---
title: "Update a trusted issuer"
method: PATCH
path: "/v1/trusted-issuers/{uuid}"
tags: ["Trust Registry"]
---

# Update a trusted issuer

`PATCH /v1/trusted-issuers/{uuid}`

Update a trusted issuer's metadata (`name`, `trust_anchor`, `jwks_uri`, `did`, `framework`) or its `status` (`active` / `disabled`). The `iss` is immutable — attempting to change it returns 400; delete and recreate the issuer instead. Editing any metadata field resets `validation_state` to `unverified`. A disabled issuer stays in the registry but fails the verification trust gate.

## Path parameters

- `uuid` string, uuid, required

## Request body

- object
  - `name` string — You optionally set the trusted issuer display name.
  - `trust_anchor` string — You optionally set the signing-key anchor type: `https-jwks`, `did-web`, or `x509`.
  - `jwks_uri` string, uri — You optionally set the JSON Web Key Set (JWKS) endpoint.
  - `did` string — You optionally set the decentralized identifier (DID) for the issuer.
  - `framework` string, nullable — You optionally set (or clear with null) the trust framework slug this issuer belongs to.
  - `status` string — You optionally set the trust-gate status: `active` or `disabled`.

## Response `200`

The trusted issuer status was updated.

- object
  - `id` string, uuid — You receive the UUID for the trusted issuer registry entry.
  - `name` string — You receive the trusted issuer display name.
  - `iss` string, uri — You receive the issuer identifier that credentials must match.
  - `trust_anchor` string — You receive the signing-key anchor type. `https-jwks` resolves through a JSON Web Key Set (JWKS) endpoint when one is configured.
  - `jwks_uri` string — You receive the JSON Web Key Set (JWKS) endpoint. The captured value is an empty string when the registry entry does not store one.
  - `did` string — You receive the decentralized identifier for the issuer. The captured value is an empty string when the registry entry does not store one.
  - `status` string — You receive the updated trust-gate status for this issuer.
  - `added_by` string — You receive the principal that registered this trusted issuer.
  - `framework` string, nullable — You receive the associated framework slug, or null when the issuer is not tied to one.
  - `created_at` string, date-time — You receive the timestamp when this trusted issuer was registered.
  - `validation_state` string — You receive the trust-anchor validation state: `unverified`, `verified`, or `failed`.
  - `last_validated_at` string, date-time, nullable — You receive the timestamp of the most recent validation run, or null when the issuer has never been validated.

## Other responses

- `400` — Bad request — you attempted to edit the immutable `iss` field.

---

[API](https://skmtc.net/didit-protocol/apis/didit-credentials-api.md) · [All operations](https://skmtc.net/didit-protocol/apis/didit-credentials-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/didit-protocol/didit-credentials-api/versions/e4eddba66557/schema)