---
title: "Validate a trusted issuer"
method: POST
path: "/v1/trusted-issuers/{uuid}/validate"
tags: ["Trust Registry"]
---

# Validate a trusted issuer

`POST /v1/trusted-issuers/{uuid}/validate`

Validate a trusted issuer's trust anchor. Didit ID checks reachability and key resolution. You can use the result before relying on a new or changed issuer.

## Path parameters

- `uuid` string, uuid, required

## Request body

- object

## Response `200`

The trusted issuer object with a validation result.

- object
  - `id` string, uuid — You receive the UUID for the trusted issuer registry entry.
  - `name` string — You receive the trusted issuer display name.
  - `iss` string, uri — You receive the issuer identifier that credentials must match.
  - `trust_anchor` string — You receive the signing-key anchor type. `https-jwks` resolves through a JSON Web Key Set (JWKS) endpoint when one is configured.
  - `jwks_uri` string — You receive the JSON Web Key Set (JWKS) endpoint. The captured value is an empty string when the registry entry does not store one.
  - `did` string — You receive the decentralized identifier for the issuer. The captured value is an empty string when the registry entry does not store one.
  - `status` string — You receive the trust-gate status for this issuer.
  - `added_by` string — You receive the principal that registered this trusted issuer.
  - `framework` string, nullable — You receive the associated framework slug, or null when the issuer is not tied to one.
  - `created_at` string, date-time — You receive the timestamp when this trusted issuer was registered.
  - `validation` object — You receive the result of the live issuer-metadata resolution and trust-anchor check.
    - `reachable` boolean — You receive `true` when Didit ID could reach the issuer trust anchor.
    - `anchor_ok` boolean — You receive `true` when signing-key resolution against the trust anchor succeeded.
    - `issuer_matches` boolean — You receive `true` when the resolved issuer metadata matches the registered `iss`.
    - `jwks_keys` integer — You receive the number of keys discovered in the resolved JSON Web Key Set (JWKS).
    - `error` string — You receive a human-readable error string when resolution fails, otherwise an empty string.
    - `status` string — You receive the registry status used during validation.
    - `validation_state` string — You receive the trust-anchor validation state: `unverified`, `verified`, or `failed`.
  - `validation_state` string — You receive the trust-anchor validation state: `unverified`, `verified`, or `failed`.
  - `last_validated_at` string, date-time, nullable — You receive the timestamp of the most recent validation run, or null when the issuer has never been validated.

---

[API](https://skmtc.net/didit-protocol/apis/didit-credentials-api.md) · [All operations](https://skmtc.net/didit-protocol/apis/didit-credentials-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/didit-protocol/didit-credentials-api/versions/e4eddba66557/schema)