> ## Documentation Index
> Fetch the complete documentation index at: https://docs.mountthor.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Update IdP

> Updates mutable IdP metadata: display name, accepted audiences, clock skew,
and status. The issuer URL and JWKS source are immutable; register a new IdP
to change those trust roots.



## OpenAPI

````yaml /api-reference/customer-api.v1.openapi.json patch /v1/admin/identity/providers/{id}
openapi: 3.1.0
info:
  title: Mount Thor Customer API
  version: v1
servers:
  - description: Mount Thor customer API edge
    url: https://api.mountthor.com
security: []
paths:
  /v1/admin/identity/providers/{id}:
    patch:
      tags:
        - identity-workload
      summary: Update IdP
      description: >-
        Updates mutable IdP metadata: display name, accepted audiences, clock
        skew,

        and status. The issuer URL and JWKS source are immutable; register a new
        IdP

        to change those trust roots.
      operationId: patch_trusted_issuer
      parameters:
        - description: IdP UUID
          in: path
          name: id
          required: true
          schema:
            format: uuid
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/TrustedIssuerPatchRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TrustedIssuerResponse'
          description: IdP updated
        '400':
          description: Request body failed validation
        '401':
          description: Missing or invalid customer API key
        '403':
          description: API key is missing issuers:write scope
        '404':
          description: IdP does not exist for this customer
        '409':
          description: Re-enabling collides with another active IdP for this URL
        '429':
          content:
            text/plain:
              schema:
                type: string
          description: Rate limit exceeded
          headers:
            Retry-After:
              description: Seconds before retry.
              schema:
                minimum: 1
                type: integer
      security:
        - api_key_bearer:
            - issuers:write
components:
  schemas:
    TrustedIssuerPatchRequest:
      additionalProperties: false
      description: |-
        Request body for `PATCH /v1/admin/identity/providers/{id}`.

        The trust root (issuer URL + JWKS source) is intentionally immutable —
        re-register to rotate it, so a silent change of which keys are trusted
        cannot ride in on an update. Mutable: label, accepted audiences, clock
        skew, and `status` (disable / re-enable).
      properties:
        allowed_clock_skew_seconds:
          description: Replacement clock skew allowance in seconds.
          example: 60
          format: int64
          type:
            - integer
            - 'null'
        audiences:
          description: Replacement accepted token audiences.
          example:
            - api.mountthor.com
          items:
            type: string
          type:
            - array
            - 'null'
        display_name:
          description: New customer-facing label.
          maxLength: 200
          type:
            - string
            - 'null'
        status:
          description: 'New lifecycle state: `active` or `disabled`.'
          example: disabled
          type:
            - string
            - 'null'
      type: object
    TrustedIssuerResponse:
      allOf:
        - $ref: '#/components/schemas/TrustedIssuerMetadata'
        - additionalProperties: false
          properties:
            customer_id:
              description: Stable UUID for the customer account.
              type: string
          required:
            - customer_id
          type: object
      description: Identity provider detail response.
    TrustedIssuerMetadata:
      additionalProperties: false
      description: Identity provider metadata.
      properties:
        allowed_clock_skew_seconds:
          description: Clock skew allowed when validating token time claims.
          example: 60
          format: int64
          type: integer
        audiences:
          description: Accepted token audiences.
          example:
            - api.mountthor.com
          items:
            type: string
          type: array
        created_at:
          description: RFC 3339 creation timestamp.
          example: '2026-05-25T17:20:00Z'
          type: string
        display_name:
          description: Customer-facing IdP label.
          example: GitHub Actions OIDC
          type: string
        id:
          description: Stable IdP UUID.
          type: string
        issuer:
          description: Canonical OIDC issuer URL used to match the token `iss` claim.
          example: https://token.actions.githubusercontent.com
          type: string
        issuer_type:
          description: IdP category. Currently `oidc`.
          example: oidc
          type: string
        jwks_document_ref:
          description: Stored JWKS reference when `jwks_source_type` is `stored-jwks`.
          type:
            - string
            - 'null'
        jwks_source_type:
          description: 'JWKS resolution mode: `discovery`, `https`, or `stored-jwks`.'
          example: discovery
          type: string
        jwks_uri:
          description: Explicit JWKS URI when `jwks_source_type` is `https`.
          type:
            - string
            - 'null'
        status:
          description: IdP lifecycle state. Disabled IdPs cannot mint sessions.
          example: active
          type: string
        updated_at:
          description: RFC 3339 update timestamp.
          example: '2026-05-25T17:30:00Z'
          type: string
      required:
        - id
        - display_name
        - issuer_type
        - issuer
        - jwks_source_type
        - audiences
        - allowed_clock_skew_seconds
        - status
        - created_at
        - updated_at
      type: object
  securitySchemes:
    api_key_bearer:
      bearerFormat: mthr_live_*
      description: Bearer scheme name used by typed customer admin operations.
      scheme: bearer
      type: http

````