--- title: Issuers url: https://platform.claude.com/docs/en/api/java/organization/federation/issuers --- # Issuers ## Create Federation Issuer `FederationIssuer organization().federation().issuers().create(params, requestOptions = RequestOptions.none())` **POST** `/v1/organizations/federation_issuers` **Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=java). Register an OIDC issuer that Anthropic will trust for workload identity federation in your organization. The `jwks` field controls how the issuer's signing keys are obtained and takes one of three shapes selected by `type`: `discovery` (resolve keys through OIDC discovery), `explicit_url` (fetch keys from a fixed JWKS URL), or `inline` (provide a static key set). When `jwks.type` is `discovery` and no `discovery_base` is set, the issuer URL must be publicly reachable over HTTPS so Anthropic can fetch the discovery document; for `explicit_url` and `inline` modes the issuer URL is only matched as the JWT's `iss` claim and is not fetched. ### Parameters - `IssuerCreateParams params` - `String issuerUrl` The `iss` claim value to match against. minLength: 1 - `String name` Slug identifier (lowercase, digits, hyphens). Unique within the organization; a duplicate name returns 409. minLength: 1, maxLength: 255 - `Optional checkJti` Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Defaults to true. Applies only to assertions carrying a `jti` claim; tokens without one are accepted without single-use enforcement. - `Optional jwks` How signing keys are obtained. Defaults to OIDC discovery. - `class JwksDiscovery` JWKS via the issuer's OIDC discovery document. - `JsonValue type = "discovery"` - `Optional caCertPem` Optional custom CA (PEM) for TLS verification of the JWKS fetch. maxLength: 8192 - `Optional discoveryBase` Set when the discovery URL differs from `issuer_url`. - `class JwksExplicitUrl` JWKS fetched from a fixed endpoint. - `JsonValue type = "explicit_url"` - `String url` JWKS endpoint. minLength: 1 - `Optional caCertPem` Optional custom CA (PEM) for TLS verification of the JWKS fetch. maxLength: 8192 - `class JwksInline` JWKS supplied directly; no network fetch. - `JsonValue type = "inline"` - `List keys` Inline JWK objects. minItems: 1 - `Optional maxJwtLifetimeSeconds` Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Defaults to 3600 (1h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected. minimum: 1, maximum: 176400 ### Returns - `class FederationIssuer` Registered external OIDC identity provider. Records an external IdP the organization trusts for the RFC 7523 jwt-bearer grant. The `issuer_url` must match the JWT `iss` claim exactly. - `JsonValue type = "federation_issuer"` - `String id` Tagged ID of the federation issuer. - `Optional archivedAt` If set, all rules referencing this issuer reject token exchange. format: date-time - `Optional archivedByActorId` Tagged ID (`user_`/`svac_`) of the actor that archived this issuer. - `boolean checkJti` Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Applies only to assertions carrying a `jti` claim; tokens without one are accepted without single-use enforcement. - `LocalDateTime createdAt` When this issuer was created. format: date-time - `Optional createdByActorId` Tagged ID (`user_`/`svac_`) of the actor that created this issuer. - `String issuerUrl` The `iss` claim value. Incoming JWTs must match exactly. - `Jwks jwks` How signing keys are obtained for signature verification. - `class JwksDiscovery` JWKS via the issuer's OIDC discovery document. - `JsonValue type = "discovery"` - `Optional caCertPem` Optional custom CA (PEM) for TLS verification of the JWKS fetch. maxLength: 8192 - `Optional discoveryBase` Set when the discovery URL differs from `issuer_url`. - `class JwksExplicitUrl` JWKS fetched from a fixed endpoint. - `JsonValue type = "explicit_url"` - `String url` JWKS endpoint. minLength: 1 - `Optional caCertPem` Optional custom CA (PEM) for TLS verification of the JWKS fetch. maxLength: 8192 - `class JwksInline` JWKS supplied directly; no network fetch. - `JsonValue type = "inline"` - `List keys` Inline JWK objects. minItems: 1 - `Optional jwksPollingDisabledAt` If set, Anthropic's JWKS poller has paused polling for this issuer after repeated fetch failures. Re-enable by sending `jwks_polling_disabled: false` via the issuer update endpoint (POST) once the upstream JWKS endpoint is fixed. An OAuth caller cannot send this when the issuer backs a rule with any scope other than `workspace:developer` or `workspace:inference`; use a Console session. format: date-time - `long maxJwtLifetimeSeconds` Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected. - `String name` Admin-chosen slug identifier. - `Optional pollStatus` Live state of Anthropic's JWKS polling for this issuer. Populated on both single-issuer retrieval and list responses, including archived issuers. Typically null for inline-key issuers (no polling), or when poll status is temporarily unavailable or polling has not started yet. - `long consecutiveFailures` Consecutive fetch failures since the last success. - `Optional lastFetchedAt` When the last successful fetch completed. format: date-time - `Optional nextPollAt` When the next fetch is scheduled. Null if paused. format: date-time - `LocalDateTime updatedAt` When this issuer was last updated. format: date-time - `Optional updatedByActorId` Tagged ID (`user_`/`svac_`) of the actor that last updated this issuer. ### Example ```java package com.anthropic.example; import com.anthropic.client.AnthropicClient; import com.anthropic.client.okhttp.AnthropicOkHttpClient; import com.anthropic.models.organization.federation.issuers.FederationIssuer; import com.anthropic.models.organization.federation.issuers.IssuerCreateParams; public final class Main { private Main() {} public static void main(String[] args) { AnthropicClient client = AnthropicOkHttpClient.fromEnv(); IssuerCreateParams params = IssuerCreateParams.builder() .issuerUrl("x") .name("x") .build(); FederationIssuer federationIssuer = client.organization().federation().issuers().create(params); } } ``` #### Response (200) ```json { "id": "fdis_01SDCCSbTxrXDpWc1phhtcfK", "archived_at": "2019-12-27T18:11:19.117Z", "archived_by_actor_id": "archived_by_actor_id", "check_jti": true, "created_at": "2024-10-30T23:58:27.427722Z", "created_by_actor_id": "created_by_actor_id", "issuer_url": "https://token.actions.githubusercontent.com", "jwks": { "type": "discovery", "ca_cert_pem": "ca_cert_pem", "discovery_base": "discovery_base" }, "jwks_polling_disabled_at": "2019-12-27T18:11:19.117Z", "max_jwt_lifetime_seconds": 0, "name": "github-actions", "poll_status": { "consecutive_failures": 0, "last_fetched_at": "2019-12-27T18:11:19.117Z", "next_poll_at": "2019-12-27T18:11:19.117Z" }, "type": "federation_issuer", "updated_at": "2024-10-30T23:58:27.427722Z", "updated_by_actor_id": "updated_by_actor_id" } ``` ## List Federation Issuers `IssuerListPage organization().federation().issuers().list(params = IssuerListParams.none(), requestOptions = RequestOptions.none())` **GET** `/v1/organizations/federation_issuers` **Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=java). List federation issuers in your organization. Archived issuers are excluded unless `include_archived=true`. ### Parameters - `IssuerListParams params` - `Optional includeArchived` (query parameter) Include archived resources. Defaults to false. - `Optional limit` (query parameter) Number of results per page. minimum: 1, maximum: 100 - `Optional page` (query parameter) Opaque cursor from a previous response's `next_page`. ### Returns - `class FederationIssuer` Registered external OIDC identity provider. Records an external IdP the organization trusts for the RFC 7523 jwt-bearer grant. The `issuer_url` must match the JWT `iss` claim exactly. - `JsonValue type = "federation_issuer"` - `String id` Tagged ID of the federation issuer. - `Optional archivedAt` If set, all rules referencing this issuer reject token exchange. format: date-time - `Optional archivedByActorId` Tagged ID (`user_`/`svac_`) of the actor that archived this issuer. - `boolean checkJti` Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Applies only to assertions carrying a `jti` claim; tokens without one are accepted without single-use enforcement. - `LocalDateTime createdAt` When this issuer was created. format: date-time - `Optional createdByActorId` Tagged ID (`user_`/`svac_`) of the actor that created this issuer. - `String issuerUrl` The `iss` claim value. Incoming JWTs must match exactly. - `Jwks jwks` How signing keys are obtained for signature verification. - `class JwksDiscovery` JWKS via the issuer's OIDC discovery document. - `JsonValue type = "discovery"` - `Optional caCertPem` Optional custom CA (PEM) for TLS verification of the JWKS fetch. maxLength: 8192 - `Optional discoveryBase` Set when the discovery URL differs from `issuer_url`. - `class JwksExplicitUrl` JWKS fetched from a fixed endpoint. - `JsonValue type = "explicit_url"` - `String url` JWKS endpoint. minLength: 1 - `Optional caCertPem` Optional custom CA (PEM) for TLS verification of the JWKS fetch. maxLength: 8192 - `class JwksInline` JWKS supplied directly; no network fetch. - `JsonValue type = "inline"` - `List keys` Inline JWK objects. minItems: 1 - `Optional jwksPollingDisabledAt` If set, Anthropic's JWKS poller has paused polling for this issuer after repeated fetch failures. Re-enable by sending `jwks_polling_disabled: false` via the issuer update endpoint (POST) once the upstream JWKS endpoint is fixed. An OAuth caller cannot send this when the issuer backs a rule with any scope other than `workspace:developer` or `workspace:inference`; use a Console session. format: date-time - `long maxJwtLifetimeSeconds` Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected. - `String name` Admin-chosen slug identifier. - `Optional pollStatus` Live state of Anthropic's JWKS polling for this issuer. Populated on both single-issuer retrieval and list responses, including archived issuers. Typically null for inline-key issuers (no polling), or when poll status is temporarily unavailable or polling has not started yet. - `long consecutiveFailures` Consecutive fetch failures since the last success. - `Optional lastFetchedAt` When the last successful fetch completed. format: date-time - `Optional nextPollAt` When the next fetch is scheduled. Null if paused. format: date-time - `LocalDateTime updatedAt` When this issuer was last updated. format: date-time - `Optional updatedByActorId` Tagged ID (`user_`/`svac_`) of the actor that last updated this issuer. ### Example ```java package com.anthropic.example; import com.anthropic.client.AnthropicClient; import com.anthropic.client.okhttp.AnthropicOkHttpClient; import com.anthropic.models.organization.federation.issuers.IssuerListPage; import com.anthropic.models.organization.federation.issuers.IssuerListParams; public final class Main { private Main() {} public static void main(String[] args) { AnthropicClient client = AnthropicOkHttpClient.fromEnv(); IssuerListPage page = client.organization().federation().issuers().list(); } } ``` #### Response (200) ```json { "data": [ { "id": "fdis_01SDCCSbTxrXDpWc1phhtcfK", "archived_at": "2019-12-27T18:11:19.117Z", "archived_by_actor_id": "archived_by_actor_id", "check_jti": true, "created_at": "2024-10-30T23:58:27.427722Z", "created_by_actor_id": "created_by_actor_id", "issuer_url": "https://token.actions.githubusercontent.com", "jwks": { "type": "discovery", "ca_cert_pem": "ca_cert_pem", "discovery_base": "discovery_base" }, "jwks_polling_disabled_at": "2019-12-27T18:11:19.117Z", "max_jwt_lifetime_seconds": 0, "name": "github-actions", "poll_status": { "consecutive_failures": 0, "last_fetched_at": "2019-12-27T18:11:19.117Z", "next_poll_at": "2019-12-27T18:11:19.117Z" }, "type": "federation_issuer", "updated_at": "2024-10-30T23:58:27.427722Z", "updated_by_actor_id": "updated_by_actor_id" } ], "next_page": "next_page" } ``` ## Get Federation Issuer `FederationIssuer organization().federation().issuers().retrieve(params = IssuerRetrieveParams.none(), requestOptions = RequestOptions.none())` **GET** `/v1/organizations/federation_issuers/{federation_issuer_id}` **Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=java). Retrieve a federation issuer by its ID (`fdis_...`). ### Parameters - `IssuerRetrieveParams params` - `Optional federationIssuerId` (path parameter) ID of the federation issuer. ### Returns - `class FederationIssuer` Registered external OIDC identity provider. Records an external IdP the organization trusts for the RFC 7523 jwt-bearer grant. The `issuer_url` must match the JWT `iss` claim exactly. - `JsonValue type = "federation_issuer"` - `String id` Tagged ID of the federation issuer. - `Optional archivedAt` If set, all rules referencing this issuer reject token exchange. format: date-time - `Optional archivedByActorId` Tagged ID (`user_`/`svac_`) of the actor that archived this issuer. - `boolean checkJti` Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Applies only to assertions carrying a `jti` claim; tokens without one are accepted without single-use enforcement. - `LocalDateTime createdAt` When this issuer was created. format: date-time - `Optional createdByActorId` Tagged ID (`user_`/`svac_`) of the actor that created this issuer. - `String issuerUrl` The `iss` claim value. Incoming JWTs must match exactly. - `Jwks jwks` How signing keys are obtained for signature verification. - `class JwksDiscovery` JWKS via the issuer's OIDC discovery document. - `JsonValue type = "discovery"` - `Optional caCertPem` Optional custom CA (PEM) for TLS verification of the JWKS fetch. maxLength: 8192 - `Optional discoveryBase` Set when the discovery URL differs from `issuer_url`. - `class JwksExplicitUrl` JWKS fetched from a fixed endpoint. - `JsonValue type = "explicit_url"` - `String url` JWKS endpoint. minLength: 1 - `Optional caCertPem` Optional custom CA (PEM) for TLS verification of the JWKS fetch. maxLength: 8192 - `class JwksInline` JWKS supplied directly; no network fetch. - `JsonValue type = "inline"` - `List keys` Inline JWK objects. minItems: 1 - `Optional jwksPollingDisabledAt` If set, Anthropic's JWKS poller has paused polling for this issuer after repeated fetch failures. Re-enable by sending `jwks_polling_disabled: false` via the issuer update endpoint (POST) once the upstream JWKS endpoint is fixed. An OAuth caller cannot send this when the issuer backs a rule with any scope other than `workspace:developer` or `workspace:inference`; use a Console session. format: date-time - `long maxJwtLifetimeSeconds` Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected. - `String name` Admin-chosen slug identifier. - `Optional pollStatus` Live state of Anthropic's JWKS polling for this issuer. Populated on both single-issuer retrieval and list responses, including archived issuers. Typically null for inline-key issuers (no polling), or when poll status is temporarily unavailable or polling has not started yet. - `long consecutiveFailures` Consecutive fetch failures since the last success. - `Optional lastFetchedAt` When the last successful fetch completed. format: date-time - `Optional nextPollAt` When the next fetch is scheduled. Null if paused. format: date-time - `LocalDateTime updatedAt` When this issuer was last updated. format: date-time - `Optional updatedByActorId` Tagged ID (`user_`/`svac_`) of the actor that last updated this issuer. ### Example ```java package com.anthropic.example; import com.anthropic.client.AnthropicClient; import com.anthropic.client.okhttp.AnthropicOkHttpClient; import com.anthropic.models.organization.federation.issuers.FederationIssuer; import com.anthropic.models.organization.federation.issuers.IssuerRetrieveParams; public final class Main { private Main() {} public static void main(String[] args) { AnthropicClient client = AnthropicOkHttpClient.fromEnv(); FederationIssuer federationIssuer = client.organization().federation().issuers().retrieve("federation_issuer_id"); } } ``` #### Response (200) ```json { "id": "fdis_01SDCCSbTxrXDpWc1phhtcfK", "archived_at": "2019-12-27T18:11:19.117Z", "archived_by_actor_id": "archived_by_actor_id", "check_jti": true, "created_at": "2024-10-30T23:58:27.427722Z", "created_by_actor_id": "created_by_actor_id", "issuer_url": "https://token.actions.githubusercontent.com", "jwks": { "type": "discovery", "ca_cert_pem": "ca_cert_pem", "discovery_base": "discovery_base" }, "jwks_polling_disabled_at": "2019-12-27T18:11:19.117Z", "max_jwt_lifetime_seconds": 0, "name": "github-actions", "poll_status": { "consecutive_failures": 0, "last_fetched_at": "2019-12-27T18:11:19.117Z", "next_poll_at": "2019-12-27T18:11:19.117Z" }, "type": "federation_issuer", "updated_at": "2024-10-30T23:58:27.427722Z", "updated_by_actor_id": "updated_by_actor_id" } ``` ## Update Federation Issuer `FederationIssuer organization().federation().issuers().update(params = IssuerUpdateParams.none(), requestOptions = RequestOptions.none())` **POST** `/v1/organizations/federation_issuers/{federation_issuer_id}` **Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=java). Partially update a federation issuer. Setting `jwks` replaces the full JWKS shape at once. Archived issuers cannot be updated; this returns 400. Create a new issuer instead. Updating an issuer that backs a rule with a scope outside `workspace:developer` or `workspace:inference` requires a Console session. ### Parameters - `IssuerUpdateParams params` - `Optional federationIssuerId` (path parameter) ID of the federation issuer to update. - `Optional checkJti` Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Applies only to assertions carrying a `jti` claim; tokens without one are accepted without single-use enforcement. - `Optional issuerUrl` Replaces the `iss` claim value to match against. For discovery-mode issuers without a `discovery_base`, this is also the URL Anthropic fetches the OIDC discovery document and signing keys from, so changing it repoints the JWKS source. Changing the issuer URL to a well-known shared platform is rejected while any live rule under this issuer would not constrain tenant identity. minLength: 1 - `Optional jwks` Replaces the entire JWKS configuration. - `class JwksDiscovery` JWKS via the issuer's OIDC discovery document. - `JsonValue type = "discovery"` - `Optional caCertPem` Optional custom CA (PEM) for TLS verification of the JWKS fetch. maxLength: 8192 - `Optional discoveryBase` Set when the discovery URL differs from `issuer_url`. - `class JwksExplicitUrl` JWKS fetched from a fixed endpoint. - `JsonValue type = "explicit_url"` - `String url` JWKS endpoint. minLength: 1 - `Optional caCertPem` Optional custom CA (PEM) for TLS verification of the JWKS fetch. maxLength: 8192 - `class JwksInline` JWKS supplied directly; no network fetch. - `JsonValue type = "inline"` - `List keys` Inline JWK objects. minItems: 1 - `Optional jwksPollingDisabled` Only `false` is accepted, to re-enable polling after the system pauses it. Polling is paused automatically; sending `true` is rejected. - `Optional maxJwtLifetimeSeconds` Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected. minimum: 1, maximum: 176400 - `Optional name` Replaces the slug identifier (lowercase, digits, hyphens). Unique within the organization; a duplicate name returns 409. minLength: 1, maxLength: 255 ### Returns - `class FederationIssuer` Registered external OIDC identity provider. Records an external IdP the organization trusts for the RFC 7523 jwt-bearer grant. The `issuer_url` must match the JWT `iss` claim exactly. - `JsonValue type = "federation_issuer"` - `String id` Tagged ID of the federation issuer. - `Optional archivedAt` If set, all rules referencing this issuer reject token exchange. format: date-time - `Optional archivedByActorId` Tagged ID (`user_`/`svac_`) of the actor that archived this issuer. - `boolean checkJti` Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Applies only to assertions carrying a `jti` claim; tokens without one are accepted without single-use enforcement. - `LocalDateTime createdAt` When this issuer was created. format: date-time - `Optional createdByActorId` Tagged ID (`user_`/`svac_`) of the actor that created this issuer. - `String issuerUrl` The `iss` claim value. Incoming JWTs must match exactly. - `Jwks jwks` How signing keys are obtained for signature verification. - `class JwksDiscovery` JWKS via the issuer's OIDC discovery document. - `JsonValue type = "discovery"` - `Optional caCertPem` Optional custom CA (PEM) for TLS verification of the JWKS fetch. maxLength: 8192 - `Optional discoveryBase` Set when the discovery URL differs from `issuer_url`. - `class JwksExplicitUrl` JWKS fetched from a fixed endpoint. - `JsonValue type = "explicit_url"` - `String url` JWKS endpoint. minLength: 1 - `Optional caCertPem` Optional custom CA (PEM) for TLS verification of the JWKS fetch. maxLength: 8192 - `class JwksInline` JWKS supplied directly; no network fetch. - `JsonValue type = "inline"` - `List keys` Inline JWK objects. minItems: 1 - `Optional jwksPollingDisabledAt` If set, Anthropic's JWKS poller has paused polling for this issuer after repeated fetch failures. Re-enable by sending `jwks_polling_disabled: false` via the issuer update endpoint (POST) once the upstream JWKS endpoint is fixed. An OAuth caller cannot send this when the issuer backs a rule with any scope other than `workspace:developer` or `workspace:inference`; use a Console session. format: date-time - `long maxJwtLifetimeSeconds` Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected. - `String name` Admin-chosen slug identifier. - `Optional pollStatus` Live state of Anthropic's JWKS polling for this issuer. Populated on both single-issuer retrieval and list responses, including archived issuers. Typically null for inline-key issuers (no polling), or when poll status is temporarily unavailable or polling has not started yet. - `long consecutiveFailures` Consecutive fetch failures since the last success. - `Optional lastFetchedAt` When the last successful fetch completed. format: date-time - `Optional nextPollAt` When the next fetch is scheduled. Null if paused. format: date-time - `LocalDateTime updatedAt` When this issuer was last updated. format: date-time - `Optional updatedByActorId` Tagged ID (`user_`/`svac_`) of the actor that last updated this issuer. ### Example ```java package com.anthropic.example; import com.anthropic.client.AnthropicClient; import com.anthropic.client.okhttp.AnthropicOkHttpClient; import com.anthropic.models.organization.federation.issuers.FederationIssuer; import com.anthropic.models.organization.federation.issuers.IssuerUpdateParams; public final class Main { private Main() {} public static void main(String[] args) { AnthropicClient client = AnthropicOkHttpClient.fromEnv(); FederationIssuer federationIssuer = client.organization().federation().issuers().update("federation_issuer_id"); } } ``` #### Response (200) ```json { "id": "fdis_01SDCCSbTxrXDpWc1phhtcfK", "archived_at": "2019-12-27T18:11:19.117Z", "archived_by_actor_id": "archived_by_actor_id", "check_jti": true, "created_at": "2024-10-30T23:58:27.427722Z", "created_by_actor_id": "created_by_actor_id", "issuer_url": "https://token.actions.githubusercontent.com", "jwks": { "type": "discovery", "ca_cert_pem": "ca_cert_pem", "discovery_base": "discovery_base" }, "jwks_polling_disabled_at": "2019-12-27T18:11:19.117Z", "max_jwt_lifetime_seconds": 0, "name": "github-actions", "poll_status": { "consecutive_failures": 0, "last_fetched_at": "2019-12-27T18:11:19.117Z", "next_poll_at": "2019-12-27T18:11:19.117Z" }, "type": "federation_issuer", "updated_at": "2024-10-30T23:58:27.427722Z", "updated_by_actor_id": "updated_by_actor_id" } ``` ## Archive Federation Issuer `FederationIssuer organization().federation().issuers().archive(params = IssuerArchiveParams.none(), requestOptions = RequestOptions.none())` **POST** `/v1/organizations/federation_issuers/{federation_issuer_id}/archive` **Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=java). Archive a federation issuer. Idempotent; re-archiving returns the issuer with its original `archived_at`. Rejected with 400 if any live (non-archived) federation rule still references the issuer; archive those rules first (a rule's issuer cannot be changed), or recreate them against another issuer. ### Parameters - `IssuerArchiveParams params` - `Optional federationIssuerId` (path parameter) ID of the federation issuer to archive. ### Returns - `class FederationIssuer` Registered external OIDC identity provider. Records an external IdP the organization trusts for the RFC 7523 jwt-bearer grant. The `issuer_url` must match the JWT `iss` claim exactly. - `JsonValue type = "federation_issuer"` - `String id` Tagged ID of the federation issuer. - `Optional archivedAt` If set, all rules referencing this issuer reject token exchange. format: date-time - `Optional archivedByActorId` Tagged ID (`user_`/`svac_`) of the actor that archived this issuer. - `boolean checkJti` Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Applies only to assertions carrying a `jti` claim; tokens without one are accepted without single-use enforcement. - `LocalDateTime createdAt` When this issuer was created. format: date-time - `Optional createdByActorId` Tagged ID (`user_`/`svac_`) of the actor that created this issuer. - `String issuerUrl` The `iss` claim value. Incoming JWTs must match exactly. - `Jwks jwks` How signing keys are obtained for signature verification. - `class JwksDiscovery` JWKS via the issuer's OIDC discovery document. - `JsonValue type = "discovery"` - `Optional caCertPem` Optional custom CA (PEM) for TLS verification of the JWKS fetch. maxLength: 8192 - `Optional discoveryBase` Set when the discovery URL differs from `issuer_url`. - `class JwksExplicitUrl` JWKS fetched from a fixed endpoint. - `JsonValue type = "explicit_url"` - `String url` JWKS endpoint. minLength: 1 - `Optional caCertPem` Optional custom CA (PEM) for TLS verification of the JWKS fetch. maxLength: 8192 - `class JwksInline` JWKS supplied directly; no network fetch. - `JsonValue type = "inline"` - `List keys` Inline JWK objects. minItems: 1 - `Optional jwksPollingDisabledAt` If set, Anthropic's JWKS poller has paused polling for this issuer after repeated fetch failures. Re-enable by sending `jwks_polling_disabled: false` via the issuer update endpoint (POST) once the upstream JWKS endpoint is fixed. An OAuth caller cannot send this when the issuer backs a rule with any scope other than `workspace:developer` or `workspace:inference`; use a Console session. format: date-time - `long maxJwtLifetimeSeconds` Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected. - `String name` Admin-chosen slug identifier. - `Optional pollStatus` Live state of Anthropic's JWKS polling for this issuer. Populated on both single-issuer retrieval and list responses, including archived issuers. Typically null for inline-key issuers (no polling), or when poll status is temporarily unavailable or polling has not started yet. - `long consecutiveFailures` Consecutive fetch failures since the last success. - `Optional lastFetchedAt` When the last successful fetch completed. format: date-time - `Optional nextPollAt` When the next fetch is scheduled. Null if paused. format: date-time - `LocalDateTime updatedAt` When this issuer was last updated. format: date-time - `Optional updatedByActorId` Tagged ID (`user_`/`svac_`) of the actor that last updated this issuer. ### Example ```java package com.anthropic.example; import com.anthropic.client.AnthropicClient; import com.anthropic.client.okhttp.AnthropicOkHttpClient; import com.anthropic.models.organization.federation.issuers.FederationIssuer; import com.anthropic.models.organization.federation.issuers.IssuerArchiveParams; public final class Main { private Main() {} public static void main(String[] args) { AnthropicClient client = AnthropicOkHttpClient.fromEnv(); FederationIssuer federationIssuer = client.organization().federation().issuers().archive("federation_issuer_id"); } } ``` #### Response (200) ```json { "id": "fdis_01SDCCSbTxrXDpWc1phhtcfK", "archived_at": "2019-12-27T18:11:19.117Z", "archived_by_actor_id": "archived_by_actor_id", "check_jti": true, "created_at": "2024-10-30T23:58:27.427722Z", "created_by_actor_id": "created_by_actor_id", "issuer_url": "https://token.actions.githubusercontent.com", "jwks": { "type": "discovery", "ca_cert_pem": "ca_cert_pem", "discovery_base": "discovery_base" }, "jwks_polling_disabled_at": "2019-12-27T18:11:19.117Z", "max_jwt_lifetime_seconds": 0, "name": "github-actions", "poll_status": { "consecutive_failures": 0, "last_fetched_at": "2019-12-27T18:11:19.117Z", "next_poll_at": "2019-12-27T18:11:19.117Z" }, "type": "federation_issuer", "updated_at": "2024-10-30T23:58:27.427722Z", "updated_by_actor_id": "updated_by_actor_id" } ``` ## Domain types ### Federation Issuer - `class FederationIssuer` Registered external OIDC identity provider. Records an external IdP the organization trusts for the RFC 7523 jwt-bearer grant. The `issuer_url` must match the JWT `iss` claim exactly. - `JsonValue type = "federation_issuer"` - `String id` Tagged ID of the federation issuer. - `Optional archivedAt` If set, all rules referencing this issuer reject token exchange. format: date-time - `Optional archivedByActorId` Tagged ID (`user_`/`svac_`) of the actor that archived this issuer. - `boolean checkJti` Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Applies only to assertions carrying a `jti` claim; tokens without one are accepted without single-use enforcement. - `LocalDateTime createdAt` When this issuer was created. format: date-time - `Optional createdByActorId` Tagged ID (`user_`/`svac_`) of the actor that created this issuer. - `String issuerUrl` The `iss` claim value. Incoming JWTs must match exactly. - `Jwks jwks` How signing keys are obtained for signature verification. - `class JwksDiscovery` JWKS via the issuer's OIDC discovery document. - `JsonValue type = "discovery"` - `Optional caCertPem` Optional custom CA (PEM) for TLS verification of the JWKS fetch. maxLength: 8192 - `Optional discoveryBase` Set when the discovery URL differs from `issuer_url`. - `class JwksExplicitUrl` JWKS fetched from a fixed endpoint. - `JsonValue type = "explicit_url"` - `String url` JWKS endpoint. minLength: 1 - `Optional caCertPem` Optional custom CA (PEM) for TLS verification of the JWKS fetch. maxLength: 8192 - `class JwksInline` JWKS supplied directly; no network fetch. - `JsonValue type = "inline"` - `List keys` Inline JWK objects. minItems: 1 - `Optional jwksPollingDisabledAt` If set, Anthropic's JWKS poller has paused polling for this issuer after repeated fetch failures. Re-enable by sending `jwks_polling_disabled: false` via the issuer update endpoint (POST) once the upstream JWKS endpoint is fixed. An OAuth caller cannot send this when the issuer backs a rule with any scope other than `workspace:developer` or `workspace:inference`; use a Console session. format: date-time - `long maxJwtLifetimeSeconds` Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected. - `String name` Admin-chosen slug identifier. - `Optional pollStatus` Live state of Anthropic's JWKS polling for this issuer. Populated on both single-issuer retrieval and list responses, including archived issuers. Typically null for inline-key issuers (no polling), or when poll status is temporarily unavailable or polling has not started yet. - `long consecutiveFailures` Consecutive fetch failures since the last success. - `Optional lastFetchedAt` When the last successful fetch completed. format: date-time - `Optional nextPollAt` When the next fetch is scheduled. Null if paused. format: date-time - `LocalDateTime updatedAt` When this issuer was last updated. format: date-time - `Optional updatedByActorId` Tagged ID (`user_`/`svac_`) of the actor that last updated this issuer. ### Federation Issuer Poll Status - `class FederationIssuerPollStatus` Status of automatic JWKS polling for a federation issuer. Anthropic periodically fetches the issuer's signing keys in the background. These fields summarize the most recent fetches so the health of the JWKS endpoint can be monitored. - `long consecutiveFailures` Consecutive fetch failures since the last success. - `Optional lastFetchedAt` When the last successful fetch completed. format: date-time - `Optional nextPollAt` When the next fetch is scheduled. Null if paused. format: date-time ### JWKS Discovery - `class JwksDiscovery` JWKS via the issuer's OIDC discovery document. - `JsonValue type = "discovery"` - `Optional caCertPem` Optional custom CA (PEM) for TLS verification of the JWKS fetch. maxLength: 8192 - `Optional discoveryBase` Set when the discovery URL differs from `issuer_url`. ### JWKS Explicit URL - `class JwksExplicitUrl` JWKS fetched from a fixed endpoint. - `JsonValue type = "explicit_url"` - `String url` JWKS endpoint. minLength: 1 - `Optional caCertPem` Optional custom CA (PEM) for TLS verification of the JWKS fetch. maxLength: 8192 ### JWKS Inline - `class JwksInline` JWKS supplied directly; no network fetch. - `JsonValue type = "inline"` - `List keys` Inline JWK objects. minItems: 1