{
  "phase": "2",
  "mode": "dry_run",
  "target": "hub",
  "status": "draft_payload_requires_pingfederate_schema_validation",
  "operation": "create_or_update_saml_sp_connection",
  "name": "lab-pf-saml-sp-iamlab-saml-a-local",
  "application": {
    "id": "saml-a",
    "display_name": "SAML Inspector A",
    "protocol": "SAML",
    "mode": "saml-sp",
    "base_url": "https://saml-a.sabathe.eu",
    "enabled": true
  },
  "admin_api_base": "https://hub-adm.sabathe.eu/pf-admin-api/v1",
  "expected_sp_metadata": {
    "entity_id": "http://127.0.0.1:18102/apps/saml-a/metadata/local",
    "metadata_url": "http://127.0.0.1:18102/apps/saml-a/metadata/local",
    "acs_url": "http://127.0.0.1:18102/saml/acs",
    "slo_url": "http://127.0.0.1:18102/saml/slo"
  },
  "draft_payload": {
    "connection_name": "lab-pf-saml-sp-iamlab-saml-a-local",
    "entity_id": "http://127.0.0.1:18102/apps/saml-a/metadata/local",
    "base_url": "https://saml-a.sabathe.eu",
    "acs_urls": [
      "http://127.0.0.1:18102/saml/acs"
    ],
    "slo_url": "http://127.0.0.1:18102/saml/slo",
    "metadata_url": "http://127.0.0.1:18102/apps/saml-a/metadata/local",
    "signing": {
      "authn_requests_signed": false,
      "want_assertions_signed": true,
      "certificate_source": "PingFederate key pair to select manually in phase 2"
    },
    "activation": "manual_approval_required"
  },
  "checks_before_write": [
    "Confirm target PingFederate is Hub",
    "Snapshot existing SP connections",
    "Confirm signing certificate/key pair",
    "Validate metadata URL or import XML",
    "Show payload and request explicit approval"
  ]
}