Skip to content

Trusted Issuer Not Admissible

URI: https://docs.ankatech.co/errors/trusted-issuer-not-admissible
HTTP Status: 400 Bad Request

When you see this

The trusted-issuer descriptor you submitted was refused by one of the admission rules that govern which external authorization servers this deployment will accept. The detail is the refusing rule's own sentence and names exactly what to change.

Common Causes

  • The issuer URL does not use HTTPS.
  • The issuer URL carries userinfo, a fragment, or a query string, none of which belong in an iss value.
  • The issuer resolves to an internal or non-routable address that this deployment will not treat as an external authorization server.
  • The descriptor fails one of the identity module's other structural rules on the issuer URL or its trust material.

Response Example

{
  "type": "https://docs.ankatech.co/errors/trusted-issuer-not-admissible",
  "title": "Trusted Issuer Not Admissible",
  "status": 400,
  "detail": "the endpoint must use HTTPS",
  "instance": "/api/v3/admin/platform/workload-identity/issuers",
  "timestamp": 1730000000,
  "extensions": {
    "requestId": "550e8400-e29b-41d4-a716-446655440000"
  }
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details.

How to Resolve

  1. Read the detail: it is the admission rule's own message, not a paraphrase, so it names the property that was refused.
  2. Correct the issuer URL or the trust material it names, then re-submit the declaration.
  3. If the issuer URL is correct as published by your identity provider, confirm the provider's issuer value from its OpenID Provider metadata document rather than typing it by hand.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.