The federation issuer object

⚠️

Preview — this feature is being built; the design below is the spec.

The federation_issuer object as the API returns it. Every field below appears in every response that returns this object; fields with no value are null rather than missing.

Example

{
  "id": "fiss_01JCJ8L0N2Q4S6U8W0Y2",
  "type": "federation_issuer",
  "issuer": "https://gitlab.internal.example.com",
  "display_name": "Self-managed GitLab",
  "jwks_uri": "https://gitlab.internal.example.com/oauth/discovery/keys",
  "discovery": "oidc",
  "allowed_algorithms": [
    "RS256",
    "ES256"
  ],
  "status": "verified",
  "keys_refreshed_at": "2026-11-05T10:00:01Z",
  "created_at": "2026-10-18T12:00:00Z"
}

Fields

Field	Type	Description
`id`	string	Unique id of this object.
`type`	string	The object type, always `federation_issuer`.
`issuer`	string	Must match the `iss` claim exactly, including scheme and no trailing slash.
`display_name`	string	See the endpoint pages below.
`jwks_uri`	string	Where signing keys are fetched. Found through OIDC discovery unless set by hand.
`discovery`	string	`oidc` (keys located through `/.well-known/openid-configuration`) or `static` (`jwks_uri` given directly).
`allowed_algorithms`	array	Signature algorithms accepted. `none` and HMAC algorithms are never accepted.
`status`	string	`verified` once keys were fetched, `unreachable` if the last three refreshes failed.
`keys_refreshed_at`	string	Keys are refreshed hourly and on an unknown `kid`.
`created_at`	string	When it was created, RFC 3339 UTC (some older objects use Unix seconds).

Returned by

eval_run file

Was this page helpful?