---
title: "Add a trusted issuer"
method: POST
path: "/v1/trusted-issuers"
tags: ["Trust Registry"]
---

# Add a trusted issuer

`POST /v1/trusted-issuers`

Register an issuer whose credentials this tenant accepts. Didit ID uses the issuer identifier and trust anchor when it verifies presented credentials. The new entry starts as active.

## Request body

- object
  - `name` string, required — You set the trusted issuer display name.
  - `iss` string, uri, required — You set the issuer identifier that credentials must match.
  - `trust_anchor` string — You set the signing-key anchor type. Use `https-jwks` for a JSON Web Key Set (JWKS) based issuer.
  - `framework` string — You set the trust framework slug to associate with this issuer.
  - `jwks_uri` string, uri — You optionally set the JSON Web Key Set (JWKS) endpoint used to resolve the issuer signing keys.
  - `did` string — You optionally set the decentralized identifier (DID) for the issuer.

## Response `201`

The trusted issuer was registered.

- object
  - `id` string, uuid — You receive the UUID for the trusted issuer registry entry.
  - `name` string — You receive the trusted issuer display name.
  - `iss` string, uri — You receive the issuer identifier that credentials must match.
  - `trust_anchor` string — You receive the signing-key anchor type. `https-jwks` resolves through a JSON Web Key Set (JWKS) endpoint when one is configured.
  - `jwks_uri` string — You receive the JSON Web Key Set (JWKS) endpoint. The captured value is an empty string when the registry entry does not store one.
  - `did` string — You receive the decentralized identifier for the issuer. The captured value is an empty string when the registry entry does not store one.
  - `status` string — You receive the trust-gate status for this issuer.
  - `added_by` string — You receive the principal that registered this trusted issuer.
  - `framework` string, nullable — You receive the associated framework slug, or null when the issuer is not tied to one.
  - `created_at` string, date-time — You receive the timestamp when this trusted issuer was registered.
  - `validation_state` string — You receive the trust-anchor validation state: `unverified`, `verified`, or `failed`.
  - `last_validated_at` string, date-time, nullable — You receive the timestamp of the most recent validation run, or null when the issuer has never been validated.

## Other responses

- `409` — Conflict — a trusted issuer with this `iss` already exists for the tenant.

---

[API](https://skmtc.net/didit-protocol/apis/didit-credentials-api.md) · [All operations](https://skmtc.net/didit-protocol/apis/didit-credentials-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/didit-protocol/didit-credentials-api/versions/e4eddba66557/schema)