Register a federated identity trust for a service account

Request body for registering a federated identity trust. The service account comes from the route. string? CreateFederationRequest.MetadataAddress is supplied only when the organization is bringing its own issuer and its discovery document is not at the issuer's well-known path. string? CreateFederationRequest.Assertion is a fresh, issuer-signed proof token the workload mints for exactly this (issuer, subject, audience); it is required for a self-registered issuer (and for an operator issuer that requires proof of possession).

The registered federated identity trust returned by the REST create-federation endpoint, echoing the (issuer, subject, audience) tuple as stored. There is no secret — the workload authenticates with a signed assertion from the trusted issuer.