Registers an external authorization server this tenant is willing to accept
workload tokens from, and returns the derivedAudience that must be
configured in that server.

The declaration lands switched off. enabled is server-set to false and cannot be sent: a body carrying it is rejected, and admitting

the issuer into the trust set is the separate enable verb. That
separation is what makes an abandoned half-finished form harmless.

🔴 No credential is submitted here, and none exists. ANKASecure verifies

tokens from this issuer against the public key set the issuer itself publishes, so
there is no secret to store, seal, mask or rotate. Revoking the workload in your own
IdP is therefore sufficient to stop it authenticating.

The issuer is stored in canonical form — lowercase scheme and

host, the default port removed, no trailing slash — because that string is both the
uniqueness key and the value a presented token's iss claim is compared
against. The response reports the canonical form, which is frequently not the string
that was typed. The path keeps its case: Keycloak realm names and Okta authorization
server ids are case-sensitive.

derivedAudience is computed by this server from the declaration's

scope and is never stored. Configure it verbatim as the API identifier / audience of
the machine-to-machine application in the external IdP. A one-character divergence
between what is configured there and what is required here produces a 401 that
cannot be diagnosed from either side, which is why the value is projected rather
than composed by any client.

Entitlement-gated. Declaring is one of the verbs a tenant's edition

governs. Reading, disabling, withdrawing and validating are not.