Answers which tenants stream their own telemetry out of this deployment, and to whom in ONE read, over the WHOLE tenant population.

This surface is ADDITIVE, and two consequences follow that the replace-style surfaces do not have. A tenant's destinations are added BESIDE the deployment collector, never in place of it, so deploymentShape is still present when tenants have diverged. And a tenant may declare up to five destinations, so the SAME tenant may be named under more than one bindings element — counted once as a diverging tenant, named once per vendor. maxTenantBindings states that ceiling; this endpoint configures nothing, so a tenant already at the ceiling is simply reported and no 4xx is produced for it here.

The response is a CLASS-level projection, on both planes. It carries the vendor a tenant exports to — DATADOG | DYNATRACE | INSTANA | GENERIC_OTLP — and a server-derived label for it, and nothing finer. It deliberately omits: the OTLP endpoint, the signal set, the export key and its mask, the credential reference, and the operator-authored destination name — that column is the one a naive pass-through would leak into label, and every label here comes from a server-side table keyed on the class alone. The same rule binds the DEPLOYMENT collector.

Eligibility comes from a different plane, which is why this endpoint needs a third scope. notEligibleCount and the tenants it names derive from the observability-export entitlement — the standing plan-gate flag, gated by admin.platform.observability-backend.tenant.entitlement.manage, not by the backends scope. A tenant that could not have diverged is NAMED as not eligible rather than counted as agreeing; folding it into onDefaultCount would report conformity where there was no choice. Per-tenant export is SaaS-only, so on a customer-operated deployment no tenant is entitled and the band covers the fleet.

The four coverage bands partition the whole population, so onDefaultCount + divergingCount + notEligibleCount + suspendedCount == tenantCount always holds; a tenant holding a live destination is reported as DIVERGING even if its entitlement has since been revoked, because a downgrade never strands a configured tenant and hiding a live export behind a commercial label would be a worse answer. A suspended tenant stays INSIDE the denominator, and this read never answers 404 for a tenant that has declared nothing.

surfaceStatus is the server-composed worst-of across both planes (FR-190.21); deploymentStatus and every bindings[*].status are returned unchanged beside it. chain is [] — this is not an ordered-chain surface — while deploymentChain carries one position per DISTINCT class the deployment plane holds, as an UNORDERED set: it is [] only when the plane holds exactly one class (which deploymentShape names) or holds nothing. Both keys are PRESENT, which is what makes the six surfaces one envelope.

Takes no path and no query parameter, so no caller-supplied identifier enters a query. It writes nothing: no audit row, no event, no state change. Required: the ROOT platform tenant, holding admin.platform.observability-backend.tenant.manage and admin.tenant.list and admin.platform.observability-backend.tenant.entitlement.manage.