Reference
issuers
Trusted-issuer registrations: an external issuer's short-lived JWTs exchanged for Troupe tokens. Index · shared schemas · errors.
| Procedure | Summary | REST | MCP tool | Stability |
|---|---|---|---|---|
issuers.create | Register a trusted issuer for the org; Troupe mints its audience and fetches its JWKS. Trust class. | POST | — | experimental |
issuers.list | List the org's trusted-issuer registrations | GET | — | experimental |
issuers.update | Change what a registration accepts or reactivate it. Trust class. | POST | — | experimental |
issuers.suspend | Suspend a registration: exchanges are refused and its tokens get SERVICE_SUSPENDED from the next request | POST | — | experimental |
issuers.remove | Remove a registration; its tokens stop working from the next request | POST | — | experimental |
issuers.create
Register a trusted issuer for the org; Troupe mints its audience and fetches its JWKS. Trust class.
| REST | POST /v1/issuers/create (input as a JSON body) |
| RPC | /rpc/v2/issuers/create |
| MCP | not a tool (a cloud platform procedure; the cloud MCP surface is the curated device tools); hints: none |
| Auth | org:manage; trust-class: locally only the runtime owner token; in the cloud only an interactive user session re-authenticated within 15 minutes; never an API key or an MCP token |
| Tenancy | org |
| Troupe Cloud | answered by the control plane |
| Stability | experimental, since 1.0 |
Input:
{
orgId: OrgId
name: DisplayName
issuer: string // ≤ 2048 chars; url
jwksUri: string // ≤ 2048 chars; url
acceptedTyp: string[] // 1–4 items; each /^[A-Za-z0-9+./-]{1,64}$/
allowedAlgs: ('EdDSA' | 'ES256' | 'RS256')[] // 1–3 items
clientBinding: ClientBinding
conditions: IssuerCondition[] // ≤ 16 items
scopeSource: 'claim' | 'fixed'
fixedScopes?: CloudScope[] // ≤ 64 items
scopeCeiling: CloudScope[] // 1–64 items
subjectTemplate?: SubjectTemplate
subtenantClaim?: ClaimName
projectMapping: 'auto-create' | 'require-existing' | 'fixed'
projectId?: ProjectId
maxProjects?: integer // 1–100000
maxTokenLifetimeSeconds?: integer // 1–600
preset?: string // /^[a-z0-9-]{1,32}$/
}Output:
{ issuer: TrustedIssuer }Errors: U, NOT_FOUND, ORG_SUSPENDED, CONFLICT.
Named types: ClaimName, ClientBinding, CloudScope, DisplayName, IssuerCondition, OrgId, ProjectId, SubjectTemplate, TrustedIssuer.
issuers.list
List the org's trusted-issuer registrations
| REST | GET /v1/issuers/list (input as query parameters) |
| RPC | /rpc/v2/issuers/list |
| MCP | not a tool (a cloud platform procedure; the cloud MCP surface is the curated device tools); hints: read-only, idempotent |
| Auth | org:manage |
| Tenancy | org |
| Troupe Cloud | answered by the control plane |
| Stability | experimental, since 1.0 |
Input:
{ orgId: OrgId }Output:
{ issuers: TrustedIssuer[] }Named types: OrgId, TrustedIssuer.
issuers.update
Change what a registration accepts or reactivate it. Trust class.
| REST | POST /v1/issuers/update (input as a JSON body) |
| RPC | /rpc/v2/issuers/update |
| MCP | not a tool (a cloud platform procedure; the cloud MCP surface is the curated device tools); hints: idempotent |
| Auth | org:manage; trust-class: locally only the runtime owner token; in the cloud only an interactive user session re-authenticated within 15 minutes; never an API key or an MCP token |
| Tenancy | org |
| Troupe Cloud | answered by the control plane |
| Stability | experimental, since 1.0 |
Input:
{
orgId: OrgId
issuerId: IssuerId
name?: DisplayName
conditions?: IssuerCondition[] // ≤ 16 items
clientBinding?: ClientBinding
scopeCeiling?: CloudScope[] // 1–64 items
fixedScopes?: CloudScope[] // ≤ 64 items
maxProjects?: integer // 1–100000
status?: 'active'
}Output:
{ issuer: TrustedIssuer }Errors: U, NOT_FOUND, ORG_SUSPENDED, CONFLICT.
Named types: ClientBinding, CloudScope, DisplayName, IssuerCondition, IssuerId, OrgId, TrustedIssuer.
issuers.suspend
Suspend a registration: exchanges are refused and its tokens get SERVICE_SUSPENDED from the next request
| REST | POST /v1/issuers/suspend (input as a JSON body) |
| RPC | /rpc/v2/issuers/suspend |
| MCP | not a tool (a cloud platform procedure; the cloud MCP surface is the curated device tools); hints: idempotent |
| Auth | org:manage |
| Tenancy | org |
| Troupe Cloud | answered by the control plane |
| Stability | experimental, since 1.0 |
Input:
{ orgId: OrgId; issuerId: IssuerId }Output:
{ issuer: TrustedIssuer }Errors: U, NOT_FOUND, CONFLICT.
Named types: IssuerId, OrgId, TrustedIssuer.
issuers.remove
Remove a registration; its tokens stop working from the next request
| REST | POST /v1/issuers/remove (input as a JSON body) |
| RPC | /rpc/v2/issuers/remove |
| MCP | not a tool (a cloud platform procedure; the cloud MCP surface is the curated device tools); hints: idempotent, destructive |
| Auth | org:manage |
| Tenancy | org |
| Troupe Cloud | answered by the control plane |
| Stability | experimental, since 1.0 |
Input:
{ orgId: OrgId; issuerId: IssuerId }Output:
{ removed: boolean }