The platform twin of the tenant plane's resolve, for an operator composing a
binding on a customer's behalf. It answers which of the issuers a binding in
THIS tenant may name is the one a presented token's iss identifies,
or none.

🔴 The comparison is not string equality, which is why this operation exists. A declaration is stored in canonical form — lowercase scheme and host, default port removed, every trailing slash stripped from the path — while a token's iss arrives exactly as its issuer wrote it, and Auth0 always emits the trailing slash. A raw comparison therefore reports NO MATCH for a configuration that is correct and will authenticate at runtime, and no spelling of the declaration can make it agree. This runs the SAME selection the operator probe and authentication run, so a client renders a verdict instead of computing one.

🔴 It is a POST, and that is deliberate — do not "correct" it

to a GET. The edge and environment NGINX both log
"$request", the full request line including the query string,

so an iss in a query parameter — or in a path segment, which is the
same thing doubly encoded — would become a durable tenant-to-issuer correlation
in an access log whose retention this surface does not control. The identifier
travels in a body so that it is written nowhere.

🔴 It carries the READ scope, not a write one, and it does not acquire a

write's gates: rejectRootTarget is NOT called, because that rule
exists to keep an audit row from being mis-attributed and this operation writes
no row and emits none. The ROOT tenant is a valid target here, exactly as it is
for the reads beside it.

No match is a 200 with matched: null — never

a 404 and never a 204. A distinct status would be a
third meaning of 404 on this controller, alongside the tenant-existence 404, and
a caller could then tell them apart. A blank, malformed or inadmissible
iss is likewise a 200/null rather than a
400. The one 400 this operation can answer is TRANSPORT

— a body it cannot read, or one carrying a field it does not declare — which says
the request was not one this operation accepts and says nothing about the tenant.

🔴 The maxLength the request schema publishes is

DOCUMENTARY, not a second refusal. It names the bound
canonicalizeIssuerUrl applies before it parses anything; an

oversized iss is still answered 200 with
matched: null, exactly like every other value nothing declares. A

generated client or schema-validating gateway that refused an oversized value
LOCALLY would author on the client side the very second refusal shape this
operation deliberately does not have — so read it as the rule's own bound,
published for a reader, never as a precondition to enforce.

It resolves over the bindable set — the same rows ../bindable-issuers lists, with no enabled filter — and

a matched row is identical to the row that list publishes for it, inherited
displayName withheld and all.

Not entitlement-gated. The operator is the party that sells the

edition, so refusing them on it would be the platform refusing itself.