Skip to content

Trusted Issuer Already Declared

URI: https://docs.ankatech.co/errors/trusted-issuer-already-declared
HTTP Status: 409 Conflict

When you see this

This plane already trusts that issuer. A trust set is a set: two rows for one issuer would make "disable it" ambiguous, because no rule says which of the two a presented token is verified against.

The comparison is made on the canonical form of the issuer URL, so two spellings of one URL collide here rather than producing two rows that both claim the same iss.

Common Causes

  • Re-submitting a declaration that already succeeded, for example after a client retry.
  • Declaring an issuer whose URL differs only in trailing slash, case, or default port from one already declared.
  • Two operators declaring the same authorization server on the same plane.

Response Example

{
  "type": "https://docs.ankatech.co/errors/trusted-issuer-already-declared",
  "title": "Trusted Issuer Already Declared",
  "status": 409,
  "detail": "https://acme.eu.auth0.com is already declared here. A trust set is a set: two rows for one issuer would make disabling it ambiguous. Edit the existing declaration, or withdraw it first.",
  "instance": "/api/v3/admin/tenants/3f9a1b62-5d47-4c8e-b0a2-91d7e4f60cc5/workload-identity/issuers",
  "timestamp": 1730000000,
  "extensions": {
    "requestId": "550e8400-e29b-41d4-a716-446655440000"
  }
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details.

How to Resolve

  1. List the declarations on this plane and locate the existing row for that issuer.
  2. If you meant to change it, edit the existing declaration instead of creating a second one.
  3. If you meant to replace it, withdraw the existing declaration first, then declare the new one.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.