PingOne Platform APIs

Create trusted issuer

POST {{apiPath}}/v1/environments/{{envID}}/trustedIssuers

The following sample shows the POST {{apiPath}}/v1/environments/{{envID}}/trustedIssuers operation to add a third-party trusted token issuer to the environment.

This action defines third-party token issuer resources in PingOne to represent actual external JWT issuers that PingOne should trust. The request body must include the issuer’s URL and specify the JWKS URL (default) or a JSON string of the JWKS (JSON Web Key Set) that validates the signature of signed JWTs. The audiences[] property is optional. If omitted, PingOne accepts any aud claim when processing third-party tokens. If specified, at least one audience in the incoming token’s aud array must match one of the defined audiences.

Request Model

Refer to the Trusted issuers data model for full property descriptions.

Property Type Required

audiences[]

Array

Optional

clockSkew

Integer

Optional

description

String

Optional

expRequired

Boolean

Optional

iatRequired

Boolean

Optional

issuer

String

Required

jwks

String

Required/Optional

jwksUrl

String

Required/Optional

maxFutureValidity

Integer

Optional

name

String

Required

nbfRequired

Boolean

Optional

Headers

Authorization      Bearer {{accessToken}}

Content-Type      application/json

Body

raw ( application/json )

{
  "name": "Issuer - {{$randomAbbreviation}}",
  "description" : "My PingFederate server",
  "issuer": "https://issuer.example.com",
  "expRequired": true,
  "iatRequired": false,
  "nbfRequired": false,
  "audiences": [
    "audience-one",
    "audience-two"
  ],
  "jwksUrl": "https://issuer.example.com/jwks"
}

Example Request

  • cURL

  • C#

  • Go

  • HTTP

  • Java

  • jQuery

  • NodeJS

  • Python

  • PHP

  • Ruby

  • Swift

curl --location --globoff '{{apiPath}}/v1/environments/{{envID}}/trustedIssuers' \
--header 'Content-Type: application/json' \
--header 'Authorization: Bearer {{accessToken}}' \
--data '{
  "name": "Issuer - {{$randomAbbreviation}}",
  "description" : "My PingFederate server",
  "issuer": "https://issuer.example.com",
  "expRequired": true,
  "iatRequired": false,
  "nbfRequired": false,
  "audiences": [
    "audience-one",
    "audience-two"
  ],
  "jwksUrl": "https://issuer.example.com/jwks"
}'
var options = new RestClientOptions("{{apiPath}}/v1/environments/{{envID}}/trustedIssuers")
{
  MaxTimeout = -1,
};
var client = new RestClient(options);
var request = new RestRequest("", Method.Post);
request.AddHeader("Content-Type", "application/json");
request.AddHeader("Authorization", "Bearer {{accessToken}}");
var body = @"{" + "\n" +
@"  ""name"": ""Issuer - {{$randomAbbreviation}}""," + "\n" +
@"  ""description"" : ""My PingFederate server""," + "\n" +
@"  ""issuer"": ""https://issuer.example.com""," + "\n" +
@"  ""expRequired"": true," + "\n" +
@"  ""iatRequired"": false," + "\n" +
@"  ""nbfRequired"": false," + "\n" +
@"  ""audiences"": [" + "\n" +
@"    ""audience-one""," + "\n" +
@"    ""audience-two""" + "\n" +
@"  ]," + "\n" +
@"  ""jwksUrl"": ""https://issuer.example.com/jwks""" + "\n" +
@"}" + "\n" +
@"";
request.AddStringBody(body, DataFormat.Json);
RestResponse response = await client.ExecuteAsync(request);
Console.WriteLine(response.Content);
package main

import (
  "fmt"
  "strings"
  "net/http"
  "io"
)

func main() {

  url := "{{apiPath}}/v1/environments/{{envID}}/trustedIssuers"
  method := "POST"

  payload := strings.NewReader(`{
  "name": "Issuer - {{$randomAbbreviation}}",
  "description" : "My PingFederate server",
  "issuer": "https://issuer.example.com",
  "expRequired": true,
  "iatRequired": false,
  "nbfRequired": false,
  "audiences": [
    "audience-one",
    "audience-two"
  ],
  "jwksUrl": "https://issuer.example.com/jwks"
}`)

  client := &http.Client {
  }
  req, err := http.NewRequest(method, url, payload)

  if err != nil {
    fmt.Println(err)
    return
  }
  req.Header.Add("Content-Type", "application/json")
  req.Header.Add("Authorization", "Bearer {{accessToken}}")

  res, err := client.Do(req)
  if err != nil {
    fmt.Println(err)
    return
  }
  defer res.Body.Close()

  body, err := io.ReadAll(res.Body)
  if err != nil {
    fmt.Println(err)
    return
  }
  fmt.Println(string(body))
}
POST /v1/environments/{{envID}}/trustedIssuers HTTP/1.1
Host: {{apiPath}}
Content-Type: application/json
Authorization: Bearer {{accessToken}}

{
  "name": "Issuer - {{$randomAbbreviation}}",
  "description" : "My PingFederate server",
  "issuer": "https://issuer.example.com",
  "expRequired": true,
  "iatRequired": false,
  "nbfRequired": false,
  "audiences": [
    "audience-one",
    "audience-two"
  ],
  "jwksUrl": "https://issuer.example.com/jwks"
}
OkHttpClient client = new OkHttpClient().newBuilder()
  .build();
MediaType mediaType = MediaType.parse("application/json");
RequestBody body = RequestBody.create(mediaType, "{\n  \"name\": \"Issuer - {{$randomAbbreviation}}\",\n  \"description\" : \"My PingFederate server\",\n  \"issuer\": \"https://issuer.example.com\",\n  \"expRequired\": true,\n  \"iatRequired\": false,\n  \"nbfRequired\": false,\n  \"audiences\": [\n    \"audience-one\",\n    \"audience-two\"\n  ],\n  \"jwksUrl\": \"https://issuer.example.com/jwks\"\n}\n");
Request request = new Request.Builder()
  .url("{{apiPath}}/v1/environments/{{envID}}/trustedIssuers")
  .method("POST", body)
  .addHeader("Content-Type", "application/json")
  .addHeader("Authorization", "Bearer {{accessToken}}")
  .build();
Response response = client.newCall(request).execute();
var settings = {
  "url": "{{apiPath}}/v1/environments/{{envID}}/trustedIssuers",
  "method": "POST",
  "timeout": 0,
  "headers": {
    "Content-Type": "application/json",
    "Authorization": "Bearer {{accessToken}}"
  },
  "data": JSON.stringify({
    "name": "Issuer - {{$randomAbbreviation}}",
    "description": "My PingFederate server",
    "issuer": "https://issuer.example.com",
    "expRequired": true,
    "iatRequired": false,
    "nbfRequired": false,
    "audiences": [
      "audience-one",
      "audience-two"
    ],
    "jwksUrl": "https://issuer.example.com/jwks"
  }),
};

$.ajax(settings).done(function (response) {
  console.log(response);
});
var request = require('request');
var options = {
  'method': 'POST',
  'url': '{{apiPath}}/v1/environments/{{envID}}/trustedIssuers',
  'headers': {
    'Content-Type': 'application/json',
    'Authorization': 'Bearer {{accessToken}}'
  },
  body: JSON.stringify({
    "name": "Issuer - {{$randomAbbreviation}}",
    "description": "My PingFederate server",
    "issuer": "https://issuer.example.com",
    "expRequired": true,
    "iatRequired": false,
    "nbfRequired": false,
    "audiences": [
      "audience-one",
      "audience-two"
    ],
    "jwksUrl": "https://issuer.example.com/jwks"
  })

};
request(options, function (error, response) {
  if (error) throw new Error(error);
  console.log(response.body);
});
import requests
import json

url = "{{apiPath}}/v1/environments/{{envID}}/trustedIssuers"

payload = json.dumps({
  "name": "Issuer - {{$randomAbbreviation}}",
  "description": "My PingFederate server",
  "issuer": "https://issuer.example.com",
  "expRequired": True,
  "iatRequired": False,
  "nbfRequired": False,
  "audiences": [
    "audience-one",
    "audience-two"
  ],
  "jwksUrl": "https://issuer.example.com/jwks"
})
headers = {
  'Content-Type': 'application/json',
  'Authorization': 'Bearer {{accessToken}}'
}

response = requests.request("POST", url, headers=headers, data=payload)

print(response.text)
<?php
require_once 'HTTP/Request2.php';
$request = new HTTP_Request2();
$request->setUrl('{{apiPath}}/v1/environments/{{envID}}/trustedIssuers');
$request->setMethod(HTTP_Request2::METHOD_POST);
$request->setConfig(array(
  'follow_redirects' => TRUE
));
$request->setHeader(array(
  'Content-Type' => 'application/json',
  'Authorization' => 'Bearer {{accessToken}}'
));
$request->setBody('{\n  "name": "Issuer - {{$randomAbbreviation}}",\n  "description" : "My PingFederate server",\n  "issuer": "https://issuer.example.com",\n  "expRequired": true,\n  "iatRequired": false,\n  "nbfRequired": false,\n  "audiences": [\n    "audience-one",\n    "audience-two"\n  ],\n  "jwksUrl": "https://issuer.example.com/jwks"\n}');
try {
  $response = $request->send();
  if ($response->getStatus() == 200) {
    echo $response->getBody();
  }
  else {
    echo 'Unexpected HTTP status: ' . $response->getStatus() . ' ' .
    $response->getReasonPhrase();
  }
}
catch(HTTP_Request2_Exception $e) {
  echo 'Error: ' . $e->getMessage();
}
require "uri"
require "json"
require "net/http"

url = URI("{{apiPath}}/v1/environments/{{envID}}/trustedIssuers")

http = Net::HTTP.new(url.host, url.port);
request = Net::HTTP::Post.new(url)
request["Content-Type"] = "application/json"
request["Authorization"] = "Bearer {{accessToken}}"
request.body = JSON.dump({
  "name": "Issuer - {{\$randomAbbreviation}}",
  "description": "My PingFederate server",
  "issuer": "https://issuer.example.com",
  "expRequired": true,
  "iatRequired": false,
  "nbfRequired": false,
  "audiences": [
    "audience-one",
    "audience-two"
  ],
  "jwksUrl": "https://issuer.example.com/jwks"
})

response = http.request(request)
puts response.read_body
let parameters = "{\n  \"name\": \"Issuer - {{$randomAbbreviation}}\",\n  \"description\" : \"My PingFederate server\",\n  \"issuer\": \"https://issuer.example.com\",\n  \"expRequired\": true,\n  \"iatRequired\": false,\n  \"nbfRequired\": false,\n  \"audiences\": [\n    \"audience-one\",\n    \"audience-two\"\n  ],\n  \"jwksUrl\": \"https://issuer.example.com/jwks\"\n}"
let postData = parameters.data(using: .utf8)

var request = URLRequest(url: URL(string: "{{apiPath}}/v1/environments/{{envID}}/trustedIssuers")!,timeoutInterval: Double.infinity)
request.addValue("application/json", forHTTPHeaderField: "Content-Type")
request.addValue("Bearer {{accessToken}}", forHTTPHeaderField: "Authorization")

request.httpMethod = "POST"
request.httpBody = postData

let task = URLSession.shared.dataTask(with: request) { data, response, error in
  guard let data = data else {
    print(String(describing: error))
    return
  }
  print(String(data: data, encoding: .utf8)!)
}

task.resume()

Example Response

{
  "id": "961c63cf-062a-4cf1-b18c-7b81e35c4b7c",
  "environment": {
    "id": "abfba8f6-49eb-49f5-a5d9-80ad5c98f9f6"
  },
  "name": "Issuer - RAM",
  "description": "My PingFederate server",
  "createdAt": "2026-10-30T19:43:57.114Z",
  "updatedAt": "2026-10-30T19:43:57.114Z",
  "issuer": "https://issuer.example.com",
  "audiences": [
    "audience-two",
    "audience-one"
  ],
  "jwksUrl": "https://issuer.example.com/jwks",
  "clockSkew": 0,
  "expRequired": true,
  "iatRequired": false,
  "nbfRequired": false,
  "maxFutureValidity": 0,
  "_links": {
    "environment": {
      "href": "https://api.pingone.com/v1/environments/abfba8f6-49eb-49f5-a5d9-80ad5c98f9f6"
    },
    "self": {
      "href": "https://api.pingone.com/v1/environments/abfba8f6-49eb-49f5-a5d9-80ad5c98f9f6/trustedIssuers/961c63cf-062a-4cf1-b18c-7b81e35c4b7c"
    }
  }
}