Create trusted issuer
POST {{apiPath}}/v1/environments/{{envID}}/trustedIssuers
The following sample shows the POST {{apiPath}}/v1/environments/{{envID}}/trustedIssuers operation to add a third-party trusted token issuer to the environment.
This action defines third-party token issuer resources in PingOne to represent actual external JWT issuers that PingOne should trust. The request body must include the issuer’s URL and specify the JWKS URL (default) or a JSON string of the JWKS (JSON Web Key Set) that validates the signature of signed JWTs. The audiences[] property is optional. If omitted, PingOne accepts any aud claim when processing third-party tokens. If specified, at least one audience in the incoming token’s aud array must match one of the defined audiences.
Request Model
Refer to the Trusted issuers data model for full property descriptions.
| Property | Type | Required |
|---|---|---|
|
Array |
Optional |
|
Integer |
Optional |
|
String |
Optional |
|
Boolean |
Optional |
|
Boolean |
Optional |
|
String |
Required |
|
String |
Required/Optional |
|
String |
Required/Optional |
|
Integer |
Optional |
|
String |
Required |
|
Boolean |
Optional |
Body
raw ( application/json )
{
"name": "Issuer - {{$randomAbbreviation}}",
"description" : "My PingFederate server",
"issuer": "https://issuer.example.com",
"expRequired": true,
"iatRequired": false,
"nbfRequired": false,
"audiences": [
"audience-one",
"audience-two"
],
"jwksUrl": "https://issuer.example.com/jwks"
}
Example Request
-
cURL
-
C#
-
Go
-
HTTP
-
Java
-
jQuery
-
NodeJS
-
Python
-
PHP
-
Ruby
-
Swift
curl --location --globoff '{{apiPath}}/v1/environments/{{envID}}/trustedIssuers' \
--header 'Content-Type: application/json' \
--header 'Authorization: Bearer {{accessToken}}' \
--data '{
"name": "Issuer - {{$randomAbbreviation}}",
"description" : "My PingFederate server",
"issuer": "https://issuer.example.com",
"expRequired": true,
"iatRequired": false,
"nbfRequired": false,
"audiences": [
"audience-one",
"audience-two"
],
"jwksUrl": "https://issuer.example.com/jwks"
}'
var options = new RestClientOptions("{{apiPath}}/v1/environments/{{envID}}/trustedIssuers")
{
MaxTimeout = -1,
};
var client = new RestClient(options);
var request = new RestRequest("", Method.Post);
request.AddHeader("Content-Type", "application/json");
request.AddHeader("Authorization", "Bearer {{accessToken}}");
var body = @"{" + "\n" +
@" ""name"": ""Issuer - {{$randomAbbreviation}}""," + "\n" +
@" ""description"" : ""My PingFederate server""," + "\n" +
@" ""issuer"": ""https://issuer.example.com""," + "\n" +
@" ""expRequired"": true," + "\n" +
@" ""iatRequired"": false," + "\n" +
@" ""nbfRequired"": false," + "\n" +
@" ""audiences"": [" + "\n" +
@" ""audience-one""," + "\n" +
@" ""audience-two""" + "\n" +
@" ]," + "\n" +
@" ""jwksUrl"": ""https://issuer.example.com/jwks""" + "\n" +
@"}" + "\n" +
@"";
request.AddStringBody(body, DataFormat.Json);
RestResponse response = await client.ExecuteAsync(request);
Console.WriteLine(response.Content);
package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "{{apiPath}}/v1/environments/{{envID}}/trustedIssuers"
method := "POST"
payload := strings.NewReader(`{
"name": "Issuer - {{$randomAbbreviation}}",
"description" : "My PingFederate server",
"issuer": "https://issuer.example.com",
"expRequired": true,
"iatRequired": false,
"nbfRequired": false,
"audiences": [
"audience-one",
"audience-two"
],
"jwksUrl": "https://issuer.example.com/jwks"
}`)
client := &http.Client {
}
req, err := http.NewRequest(method, url, payload)
if err != nil {
fmt.Println(err)
return
}
req.Header.Add("Content-Type", "application/json")
req.Header.Add("Authorization", "Bearer {{accessToken}}")
res, err := client.Do(req)
if err != nil {
fmt.Println(err)
return
}
defer res.Body.Close()
body, err := io.ReadAll(res.Body)
if err != nil {
fmt.Println(err)
return
}
fmt.Println(string(body))
}
POST /v1/environments/{{envID}}/trustedIssuers HTTP/1.1
Host: {{apiPath}}
Content-Type: application/json
Authorization: Bearer {{accessToken}}
{
"name": "Issuer - {{$randomAbbreviation}}",
"description" : "My PingFederate server",
"issuer": "https://issuer.example.com",
"expRequired": true,
"iatRequired": false,
"nbfRequired": false,
"audiences": [
"audience-one",
"audience-two"
],
"jwksUrl": "https://issuer.example.com/jwks"
}
OkHttpClient client = new OkHttpClient().newBuilder()
.build();
MediaType mediaType = MediaType.parse("application/json");
RequestBody body = RequestBody.create(mediaType, "{\n \"name\": \"Issuer - {{$randomAbbreviation}}\",\n \"description\" : \"My PingFederate server\",\n \"issuer\": \"https://issuer.example.com\",\n \"expRequired\": true,\n \"iatRequired\": false,\n \"nbfRequired\": false,\n \"audiences\": [\n \"audience-one\",\n \"audience-two\"\n ],\n \"jwksUrl\": \"https://issuer.example.com/jwks\"\n}\n");
Request request = new Request.Builder()
.url("{{apiPath}}/v1/environments/{{envID}}/trustedIssuers")
.method("POST", body)
.addHeader("Content-Type", "application/json")
.addHeader("Authorization", "Bearer {{accessToken}}")
.build();
Response response = client.newCall(request).execute();
var settings = {
"url": "{{apiPath}}/v1/environments/{{envID}}/trustedIssuers",
"method": "POST",
"timeout": 0,
"headers": {
"Content-Type": "application/json",
"Authorization": "Bearer {{accessToken}}"
},
"data": JSON.stringify({
"name": "Issuer - {{$randomAbbreviation}}",
"description": "My PingFederate server",
"issuer": "https://issuer.example.com",
"expRequired": true,
"iatRequired": false,
"nbfRequired": false,
"audiences": [
"audience-one",
"audience-two"
],
"jwksUrl": "https://issuer.example.com/jwks"
}),
};
$.ajax(settings).done(function (response) {
console.log(response);
});
var request = require('request');
var options = {
'method': 'POST',
'url': '{{apiPath}}/v1/environments/{{envID}}/trustedIssuers',
'headers': {
'Content-Type': 'application/json',
'Authorization': 'Bearer {{accessToken}}'
},
body: JSON.stringify({
"name": "Issuer - {{$randomAbbreviation}}",
"description": "My PingFederate server",
"issuer": "https://issuer.example.com",
"expRequired": true,
"iatRequired": false,
"nbfRequired": false,
"audiences": [
"audience-one",
"audience-two"
],
"jwksUrl": "https://issuer.example.com/jwks"
})
};
request(options, function (error, response) {
if (error) throw new Error(error);
console.log(response.body);
});
import requests
import json
url = "{{apiPath}}/v1/environments/{{envID}}/trustedIssuers"
payload = json.dumps({
"name": "Issuer - {{$randomAbbreviation}}",
"description": "My PingFederate server",
"issuer": "https://issuer.example.com",
"expRequired": True,
"iatRequired": False,
"nbfRequired": False,
"audiences": [
"audience-one",
"audience-two"
],
"jwksUrl": "https://issuer.example.com/jwks"
})
headers = {
'Content-Type': 'application/json',
'Authorization': 'Bearer {{accessToken}}'
}
response = requests.request("POST", url, headers=headers, data=payload)
print(response.text)
<?php
require_once 'HTTP/Request2.php';
$request = new HTTP_Request2();
$request->setUrl('{{apiPath}}/v1/environments/{{envID}}/trustedIssuers');
$request->setMethod(HTTP_Request2::METHOD_POST);
$request->setConfig(array(
'follow_redirects' => TRUE
));
$request->setHeader(array(
'Content-Type' => 'application/json',
'Authorization' => 'Bearer {{accessToken}}'
));
$request->setBody('{\n "name": "Issuer - {{$randomAbbreviation}}",\n "description" : "My PingFederate server",\n "issuer": "https://issuer.example.com",\n "expRequired": true,\n "iatRequired": false,\n "nbfRequired": false,\n "audiences": [\n "audience-one",\n "audience-two"\n ],\n "jwksUrl": "https://issuer.example.com/jwks"\n}');
try {
$response = $request->send();
if ($response->getStatus() == 200) {
echo $response->getBody();
}
else {
echo 'Unexpected HTTP status: ' . $response->getStatus() . ' ' .
$response->getReasonPhrase();
}
}
catch(HTTP_Request2_Exception $e) {
echo 'Error: ' . $e->getMessage();
}
require "uri"
require "json"
require "net/http"
url = URI("{{apiPath}}/v1/environments/{{envID}}/trustedIssuers")
http = Net::HTTP.new(url.host, url.port);
request = Net::HTTP::Post.new(url)
request["Content-Type"] = "application/json"
request["Authorization"] = "Bearer {{accessToken}}"
request.body = JSON.dump({
"name": "Issuer - {{\$randomAbbreviation}}",
"description": "My PingFederate server",
"issuer": "https://issuer.example.com",
"expRequired": true,
"iatRequired": false,
"nbfRequired": false,
"audiences": [
"audience-one",
"audience-two"
],
"jwksUrl": "https://issuer.example.com/jwks"
})
response = http.request(request)
puts response.read_body
let parameters = "{\n \"name\": \"Issuer - {{$randomAbbreviation}}\",\n \"description\" : \"My PingFederate server\",\n \"issuer\": \"https://issuer.example.com\",\n \"expRequired\": true,\n \"iatRequired\": false,\n \"nbfRequired\": false,\n \"audiences\": [\n \"audience-one\",\n \"audience-two\"\n ],\n \"jwksUrl\": \"https://issuer.example.com/jwks\"\n}"
let postData = parameters.data(using: .utf8)
var request = URLRequest(url: URL(string: "{{apiPath}}/v1/environments/{{envID}}/trustedIssuers")!,timeoutInterval: Double.infinity)
request.addValue("application/json", forHTTPHeaderField: "Content-Type")
request.addValue("Bearer {{accessToken}}", forHTTPHeaderField: "Authorization")
request.httpMethod = "POST"
request.httpBody = postData
let task = URLSession.shared.dataTask(with: request) { data, response, error in
guard let data = data else {
print(String(describing: error))
return
}
print(String(data: data, encoding: .utf8)!)
}
task.resume()
Example Response
{
"id": "961c63cf-062a-4cf1-b18c-7b81e35c4b7c",
"environment": {
"id": "abfba8f6-49eb-49f5-a5d9-80ad5c98f9f6"
},
"name": "Issuer - RAM",
"description": "My PingFederate server",
"createdAt": "2026-10-30T19:43:57.114Z",
"updatedAt": "2026-10-30T19:43:57.114Z",
"issuer": "https://issuer.example.com",
"audiences": [
"audience-two",
"audience-one"
],
"jwksUrl": "https://issuer.example.com/jwks",
"clockSkew": 0,
"expRequired": true,
"iatRequired": false,
"nbfRequired": false,
"maxFutureValidity": 0,
"_links": {
"environment": {
"href": "https://api.pingone.com/v1/environments/abfba8f6-49eb-49f5-a5d9-80ad5c98f9f6"
},
"self": {
"href": "https://api.pingone.com/v1/environments/abfba8f6-49eb-49f5-a5d9-80ad5c98f9f6/trustedIssuers/961c63cf-062a-4cf1-b18c-7b81e35c4b7c"
}
}
}