Answers which tenants trust an external identity provider of their own, and which in ONE read, over the WHOLE tenant population.

This surface is a TRUST UNION, and two consequences follow that the replace-style surfaces do not have. A tenant's issuers are trusted BESIDE the deployment's, never in place of them — trust is additive by its nature, and a token minted by the deployment issuer keeps verifying after a tenant declares one of its own — so deploymentShape is still present when tenants have diverged. And deploymentStatus and every bindings[*].status are INDEPENDENT verdicts returned in the same body: a deployment issuer verified and live while a tenant's sits unverified is the ordinary case, not a contradiction. surfaceStatus is the server-composed worst-of across both planes (FR-190.21) and replaces neither of them.

The response is a CLASS-level projection, on both planes. It carries the provider a tenant trusts — AUTH0 | ENTRA | OKTA | KEYCLOAK | COGNITO | GENERIC_OIDC — and a server-derived label for it, and nothing finer. It deliberately omits: the issuer url and the jwks endpoint derived from it, the permitted algorithms, the declared maximum token lifetime, the audience, the actor bindings, the last reachability probe outcome, and the operator-authored issuer display name — that column is the one a naive pass-through would leak into label, and every label here comes from a server-side table keyed on the class alone. The same rule binds the DEPLOYMENT issuer.

Never entitlement-gated. This read REPORTS eligibility; it never applies it. Gating it on the workload-identity entitlement would make the notEligibleTenants band unreadable on exactly the deployment where it is not empty, and a platform operator who cannot see which tenants are Edition-blocked cannot act on the upgrade path the topology screen exists to make legible (FR-190.27). Its own admission is the scope conjunction plus the ROOT tenant boundary, and nothing else.

Eligibility comes from this surface's own entitlement plane, and needs no extra scope. notEligibleCount and the tenants it names derive from the workload-identity entitlement — customer-operated deployment, or an ENTERPRISE effective Edition. That plane is gated by the same admin.platform.workload-identity.read this endpoint already requires, which is why this surface carries two conjuncts where observability-export carries three. A tenant that could not have diverged is NAMED as not eligible rather than counted as agreeing; folding it into onDefaultCount would report conformity where there was no choice.

The four coverage bands partition the whole population, so onDefaultCount + divergingCount + notEligibleCount + suspendedCount == tenantCount always holds; a tenant holding a declared issuer is reported as DIVERGING even if its entitlement has since been revoked, because a downgrade never strands a configured tenant. A suspended tenant stays INSIDE the denominator, and this read never answers 404 for a tenant that has declared nothing.

maxTenantBindings is null — this surface states no per-tenant ceiling. chain is [] — this is not an ordered-chain surface — while deploymentChain carries one position per DISTINCT class the deployment plane holds, as an UNORDERED set: it is [] only when the plane holds exactly one class (which deploymentShape names) or holds nothing. Both keys are PRESENT, which is what makes the six surfaces one envelope.

Takes no path and no query parameter, so no caller-supplied identifier enters a query. It writes nothing: no audit row, no event, no state change. Required: the ROOT platform tenant, holding admin.platform.workload-identity.read and admin.tenant.list.