Skip to content

Trusted Issuer URL Is Immutable

URI: https://docs.ankatech.co/errors/trusted-issuer-url-immutable
HTTP Status: 409 Conflict

When you see this

A replace request named a different issuer URL from the one the declaration holds. A different issuer URL is a different trust relationship, not an edit of this one.

409 rather than 400: the submitted body is well-formed and every rule in it is satisfied. What it conflicts with is the state of the resource it names. The refusal is what keeps the change from being silent — a rewritten URL would update cleanly and stop every existing (issuer, subject) binding matching, with nothing failing anywhere.

Common Causes

  • Editing the issuer URL in a replace body instead of declaring the new issuer separately.
  • Migrating to a new identity provider tenant or domain by rewriting the existing declaration.
  • Replaying a replace body captured against a different declaration.

Response Example

{
  "type": "https://docs.ankatech.co/errors/trusted-issuer-url-immutable",
  "title": "Trusted Issuer URL Is Immutable",
  "status": 409,
  "detail": "This declaration is for https://acme.eu.auth0.com and the request names https://acme-eu.okta.com. A different issuer URL is a different trust relationship, not an edit of this one: every actor binding resolves on the pair (issuer, subject), so rewriting the URL here would stop all of them matching without anything failing. Declare the new issuer, move the bindings, then withdraw this one.",
  "instance": "/api/v3/admin/tenants/3f9a1b62-5d47-4c8e-b0a2-91d7e4f60cc5/workload-identity/issuers/9e2f77a1-3c04-42db-8f5b-1a6d0e93bb41",
  "timestamp": 1730000000,
  "extensions": {
    "requestId": "550e8400-e29b-41d4-a716-446655440000"
  }
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details.

How to Resolve

  1. Re-send the replace with the issuer URL the declaration already holds, changing only the fields you meant to change.
  2. To move to a different issuer, do it as three steps: declare the new issuer, move the actor bindings onto it, then withdraw the old declaration.
  3. Do not treat this as a rename — the bindings resolve on the (issuer, subject) pair and must be moved explicitly.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.