--- title: Create trusted issuer description: Add a new trusted issuer to an environment component: pingone-api page_id: pingone-api:platform:trusted-issuers/create-trusted-issuer canonical_url: https://developer.pingidentity.com/pingone-api/platform/trusted-issuers/create-trusted-issuer.html llms_txt: https://developer.pingidentity.com/pingone-api/llms.txt docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md revdate: 2026-11-01 section_ids: headers: Headers body: Body example-request: Example Request example-response: Example Response --- # Create trusted issuer ## Required permission: * [trustedIssuers:create:trustedIssuer](../reference/roles-and-permissions-in-pingone/pingone-permissions-by-identifier.html#permission-trustedIssuers-create-trustedIssuer "Learn more about this permission") ```none POST {{apiPath}}/v1/environments/{{envID}}/trustedIssuers ``` The following sample shows the `POST {{apiPath}}/v1/environments/{{envID}}/trustedIssuers` operation to add a third-party trusted token issuer to the environment. This action defines third-party token issuer resources in PingOne to represent actual external JWT issuers that PingOne should trust. The request body must include the issuer's URL and specify the JWKS URL (default) or a JSON string of the JWKS (JSON Web Key Set) that validates the signature of signed JWTs. The `audiences[]` property is optional. If omitted, PingOne accepts any `aud` claim when processing third-party tokens. If specified, at least one audience in the incoming token's `aud` array must match one of the defined audiences. > **Collapse: Request Model** > > Refer to the [Trusted issuers data model](index.html) for full property descriptions. > > | Property | Type | Required | > | ------------------- | ------- | ----------------- | > | `audiences[]` | Array | Optional | > | `clockSkew` | Integer | Optional | > | `description` | String | Optional | > | `expRequired` | Boolean | Optional | > | `iatRequired` | Boolean | Optional | > | `issuer` | String | Required | > | `jwks` | String | Required/Optional | > | `jwksUrl` | String | Required/Optional | > | `maxFutureValidity` | Integer | Optional | > | `name` | String | Required | > | `nbfRequired` | Boolean | Optional | ### Headers Authorization      Bearer {{accessToken}} Content-Type      application/json ### Body raw ( application/json ) ```json { "name": "Issuer - {{$randomAbbreviation}}", "description" : "My PingFederate server", "issuer": "https://issuer.example.com", "expRequired": true, "iatRequired": false, "nbfRequired": false, "audiences": [ "audience-one", "audience-two" ], "jwksUrl": "https://issuer.example.com/jwks" } ``` ## ### Example Request * cURL * C# * Go * HTTP * Java * jQuery * NodeJS * Python * PHP * Ruby * Swift ```shell curl --location --globoff '{{apiPath}}/v1/environments/{{envID}}/trustedIssuers' \ --header 'Content-Type: application/json' \ --header 'Authorization: Bearer {{accessToken}}' \ --data '{ "name": "Issuer - {{$randomAbbreviation}}", "description" : "My PingFederate server", "issuer": "https://issuer.example.com", "expRequired": true, "iatRequired": false, "nbfRequired": false, "audiences": [ "audience-one", "audience-two" ], "jwksUrl": "https://issuer.example.com/jwks" }' ``` ```csharp var options = new RestClientOptions("{{apiPath}}/v1/environments/{{envID}}/trustedIssuers") { MaxTimeout = -1, }; var client = new RestClient(options); var request = new RestRequest("", Method.Post); request.AddHeader("Content-Type", "application/json"); request.AddHeader("Authorization", "Bearer {{accessToken}}"); var body = @"{" + "\n" + @" ""name"": ""Issuer - {{$randomAbbreviation}}""," + "\n" + @" ""description"" : ""My PingFederate server""," + "\n" + @" ""issuer"": ""https://issuer.example.com""," + "\n" + @" ""expRequired"": true," + "\n" + @" ""iatRequired"": false," + "\n" + @" ""nbfRequired"": false," + "\n" + @" ""audiences"": [" + "\n" + @" ""audience-one""," + "\n" + @" ""audience-two""" + "\n" + @" ]," + "\n" + @" ""jwksUrl"": ""https://issuer.example.com/jwks""" + "\n" + @"}" + "\n" + @""; request.AddStringBody(body, DataFormat.Json); RestResponse response = await client.ExecuteAsync(request); Console.WriteLine(response.Content); ``` ```golang package main import ( "fmt" "strings" "net/http" "io" ) func main() { url := "{{apiPath}}/v1/environments/{{envID}}/trustedIssuers" method := "POST" payload := strings.NewReader(`{ "name": "Issuer - {{$randomAbbreviation}}", "description" : "My PingFederate server", "issuer": "https://issuer.example.com", "expRequired": true, "iatRequired": false, "nbfRequired": false, "audiences": [ "audience-one", "audience-two" ], "jwksUrl": "https://issuer.example.com/jwks" }`) client := &http.Client { } req, err := http.NewRequest(method, url, payload) if err != nil { fmt.Println(err) return } req.Header.Add("Content-Type", "application/json") req.Header.Add("Authorization", "Bearer {{accessToken}}") res, err := client.Do(req) if err != nil { fmt.Println(err) return } defer res.Body.Close() body, err := io.ReadAll(res.Body) if err != nil { fmt.Println(err) return } fmt.Println(string(body)) } ``` ```http POST /v1/environments/{{envID}}/trustedIssuers HTTP/1.1 Host: {{apiPath}} Content-Type: application/json Authorization: Bearer {{accessToken}} { "name": "Issuer - {{$randomAbbreviation}}", "description" : "My PingFederate server", "issuer": "https://issuer.example.com", "expRequired": true, "iatRequired": false, "nbfRequired": false, "audiences": [ "audience-one", "audience-two" ], "jwksUrl": "https://issuer.example.com/jwks" } ``` ```java OkHttpClient client = new OkHttpClient().newBuilder() .build(); MediaType mediaType = MediaType.parse("application/json"); RequestBody body = RequestBody.create(mediaType, "{\n \"name\": \"Issuer - {{$randomAbbreviation}}\",\n \"description\" : \"My PingFederate server\",\n \"issuer\": \"https://issuer.example.com\",\n \"expRequired\": true,\n \"iatRequired\": false,\n \"nbfRequired\": false,\n \"audiences\": [\n \"audience-one\",\n \"audience-two\"\n ],\n \"jwksUrl\": \"https://issuer.example.com/jwks\"\n}\n"); Request request = new Request.Builder() .url("{{apiPath}}/v1/environments/{{envID}}/trustedIssuers") .method("POST", body) .addHeader("Content-Type", "application/json") .addHeader("Authorization", "Bearer {{accessToken}}") .build(); Response response = client.newCall(request).execute(); ``` ```javascript var settings = { "url": "{{apiPath}}/v1/environments/{{envID}}/trustedIssuers", "method": "POST", "timeout": 0, "headers": { "Content-Type": "application/json", "Authorization": "Bearer {{accessToken}}" }, "data": JSON.stringify({ "name": "Issuer - {{$randomAbbreviation}}", "description": "My PingFederate server", "issuer": "https://issuer.example.com", "expRequired": true, "iatRequired": false, "nbfRequired": false, "audiences": [ "audience-one", "audience-two" ], "jwksUrl": "https://issuer.example.com/jwks" }), }; $.ajax(settings).done(function (response) { console.log(response); }); ``` ```javascript var request = require('request'); var options = { 'method': 'POST', 'url': '{{apiPath}}/v1/environments/{{envID}}/trustedIssuers', 'headers': { 'Content-Type': 'application/json', 'Authorization': 'Bearer {{accessToken}}' }, body: JSON.stringify({ "name": "Issuer - {{$randomAbbreviation}}", "description": "My PingFederate server", "issuer": "https://issuer.example.com", "expRequired": true, "iatRequired": false, "nbfRequired": false, "audiences": [ "audience-one", "audience-two" ], "jwksUrl": "https://issuer.example.com/jwks" }) }; request(options, function (error, response) { if (error) throw new Error(error); console.log(response.body); }); ``` ```python import requests import json url = "{{apiPath}}/v1/environments/{{envID}}/trustedIssuers" payload = json.dumps({ "name": "Issuer - {{$randomAbbreviation}}", "description": "My PingFederate server", "issuer": "https://issuer.example.com", "expRequired": True, "iatRequired": False, "nbfRequired": False, "audiences": [ "audience-one", "audience-two" ], "jwksUrl": "https://issuer.example.com/jwks" }) headers = { 'Content-Type': 'application/json', 'Authorization': 'Bearer {{accessToken}}' } response = requests.request("POST", url, headers=headers, data=payload) print(response.text) ``` ```php setUrl('{{apiPath}}/v1/environments/{{envID}}/trustedIssuers'); $request->setMethod(HTTP_Request2::METHOD_POST); $request->setConfig(array( 'follow_redirects' => TRUE )); $request->setHeader(array( 'Content-Type' => 'application/json', 'Authorization' => 'Bearer {{accessToken}}' )); $request->setBody('{\n "name": "Issuer - {{$randomAbbreviation}}",\n "description" : "My PingFederate server",\n "issuer": "https://issuer.example.com",\n "expRequired": true,\n "iatRequired": false,\n "nbfRequired": false,\n "audiences": [\n "audience-one",\n "audience-two"\n ],\n "jwksUrl": "https://issuer.example.com/jwks"\n}'); try { $response = $request->send(); if ($response->getStatus() == 200) { echo $response->getBody(); } else { echo 'Unexpected HTTP status: ' . $response->getStatus() . ' ' . $response->getReasonPhrase(); } } catch(HTTP_Request2_Exception $e) { echo 'Error: ' . $e->getMessage(); } ``` ```ruby require "uri" require "json" require "net/http" url = URI("{{apiPath}}/v1/environments/{{envID}}/trustedIssuers") http = Net::HTTP.new(url.host, url.port); request = Net::HTTP::Post.new(url) request["Content-Type"] = "application/json" request["Authorization"] = "Bearer {{accessToken}}" request.body = JSON.dump({ "name": "Issuer - {{\$randomAbbreviation}}", "description": "My PingFederate server", "issuer": "https://issuer.example.com", "expRequired": true, "iatRequired": false, "nbfRequired": false, "audiences": [ "audience-one", "audience-two" ], "jwksUrl": "https://issuer.example.com/jwks" }) response = http.request(request) puts response.read_body ``` ```swift let parameters = "{\n \"name\": \"Issuer - {{$randomAbbreviation}}\",\n \"description\" : \"My PingFederate server\",\n \"issuer\": \"https://issuer.example.com\",\n \"expRequired\": true,\n \"iatRequired\": false,\n \"nbfRequired\": false,\n \"audiences\": [\n \"audience-one\",\n \"audience-two\"\n ],\n \"jwksUrl\": \"https://issuer.example.com/jwks\"\n}" let postData = parameters.data(using: .utf8) var request = URLRequest(url: URL(string: "{{apiPath}}/v1/environments/{{envID}}/trustedIssuers")!,timeoutInterval: Double.infinity) request.addValue("application/json", forHTTPHeaderField: "Content-Type") request.addValue("Bearer {{accessToken}}", forHTTPHeaderField: "Authorization") request.httpMethod = "POST" request.httpBody = postData let task = URLSession.shared.dataTask(with: request) { data, response, error in guard let data = data else { print(String(describing: error)) return } print(String(data: data, encoding: .utf8)!) } task.resume() ``` ### Example Response ```json { "id": "961c63cf-062a-4cf1-b18c-7b81e35c4b7c", "environment": { "id": "abfba8f6-49eb-49f5-a5d9-80ad5c98f9f6" }, "name": "Issuer - RAM", "description": "My PingFederate server", "createdAt": "2026-10-30T19:43:57.114Z", "updatedAt": "2026-10-30T19:43:57.114Z", "issuer": "https://issuer.example.com", "audiences": [ "audience-two", "audience-one" ], "jwksUrl": "https://issuer.example.com/jwks", "clockSkew": 0, "expRequired": true, "iatRequired": false, "nbfRequired": false, "maxFutureValidity": 0, "_links": { "environment": { "href": "https://api.pingone.com/v1/environments/abfba8f6-49eb-49f5-a5d9-80ad5c98f9f6" }, "self": { "href": "https://api.pingone.com/v1/environments/abfba8f6-49eb-49f5-a5d9-80ad5c98f9f6/trustedIssuers/961c63cf-062a-4cf1-b18c-7b81e35c4b7c" } } } ```