{
  "request_id": "hub_and_idp:create_or_update_hub_idp_federation_link:lab-pf-federation-link-hub-idp-local",
  "mode": "prepare_only",
  "execution_allowed": false,
  "operation": "create_or_update_hub_idp_federation_link",
  "target": "hub_and_idp",
  "risk": "high",
  "expected_approval_phrase": "APPROVE create_or_update_hub_idp_federation_link hub_and_idp lab-pf-federation-link-hub-idp-local",
  "approved_by": null,
  "gates": [
    {
      "name": "admin_credentials",
      "passed": false,
      "evidence": "Admin API credentials must be configured locally"
    },
    {
      "name": "inventory_read",
      "passed": false,
      "evidence": "Read current object state before writing"
    },
    {
      "name": "pre_change_snapshot",
      "passed": false,
      "evidence": "Save snapshot under runtime/pingfederate/snapshots"
    },
    {
      "name": "schema_validation",
      "passed": false,
      "evidence": "Validate PingFederate endpoint and payload schema"
    },
    {
      "name": "diff_ready",
      "passed": false,
      "evidence": "Show before/after diff"
    },
    {
      "name": "explicit_approval",
      "passed": false,
      "evidence": "Approval phrase: APPROVE create_or_update_hub_idp_federation_link hub_and_idp lab-pf-federation-link-hub-idp-local"
    }
  ],
  "next_action": "Resolve gate: admin_credentials",
  "write_endpoint": "not_selected_until_schema_validation",
  "plan": {
    "phase": "4",
    "mode": "dry_run",
    "target": "hub_and_idp",
    "status": "draft_payload_requires_pingfederate_schema_validation",
    "operation": "create_or_update_hub_idp_federation_link",
    "name": "lab-pf-federation-link-hub-idp-local",
    "admin_api_bases": {
      "hub": "https://hub-adm.sabathe.eu/pf-admin-api/v1",
      "idp": "https://idp-adm.sabathe.eu/pf-admin-api/v1"
    },
    "runtime_urls": {
      "hub": "https://hub.sabathe.eu",
      "idp": "https://idp.sabathe.eu"
    },
    "draft_payload": {
      "hub_side": {
        "object_type": "sp_idp_connection",
        "connection_name": "lab-pf-sp-idpconn-hub-to-idp-local",
        "expected_endpoint_family": "sp/idpConnections",
        "partner_entity": "idp.sabathe.eu",
        "metadata_source": "idp_runtime_metadata_or_admin_export",
        "activation": "manual_approval_required"
      },
      "idp_side": {
        "object_type": "idp_sp_connection",
        "connection_name": "lab-pf-idp-spconn-idp-to-hub-local",
        "expected_endpoint_family": "idp/spConnections",
        "partner_entity": "hub.sabathe.eu",
        "metadata_source": "hub_runtime_metadata_or_admin_export",
        "activation": "manual_approval_required"
      },
      "policy_attachment": {
        "source": "html_form_adapter_with_simple_pcv",
        "status": "planned"
      }
    },
    "checks_before_write": [
      "Inventory Hub SP IdP connections and IdP SP connections",
      "Confirm federation direction and entity IDs",
      "Validate public certificates and signing expectations",
      "Show Hub-side and IdP-side payloads",
      "Request explicit approval for each side"
    ]
  }
}