{
  "phase": "3",
  "mode": "dry_run",
  "target": "hub",
  "status": "draft_payload_requires_pingfederate_schema_validation",
  "operation": "create_or_update_oidc_client",
  "name": "lab-pf-oidc-client-iamlab-oidc-a-configured",
  "application": {
    "id": "oidc-a",
    "display_name": "OIDC Inspector A",
    "protocol": "OIDC",
    "mode": "oidc-client",
    "base_url": "https://oidc-a.sabathe.eu",
    "enabled": true
  },
  "admin_api_base": "https://hub-adm.sabathe.eu/pf-admin-api/v1",
  "expected_oidc_client": {
    "client_id": "oidc-a",
    "client_secret_env": "OIDC_A_CLIENT_SECRET",
    "redirect_uri": "https://oidc-a.sabathe.eu/callback",
    "post_logout_redirect_uri": "https://oidc-a.sabathe.eu/logout/callback",
    "scopes": [
      "openid",
      "profile",
      "email"
    ]
  },
  "draft_payload": {
    "client_id": "oidc-a",
    "name": "lab-pf-oidc-client-iamlab-oidc-a-configured",
    "redirect_uris": [
      "https://oidc-a.sabathe.eu/callback"
    ],
    "post_logout_redirect_uris": [
      "https://oidc-a.sabathe.eu/logout/callback"
    ],
    "grant_types": [
      "authorization_code"
    ],
    "response_types": [
      "code"
    ],
    "scopes": [
      "openid",
      "profile",
      "email"
    ],
    "client_secret": "[REDACTED]",
    "activation": "manual_approval_required"
  },
  "checks_before_write": [
    "Confirm target PingFederate is Hub",
    "Snapshot existing OAuth clients",
    "Confirm redirect URI reachability",
    "Confirm client secret generation/storage mode",
    "Show payload and request explicit approval"
  ]
}