Troubleshooting: issuer readiness
Activation returns 400
Activation runs a checklist and refuses if anything required is outstanding. It is not a status you set, so retrying unchanged fails identically.
Read the checklist:
curl -sS "$MGMT/issuers/$ISSUER/readiness?api-version=2026-08-30" \
-H "Authorization: ApiKey $DILIGENCE_API_KEY"
Each requirement reports whether it is satisfied, and readyForActivation summarises. Fix what is listed.
Common causes
No active signing key. An issuer without one cannot sign, so it cannot issue. Provision a key — you can do it in the same call that creates the issuer.
No credential configuration. An activated issuer with nothing to issue would be activated in name only.
Incomplete metadata. Wallets fetch an issuer's published metadata; incomplete metadata produces an issuer wallets cannot use.
Issuance fails on an active issuer
Wrong environment. The issuer and the key must be in the same one. A cross-environment reference reports the issuer as not found.
The credential configuration is not authorised for this issuer. Configurations are created against an issuer; a configuration belonging to another issuer is not usable.
A claim is not declared. Issuance validates claims against the configuration and rejects anything
undeclared. The error names the offending claim in error.target. This is the mechanism working — a typo
failing at issuance is far better than a credential missing a field.
Readiness says ready, activation still fails
Something changed between the two calls, or the failure is not a readiness condition. Capture
x-ms-request-id from the activation response and quote it.