional discoveryBase` Set when the discovery URL differs from `issuer_url`. - `class BetaJwksExplicitUrl` JWKS fetched from a fixed endpoint. - `JsonValue type = "explicit_url"` - `String url` JWKS endpoint. minLength: 1 - `Optional caCertPem` Optional custom CA (PEM) for TLS verification of the JWKS fetch. maxLength: 8192 - `class BetaJwksInline` JWKS supplied directly; no network fetch. - `JsonValue type = "inline"` - `List keys` Inline JWK objects. minItems: 1 - `Optional jwksPollingDisabledAt` If set, Anthropic's JWKS poller has paused polling for this issuer after repeated fetch failures. Re-enable by sending `jwks_polling_disabled: false` via the issuer update endpoint (POST) once the upstream JWKS endpoint is fixed. An OAuth caller cannot send this when the issuer backs a rule with any scope other than `workspace:developer` or `workspace:inference`; use a Console session. format: date-time - `long maxJwtLifetimeSeconds` Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected. - `String name` Admin-chosen slug identifier. - `Optional pollStatus` Live state of Anthropic's JWKS polling for this issuer. Populated on both single-issuer retrieval and list responses, including archived issuers. Typically null for inline-key issuers (no polling), or when poll status is temporarily unavailable or polling has not started yet. - `long consecutiveFailures` Consecutive fetch failures since the last success. - `Optional lastFetchedAt` When the last successful fetch completed. format: date-time - `Optional nextPollAt` When the next fetch is scheduled. Null if paused. format: date-time - `LocalDateTime updatedAt` When this issuer was last updated. format: date-time - `Optional updatedByActorId` Tagged ID (`user_`/`svac_`) of the actor that last updated this issuer. ### Example ```java package com.anthropic.example; import com.anthropic.client.AnthropicClient; import com.anthropic.client.okhttp.AnthropicOkHttpClient; import com.anthropic.models.beta.organization.federation.issuers.BetaFederationIssuer; import com.anthropic.models.beta.organization.federation.issuers.IssuerRetrieveParams; public final class Main { private Main() {} public static void main(String[] args) { AnthropicClient client = AnthropicOkHttpClient.fromEnv(); BetaFederationIssuer betaFederationIssuer = client.beta().organization().federation().issuers().retrieve("federation_issuer_id"); } } ``` #### Response (200) ```json { "id": "fdis_01SDCCSbTxrXDpWc1phhtcfK", "archived_at": "2019-12-27T18:11:19.117Z", "archived_by_actor_id": "archived_by_actor_id", "check_jti": true, "created_at": "2024-10-30T23:58:27.427722Z", "created_by_actor_id": "created_by_actor_id", "issuer_url": "https://token.actions.githubusercontent.com", "jwks": { "type": "discovery", "ca_cert_pem": "ca_cert_pem", "discovery_base": "discovery_base" }, "jwks_polling_disabled_at": "2019-12-27T18:11:19.117Z", "max_jwt_lifetime_seconds": 0, "name": "github-actions", "poll_status": { "consecutive_failures": 0, "last_fetched_at": "2019-12-27T18:11:19.117Z", "next_poll_at": "2019-12-27T18:11:19.117Z" }, "type": "federation_issuer", "updated_at": "2024-10-30T23:58:27.427722Z", "updated_by_actor_id": "updated_by_actor_id" } ``` ## Update Federation Issuer `BetaFederationIssuer beta().organization().federation().issuers().update(params = IssuerUpdateParams.none(), requestOptions = RequestOptions.none())` **POST** `/v1/organizations/federation_issuers/{federation_issuer_id}` **Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=java). Partially update a federation issuer. Setting `jwks` replaces the full JWKS shape at once. Archived issuers cannot be updated; this returns 400. Create a new issuer instead. Updating an issuer that backs a rule with a scope outside `workspace:developer` or `workspace:inference` requires a Console session. ### Parameters - `IssuerUpdateParams params` - `Optional federationIssuerId` (path parameter) ID of the federation issuer to update. - `Optional> betas` (header parameter) Optional header to specify the beta version(s) you want to use. - `MESSAGE_BATCHES_2024_09_24("message-batches-2024-09-24")` - `PROMPT_CACHING_2024_07_31("prompt-caching-2024-07-31")` - `COMPUTER_USE_2024_10_22("computer-use-2024-10-22")` - `COMPUTER_USE_2025_01_24("computer-use-2025-01-24")` - `PDFS_2024_09_25("pdfs-2024-09-25")` - `TOKEN_COUNTING_2024_11_01("token-counting-2024-11-01")` - `TOKEN_EFFICIENT_TOOLS_2025_02_19("token-efficient-tools-2025-02-19")` - `OUTPUT_128K_2025_02_19("output-128k-2025-02-19")` - `FILES_API_2025_04_14("files-api-2025-04-14")` - `MCP_CLIENT_2025_04_04("mcp-client-2025-04-04")` - `MCP_CLIENT_2025_11_20("mcp-client-2025-11-20")` - `DEV_FULL_THINKING_2025_05_14("dev-full-thinking-2025-05-14")` - `INTERLEAVED_THINKING_2025_05_14("interleaved-thinking-2025-05-14")` - `CODE_EXECUTION_2025_05_22("code-execution-2025-05-22")` - `EXTENDED_CACHE_TTL_2025_04_11("extended-cache-ttl-2025-04-11")` - `CONTEXT_1M_2025_08_07("context-1m-2025-08-07")` - `CONTEXT_MANAGEMENT_2025_06_27("context-management-2025-06-27")` - `MODEL_CONTEXT_WINDOW_EXCEEDED_2025_08_26("model-context-window-exceeded-2025-08-26")` - `SKILLS_2025_10_02("skills-2025-10-02")` - `FAST_MODE_2026_02_01("fast-mode-2026-02-01")` - `OUTPUT_300K_2026_03_24("output-300k-2026-03-24")` - `USER_PROFILES_2026_03_24("user-profiles-2026-03-24")` - `USER_PROFILES_2026_08_18("user-profiles-2026-08-18")` - `USER_PROFILES_2026_09_04("user-profiles-2026-09-04")` - `ADVISOR_TOOL_2026_03_01("advisor-tool-2026-03-01")` - `MANAGED_AGENTS_2026_04_01("managed-agents-2026-04-01")` - `CACHE_DIAGNOSIS_2026_04_07("cache-diagnosis-2026-04-07")` - `DREAMING_2026_04_21("dreaming-2026-04-21")` - `THINKING_TOKEN_COUNT_2026_05_13("thinking-token-count-2026-05-13")` - `SERVER_SIDE_FALLBACK_2026_06_01("server-side-fallback-2026-06-01")` - `SERVER_SIDE_FALLBACK_2026_07_01("server-side-fallback-2026-07-01")` - `FALLBACK_CREDIT_2026_06_01("fallback-credit-2026-06-01")` - `FALLBACK_CREDIT_2026_07_01("fallback-credit-2026-07-01")` - `AGENT_MEMORY_2026_07_22("agent-memory-2026-07-22")` - `MID_CONVERSATION_TOOL_CHANGES_2026_07_01("mid-conversation-tool-changes-2026-07-01")` - `COMPACT_2026_01_12("compact-2026-01-12")` - `COMPUTER_USE_2025_11_24("computer-use-2025-11-24")` - `MCP_TUNNELS_2026_06_22("mcp-tunnels-2026-06-22")` - `STRUCTURED_OUTPUTS_2025_11_13("structured-outputs-2025-11-13")` - `TASK_BUDGETS_2026_03_13("task-budgets-2026-03-13")` - `THINKING_DISPLAY_UPDATES_2026_08_18("thinking-display-updates-2026-08-18")` - `CE_USER_MANAGEMENT_2026_07_13("ce-user-management-2026-07-13")` - `MID_CONVERSATION_OUTPUT_CONFIG_2026_07_01("mid-conversation-output-config-2026-07-01")` - `THINKING_BINDING_CONTROLS_2026_08_01("thinking-binding-controls-2026-08-01")` - `MID_CONVERSATION_SYSTEM_CLEAR_AT_2026_08_21("mid-conversation-system-clear-at-2026-08-21")` - `COMPACT_2026_09_04("compact-2026-09-04")` - `INLINE_TOOLS_2026_09_15("inline-tools-2026-09-15")` - `MCP_CLIENT_2026_09_15("mcp-client-2026-09-15")` - `CE_PLUGINS_2026_09_01("ce-plugins-2026-09-01")` - `SPEND_LIMIT_READS_2026_09_26("spend-limit-reads-2026-09-26")` - `TELEMETRY_DESTINATIONS_2026_08_11("telemetry-destinations-2026-08-11")` - `Optional checkJti` Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Applies only to assertions carrying a `jti` claim; tokens without one are accepted without single-use enforcement. - `Optional issuerUrl` Replaces the `iss` claim value to match against. For discovery-mode issuers without a `discovery_base`, this is also the URL Anthropic fetches the OIDC discovery document and signing keys from, so changing it repoints the JWKS source. Changing the issuer URL to a well-known shared platform is rejected while any live rule under this issuer would not constrain tenant identity. minLength: 1 - `Optional jwks` Replaces the entire JWKS configuration. - `class BetaJwksDiscovery` JWKS via the issuer's OIDC discovery document. - `JsonValue type = "discovery"` - `Optional caCertPem` Optional custom CA (PEM) for TLS verification of the JWKS fetch. maxLength: 8192 - `Optional discoveryBase` Set when the discovery URL differs from `issuer_url`. - `class BetaJwksExplicitUrl` JWKS fetched from a fixed endpoint. - `JsonValue type = "explicit_url"` - `String url` JWKS endpoint. minLength: 1 - `Optional caCertPem` Optional custom CA (PEM) for TLS verification of the JWKS fetch. maxLength: 8192 - `class BetaJwksInline` JWKS supplied directly; no network fetch. - `JsonValue type = "inline"` - `List keys` Inline JWK objects. minItems: 1 - `Optional jwksPollingDisabled` Only `false` is accepted, to re-enable polling after the system pauses it. Polling is paused automatically; sending `true` is rejected. - `Optional maxJwtLifetimeSeconds` Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected. minimum: 1, maximum: 176400 - `Optional name` Replaces the slug identifier (lowercase, digits, hyphens). Unique within the organization; a duplicate name returns 409. minLength: 1, maxLength: 255 ### Returns - `class BetaFederationIssuer` Registered external OIDC identity provider. Records an external IdP the organization trusts for the RFC 7523 jwt-bearer grant. The `issuer_url` must match the JWT `iss` claim exactly. - `JsonValue type = "federation_issuer"` - `String id` Tagged ID of the federation issuer. - `Optional archivedAt` If set, all rules referencing this issuer reject token exchange. format: date-time - `Optional archivedByActorId` Tagged ID (`user_`/`svac_`) of the actor that archived this issuer. - `boolean checkJti` Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Applies only to assertions carrying a `jti` claim; tokens without one are accepted without single-use enforcement. - `LocalDateTime createdAt` When this issuer was created. format: date-time - `Optional createdByActorId` Tagged ID (`user_`/`svac_`) of the actor that created this issuer. - `String issuerUrl` The `iss` claim value. Incoming JWTs must match exactly. - `Jwks jwks` How signing keys are obtained for signature verification. - `class BetaJwksDiscovery` JWKS via the issuer's OIDC discovery document. - `JsonValue type = "discovery"` - `Optional caCertPem` Optional custom CA (PEM) for TLS verification of the JWKS fetch. maxLength: 8192 - `Optional discoveryBase` Set when the discovery URL differs from `issuer_url`. - `class BetaJwksExplicitUrl` JWKS fetched from a fixed endpoint. - `JsonValue type = "explicit_url"` - `String url` JWKS endpoint. minLength: 1 - `Optional caCertPem` Optional custom CA (PEM) for TLS verification of the JWKS fetch. maxLength: 8192 - `class BetaJwksInline` JWKS supplied directly; no network fetch. - `JsonValue type = "inline"` - `List keys` Inline JWK objects. minItems: 1 - `Optional jwksPollingDisabledAt` If set, Anthropic's JWKS poller has paused polling for this issuer after repeated fetch failures. Re-enable by sending `jwks_polling_disabled: false` via the issuer update endpoint (POST) once the upstream JWKS endpoint is fixed. An OAuth caller cannot send this when the issuer backs a rule with any scope other than `workspace:developer` or `workspace:inference`; use a Console session. format: date-time - `long maxJwtLifetimeSeconds` Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected. - `String name` Admin-chosen slug identifier. - `Optional pollStatus` Live state of Anthropic's JWKS polling for this issuer. Populated on both single-issuer retrieval and list responses, including archived issuers. Typically null for inline-key issuers (no polling), or when poll status is temporarily unavailable or polling has not started yet. - `long consecutiveFailures` Consecutive fetch failures since the last success. - `Optional lastFetchedAt` When the last successful fetch completed. format: date-time - `Optional nextPollAt` When the next fetch is scheduled. Null if paused. format: date-time - `LocalDateTime updatedAt` When this issuer was last updated. format: date-time - `Optional updatedByActorId` Tagged ID (`user_`/`svac_`) of the actor that last updated this issuer. ### Example ```java package com.anthropic.example; import com.anthropic.client.AnthropicClient; import com.anthropic.client.okhttp.AnthropicOkHttpClient; import com.anthropic.models.beta.organization.federation.issuers.BetaFederationIssuer; import com.anthropic.models.beta.organization.federation.issuers.IssuerUpdateParams; public final class Main { private Main() {} public static void main(String[] args) { AnthropicClient client = AnthropicOkHttpClient.fromEnv(); BetaFederationIssuer betaFederationIssuer = client.beta().organization().federation().issuers().update("federation_issuer_id"); } } ``` #### Response (200) ```json { "id": "fdis_01SDCCSbTxrXDpWc1phhtcfK", "archived_at": "2019-12-27T18:11:19.117Z", "archived_by_actor_id": "archived_by_actor_id", "check_jti": true, "created_at": "2024-10-30T23:58:27.427722Z", "created_by_actor_id": "created_by_actor_id", "issuer_url": "https://token.actions.githubusercontent.com", "jwks": { "type": "discovery", "ca_cert_pem": "ca_cert_pem", "discovery_base": "discovery_base" }, "jwks_polling_disabled_at": "2019-12-27T18:11:19.117Z", "max_jwt_lifetime_seconds": 0, "name": "github-actions", "poll_status": { "consecutive_failures": 0, "last_fetched_at": "2019-12-27T18:11:19.117Z", "next_poll_at": "2019-12-27T18:11:19.117Z" }, "type": "federation_issuer", "updated_at": "2024-10-30T23:58:27.427722Z", "updated_by_actor_id": "updated_by_actor_id" } ``` ## Archive Federation Issuer `BetaFederationIssuer beta().organization().federation().issuers().archive(params = IssuerArchiveParams.none(), requestOptions = RequestOptions.none())` **POST** `/v1/organizations/federation_issuers/{federation_issuer_id}/archive` **Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=java). Archive a federation issuer. Idempotent; re-archiving returns the issuer with its original `archived_at`. Rejected with 400 if any live (non-archived) federation rule still references the issuer; archive those rules first (a rule's issuer cannot be changed), or recreate them against another issuer. ### Parameters - `IssuerArchiveParams params` - `Optional federationIssuerId` (path parameter) ID of the federation issuer to archive. - `Optional> betas` (header parameter) Optional header to specify the beta version(s) you want to use. - `MESSAGE_BATCHES_2024_09_24("message-batches-2024-09-24")` - `PROMPT_CACHING_2024_07_31("prompt-caching-2024-07-31")` - `COMPUTER_USE_2024_10_22("computer-use-2024-10-22")` - `COMPUTER_USE_2025_01_24("computer-use-2025-01-24")` - `PDFS_2024_09_25("pdfs-2024-09-25")` - `TOKEN_COUNTING_2024_11_01("token-counting-2024-11-01")` - `TOKEN_EFFICIENT_TOOLS_2025_02_19("token-efficient-tools-2025-02-19")` - `OUTPUT_128K_2025_02_19("output-128k-2025-02-19")` - `FILES_API_2025_04_14("files-api-2025-04-14")` - `MCP_CLIENT_2025_04_04("mcp-client-2025-04-04")` - `MCP_CLIENT_2025_11_20("mcp-client-2025-11-20")` - `DEV_FULL_THINKING_2025_05_14("dev-full-thinking-2025-05-14")` - `INTERLEAVED_THINKING_2025_05_14("interleaved-thinking-2025-05-14")` - `CODE_EXECUTION_2025_05_22("code-execution-2025-05-22")` - `EXTENDED_CACHE_TTL_2025_04_11("extended-cache-ttl-2025-04-11")` - `CONTEXT_1M_2025_08_07("context-1m-2025-08-07")` - `CONTEXT_MANAGEMENT_2025_06_27("context-management-2025-06-27")` - `MODEL_CONTEXT_WINDOW_EXCEEDED_2025_08_26("model-context-window-exceeded-2025-08-26")` - `SKILLS_2025_10_02("skills-2025-10-02")` - `FAST_MODE_2026_02_01("fast-mode-2026-02-01")` - `OUTPUT_300K_2026_03_24("output-300k-2026-03-24")` - `USER_PROFILES_2026_03_24("user-profiles-2026-03-24")` - `USER_PROFILES_2026_08_18("user-profiles-2026-08-18")` - `USER_PROFILES_2026_09_04("user-profiles-2026-09-04")` - `ADVISOR_TOOL_2026_03_01("advisor-tool-2026-03-01")` - `MANAGED_AGENTS_2026_04_01("managed-agents-2026-04-01")` - `CACHE_DIAGNOSIS_2026_04_07("cache-diagnosis-2026-04-07")` - `DREAMING_2026_04_21("dreaming-2026-04-21")` - `THINKING_TOKEN_COUNT_2026_05_13("thinking-token-count-2026-05-13")` - `SERVER_SIDE_FALLBACK_2026_06_01("server-side-fallback-2026-06-01")` - `SERVER_SIDE_FALLBACK_2026_07_01("server-side-fallback-2026-07-01")` - `FALLBACK_CREDIT_2026_06_01("fallback-credit-2026-06-01")` - `FALLBACK_CREDIT_2026_07_01("fallback-credit-2026-07-01")` - `AGENT_MEMORY_2026_07_22("agent-memory-2026-07-22")` - `MID_CONVERSATION_TOOL_CHANGES_2026_07_01("mid-conversation-tool-changes-2026-07-01")` - `COMPACT_2026_01_12("compact-2026-01-12")` - `COMPUTER_USE_2025_11_24("computer-use-2025-11-24")` - `MCP_TUNNELS_2026_06_22("mcp-tunnels-2026-06-22")` - `STRUCTURED_OUTPUTS_2025_11_13("structured-outputs-2025-11-13")` - `TASK_BUDGETS_2026_03_13("task-budgets-2026-03-13")` - `THINKING_DISPLAY_UPDATES_2026_08_18("thinking-display-updates-2026-08-18")` - `CE_USER_MANAGEMENT_2026_07_13("ce-user-management-2026-07-13")` - `MID_CONVERSATION_OUTPUT_CONFIG_2026_07_01("mid-conversation-output-config-2026-07-01")` - `THINKING_BINDING_CONTROLS_2026_08_01("thinking-binding-controls-2026-08-01")` - `MID_CONVERSATION_SYSTEM_CLEAR_AT_2026_08_21("mid-conversation-system-clear-at-2026-08-21")` - `COMPACT_2026_09_04("compact-2026-09-04")` - `INLINE_TOOLS_2026_09_15("inline-tools-2026-09-15")` - `MCP_CLIENT_2026_09_15("mcp-client-2026-09-15")` - `CE_PLUGINS_2026_09_01("ce-plugins-2026-09-01")` - `SPEND_LIMIT_READS_2026_09_26("spend-limit-reads-2026-09-26")` - `TELEMETRY_DESTINATIONS_2026_08_11("telemetry-destinations-2026-08-11")` ### Returns - `class BetaFederationIssuer` Registered external OIDC identity provider. Records an external IdP the organization trusts for the RFC 7523 jwt-bearer grant. The `issuer_url` must match the JWT `iss` claim exactly. - `JsonValue type = "federation_issuer"` - `String id` Tagged ID of the federation issuer. - `Optional archivedAt` If set, all rules referencing this issuer reject token exchange. format: date-time - `Optional archivedByActorId` Tagged ID (`user_`/`svac_`) of the actor that archived this issuer. - `boolean checkJti` Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Applies only to assertions carrying a `jti` claim; tokens without one are accepted without single-use enforcement. - `LocalDateTime createdAt` When this issuer was created. format: date-time - `Optional createdByActorId` Tagged ID (`user_`/`svac_`) of the actor that created this issuer. - `String issuerUrl` The `iss` claim value. Incoming JWTs must match exactly. - `Jwks jwks` How signing keys are obtained for signature verification. - `class BetaJwksDiscovery` JWKS via the issuer's OIDC discovery document. - `JsonValue type = "discovery"` - `Optional caCertPem` Optional custom CA (PEM) for TLS verification of the JWKS fetch. maxLength: 8192 - `Optional discoveryBase` Set when the discovery URL differs from `issuer_url`. - `class BetaJwksExplicitUrl` JWKS fetched from a fixed endpoint. - `JsonValue type = "explicit_url"` - `String url` JWKS endpoint. minLength: 1 - `Optional caCertPem` Optional custom CA (PEM) for TLS verification of the JWKS fetch. maxLength: 8192 - `class BetaJwksInline` JWKS supplied directly; no network fetch. - `JsonValue type = "inline"` - `List keys` Inline JWK objects. minItems: 1 - `Optional jwksPollingDisabledAt` If set, Anthropic's JWKS poller has paused polling for this issuer after repeated fetch failures. Re-enable by sending `jwks_polling_disabled: false` via the issuer update endpoint (POST) once the upstream JWKS endpoint is fixed. An OAuth caller cannot send this when the issuer backs a rule with any scope other than `workspace:developer` or `workspace:inference`; use a Console session. format: date-time - `long maxJwtLifetimeSeconds` Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected. - `String name` Admin-chosen slug identifier. - `Optional pollStatus` Live state of Anthropic's JWKS polling for this issuer. Populated on both single-issuer retrieval and list responses, including archived issuers. Typically null for inline-key issuers (no polling), or when poll status is temporarily unavailable or polling has not started yet. - `long consecutiveFailures` Consecutive fetch failures since the last success. - `Optional lastFetchedAt` When the last successful fetch completed. format: date-time - `Optional nextPollAt` When the next fetch is scheduled. Null if paused. format: date-time - `LocalDateTime updatedAt` When this issuer was last updated. format: date-time - `Optional updatedByActorId` Tagged ID (`user_`/`svac_`) of the actor that last updated this issuer. ### Example ```java package com.anthropic.example; import com.anthropic.client.AnthropicClient; import com.anthropic.client.okhttp.AnthropicOkHttpClient; import com.anthropic.models.beta.organization.federation.issuers.BetaFederationIssuer; import com.anthropic.models.beta.organization.federation.issuers.IssuerArchiveParams; public final class Main { private Main() {} public static void main(String[] args) { AnthropicClient client = AnthropicOkHttpClient.fromEnv(); BetaFederationIssuer betaFederationIssuer = client.beta().organization().federation().issuers().archive("federation_issuer_id"); } } ``` #### Response (200) ```json { "id": "fdis_01SDCCSbTxrXDpWc1phhtcfK", "archived_at": "2019-12-27T18:11:19.117Z", "archived_by_actor_id": "archived_by_actor_id", "check_jti": true, "created_at": "2024-10-30T23:58:27.427722Z", "created_by_actor_id": "created_by_actor_id", "issuer_url": "https://token.actions.githubusercontent.com", "jwks": { "type": "discovery", "ca_cert_pem": "ca_cert_pem", "discovery_base": "discovery_base" }, "jwks_polling_disabled_at": "2019-12-27T18:11:19.117Z", "max_jwt_lifetime_seconds": 0, "name": "github-actions", "poll_status": { "consecutive_failures": 0, "last_fetched_at": "2019-12-27T18:11:19.117Z", "next_poll_at": "2019-12-27T18:11:19.117Z" }, "type": "federation_issuer", "updated_at": "2024-10-30T23:58:27.427722Z", "updated_by_actor_id": "updated_by_actor_id" } ``` ## Domain types ### Beta Federation Issuer - `class BetaFederationIssuer` Registered external OIDC identity provider. Records an external IdP the organization trusts for the RFC 7523 jwt-bearer grant. The `issuer_url` must match the JWT `iss` claim exactly. - `JsonValue type = "federation_issuer"` - `String id` Tagged ID of the federation issuer. - `Optional archivedAt` If set, all rules referencing this issuer reject token exchange. format: date-time - `Optional archivedByActorId` Tagged ID (`user_`/`svac_`) of the actor that archived this issuer. - `boolean checkJti` Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Applies only to assertions carrying a `jti` claim; tokens without one are accepted without single-use enforcement. - `LocalDateTime createdAt` When this issuer was created. format: date-time - `Optional createdByActorId` Tagged ID (`user_`/`svac_`) of the actor that created this issuer. - `String issuerUrl` The `iss` claim value. Incoming JWTs must match exactly. - `Jwks jwks` How signing keys are obtained for signature verification. - `class BetaJwksDiscovery` JWKS via the issuer's OIDC discovery document. - `JsonValue type = "discovery"` - `Optional caCertPem` Optional custom CA (PEM) for TLS verification of the JWKS fetch. maxLength: 8192 - `Optional discoveryBase` Set when the discovery URL differs from `issuer_url`. - `class BetaJwksExplicitUrl` JWKS fetched from a fixed endpoint. - `JsonValue type = "explicit_url"` - `String url` JWKS endpoint. minLength: 1 - `Optional caCertPem` Optional custom CA (PEM) for TLS verification of the JWKS fetch. maxLength: 8192 - `class BetaJwksInline` JWKS supplied directly; no network fetch. - `JsonValue type = "inline"` - `List keys` Inline JWK objects. minItems: 1 - `Optional jwksPollingDisabledAt` If set, Anthropic's JWKS poller has paused polling for this issuer after repeated fetch failures. Re-enable by sending `jwks_polling_disabled: false` via the issuer update endpoint (POST) once the upstream JWKS endpoint is fixed. An OAuth caller cannot send this when the issuer backs a rule with any scope other than `workspace:developer` or `workspace:inference`; use a Console session. format: date-time - `long maxJwtLifetimeSeconds` Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected. - `String name` Admin-chosen slug identifier. - `Optional pollStatus` Live state of Anthropic's JWKS polling for this issuer. Populated on both single-issuer retrieval and list responses, including archived issuers. Typically null for inline-key issuers (no polling), or when poll status is temporarily unavailable or polling has not started yet. - `long consecutiveFailures` Consecutive fetch failures since the last success. - `Optional lastFetchedAt` When the last successful fetch completed. format: date-time - `Optional nextPollAt` When the next fetch is scheduled. Null if paused. format: date-time - `LocalDateTime updatedAt` When this issuer was last updated. format: date-time - `Optional updatedByActorId` Tagged ID (`user_`/`svac_`) of the actor that last updated this issuer. ### Beta Federation Issuer Poll Status - `class BetaFederationIssuerPollStatus` Status of automatic JWKS polling for a federation issuer. Anthropic periodically fetches the issuer's signing keys in the background. These fields summarize the most recent fetches so the health of the JWKS endpoint can be monitored. - `long consecutiveFailures` Consecutive fetch failures since the last success. - `Optional lastFetchedAt` When the last successful fetch completed. format: date-time - `Optional nextPollAt` When the next fetch is scheduled. Null if paused. format: date-time ### Beta JWKS Discovery - `class BetaJwksDiscovery` JWKS via the issuer's OIDC discovery document. - `JsonValue type = "discovery"` - `Optional caCertPem` Optional custom CA (PEM) for TLS verification of the JWKS fetch. maxLength: 8192 - `Optional discoveryBase` Set when the discovery URL differs from `issuer_url`. ### Beta JWKS Explicit URL - `class BetaJwksExplicitUrl` JWKS fetched from a fixed endpoint. - `JsonValue type = "explicit_url"` - `String url` JWKS endpoint. minLength: 1 - `Optional caCertPem` Optional custom CA (PEM) for TLS verification of the JWKS fetch. maxLength: 8192 ### Beta JWKS Inline - `class BetaJwksInline` JWKS supplied directly; no network fetch. - `JsonValue type = "inline"` - `List keys` Inline JWK objects. minItems: 1