PublishCatalog

A relying party publishes its tenant's catalog: the permissions and aliases its namespace defines. Authenticated by the client secret, like ExchangeCode. Refused (INVALID_ARGUMENT) when anything lies outside the tenant's namespace, an alias names a permission the catalog does not define, a delegated alias delegates in turn, the catalog exceeds 1024 permissions or 128 aliases or a name exceeds 128 characters, or version lies more than a day ahead of this plane's clock; FAILED_PRECONDITION when version is older than the stored one, or equal with different content. Every published catalog is kept. Grants whose target the new catalog drops stay, grant nothing, and are listed as orphaned.