SAML-Provider anlegen

{
  "operationId": "post_v2_saml",
  "summary": "SAML-Provider anlegen",
  "description": "Importiert IdP-Metadaten über remote_xml_url oder remote_xml_file (XML bzw. Base64-XML), erzeugt das SP-Zertifikat und startet deaktiviert. provider_name ist erforderlich; bei login_scope=both/admin wird eine gültige permission benötigt, bei user kann das Standardprofil dienen. Aktivierung erst nach vollständigem Feldmapping; gültiges IdP-Zertifikat mit mehr als sieben Tagen Restlaufzeit erforderlich.",
  "tags": [
    "saml"
  ],
  "security": [
    {
      "bearerAuth": [],
      "accountContext": []
    },
    {
      "sessionCookie": [],
      "accountContext": []
    }
  ],
  "parameters": [
    {
      "name": "language",
      "in": "header",
      "required": false,
      "description": "Account language code, where the resource supports setLanguage().",
      "schema": {
        "type": "string",
        "examples": [
          "de"
        ]
      }
    },
    {
      "name": "X-Edoobox-If-Revision",
      "in": "header",
      "required": false,
      "schema": {
        "type": "string",
        "pattern": "^[a-f0-9]{32}$",
        "examples": [
          "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
        ]
      },
      "description": "Optional account mutation revision from a preceding authenticated auth-context snapshot. The dispatcher compares it while holding the account lock; mismatch409 requires a new review."
    }
  ],
  "responses": {
    "200": {
      "description": "Response; inspect error and success as legacy failures may also use HTTP 200.",
      "content": {
        "application/json": {
          "example": {
            "success": true,
            "error": false,
            "data": {
              "id": "saml_012345abcdef_123456"
            }
          },
          "schema": {
            "type": "object",
            "properties": {
              "success": {
                "type": "boolean"
              },
              "error": {
                "type": [
                  "boolean",
                  "string"
                ]
              },
              "error_code": {
                "type": "string"
              },
              "data": {
                "description": "Action-dependent data; deliberately unconstrained until a complete field contract is established."
              },
              "type": {
                "type": "string"
              }
            },
            "additionalProperties": true
          }
        }
      },
      "headers": {
        "X-Edoobox-Revision": {
          "schema": {
            "type": "string",
            "pattern": "^[a-f0-9]{32}$"
          },
          "description": "Rotated account revision supplied for the next action in one reviewed sequence."
        }
      }
    },
    "400": {
      "description": "Invalid request.",
      "content": {
        "application/json": {
          "example": {
            "success": false,
            "error": "ED40006"
          }
        }
      }
    },
    "401": {
      "description": "Missing/expired token, missing account context, account paused or model-specific authorization failure.",
      "content": {
        "application/json": {
          "example": {
            "success": false,
            "error": "ED40103"
          }
        }
      }
    },
    "402": {
      "description": "Missing/invalid action data or subscription/operation restriction.",
      "content": {
        "application/json": {
          "example": {
            "success": false,
            "error": "ED80100"
          }
        }
      }
    },
    "403": {
      "description": "Permission denied. Browser CORS rejection may have an empty body.",
      "content": {
        "application/json": {
          "example": {
            "success": false,
            "error": "ED40340"
          }
        }
      }
    },
    "404": {
      "description": "Unknown resource/action or unsupported method.",
      "content": {
        "application/json": {
          "example": {
            "success": false,
            "error": "ED80019"
          }
        }
      }
    },
    "409": {
      "description": "The account changed after the reviewed read. No domain operation is dispatched; obtain fresh state and review again.",
      "content": {
        "application/json": {
          "schema": {
            "type": "object",
            "additionalProperties": true
          },
          "example": {
            "error": "ED40901",
            "error_code": "mutation_revision_conflict"
          }
        }
      }
    },
    "422": {
      "description": "Validation failed.",
      "content": {
        "application/json": {
          "example": {
            "success": false,
            "error": "ED80020"
          }
        }
      }
    },
    "429": {
      "description": "Request/login rate limit exceeded. Honor Retry-After when supplied; legacy rate-limit paths may omit it. Retry only proven reads within a bounded deadline; a mutation is never automatically replayed after an ambiguous response.",
      "content": {
        "application/json": {
          "example": {
            "success": false,
            "error": "ED42902"
          }
        }
      },
      "headers": {
        "Retry-After": {
          "description": "Optional server delay in whole seconds or an HTTP date. Absence is not permission for an immediate retry.",
          "schema": {
            "type": "string",
            "examples": [
              "30"
            ]
          }
        }
      }
    },
    "502": {
      "description": "Server-side operation failed.",
      "content": {
        "application/json": {
          "example": {
            "success": false,
            "error": "ED50201"
          }
        }
      }
    },
    "503": {
      "description": "The account mutation lock or revision store is unavailable. No unprotected fallback is executed.",
      "headers": {
        "Retry-After": {
          "schema": {
            "type": "integer",
            "const": 1
          }
        }
      },
      "content": {
        "application/json": {
          "schema": {
            "type": "object",
            "additionalProperties": true
          },
          "example": {
            "error": "ED50301",
            "error_code": "mutation_revision_busy"
          }
        }
      }
    }
  },
  "x-edoobox-mutates-state": true,
  "requestBody": {
    "required": true,
    "content": {
      "application/json": {
        "schema": {
          "type": "object",
          "properties": {
            "data": {
              "anyOf": [
                {
                  "type": "object",
                  "properties": {
                    "id": false,
                    "status": {
                      "type": [
                        "string",
                        "number",
                        "boolean",
                        "null",
                        "array",
                        "object"
                      ],
                      "x-edoobox-canonicalType": "boolean",
                      "x-edoobox-schemaStatus": "reviewed-normalizing",
                      "x-edoobox-normalization": "Creation must remain disabled: getter uses loose PHP == true and before-insert rejects normalized enabled state with ED80100/status_activation_after_setup, then forces 0.",
                      "description": "Creation must remain disabled: getter uses loose PHP == true and before-insert rejects normalized enabled state with ED80100/status_activation_after_setup, then forces 0.",
                      "x-edoobox-contractSource": [
                        {
                          "file": "application/models/v2/Saml.php",
                          "line": 40,
                          "reason": "Structure declaration: input get, output set, persistence flags and field hooks.",
                          "sha256": "d96a3b34fc395f517b58f0fe921ceffba9dd675c237f546d91cebc600ea783fc"
                        },
                        {
                          "file": "application/models/v2/Samlfunc.php",
                          "line": 224,
                          "reason": "Create forbids activating before setup and forces initial disabled status.",
                          "sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
                        },
                        {
                          "file": "application/models/v2/Samlfunc.php",
                          "line": 1274,
                          "reason": "Actual activation hook: strict false short circuit, settings/URL and required mapping checks.",
                          "sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
                        },
                        {
                          "file": "application/models/v2/Samlfunc.php",
                          "line": 1399,
                          "reason": "Provider config depends on stored certificate/mapping and may refresh metadata XML in real runtime.",
                          "sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
                        },
                        {
                          "file": "application/models/v2/Samlfunc.php",
                          "line": 1357,
                          "reason": "Metadata refresh delegates parsing and may fetch XML during real runtime; not invoked by this source review.",
                          "sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
                        },
                        {
                          "file": "application/libraries/edoobox/integrations/auth/Saml.php",
                          "line": 85,
                          "reason": "Login URL wrapper delegates to OneLogin auth login with stay=true.",
                          "sha256": "cb122e325068b8432675dd52856fd095233782d10652ee3a56ee8161ff3acb57"
                        },
                        {
                          "file": "application/models/v2/Samlfunc.php",
                          "line": 2925,
                          "reason": "Required mapping keys are explicit.",
                          "sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
                        },
                        {
                          "file": "application/models/v2/Saml.php",
                          "line": 349,
                          "reason": "Resource POST/PUT dispatch reachability and preconditions; field contracts apply to parent resource, not sub-resource actions.",
                          "sha256": "d96a3b34fc395f517b58f0fe921ceffba9dd675c237f546d91cebc600ea783fc"
                        },
                        {
                          "file": "application/libraries/edoobox/integrations/auth/Saml.php",
                          "line": 246,
                          "reason": "Followed injectSettings/getSettings: build SP/IdP settings and instantiate OneLogin Auth, with signing and stored certificate settings.",
                          "sha256": "cb122e325068b8432675dd52856fd095233782d10652ee3a56ee8161ff3acb57"
                        },
                        {
                          "file": "application/libraries/edoobox/integrations/auth/Saml.php",
                          "line": 115,
                          "reason": "Followed service-provider settings construction used for activation.",
                          "sha256": "cb122e325068b8432675dd52856fd095233782d10652ee3a56ee8161ff3acb57"
                        },
                        {
                          "file": "vendor/onelogin/php-saml/src/Saml2/Auth.php",
                          "line": 174,
                          "reason": "Installed OneLogin Auth delegates validation to its Settings constructor.",
                          "sha256": "d4a3737528426ace71044fbc90e1a06273a76149c55ee1410dc21ae225ed4a8a"
                        },
                        {
                          "file": "vendor/onelogin/php-saml/src/Saml2/Auth.php",
                          "line": 542,
                          "reason": "Installed OneLogin login builds the SAML request and a redirect URL; this is not a completed external provider handshake.",
                          "sha256": "d4a3737528426ace71044fbc90e1a06273a76149c55ee1410dc21ae225ed4a8a"
                        },
                        {
                          "file": "docs/openapi/reviews/identity-fields.json",
                          "line": 1,
                          "reason": "Independent field-level source review, direction applicability, examples and explicit runtime limitations.",
                          "sha256": "ccb043758defa22ad8cf879c4c81b317fd537f8fd0cfb125a4c1c7ffc7cdf8bf"
                        }
                      ]
                    },
                    "permission": {
                      "type": "string",
                      "pattern": "^[a-z0-9]+_[a-f0-9]{12}_-?[0-9]+$",
                      "description": "Opaque edoobox v2 object ID returned by this account. Never send a raw database ID. The synthetic example is illustrative and is not a real record.",
                      "examples": [
                        "permission_012345abcdef_123456"
                      ],
                      "x-edoobox-schemaStatus": "source-inferred",
                      "x-edoobox-sourceLine": 50
                    },
                    "provider_name": {
                      "x-edoobox-canonicalType": "string",
                      "x-edoobox-maxStoredLength": 150,
                      "x-edoobox-normalization": "The aP getter trims text, replaces newlines and limits the legacy escaped storage representation to maxStoredLength UTF-8 characters without splitting escape pairs; aQ decodes the stored representation. Non-string input becomes empty text. This getter limit is normalization, not a rejecting input maxLength or proof of a custom action hook or database column capacity.",
                      "examples": [
                        "Example"
                      ],
                      "x-edoobox-requiredOnCreate": true,
                      "x-edoobox-sourceLine": 63
                    },
                    "remote_xml_url": {
                      "x-edoobox-canonicalType": "string",
                      "x-edoobox-maxStoredLength": 500,
                      "x-edoobox-normalization": "The aP getter trims text, replaces newlines and limits the legacy escaped storage representation to maxStoredLength UTF-8 characters without splitting escape pairs; aQ decodes the stored representation. Non-string input becomes empty text. This getter limit is normalization, not a rejecting input maxLength or proof of a custom action hook or database column capacity.",
                      "examples": [
                        "Example"
                      ],
                      "x-edoobox-writableOnUpdate": false,
                      "x-edoobox-sourceLine": 76
                    },
                    "remote_xml_content": {
                      "not": {},
                      "description": "Omit on ordinary single-record POST: getter returns strict false and API_DATA rejects the record before before-insert. The XML is obtained from remote_xml_file/remote_xml_url and its parser output.",
                      "x-edoobox-schemaStatus": "reviewed-not-writable",
                      "x-edoobox-clientRestriction": "Omit this field from client writes; the runtime behavior is described separately.",
                      "x-edoobox-contractSource": [
                        {
                          "file": "application/models/v2/Saml.php",
                          "line": 90,
                          "reason": "Structure declaration: input get, output set, persistence flags and field hooks.",
                          "sha256": "d96a3b34fc395f517b58f0fe921ceffba9dd675c237f546d91cebc600ea783fc"
                        },
                        {
                          "file": "application/models/v2/Samlfunc.php",
                          "line": 236,
                          "reason": "Creation reads remote_xml_file or remote_xml_url, validates/parses XML and assigns escaped metadata content.",
                          "sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
                        },
                        {
                          "file": "application/models/v2/Saml.php",
                          "line": 349,
                          "reason": "Resource POST/PUT dispatch reachability and preconditions; field contracts apply to parent resource, not sub-resource actions.",
                          "sha256": "d96a3b34fc395f517b58f0fe921ceffba9dd675c237f546d91cebc600ea783fc"
                        },
                        {
                          "file": "application/libraries/edoobox/integrations/auth/Saml.php",
                          "line": 232,
                          "reason": "Followed XML parsing wrapper to the installed OneLogin metadata parser.",
                          "sha256": "cb122e325068b8432675dd52856fd095233782d10652ee3a56ee8161ff3acb57"
                        },
                        {
                          "file": "vendor/onelogin/php-saml/src/Saml2/IdPMetadataParser.php",
                          "line": 115,
                          "reason": "Installed parser loads XML, selects entity descriptor and extracts SSO/SLO locations and bindings.",
                          "sha256": "4df0c1b7bf79d2df3d1903099fde2edaefe07b7d690f427958a0746f3daf6e9e"
                        },
                        {
                          "file": "docs/openapi/reviews/identity-fields.json",
                          "line": 1,
                          "reason": "Independent field-level source review, direction applicability, examples and explicit runtime limitations.",
                          "sha256": "ccb043758defa22ad8cf879c4c81b317fd537f8fd0cfb125a4c1c7ffc7cdf8bf"
                        }
                      ]
                    },
                    "login_service_url": {
                      "not": {},
                      "description": "Omit on ordinary single-record POST: getter returns strict false and API_DATA rejects the record before before-insert. The service URL is extracted from parsed metadata.",
                      "x-edoobox-schemaStatus": "reviewed-not-writable",
                      "x-edoobox-clientRestriction": "Omit this field from client writes; the runtime behavior is described separately.",
                      "x-edoobox-contractSource": [
                        {
                          "file": "application/models/v2/Saml.php",
                          "line": 103,
                          "reason": "Structure declaration: input get, output set, persistence flags and field hooks.",
                          "sha256": "d96a3b34fc395f517b58f0fe921ceffba9dd675c237f546d91cebc600ea783fc"
                        },
                        {
                          "file": "application/models/v2/Samlfunc.php",
                          "line": 297,
                          "reason": "Before-insert derives SSO/SLO URLs; missing valid SSO rejects provider, optional SLO can remain false.",
                          "sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
                        },
                        {
                          "file": "application/models/v2/Saml.php",
                          "line": 349,
                          "reason": "Resource POST/PUT dispatch reachability and preconditions; field contracts apply to parent resource, not sub-resource actions.",
                          "sha256": "d96a3b34fc395f517b58f0fe921ceffba9dd675c237f546d91cebc600ea783fc"
                        },
                        {
                          "file": "application/libraries/edoobox/integrations/auth/Saml.php",
                          "line": 232,
                          "reason": "Followed XML parsing wrapper to the installed OneLogin metadata parser.",
                          "sha256": "cb122e325068b8432675dd52856fd095233782d10652ee3a56ee8161ff3acb57"
                        },
                        {
                          "file": "vendor/onelogin/php-saml/src/Saml2/IdPMetadataParser.php",
                          "line": 115,
                          "reason": "Installed parser loads XML, selects entity descriptor and extracts SSO/SLO locations and bindings.",
                          "sha256": "4df0c1b7bf79d2df3d1903099fde2edaefe07b7d690f427958a0746f3daf6e9e"
                        },
                        {
                          "file": "docs/openapi/reviews/identity-fields.json",
                          "line": 1,
                          "reason": "Independent field-level source review, direction applicability, examples and explicit runtime limitations.",
                          "sha256": "ccb043758defa22ad8cf879c4c81b317fd537f8fd0cfb125a4c1c7ffc7cdf8bf"
                        }
                      ]
                    },
                    "logout_service_url": {
                      "not": {},
                      "description": "Omit on ordinary single-record POST: getter returns strict false and API_DATA rejects the record before before-insert. The service URL is extracted from parsed metadata.",
                      "x-edoobox-schemaStatus": "reviewed-not-writable",
                      "x-edoobox-clientRestriction": "Omit this field from client writes; the runtime behavior is described separately.",
                      "x-edoobox-contractSource": [
                        {
                          "file": "application/models/v2/Saml.php",
                          "line": 113,
                          "reason": "Structure declaration: input get, output set, persistence flags and field hooks.",
                          "sha256": "d96a3b34fc395f517b58f0fe921ceffba9dd675c237f546d91cebc600ea783fc"
                        },
                        {
                          "file": "application/models/v2/Samlfunc.php",
                          "line": 297,
                          "reason": "Before-insert derives SSO/SLO URLs; missing valid SSO rejects provider, optional SLO can remain false.",
                          "sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
                        },
                        {
                          "file": "application/models/v2/Saml.php",
                          "line": 349,
                          "reason": "Resource POST/PUT dispatch reachability and preconditions; field contracts apply to parent resource, not sub-resource actions.",
                          "sha256": "d96a3b34fc395f517b58f0fe921ceffba9dd675c237f546d91cebc600ea783fc"
                        },
                        {
                          "file": "application/libraries/edoobox/integrations/auth/Saml.php",
                          "line": 232,
                          "reason": "Followed XML parsing wrapper to the installed OneLogin metadata parser.",
                          "sha256": "cb122e325068b8432675dd52856fd095233782d10652ee3a56ee8161ff3acb57"
                        },
                        {
                          "file": "vendor/onelogin/php-saml/src/Saml2/IdPMetadataParser.php",
                          "line": 115,
                          "reason": "Installed parser loads XML, selects entity descriptor and extracts SSO/SLO locations and bindings.",
                          "sha256": "4df0c1b7bf79d2df3d1903099fde2edaefe07b7d690f427958a0746f3daf6e9e"
                        },
                        {
                          "file": "docs/openapi/reviews/identity-fields.json",
                          "line": 1,
                          "reason": "Independent field-level source review, direction applicability, examples and explicit runtime limitations.",
                          "sha256": "ccb043758defa22ad8cf879c4c81b317fd537f8fd0cfb125a4c1c7ffc7cdf8bf"
                        }
                      ]
                    },
                    "field_maping": {
                      "not": {},
                      "description": "Omit on ordinary single-record POST: getter always returns false, causing ED80100 before the before-insert hook. Creation derives mappings from metadata instead.",
                      "x-edoobox-schemaStatus": "reviewed-not-writable",
                      "x-edoobox-clientRestriction": "Omit this field from client writes; the runtime behavior is described separately.",
                      "x-edoobox-contractSource": [
                        {
                          "file": "application/models/v2/Saml.php",
                          "line": 123,
                          "reason": "Structure declaration: input get, output set, persistence flags and field hooks.",
                          "sha256": "d96a3b34fc395f517b58f0fe921ceffba9dd675c237f546d91cebc600ea783fc"
                        },
                        {
                          "file": "application/models/v2/Samlfunc.php",
                          "line": 2861,
                          "reason": "Actual PUT mapping loop, truthiness requirement, duplicate detection and full replacement.",
                          "sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
                        },
                        {
                          "file": "application/models/v2/Samlfunc.php",
                          "line": 480,
                          "reason": "Followed target normalizer and additional-user-field classifier.",
                          "sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
                        },
                        {
                          "file": "application/models/v2/Samlfunc.php",
                          "line": 2925,
                          "reason": "Followed base required mapping keys.",
                          "sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
                        },
                        {
                          "file": "application/models/v2/Samlfunc.php",
                          "line": 319,
                          "reason": "Create mapping starts with idp metadata and empty field list.",
                          "sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
                        },
                        {
                          "file": "application/models/v2/Samlfunc.php",
                          "line": 389,
                          "reason": "Create mapping is derived from offered/default claims and stored, overwriting submitted batch value.",
                          "sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
                        },
                        {
                          "file": "application/models/v2/Samlfunc.php",
                          "line": 1399,
                          "reason": "Followed getProviderData: existing provider/certificate lookup and mapping metadata; refresh may load remote XML in actual runtime, never during this review.",
                          "sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
                        },
                        {
                          "file": "application/models/v2/Saml.php",
                          "line": 349,
                          "reason": "Resource POST/PUT dispatch reachability and preconditions; field contracts apply to parent resource, not sub-resource actions.",
                          "sha256": "d96a3b34fc395f517b58f0fe921ceffba9dd675c237f546d91cebc600ea783fc"
                        },
                        {
                          "file": "docs/openapi/reviews/identity-fields.json",
                          "line": 1,
                          "reason": "Independent field-level source review, direction applicability, examples and explicit runtime limitations.",
                          "sha256": "ccb043758defa22ad8cf879c4c81b317fd537f8fd0cfb125a4c1c7ffc7cdf8bf"
                        }
                      ]
                    },
                    "allow_migration_user": {
                      "x-edoobox-schemaStatus": "source-inferred",
                      "x-edoobox-sourceLine": 135,
                      "x-edoobox-canonicalType": "boolean",
                      "x-edoobox-normalization": "PHP coercion/normalization is applied by the Structure getter; its return type is not a rejecting wire-input type restriction.",
                      "examples": [
                        false
                      ]
                    },
                    "allow_permission_acl": {
                      "x-edoobox-schemaStatus": "source-inferred",
                      "x-edoobox-sourceLine": 144,
                      "x-edoobox-canonicalType": "boolean",
                      "x-edoobox-normalization": "PHP coercion/normalization is applied by the Structure getter; its return type is not a rejecting wire-input type restriction.",
                      "examples": [
                        false
                      ]
                    },
                    "login_scope": {
                      "x-edoobox-canonicalType": "string",
                      "x-edoobox-schemaStatus": "reviewed-normalizing",
                      "x-edoobox-normalization": "Strings are trimmed and lowercased. Nonempty unknown strings are rejected with ED80100/invalid_login_scope. Empty/whitespace-only strings and non-string JSON values normalize to both. This is not an exact case-sensitive input enum.",
                      "description": "Strings are trimmed and lowercased. Nonempty unknown strings are rejected with ED80100/invalid_login_scope. Empty/whitespace-only strings and non-string JSON values normalize to both. This is not an exact case-sensitive input enum.",
                      "x-edoobox-recognizedValues": [
                        "both",
                        "admin",
                        "user"
                      ],
                      "examples": [
                        " User "
                      ],
                      "anyOf": [
                        {
                          "type": "string",
                          "pattern": "^[ \\t\\n\\r\\x00\\x0B]*(?:[bB][oO][tT][hH]|[aA][dD][mM][iI][nN]|[uU][sS][eE][rR])?[ \\t\\n\\r\\x00\\x0B]*$"
                        },
                        {
                          "type": [
                            "number",
                            "boolean",
                            "null",
                            "array",
                            "object"
                          ]
                        }
                      ],
                      "x-edoobox-contractSource": [
                        {
                          "file": "application/models/v2/Saml.php",
                          "line": 153,
                          "reason": "Structure declaration: input get, output set, persistence flags and field hooks.",
                          "sha256": "d96a3b34fc395f517b58f0fe921ceffba9dd675c237f546d91cebc600ea783fc"
                        },
                        {
                          "file": "application/models/v2/Samlfunc.php",
                          "line": 22,
                          "reason": "Followed validateProvidedLoginScope and provider normalizer.",
                          "sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
                        },
                        {
                          "file": "application/models/v2/Samlfunc.php",
                          "line": 197,
                          "reason": "Before-insert sets scope and applies dependent permission requirement.",
                          "sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
                        },
                        {
                          "file": "application/models/v2/Samlfunc.php",
                          "line": 2840,
                          "reason": "Actual PUT hook delegates to scope validator.",
                          "sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
                        },
                        {
                          "file": "application/libraries/edoobox/integrations/auth/Saml.php",
                          "line": 42,
                          "reason": "Allowed normalized scopes and default both; output normalizer.",
                          "sha256": "cb122e325068b8432675dd52856fd095233782d10652ee3a56ee8161ff3acb57"
                        },
                        {
                          "file": "application/models/v2/Saml.php",
                          "line": 349,
                          "reason": "Resource POST/PUT dispatch reachability and preconditions; field contracts apply to parent resource, not sub-resource actions.",
                          "sha256": "d96a3b34fc395f517b58f0fe921ceffba9dd675c237f546d91cebc600ea783fc"
                        },
                        {
                          "file": "docs/openapi/reviews/identity-fields.json",
                          "line": 1,
                          "reason": "Independent field-level source review, direction applicability, examples and explicit runtime limitations.",
                          "sha256": "ccb043758defa22ad8cf879c4c81b317fd537f8fd0cfb125a4c1c7ffc7cdf8bf"
                        }
                      ]
                    },
                    "name_id_format": {
                      "type": "string",
                      "enum": [
                        "urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified",
                        "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress",
                        "urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"
                      ],
                      "description": "Exact OneLogin NameID format; input validator strictly rejects every other value. No trimming/case folding precedes validation.",
                      "x-edoobox-schemaStatus": "source-reviewed",
                      "x-edoobox-contractSource": [
                        {
                          "file": "application/models/v2/Saml.php",
                          "line": 172,
                          "reason": "Structure declaration: input get, output set, persistence flags and field hooks.",
                          "sha256": "d96a3b34fc395f517b58f0fe921ceffba9dd675c237f546d91cebc600ea783fc"
                        },
                        {
                          "file": "application/models/v2/Samlfunc.php",
                          "line": 2770,
                          "reason": "PUT checks exact NameID allowed values before aP storage.",
                          "sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
                        },
                        {
                          "file": "application/libraries/edoobox/integrations/auth/Saml.php",
                          "line": 14,
                          "reason": "Strict allowed formats and separate response fallback.",
                          "sha256": "cb122e325068b8432675dd52856fd095233782d10652ee3a56ee8161ff3acb57"
                        },
                        {
                          "file": "vendor/onelogin/php-saml/src/Saml2/Constants.php",
                          "line": 26,
                          "reason": "Followed installed dependency constants to actual standard URI strings.",
                          "sha256": "a7f6ab35d1209e34d499662ae1f8f5bedf0ae6f08325388e8b186ea85f6c236d"
                        },
                        {
                          "file": "application/models/v2/Saml.php",
                          "line": 349,
                          "reason": "Resource POST/PUT dispatch reachability and preconditions; field contracts apply to parent resource, not sub-resource actions.",
                          "sha256": "d96a3b34fc395f517b58f0fe921ceffba9dd675c237f546d91cebc600ea783fc"
                        },
                        {
                          "file": "docs/openapi/reviews/identity-fields.json",
                          "line": 1,
                          "reason": "Independent field-level source review, direction applicability, examples and explicit runtime limitations.",
                          "sha256": "ccb043758defa22ad8cf879c4c81b317fd537f8fd0cfb125a4c1c7ffc7cdf8bf"
                        }
                      ]
                    },
                    "auth_request_signed": {
                      "type": [
                        "string",
                        "number",
                        "boolean",
                        "null",
                        "array",
                        "object"
                      ],
                      "x-edoobox-canonicalType": "boolean",
                      "x-edoobox-schemaStatus": "reviewed-normalizing",
                      "x-edoobox-normalization": "POST getter uses PHP loose comparison to true. Canonical client value is boolean; non-boolean values are normalized, not rejected by a wire type validator.",
                      "description": "POST getter uses PHP loose comparison to true. Canonical client value is boolean; non-boolean values are normalized, not rejected by a wire type validator.",
                      "x-edoobox-contractSource": [
                        {
                          "file": "application/models/v2/Saml.php",
                          "line": 190,
                          "reason": "Structure declaration: input get, output set, persistence flags and field hooks.",
                          "sha256": "d96a3b34fc395f517b58f0fe921ceffba9dd675c237f546d91cebc600ea783fc"
                        },
                        {
                          "file": "application/models/v2/Samlfunc.php",
                          "line": 2801,
                          "reason": "Actual flag hook clears provider cache and compares edisset value strictly with true.",
                          "sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
                        },
                        {
                          "file": "application/models/v2/Saml.php",
                          "line": 349,
                          "reason": "Resource POST/PUT dispatch reachability and preconditions; field contracts apply to parent resource, not sub-resource actions.",
                          "sha256": "d96a3b34fc395f517b58f0fe921ceffba9dd675c237f546d91cebc600ea783fc"
                        },
                        {
                          "file": "docs/openapi/reviews/identity-fields.json",
                          "line": 1,
                          "reason": "Independent field-level source review, direction applicability, examples and explicit runtime limitations.",
                          "sha256": "ccb043758defa22ad8cf879c4c81b317fd537f8fd0cfb125a4c1c7ffc7cdf8bf"
                        }
                      ]
                    },
                    "disable_third_party_cookie": {
                      "type": [
                        "string",
                        "number",
                        "boolean",
                        "null",
                        "array",
                        "object"
                      ],
                      "x-edoobox-canonicalType": "boolean",
                      "x-edoobox-schemaStatus": "reviewed-normalizing",
                      "x-edoobox-normalization": "POST getter uses PHP loose comparison to true. Canonical client value is boolean; non-boolean values are normalized, not rejected by a wire type validator.",
                      "description": "POST getter uses PHP loose comparison to true. Canonical client value is boolean; non-boolean values are normalized, not rejected by a wire type validator.",
                      "x-edoobox-contractSource": [
                        {
                          "file": "application/models/v2/Saml.php",
                          "line": 200,
                          "reason": "Structure declaration: input get, output set, persistence flags and field hooks.",
                          "sha256": "d96a3b34fc395f517b58f0fe921ceffba9dd675c237f546d91cebc600ea783fc"
                        },
                        {
                          "file": "application/models/v2/Samlfunc.php",
                          "line": 2810,
                          "reason": "Actual flag hook clears provider cache and compares edisset value strictly with true.",
                          "sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
                        },
                        {
                          "file": "application/models/v2/Saml.php",
                          "line": 349,
                          "reason": "Resource POST/PUT dispatch reachability and preconditions; field contracts apply to parent resource, not sub-resource actions.",
                          "sha256": "d96a3b34fc395f517b58f0fe921ceffba9dd675c237f546d91cebc600ea783fc"
                        },
                        {
                          "file": "docs/openapi/reviews/identity-fields.json",
                          "line": 1,
                          "reason": "Independent field-level source review, direction applicability, examples and explicit runtime limitations.",
                          "sha256": "ccb043758defa22ad8cf879c4c81b317fd537f8fd0cfb125a4c1c7ffc7cdf8bf"
                        }
                      ]
                    },
                    "regenerate_certificate": {
                      "not": {},
                      "description": "POST has no supported regenerate_certificate input: Structure defines no get, so generic insertion attempts a missing callback before any field func can run. Omit it on creation.",
                      "x-edoobox-schemaStatus": "reviewed-not-writable",
                      "x-edoobox-clientRestriction": "Omit this field from client writes; the runtime behavior is described separately.",
                      "x-edoobox-contractSource": [
                        {
                          "file": "application/models/v2/Saml.php",
                          "line": 210,
                          "reason": "Structure declaration: input get, output set, persistence flags and field hooks.",
                          "sha256": "d96a3b34fc395f517b58f0fe921ceffba9dd675c237f546d91cebc600ea783fc"
                        },
                        {
                          "file": "application/models/v2/Samlfunc.php",
                          "line": 2819,
                          "reason": "Strict command allowlist and generation/storage delegation.",
                          "sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
                        },
                        {
                          "file": "application/models/v2/Samlfunc.php",
                          "line": 1087,
                          "reason": "Followed certificate payload generation and replace-active storage behavior.",
                          "sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
                        },
                        {
                          "file": "application/models/v2/Saml.php",
                          "line": 349,
                          "reason": "Resource POST/PUT dispatch reachability and preconditions; field contracts apply to parent resource, not sub-resource actions.",
                          "sha256": "d96a3b34fc395f517b58f0fe921ceffba9dd675c237f546d91cebc600ea783fc"
                        },
                        {
                          "file": "application/models/v2/Samlfunc.php",
                          "line": 1077,
                          "reason": "Followed certificate host resolution: base URL host is required; a bad host throws RuntimeException.",
                          "sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
                        },
                        {
                          "file": "docs/openapi/reviews/identity-fields.json",
                          "line": 1,
                          "reason": "Independent field-level source review, direction applicability, examples and explicit runtime limitations.",
                          "sha256": "ccb043758defa22ad8cf879c4c81b317fd537f8fd0cfb125a4c1c7ffc7cdf8bf"
                        }
                      ]
                    },
                    "enforce_offer_tags": {
                      "x-edoobox-schemaStatus": "source-inferred",
                      "x-edoobox-sourceLine": 222,
                      "x-edoobox-canonicalType": "boolean",
                      "x-edoobox-normalization": "PHP coercion/normalization is applied by the Structure getter; its return type is not a rejecting wire-input type restriction.",
                      "examples": [
                        false
                      ]
                    },
                    "offer_tags_additive": {
                      "x-edoobox-schemaStatus": "source-inferred",
                      "x-edoobox-sourceLine": 231,
                      "x-edoobox-canonicalType": "boolean",
                      "x-edoobox-normalization": "PHP coercion/normalization is applied by the Structure getter; its return type is not a rejecting wire-input type restriction.",
                      "examples": [
                        false
                      ]
                    },
                    "tags": {
                      "anyOf": [
                        {
                          "type": "array",
                          "items": {
                            "type": "object",
                            "properties": {
                              "tag": {
                                "type": "string",
                                "pattern": "^tag_[a-f0-9]{12}_-?[0-9]+$",
                                "description": "Public tag v2 ID returned for a currently existing record in the selected account; signature, resource type and account ownership are checked by the native hook."
                              },
                              "type": {
                                "type": "string",
                                "pattern": "^[nN][oO][rR][mM][aA][lL]$",
                                "description": "Optional; missing type defaults to normal. ASCII case is normalized before validation."
                              }
                            },
                            "additionalProperties": true,
                            "required": [
                              "tag"
                            ]
                          }
                        },
                        {
                          "type": "null"
                        }
                      ],
                      "description": "Null or [] clears provider tags. Only participant/normal tags are supported. All final provider tags, including retained tags during an offer_filter_tags-only update, must exist in the selected account before tag/filter writes.",
                      "x-edoobox-contractSource": [
                        {
                          "file": "application/models/v2/Samlfunc.php",
                          "line": 2610,
                          "reason": "Array or null accepted; each item must contain a public tag ID.",
                          "sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
                        },
                        {
                          "file": "application/models/v2/Samlfunc.php",
                          "line": 2630,
                          "reason": "Missing type defaults to normal; supplied type is lowercased before validation.",
                          "sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
                        },
                        {
                          "file": "application/models/v2/Saml.php",
                          "line": 256,
                          "reason": "Response is an array of {tag,type:normal}.",
                          "sha256": "d96a3b34fc395f517b58f0fe921ceffba9dd675c237f546d91cebc600ea783fc"
                        },
                        {
                          "file": "application/models/v2/Samlfunc.php",
                          "line": 2686,
                          "lineEnd": 2697,
                          "sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8",
                          "reason": "The final provider tag set, including retained tags on filter-only updates, must exist in this account before any tag/filter persistence."
                        }
                      ]
                    },
                    "offer_filter_tags": {
                      "anyOf": [
                        {
                          "type": "array",
                          "items": {
                            "type": "string",
                            "pattern": "^tag_[a-f0-9]{12}_-?[0-9]+$",
                            "description": "Public tag v2 ID returned for a currently existing record in the selected account; signature, resource type and account ownership are checked by the native hook."
                          }
                        },
                        {
                          "type": "null"
                        }
                      ],
                      "description": "Null or [] clears offer-filter tags. Every filter tag must also be a provider tag. All final provider tags, including retained tags during an offer_filter_tags-only update, must exist in the selected account before tag/filter writes.",
                      "x-edoobox-contractSource": [
                        {
                          "file": "application/models/v2/Samlfunc.php",
                          "line": 2653,
                          "reason": "Array or null accepted; items decode as public tag IDs.",
                          "sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
                        },
                        {
                          "file": "application/models/v2/Samlfunc.php",
                          "line": 2678,
                          "reason": "Filter tags must be contained in provider tags.",
                          "sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
                        },
                        {
                          "file": "application/models/v2/Saml.php",
                          "line": 298,
                          "reason": "Response is an array of public tag IDs.",
                          "sha256": "d96a3b34fc395f517b58f0fe921ceffba9dd675c237f546d91cebc600ea783fc"
                        },
                        {
                          "file": "application/models/v2/Samlfunc.php",
                          "line": 2686,
                          "lineEnd": 2697,
                          "sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8",
                          "reason": "The final provider tag set, including retained tags on filter-only updates, must exist in this account before any tag/filter persistence."
                        }
                      ]
                    },
                    "date_valid": {
                      "x-edoobox-canonicalType": "string",
                      "description": "dP uses PHP strtotime(); unparseable/falsy results normalize to zero. ISO 8601 text is the canonical client input; no rejecting JSON date-time format assertion is established here. Account/action hooks may add preconditions.",
                      "examples": [
                        "2026-10-15T10:00:00+02:00"
                      ],
                      "x-edoobox-writableOnUpdate": false,
                      "x-edoobox-sourceLine": 317
                    },
                    "date_create": {
                      "x-edoobox-canonicalType": "string",
                      "description": "dP uses PHP strtotime(); unparseable/falsy results normalize to zero. ISO 8601 text is the canonical client input; no rejecting JSON date-time format assertion is established here. Account/action hooks may add preconditions.",
                      "examples": [
                        "2026-10-15T10:00:00+02:00"
                      ],
                      "x-edoobox-writableOnUpdate": false,
                      "x-edoobox-sourceLine": 327
                    },
                    "remote_xml_file": {
                      "type": "string",
                      "description": "Vollständiges IdP-Metadaten-XML mit XML-Deklaration, wahlweise Base64-codiert. Alternative zur remote_xml_url."
                    }
                  },
                  "additionalProperties": true,
                  "description": "Source-declared fields; action-specific and account validation still apply.",
                  "required": [
                    "provider_name"
                  ],
                  "minProperties": 1,
                  "allOf": [
                    {
                      "anyOf": [
                        {
                          "required": [
                            "remote_xml_url"
                          ]
                        },
                        {
                          "required": [
                            "remote_xml_file"
                          ]
                        }
                      ]
                    },
                    {
                      "anyOf": [
                        {
                          "required": [
                            "permission"
                          ]
                        },
                        {
                          "required": [
                            "login_scope"
                          ],
                          "properties": {
                            "login_scope": {
                              "type": "string",
                              "pattern": "^\\s*[uU][sS][eE][rR]\\s*$"
                            }
                          }
                        }
                      ]
                    }
                  ]
                },
                {
                  "type": "array",
                  "minItems": 1,
                  "maxItems": 100,
                  "items": {
                    "type": "object",
                    "properties": {
                      "id": false,
                      "status": {
                        "type": [
                          "string",
                          "number",
                          "boolean",
                          "null",
                          "array",
                          "object"
                        ],
                        "x-edoobox-canonicalType": "boolean",
                        "x-edoobox-schemaStatus": "reviewed-normalizing",
                        "x-edoobox-normalization": "Creation must remain disabled: getter uses loose PHP == true and before-insert rejects normalized enabled state with ED80100/status_activation_after_setup, then forces 0.",
                        "description": "Creation must remain disabled: getter uses loose PHP == true and before-insert rejects normalized enabled state with ED80100/status_activation_after_setup, then forces 0.",
                        "x-edoobox-contractSource": [
                          {
                            "file": "application/models/v2/Saml.php",
                            "line": 40,
                            "reason": "Structure declaration: input get, output set, persistence flags and field hooks.",
                            "sha256": "d96a3b34fc395f517b58f0fe921ceffba9dd675c237f546d91cebc600ea783fc"
                          },
                          {
                            "file": "application/models/v2/Samlfunc.php",
                            "line": 224,
                            "reason": "Create forbids activating before setup and forces initial disabled status.",
                            "sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
                          },
                          {
                            "file": "application/models/v2/Samlfunc.php",
                            "line": 1274,
                            "reason": "Actual activation hook: strict false short circuit, settings/URL and required mapping checks.",
                            "sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
                          },
                          {
                            "file": "application/models/v2/Samlfunc.php",
                            "line": 1399,
                            "reason": "Provider config depends on stored certificate/mapping and may refresh metadata XML in real runtime.",
                            "sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
                          },
                          {
                            "file": "application/models/v2/Samlfunc.php",
                            "line": 1357,
                            "reason": "Metadata refresh delegates parsing and may fetch XML during real runtime; not invoked by this source review.",
                            "sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
                          },
                          {
                            "file": "application/libraries/edoobox/integrations/auth/Saml.php",
                            "line": 85,
                            "reason": "Login URL wrapper delegates to OneLogin auth login with stay=true.",
                            "sha256": "cb122e325068b8432675dd52856fd095233782d10652ee3a56ee8161ff3acb57"
                          },
                          {
                            "file": "application/models/v2/Samlfunc.php",
                            "line": 2925,
                            "reason": "Required mapping keys are explicit.",
                            "sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
                          },
                          {
                            "file": "application/models/v2/Saml.php",
                            "line": 349,
                            "reason": "Resource POST/PUT dispatch reachability and preconditions; field contracts apply to parent resource, not sub-resource actions.",
                            "sha256": "d96a3b34fc395f517b58f0fe921ceffba9dd675c237f546d91cebc600ea783fc"
                          },
                          {
                            "file": "application/libraries/edoobox/integrations/auth/Saml.php",
                            "line": 246,
                            "reason": "Followed injectSettings/getSettings: build SP/IdP settings and instantiate OneLogin Auth, with signing and stored certificate settings.",
                            "sha256": "cb122e325068b8432675dd52856fd095233782d10652ee3a56ee8161ff3acb57"
                          },
                          {
                            "file": "application/libraries/edoobox/integrations/auth/Saml.php",
                            "line": 115,
                            "reason": "Followed service-provider settings construction used for activation.",
                            "sha256": "cb122e325068b8432675dd52856fd095233782d10652ee3a56ee8161ff3acb57"
                          },
                          {
                            "file": "vendor/onelogin/php-saml/src/Saml2/Auth.php",
                            "line": 174,
                            "reason": "Installed OneLogin Auth delegates validation to its Settings constructor.",
                            "sha256": "d4a3737528426ace71044fbc90e1a06273a76149c55ee1410dc21ae225ed4a8a"
                          },
                          {
                            "file": "vendor/onelogin/php-saml/src/Saml2/Auth.php",
                            "line": 542,
                            "reason": "Installed OneLogin login builds the SAML request and a redirect URL; this is not a completed external provider handshake.",
                            "sha256": "d4a3737528426ace71044fbc90e1a06273a76149c55ee1410dc21ae225ed4a8a"
                          },
                          {
                            "file": "docs/openapi/reviews/identity-fields.json",
                            "line": 1,
                            "reason": "Independent field-level source review, direction applicability, examples and explicit runtime limitations.",
                            "sha256": "ccb043758defa22ad8cf879c4c81b317fd537f8fd0cfb125a4c1c7ffc7cdf8bf"
                          }
                        ]
                      },
                      "permission": {
                        "type": "string",
                        "pattern": "^[a-z0-9]+_[a-f0-9]{12}_-?[0-9]+$",
                        "description": "Opaque edoobox v2 object ID returned by this account. Never send a raw database ID. The synthetic example is illustrative and is not a real record.",
                        "examples": [
                          "permission_012345abcdef_123456"
                        ],
                        "x-edoobox-schemaStatus": "source-inferred",
                        "x-edoobox-sourceLine": 50
                      },
                      "provider_name": {
                        "x-edoobox-canonicalType": "string",
                        "x-edoobox-maxStoredLength": 150,
                        "x-edoobox-normalization": "The aP getter trims text, replaces newlines and limits the legacy escaped storage representation to maxStoredLength UTF-8 characters without splitting escape pairs; aQ decodes the stored representation. Non-string input becomes empty text. This getter limit is normalization, not a rejecting input maxLength or proof of a custom action hook or database column capacity.",
                        "examples": [
                          "Example"
                        ],
                        "x-edoobox-requiredOnCreate": true,
                        "x-edoobox-sourceLine": 63
                      },
                      "remote_xml_url": {
                        "x-edoobox-canonicalType": "string",
                        "x-edoobox-maxStoredLength": 500,
                        "x-edoobox-normalization": "The aP getter trims text, replaces newlines and limits the legacy escaped storage representation to maxStoredLength UTF-8 characters without splitting escape pairs; aQ decodes the stored representation. Non-string input becomes empty text. This getter limit is normalization, not a rejecting input maxLength or proof of a custom action hook or database column capacity.",
                        "examples": [
                          "Example"
                        ],
                        "x-edoobox-writableOnUpdate": false,
                        "x-edoobox-sourceLine": 76
                      },
                      "remote_xml_content": {
                        "not": {},
                        "description": "Omit on ordinary single-record POST: getter returns strict false and API_DATA rejects the record before before-insert. The XML is obtained from remote_xml_file/remote_xml_url and its parser output.",
                        "x-edoobox-schemaStatus": "reviewed-not-writable",
                        "x-edoobox-clientRestriction": "Omit this field from client writes; the runtime behavior is described separately.",
                        "x-edoobox-contractSource": [
                          {
                            "file": "application/models/v2/Saml.php",
                            "line": 90,
                            "reason": "Structure declaration: input get, output set, persistence flags and field hooks.",
                            "sha256": "d96a3b34fc395f517b58f0fe921ceffba9dd675c237f546d91cebc600ea783fc"
                          },
                          {
                            "file": "application/models/v2/Samlfunc.php",
                            "line": 236,
                            "reason": "Creation reads remote_xml_file or remote_xml_url, validates/parses XML and assigns escaped metadata content.",
                            "sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
                          },
                          {
                            "file": "application/models/v2/Saml.php",
                            "line": 349,
                            "reason": "Resource POST/PUT dispatch reachability and preconditions; field contracts apply to parent resource, not sub-resource actions.",
                            "sha256": "d96a3b34fc395f517b58f0fe921ceffba9dd675c237f546d91cebc600ea783fc"
                          },
                          {
                            "file": "application/libraries/edoobox/integrations/auth/Saml.php",
                            "line": 232,
                            "reason": "Followed XML parsing wrapper to the installed OneLogin metadata parser.",
                            "sha256": "cb122e325068b8432675dd52856fd095233782d10652ee3a56ee8161ff3acb57"
                          },
                          {
                            "file": "vendor/onelogin/php-saml/src/Saml2/IdPMetadataParser.php",
                            "line": 115,
                            "reason": "Installed parser loads XML, selects entity descriptor and extracts SSO/SLO locations and bindings.",
                            "sha256": "4df0c1b7bf79d2df3d1903099fde2edaefe07b7d690f427958a0746f3daf6e9e"
                          },
                          {
                            "file": "docs/openapi/reviews/identity-fields.json",
                            "line": 1,
                            "reason": "Independent field-level source review, direction applicability, examples and explicit runtime limitations.",
                            "sha256": "ccb043758defa22ad8cf879c4c81b317fd537f8fd0cfb125a4c1c7ffc7cdf8bf"
                          }
                        ]
                      },
                      "login_service_url": {
                        "not": {},
                        "description": "Omit on ordinary single-record POST: getter returns strict false and API_DATA rejects the record before before-insert. The service URL is extracted from parsed metadata.",
                        "x-edoobox-schemaStatus": "reviewed-not-writable",
                        "x-edoobox-clientRestriction": "Omit this field from client writes; the runtime behavior is described separately.",
                        "x-edoobox-contractSource": [
                          {
                            "file": "application/models/v2/Saml.php",
                            "line": 103,
                            "reason": "Structure declaration: input get, output set, persistence flags and field hooks.",
                            "sha256": "d96a3b34fc395f517b58f0fe921ceffba9dd675c237f546d91cebc600ea783fc"
                          },
                          {
                            "file": "application/models/v2/Samlfunc.php",
                            "line": 297,
                            "reason": "Before-insert derives SSO/SLO URLs; missing valid SSO rejects provider, optional SLO can remain false.",
                            "sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
                          },
                          {
                            "file": "application/models/v2/Saml.php",
                            "line": 349,
                            "reason": "Resource POST/PUT dispatch reachability and preconditions; field contracts apply to parent resource, not sub-resource actions.",
                            "sha256": "d96a3b34fc395f517b58f0fe921ceffba9dd675c237f546d91cebc600ea783fc"
                          },
                          {
                            "file": "application/libraries/edoobox/integrations/auth/Saml.php",
                            "line": 232,
                            "reason": "Followed XML parsing wrapper to the installed OneLogin metadata parser.",
                            "sha256": "cb122e325068b8432675dd52856fd095233782d10652ee3a56ee8161ff3acb57"
                          },
                          {
                            "file": "vendor/onelogin/php-saml/src/Saml2/IdPMetadataParser.php",
                            "line": 115,
                            "reason": "Installed parser loads XML, selects entity descriptor and extracts SSO/SLO locations and bindings.",
                            "sha256": "4df0c1b7bf79d2df3d1903099fde2edaefe07b7d690f427958a0746f3daf6e9e"
                          },
                          {
                            "file": "docs/openapi/reviews/identity-fields.json",
                            "line": 1,
                            "reason": "Independent field-level source review, direction applicability, examples and explicit runtime limitations.",
                            "sha256": "ccb043758defa22ad8cf879c4c81b317fd537f8fd0cfb125a4c1c7ffc7cdf8bf"
                          }
                        ]
                      },
                      "logout_service_url": {
                        "not": {},
                        "description": "Omit on ordinary single-record POST: getter returns strict false and API_DATA rejects the record before before-insert. The service URL is extracted from parsed metadata.",
                        "x-edoobox-schemaStatus": "reviewed-not-writable",
                        "x-edoobox-clientRestriction": "Omit this field from client writes; the runtime behavior is described separately.",
                        "x-edoobox-contractSource": [
                          {
                            "file": "application/models/v2/Saml.php",
                            "line": 113,
                            "reason": "Structure declaration: input get, output set, persistence flags and field hooks.",
                            "sha256": "d96a3b34fc395f517b58f0fe921ceffba9dd675c237f546d91cebc600ea783fc"
                          },
                          {
                            "file": "application/models/v2/Samlfunc.php",
                            "line": 297,
                            "reason": "Before-insert derives SSO/SLO URLs; missing valid SSO rejects provider, optional SLO can remain false.",
                            "sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
                          },
                          {
                            "file": "application/models/v2/Saml.php",
                            "line": 349,
                            "reason": "Resource POST/PUT dispatch reachability and preconditions; field contracts apply to parent resource, not sub-resource actions.",
                            "sha256": "d96a3b34fc395f517b58f0fe921ceffba9dd675c237f546d91cebc600ea783fc"
                          },
                          {
                            "file": "application/libraries/edoobox/integrations/auth/Saml.php",
                            "line": 232,
                            "reason": "Followed XML parsing wrapper to the installed OneLogin metadata parser.",
                            "sha256": "cb122e325068b8432675dd52856fd095233782d10652ee3a56ee8161ff3acb57"
                          },
                          {
                            "file": "vendor/onelogin/php-saml/src/Saml2/IdPMetadataParser.php",
                            "line": 115,
                            "reason": "Installed parser loads XML, selects entity descriptor and extracts SSO/SLO locations and bindings.",
                            "sha256": "4df0c1b7bf79d2df3d1903099fde2edaefe07b7d690f427958a0746f3daf6e9e"
                          },
                          {
                            "file": "docs/openapi/reviews/identity-fields.json",
                            "line": 1,
                            "reason": "Independent field-level source review, direction applicability, examples and explicit runtime limitations.",
                            "sha256": "ccb043758defa22ad8cf879c4c81b317fd537f8fd0cfb125a4c1c7ffc7cdf8bf"
                          }
                        ]
                      },
                      "field_maping": {
                        "not": {},
                        "description": "Omit on ordinary single-record POST: getter always returns false, causing ED80100 before the before-insert hook. Creation derives mappings from metadata instead.",
                        "x-edoobox-schemaStatus": "reviewed-not-writable",
                        "x-edoobox-clientRestriction": "Omit this field from client writes; the runtime behavior is described separately.",
                        "x-edoobox-contractSource": [
                          {
                            "file": "application/models/v2/Saml.php",
                            "line": 123,
                            "reason": "Structure declaration: input get, output set, persistence flags and field hooks.",
                            "sha256": "d96a3b34fc395f517b58f0fe921ceffba9dd675c237f546d91cebc600ea783fc"
                          },
                          {
                            "file": "application/models/v2/Samlfunc.php",
                            "line": 2861,
                            "reason": "Actual PUT mapping loop, truthiness requirement, duplicate detection and full replacement.",
                            "sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
                          },
                          {
                            "file": "application/models/v2/Samlfunc.php",
                            "line": 480,
                            "reason": "Followed target normalizer and additional-user-field classifier.",
                            "sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
                          },
                          {
                            "file": "application/models/v2/Samlfunc.php",
                            "line": 2925,
                            "reason": "Followed base required mapping keys.",
                            "sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
                          },
                          {
                            "file": "application/models/v2/Samlfunc.php",
                            "line": 319,
                            "reason": "Create mapping starts with idp metadata and empty field list.",
                            "sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
                          },
                          {
                            "file": "application/models/v2/Samlfunc.php",
                            "line": 389,
                            "reason": "Create mapping is derived from offered/default claims and stored, overwriting submitted batch value.",
                            "sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
                          },
                          {
                            "file": "application/models/v2/Samlfunc.php",
                            "line": 1399,
                            "reason": "Followed getProviderData: existing provider/certificate lookup and mapping metadata; refresh may load remote XML in actual runtime, never during this review.",
                            "sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
                          },
                          {
                            "file": "application/models/v2/Saml.php",
                            "line": 349,
                            "reason": "Resource POST/PUT dispatch reachability and preconditions; field contracts apply to parent resource, not sub-resource actions.",
                            "sha256": "d96a3b34fc395f517b58f0fe921ceffba9dd675c237f546d91cebc600ea783fc"
                          },
                          {
                            "file": "docs/openapi/reviews/identity-fields.json",
                            "line": 1,
                            "reason": "Independent field-level source review, direction applicability, examples and explicit runtime limitations.",
                            "sha256": "ccb043758defa22ad8cf879c4c81b317fd537f8fd0cfb125a4c1c7ffc7cdf8bf"
                          }
                        ]
                      },
                      "allow_migration_user": {
                        "x-edoobox-schemaStatus": "source-inferred",
                        "x-edoobox-sourceLine": 135,
                        "x-edoobox-canonicalType": "boolean",
                        "x-edoobox-normalization": "PHP coercion/normalization is applied by the Structure getter; its return type is not a rejecting wire-input type restriction.",
                        "examples": [
                          false
                        ]
                      },
                      "allow_permission_acl": {
                        "x-edoobox-schemaStatus": "source-inferred",
                        "x-edoobox-sourceLine": 144,
                        "x-edoobox-canonicalType": "boolean",
                        "x-edoobox-normalization": "PHP coercion/normalization is applied by the Structure getter; its return type is not a rejecting wire-input type restriction.",
                        "examples": [
                          false
                        ]
                      },
                      "login_scope": {
                        "x-edoobox-canonicalType": "string",
                        "x-edoobox-schemaStatus": "reviewed-normalizing",
                        "x-edoobox-normalization": "Strings are trimmed and lowercased. Nonempty unknown strings are rejected with ED80100/invalid_login_scope. Empty/whitespace-only strings and non-string JSON values normalize to both. This is not an exact case-sensitive input enum.",
                        "description": "Strings are trimmed and lowercased. Nonempty unknown strings are rejected with ED80100/invalid_login_scope. Empty/whitespace-only strings and non-string JSON values normalize to both. This is not an exact case-sensitive input enum.",
                        "x-edoobox-recognizedValues": [
                          "both",
                          "admin",
                          "user"
                        ],
                        "examples": [
                          " User "
                        ],
                        "anyOf": [
                          {
                            "type": "string",
                            "pattern": "^[ \\t\\n\\r\\x00\\x0B]*(?:[bB][oO][tT][hH]|[aA][dD][mM][iI][nN]|[uU][sS][eE][rR])?[ \\t\\n\\r\\x00\\x0B]*$"
                          },
                          {
                            "type": [
                              "number",
                              "boolean",
                              "null",
                              "array",
                              "object"
                            ]
                          }
                        ],
                        "x-edoobox-contractSource": [
                          {
                            "file": "application/models/v2/Saml.php",
                            "line": 153,
                            "reason": "Structure declaration: input get, output set, persistence flags and field hooks.",
                            "sha256": "d96a3b34fc395f517b58f0fe921ceffba9dd675c237f546d91cebc600ea783fc"
                          },
                          {
                            "file": "application/models/v2/Samlfunc.php",
                            "line": 22,
                            "reason": "Followed validateProvidedLoginScope and provider normalizer.",
                            "sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
                          },
                          {
                            "file": "application/models/v2/Samlfunc.php",
                            "line": 197,
                            "reason": "Before-insert sets scope and applies dependent permission requirement.",
                            "sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
                          },
                          {
                            "file": "application/models/v2/Samlfunc.php",
                            "line": 2840,
                            "reason": "Actual PUT hook delegates to scope validator.",
                            "sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
                          },
                          {
                            "file": "application/libraries/edoobox/integrations/auth/Saml.php",
                            "line": 42,
                            "reason": "Allowed normalized scopes and default both; output normalizer.",
                            "sha256": "cb122e325068b8432675dd52856fd095233782d10652ee3a56ee8161ff3acb57"
                          },
                          {
                            "file": "application/models/v2/Saml.php",
                            "line": 349,
                            "reason": "Resource POST/PUT dispatch reachability and preconditions; field contracts apply to parent resource, not sub-resource actions.",
                            "sha256": "d96a3b34fc395f517b58f0fe921ceffba9dd675c237f546d91cebc600ea783fc"
                          },
                          {
                            "file": "docs/openapi/reviews/identity-fields.json",
                            "line": 1,
                            "reason": "Independent field-level source review, direction applicability, examples and explicit runtime limitations.",
                            "sha256": "ccb043758defa22ad8cf879c4c81b317fd537f8fd0cfb125a4c1c7ffc7cdf8bf"
                          }
                        ]
                      },
                      "name_id_format": {
                        "type": "string",
                        "enum": [
                          "urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified",
                          "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress",
                          "urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"
                        ],
                        "description": "Exact OneLogin NameID format; input validator strictly rejects every other value. No trimming/case folding precedes validation.",
                        "x-edoobox-schemaStatus": "source-reviewed",
                        "x-edoobox-contractSource": [
                          {
                            "file": "application/models/v2/Saml.php",
                            "line": 172,
                            "reason": "Structure declaration: input get, output set, persistence flags and field hooks.",
                            "sha256": "d96a3b34fc395f517b58f0fe921ceffba9dd675c237f546d91cebc600ea783fc"
                          },
                          {
                            "file": "application/models/v2/Samlfunc.php",
                            "line": 2770,
                            "reason": "PUT checks exact NameID allowed values before aP storage.",
                            "sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
                          },
                          {
                            "file": "application/libraries/edoobox/integrations/auth/Saml.php",
                            "line": 14,
                            "reason": "Strict allowed formats and separate response fallback.",
                            "sha256": "cb122e325068b8432675dd52856fd095233782d10652ee3a56ee8161ff3acb57"
                          },
                          {
                            "file": "vendor/onelogin/php-saml/src/Saml2/Constants.php",
                            "line": 26,
                            "reason": "Followed installed dependency constants to actual standard URI strings.",
                            "sha256": "a7f6ab35d1209e34d499662ae1f8f5bedf0ae6f08325388e8b186ea85f6c236d"
                          },
                          {
                            "file": "application/models/v2/Saml.php",
                            "line": 349,
                            "reason": "Resource POST/PUT dispatch reachability and preconditions; field contracts apply to parent resource, not sub-resource actions.",
                            "sha256": "d96a3b34fc395f517b58f0fe921ceffba9dd675c237f546d91cebc600ea783fc"
                          },
                          {
                            "file": "docs/openapi/reviews/identity-fields.json",
                            "line": 1,
                            "reason": "Independent field-level source review, direction applicability, examples and explicit runtime limitations.",
                            "sha256": "ccb043758defa22ad8cf879c4c81b317fd537f8fd0cfb125a4c1c7ffc7cdf8bf"
                          }
                        ]
                      },
                      "auth_request_signed": {
                        "type": [
                          "string",
                          "number",
                          "boolean",
                          "null",
                          "array",
                          "object"
                        ],
                        "x-edoobox-canonicalType": "boolean",
                        "x-edoobox-schemaStatus": "reviewed-normalizing",
                        "x-edoobox-normalization": "POST getter uses PHP loose comparison to true. Canonical client value is boolean; non-boolean values are normalized, not rejected by a wire type validator.",
                        "description": "POST getter uses PHP loose comparison to true. Canonical client value is boolean; non-boolean values are normalized, not rejected by a wire type validator.",
                        "x-edoobox-contractSource": [
                          {
                            "file": "application/models/v2/Saml.php",
                            "line": 190,
                            "reason": "Structure declaration: input get, output set, persistence flags and field hooks.",
                            "sha256": "d96a3b34fc395f517b58f0fe921ceffba9dd675c237f546d91cebc600ea783fc"
                          },
                          {
                            "file": "application/models/v2/Samlfunc.php",
                            "line": 2801,
                            "reason": "Actual flag hook clears provider cache and compares edisset value strictly with true.",
                            "sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
                          },
                          {
                            "file": "application/models/v2/Saml.php",
                            "line": 349,
                            "reason": "Resource POST/PUT dispatch reachability and preconditions; field contracts apply to parent resource, not sub-resource actions.",
                            "sha256": "d96a3b34fc395f517b58f0fe921ceffba9dd675c237f546d91cebc600ea783fc"
                          },
                          {
                            "file": "docs/openapi/reviews/identity-fields.json",
                            "line": 1,
                            "reason": "Independent field-level source review, direction applicability, examples and explicit runtime limitations.",
                            "sha256": "ccb043758defa22ad8cf879c4c81b317fd537f8fd0cfb125a4c1c7ffc7cdf8bf"
                          }
                        ]
                      },
                      "disable_third_party_cookie": {
                        "type": [
                          "string",
                          "number",
                          "boolean",
                          "null",
                          "array",
                          "object"
                        ],
                        "x-edoobox-canonicalType": "boolean",
                        "x-edoobox-schemaStatus": "reviewed-normalizing",
                        "x-edoobox-normalization": "POST getter uses PHP loose comparison to true. Canonical client value is boolean; non-boolean values are normalized, not rejected by a wire type validator.",
                        "description": "POST getter uses PHP loose comparison to true. Canonical client value is boolean; non-boolean values are normalized, not rejected by a wire type validator.",
                        "x-edoobox-contractSource": [
                          {
                            "file": "application/models/v2/Saml.php",
                            "line": 200,
                            "reason": "Structure declaration: input get, output set, persistence flags and field hooks.",
                            "sha256": "d96a3b34fc395f517b58f0fe921ceffba9dd675c237f546d91cebc600ea783fc"
                          },
                          {
                            "file": "application/models/v2/Samlfunc.php",
                            "line": 2810,
                            "reason": "Actual flag hook clears provider cache and compares edisset value strictly with true.",
                            "sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
                          },
                          {
                            "file": "application/models/v2/Saml.php",
                            "line": 349,
                            "reason": "Resource POST/PUT dispatch reachability and preconditions; field contracts apply to parent resource, not sub-resource actions.",
                            "sha256": "d96a3b34fc395f517b58f0fe921ceffba9dd675c237f546d91cebc600ea783fc"
                          },
                          {
                            "file": "docs/openapi/reviews/identity-fields.json",
                            "line": 1,
                            "reason": "Independent field-level source review, direction applicability, examples and explicit runtime limitations.",
                            "sha256": "ccb043758defa22ad8cf879c4c81b317fd537f8fd0cfb125a4c1c7ffc7cdf8bf"
                          }
                        ]
                      },
                      "regenerate_certificate": {
                        "not": {},
                        "description": "POST has no supported regenerate_certificate input: Structure defines no get, so generic insertion attempts a missing callback before any field func can run. Omit it on creation.",
                        "x-edoobox-schemaStatus": "reviewed-not-writable",
                        "x-edoobox-clientRestriction": "Omit this field from client writes; the runtime behavior is described separately.",
                        "x-edoobox-contractSource": [
                          {
                            "file": "application/models/v2/Saml.php",
                            "line": 210,
                            "reason": "Structure declaration: input get, output set, persistence flags and field hooks.",
                            "sha256": "d96a3b34fc395f517b58f0fe921ceffba9dd675c237f546d91cebc600ea783fc"
                          },
                          {
                            "file": "application/models/v2/Samlfunc.php",
                            "line": 2819,
                            "reason": "Strict command allowlist and generation/storage delegation.",
                            "sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
                          },
                          {
                            "file": "application/models/v2/Samlfunc.php",
                            "line": 1087,
                            "reason": "Followed certificate payload generation and replace-active storage behavior.",
                            "sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
                          },
                          {
                            "file": "application/models/v2/Saml.php",
                            "line": 349,
                            "reason": "Resource POST/PUT dispatch reachability and preconditions; field contracts apply to parent resource, not sub-resource actions.",
                            "sha256": "d96a3b34fc395f517b58f0fe921ceffba9dd675c237f546d91cebc600ea783fc"
                          },
                          {
                            "file": "application/models/v2/Samlfunc.php",
                            "line": 1077,
                            "reason": "Followed certificate host resolution: base URL host is required; a bad host throws RuntimeException.",
                            "sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
                          },
                          {
                            "file": "docs/openapi/reviews/identity-fields.json",
                            "line": 1,
                            "reason": "Independent field-level source review, direction applicability, examples and explicit runtime limitations.",
                            "sha256": "ccb043758defa22ad8cf879c4c81b317fd537f8fd0cfb125a4c1c7ffc7cdf8bf"
                          }
                        ]
                      },
                      "enforce_offer_tags": {
                        "x-edoobox-schemaStatus": "source-inferred",
                        "x-edoobox-sourceLine": 222,
                        "x-edoobox-canonicalType": "boolean",
                        "x-edoobox-normalization": "PHP coercion/normalization is applied by the Structure getter; its return type is not a rejecting wire-input type restriction.",
                        "examples": [
                          false
                        ]
                      },
                      "offer_tags_additive": {
                        "x-edoobox-schemaStatus": "source-inferred",
                        "x-edoobox-sourceLine": 231,
                        "x-edoobox-canonicalType": "boolean",
                        "x-edoobox-normalization": "PHP coercion/normalization is applied by the Structure getter; its return type is not a rejecting wire-input type restriction.",
                        "examples": [
                          false
                        ]
                      },
                      "tags": {
                        "anyOf": [
                          {
                            "type": "array",
                            "items": {
                              "type": "object",
                              "properties": {
                                "tag": {
                                  "type": "string",
                                  "pattern": "^tag_[a-f0-9]{12}_-?[0-9]+$",
                                  "description": "Public tag v2 ID returned for a currently existing record in the selected account; signature, resource type and account ownership are checked by the native hook."
                                },
                                "type": {
                                  "type": "string",
                                  "pattern": "^[nN][oO][rR][mM][aA][lL]$",
                                  "description": "Optional; missing type defaults to normal. ASCII case is normalized before validation."
                                }
                              },
                              "additionalProperties": true,
                              "required": [
                                "tag"
                              ]
                            }
                          },
                          {
                            "type": "null"
                          }
                        ],
                        "description": "Null or [] clears provider tags. Only participant/normal tags are supported. All final provider tags, including retained tags during an offer_filter_tags-only update, must exist in the selected account before tag/filter writes.",
                        "x-edoobox-contractSource": [
                          {
                            "file": "application/models/v2/Samlfunc.php",
                            "line": 2610,
                            "reason": "Array or null accepted; each item must contain a public tag ID.",
                            "sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
                          },
                          {
                            "file": "application/models/v2/Samlfunc.php",
                            "line": 2630,
                            "reason": "Missing type defaults to normal; supplied type is lowercased before validation.",
                            "sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
                          },
                          {
                            "file": "application/models/v2/Saml.php",
                            "line": 256,
                            "reason": "Response is an array of {tag,type:normal}.",
                            "sha256": "d96a3b34fc395f517b58f0fe921ceffba9dd675c237f546d91cebc600ea783fc"
                          },
                          {
                            "file": "application/models/v2/Samlfunc.php",
                            "line": 2686,
                            "lineEnd": 2697,
                            "sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8",
                            "reason": "The final provider tag set, including retained tags on filter-only updates, must exist in this account before any tag/filter persistence."
                          }
                        ]
                      },
                      "offer_filter_tags": {
                        "anyOf": [
                          {
                            "type": "array",
                            "items": {
                              "type": "string",
                              "pattern": "^tag_[a-f0-9]{12}_-?[0-9]+$",
                              "description": "Public tag v2 ID returned for a currently existing record in the selected account; signature, resource type and account ownership are checked by the native hook."
                            }
                          },
                          {
                            "type": "null"
                          }
                        ],
                        "description": "Null or [] clears offer-filter tags. Every filter tag must also be a provider tag. All final provider tags, including retained tags during an offer_filter_tags-only update, must exist in the selected account before tag/filter writes.",
                        "x-edoobox-contractSource": [
                          {
                            "file": "application/models/v2/Samlfunc.php",
                            "line": 2653,
                            "reason": "Array or null accepted; items decode as public tag IDs.",
                            "sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
                          },
                          {
                            "file": "application/models/v2/Samlfunc.php",
                            "line": 2678,
                            "reason": "Filter tags must be contained in provider tags.",
                            "sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
                          },
                          {
                            "file": "application/models/v2/Saml.php",
                            "line": 298,
                            "reason": "Response is an array of public tag IDs.",
                            "sha256": "d96a3b34fc395f517b58f0fe921ceffba9dd675c237f546d91cebc600ea783fc"
                          },
                          {
                            "file": "application/models/v2/Samlfunc.php",
                            "line": 2686,
                            "lineEnd": 2697,
                            "sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8",
                            "reason": "The final provider tag set, including retained tags on filter-only updates, must exist in this account before any tag/filter persistence."
                          }
                        ]
                      },
                      "date_valid": {
                        "x-edoobox-canonicalType": "string",
                        "description": "dP uses PHP strtotime(); unparseable/falsy results normalize to zero. ISO 8601 text is the canonical client input; no rejecting JSON date-time format assertion is established here. Account/action hooks may add preconditions.",
                        "examples": [
                          "2026-10-15T10:00:00+02:00"
                        ],
                        "x-edoobox-writableOnUpdate": false,
                        "x-edoobox-sourceLine": 317
                      },
                      "date_create": {
                        "x-edoobox-canonicalType": "string",
                        "description": "dP uses PHP strtotime(); unparseable/falsy results normalize to zero. ISO 8601 text is the canonical client input; no rejecting JSON date-time format assertion is established here. Account/action hooks may add preconditions.",
                        "examples": [
                          "2026-10-15T10:00:00+02:00"
                        ],
                        "x-edoobox-writableOnUpdate": false,
                        "x-edoobox-sourceLine": 327
                      },
                      "remote_xml_file": {
                        "type": "string",
                        "description": "Vollständiges IdP-Metadaten-XML mit XML-Deklaration, wahlweise Base64-codiert. Alternative zur remote_xml_url."
                      }
                    },
                    "additionalProperties": true,
                    "description": "Source-declared fields; action-specific and account validation still apply.",
                    "required": [
                      "provider_name"
                    ],
                    "allOf": [
                      {
                        "anyOf": [
                          {
                            "required": [
                              "remote_xml_url"
                            ]
                          },
                          {
                            "required": [
                              "remote_xml_file"
                            ]
                          }
                        ]
                      },
                      {
                        "anyOf": [
                          {
                            "required": [
                              "permission"
                            ]
                          },
                          {
                            "required": [
                              "login_scope"
                            ],
                            "properties": {
                              "login_scope": {
                                "type": "string",
                                "pattern": "^\\s*[uU][sS][eE][rR]\\s*$"
                              }
                            }
                          }
                        ]
                      }
                    ]
                  }
                }
              ],
              "x-edoobox-readOnlyFields": [],
              "x-edoobox-clientRestriction": "The server-generated id is forbidden. insert:false fields are readOnly and tolerated for existing Vue payloads because the API skips them."
            },
            "id": {
              "type": "string",
              "pattern": "^[a-z0-9]+_[a-f0-9]{12}_-?[0-9]+$",
              "description": "Opaque edoobox v2 object ID returned by this account. Never send a raw database ID. The synthetic example is illustrative and is not a real record.",
              "examples": [
                "saml_012345abcdef_123456"
              ]
            }
          },
          "additionalProperties": true,
          "required": [
            "data"
          ]
        },
        "examples": {
          "request": {
            "summary": "SAML-Provider anlegen",
            "value": {
              "data": {
                "provider_name": "Beispiel-Identitätsanbieter",
                "permission": "permission_012345abcdef_123456",
                "status": false,
                "login_scope": "both",
                "remote_xml_url": "https://idp.example.invalid/metadata.xml"
              }
            }
          }
        }
      }
    }
  },
  "x-edoobox-runtimeMutationGuard": true,
  "x-edoobox-documentationReview": {
    "file": "docs/openapi/operation-contracts/05-auth.json",
    "notes": []
  },
  "x-edoobox-source": {
    "file": "application/models/v2/Saml.php",
    "method": "postSaml",
    "line": 349
  },
  "x-edoobox-documentationStatus": "reviewed",
  "x-edoobox-readOnly": false,
  "x-edoobox-safeForAutomation": false,
  "x-edoobox-permission": {
    "resource": "saml",
    "short": "saml",
    "checkedByDispatcher": true,
    "levels": [
      2,
      3,
      4
    ],
    "description": "Resource permission mapping from APIPermissions(), Authfunc::_getCheckJWT. Additional model/admin/plugin checks may apply; resources absent from api_permission do not acquire a fictitious scope."
  }
}