---
# @generated by sylphx-gen. Do not edit.
title: "Update a trusted issuer"
description: "`auth.trusted_issuers.update` (PATCH /v1/{trusted_issuer.name}): Updates an trusted issuer."
type: reference
product: auth
summary: "Updates an trusted issuer."
updated: 2026-09-28
nav: false
---

Updates an trusted issuer.

- **Path** `PATCH https://api.sylphx.com/v1/orgs/acme/projects/shop/envs/production/trusted_issuers/trusted-issuer`
- **Scope** `auth:write`
- **Effect** `write` — a successful call changes state.
- **Collection** [trusted_issuers](/docs/api/trusted_issuers)
- **Query** `update_mask`, `validate_only`

## Request

| Field | Type | What it is |
| --- | --- | --- |
| `trusted_issuer` | `TrustedIssuer` | The trusted issuer to update; `name` identifies it. Required. |
| `update_mask` | `field_mask` | The fields to write; unset writes every populated field. |
| `validate_only` | `bool` | Validate and return the result without writing anything. |

### TrustedIssuer

| Field | Type | What it is |
| --- | --- | --- |
| `name` | `string` | `orgs/{org}/projects/{project}/envs/{env}/trusted_issuers/{trusted_issuer}`; the final segment is the issuer key (`^[a-z][a-z0-9]{1,15}$`, for example `clerk`) that every end-user id from this issuer carries. It never changes, so a user keeps the same id for as long as the issuer is trusted. |
| `meta` | `ResourceMeta` | Resource metadata. |
| `issuer` | `string` | The exact `iss` the issuer's tokens carry, an HTTPS URL, for example `https://clerk.example.com` or `https://securetoken.google.com/<project>`. One Trusted Issuer per issuer in an environment. Required. |
| `jwks_uri` | `string` | The HTTPS URL of the issuer's JSON Web Key Set. Only Auth fetches it. Required. |
| `audiences` | `string[]` | A token's `aud` must contain one of these, for example the Firebase project id or the Auth0 API identifier. Required. |
| `app_metadata_claims` | `TrustedIssuerClaimMapping[]` | Token claims copied into the end user's `app_metadata`, the claim policies read (for example the issuer's `org_role` as `roles`). Map only claims the issuer's admin sets, never ones the user can write. |
| `disabled` | `bool` | A disabled issuer's tokens are refused; its users keep their ids and data. |

### ResourceMeta

| Field | Type | What it is |
| --- | --- | --- |
| `labels` | `map<string, string>` | Caller-writable, indexed labels (AIP-122 label rules). |
| `annotations` | `map<string, string>` | Caller-writable, unindexed annotations. |
| `display_name` | `string` | Caller-writable human-readable name. |

### TrustedIssuerClaimMapping

| Field | Type | What it is |
| --- | --- | --- |
| `claim` | `string` | The top-level claim name in the issuer's token, for example `org_role` or `https://example.com/roles`. Required. |
| `key` | `string` | The `app_metadata` key it is copied to; unique within the issuer. Required. |

## Response

| Field | Type | What it is |
| --- | --- | --- |
| `name` | `string` | `orgs/{org}/projects/{project}/envs/{env}/trusted_issuers/{trusted_issuer}`; the final segment is the issuer key (`^[a-z][a-z0-9]{1,15}$`, for example `clerk`) that every end-user id from this issuer carries. It never changes, so a user keeps the same id for as long as the issuer is trusted. |
| `uid` | `string` | `tis_<ulid>`; never reused. Output only. |
| `meta` | `ResourceMeta` | Resource metadata. |
| `issuer` | `string` | The exact `iss` the issuer's tokens carry, an HTTPS URL, for example `https://clerk.example.com` or `https://securetoken.google.com/<project>`. One Trusted Issuer per issuer in an environment. Required. |
| `jwks_uri` | `string` | The HTTPS URL of the issuer's JSON Web Key Set. Only Auth fetches it. Required. |
| `audiences` | `string[]` | A token's `aud` must contain one of these, for example the Firebase project id or the Auth0 API identifier. Required. |
| `app_metadata_claims` | `TrustedIssuerClaimMapping[]` | Token claims copied into the end user's `app_metadata`, the claim policies read (for example the issuer's `org_role` as `roles`). Map only claims the issuer's admin sets, never ones the user can write. |
| `disabled` | `bool` | A disabled issuer's tokens are refused; its users keep their ids and data. |

### ResourceMeta

| Field | Type | What it is |
| --- | --- | --- |
| `generation` | `int64` | Increases by one on every change to `spec`. Output only. |
| `etag` | `string` | Strong ETag (AIP-154): changes on any change to spec, status, or metadata. Send it back as `If-Match` or `etag` to make Update and Delete conditional; a mismatch fails with ABORTED / 409 `ETAG_MISMATCH`. Output only. |
| `create_time` | `timestamp` | When the Resource was created. Output only. |
| `update_time` | `timestamp` | When the Resource last changed. Output only. |
| `delete_time` | `timestamp` | Set while the Resource is being deleted. Output only. |
| `labels` | `map<string, string>` | Caller-writable, indexed labels (AIP-122 label rules). |
| `annotations` | `map<string, string>` | Caller-writable, unindexed annotations. |
| `display_name` | `string` | Caller-writable human-readable name. |
| `creator` | `string` | The principal that created the Resource. Output only. |

### TrustedIssuerClaimMapping

| Field | Type | What it is |
| --- | --- | --- |
| `claim` | `string` | The top-level claim name in the issuer's token, for example `org_role` or `https://example.com/roles`. Required. |
| `key` | `string` | The `app_metadata` key it is copied to; unique within the issuer. Required. |

## Errors

- [`UNAUTHENTICATED`](/docs/api/errors/UNAUTHENTICATED) — No valid key or token was presented.
- [`PERMISSION_DENIED`](/docs/api/errors/PERMISSION_DENIED) — The key lacks the method's permission.
- [`RESOURCE_NOT_FOUND`](/docs/api/errors/RESOURCE_NOT_FOUND) — The named Resource does not exist or is not visible.
- [`UNKNOWN_FIELD`](/docs/api/errors/UNKNOWN_FIELD) — The request has a field the schema does not know.
- [`INVALID_FIELD`](/docs/api/errors/INVALID_FIELD) — A field failed validation.
- [`ETAG_MISMATCH`](/docs/api/errors/ETAG_MISMATCH) — The etag sent does not match the Resource's current etag.
- [`IDEMPOTENCY_KEY_REUSED`](/docs/api/errors/IDEMPOTENCY_KEY_REUSED) — An Idempotency-Key was reused with another body.
- [`IDEMPOTENCY_IN_PROGRESS`](/docs/api/errors/IDEMPOTENCY_IN_PROGRESS) — The first call with this Idempotency-Key is still running.

Every error arrives in the body [Errors](/docs/platform/errors) describes.

## Examples

**cURL**

```curl
curl -X PATCH "https://api.sylphx.com/v1/orgs/acme/projects/shop/envs/production/trusted_issuers/trusted-issuer" \
  -H "Authorization: Bearer $SYLPHX_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"audiences":["…"],"issuer":"…","jwks_uri":"…","name":"orgs/acme/projects/shop/envs/production/trusted_issuers/trusted-issuer"}'
```

**TypeScript**

```ts
const response = await sylphx.auth.trustedIssuers.update({ trustedIssuer: { audiences: ['…'], issuer: '…', jwksUri: '…', name: 'orgs/acme/projects/shop/envs/production/trusted_issuers/trusted-issuer' } })
```

**Rust**

```rust
let mut req = sylphx::auth::UpdateTrustedIssuerRequest::default();
req.trusted_issuer = Some(sylphx::auth::TrustedIssuer {
    audiences: vec!["…".to_string()],
    issuer: "…".to_string(),
    jwks_uri: "…".to_string(),
    name: "orgs/acme/projects/shop/envs/production/trusted_issuers/trusted-issuer".to_string(),
    ..Default::default()
});
let response = sx.auth().trusted_issuers().update(req).await?;
```

**CLI**

```bash
sylphx auth trusted-issuers update orgs/acme/projects/shop/envs/production/trusted_issuers/trusted-issuer --jwks-uri …
```

**MCP**

```json
{ "method_id": "auth.trusted_issuers.update", "args": {"trusted_issuer":{"audiences":["…"],"issuer":"…","jwks_uri":"…","name":"orgs/acme/projects/shop/envs/production/trusted_issuers/trusted-issuer"}} }
```