Get an issuer
⚠️
Preview — this feature is being built; the design below is the spec.
GET https://app.syntic.ai/v1/organizations/federation/issuers/{issuer_id}Return one issuer, including when its keys were last refreshed.
For how this fits into a full workflow, see Workload identity.
Headers
| Header | Required | Value |
|---|---|---|
Authorization | Yes | Bearer <admin key>: an Admin API key (sk_admin_...). Inference keys are refused with 403 admin_key_required. See Admin API keys. |
syntic-beta | Yes, while in preview | admin-2026-11-01. Without it the call fails with 400 beta_required. See Versioning. |
Path parameters
| Parameter | Type | Description |
|---|---|---|
issuer_id | string | The issuer id, starting with fiss_. |
Response
200 OK, Content-Type: application/json
{
"id": "fiss_01JCJ8L0N2Q4S6U8W0Y2",
"type": "federation_issuer",
"issuer": "https://gitlab.internal.example.com",
"display_name": "Self-managed GitLab",
"jwks_uri": "https://gitlab.internal.example.com/oauth/discovery/keys",
"discovery": "oidc",
"allowed_algorithms": [
"RS256",
"ES256"
],
"status": "verified",
"keys_refreshed_at": "2026-11-05T09:00:00Z",
"created_at": "2026-10-18T12:00:00Z"
}| Field | Type | Description |
|---|---|---|
issuer | string | Must match the iss claim exactly, including scheme and no trailing slash. |
jwks_uri | string | Where signing keys are fetched. Found through OIDC discovery unless set by hand. |
discovery | string | oidc (keys located through /.well-known/openid-configuration) or static (jwks_uri given directly). |
allowed_algorithms | array | Signature algorithms accepted. none and HMAC algorithms are never accepted. |
status | string | verified once keys were fetched, unreachable if the last three refreshes failed. |
keys_refreshed_at | string | Keys are refreshed hourly and on an unknown kid. |
Examples
curl -sS "https://app.syntic.ai/v1/organizations/federation/issuers/fiss_01JCJ8L0N2Q4S6U8W0Y2" \
-H "Authorization: Bearer $SYNTIC_ADMIN_KEY" \
-H "syntic-beta: admin-2026-11-01"Errors
Errors use the error envelope and carry a request_id. Codes specific to this operation:
| Status | type | code | When |
|---|---|---|---|
| 400 | invalid_request_error | beta_required | The syntic-beta header is missing. |
| 404 | not_found_error | issuer_not_found | No registered issuer with this id. |
| 401 | authentication_error | invalid_api_key | The admin key is missing, unknown, revoked or expired. |
| 403 | permission_error | admin_key_required | An inference key was used. |
| 429 | rate_limit_error | rate_limited | Too many requests; wait for Retry-After. See Rate-limit headers. |
Was this page helpful?