Get an issuer

⚠️
Preview — this feature is being built; the design below is the spec.
GET https://app.syntic.ai/v1/organizations/federation/issuers/{issuer_id}

Return one issuer, including when its keys were last refreshed.

For how this fits into a full workflow, see Workload identity.

Headers

HeaderRequiredValue
AuthorizationYesBearer <admin key>: an Admin API key (sk_admin_...). Inference keys are refused with 403 admin_key_required. See Admin API keys.
syntic-betaYes, while in previewadmin-2026-11-01. Without it the call fails with 400 beta_required. See Versioning.

Path parameters

ParameterTypeDescription
issuer_idstringThe issuer id, starting with fiss_.

Response

200 OK, Content-Type: application/json

{
  "id": "fiss_01JCJ8L0N2Q4S6U8W0Y2",
  "type": "federation_issuer",
  "issuer": "https://gitlab.internal.example.com",
  "display_name": "Self-managed GitLab",
  "jwks_uri": "https://gitlab.internal.example.com/oauth/discovery/keys",
  "discovery": "oidc",
  "allowed_algorithms": [
    "RS256",
    "ES256"
  ],
  "status": "verified",
  "keys_refreshed_at": "2026-11-05T09:00:00Z",
  "created_at": "2026-10-18T12:00:00Z"
}
FieldTypeDescription
issuerstringMust match the iss claim exactly, including scheme and no trailing slash.
jwks_uristringWhere signing keys are fetched. Found through OIDC discovery unless set by hand.
discoverystringoidc (keys located through /.well-known/openid-configuration) or static (jwks_uri given directly).
allowed_algorithmsarraySignature algorithms accepted. none and HMAC algorithms are never accepted.
statusstringverified once keys were fetched, unreachable if the last three refreshes failed.
keys_refreshed_atstringKeys are refreshed hourly and on an unknown kid.

Examples

curl -sS "https://app.syntic.ai/v1/organizations/federation/issuers/fiss_01JCJ8L0N2Q4S6U8W0Y2" \
  -H "Authorization: Bearer $SYNTIC_ADMIN_KEY" \
  -H "syntic-beta: admin-2026-11-01"

Errors

Errors use the error envelope and carry a request_id. Codes specific to this operation:

StatustypecodeWhen
400invalid_request_errorbeta_requiredThe syntic-beta header is missing.
404not_found_errorissuer_not_foundNo registered issuer with this id.
401authentication_errorinvalid_api_keyThe admin key is missing, unknown, revoked or expired.
403permission_erroradmin_key_requiredAn inference key was used.
429rate_limit_errorrate_limitedToo many requests; wait for Retry-After. See Rate-limit headers.
Was this page helpful?