<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Federation Trust Relationships — API Reference

## Azure AD Federation (Microsoft Graph)

```bash
# List federated domains
curl -s -H "Authorization: Bearer ${ACCESS_TOKEN}" \
  "https://graph.microsoft.com/v1.0/domains?\$filter=authenticationType eq 'Federated'" \
  | jq '.value[] | {id, authenticationType, isVerified}'

# Get federation configuration
curl -s -H "Authorization: Bearer ${ACCESS_TOKEN}" \
  "https://graph.microsoft.com/v1.0/domains/contoso.com/federationConfiguration" \
  | jq '.[0] | {displayName, issuerUri, passiveSignInUri, signingCertificate}'

# List cross-tenant access partners
curl -s -H "Authorization: Bearer ${ACCESS_TOKEN}" \
  "https://graph.microsoft.com/v1.0/policies/crossTenantAccessPolicy/partners" \
  | jq '.value[] | {tenantId, isServiceProvider, inboundTrust}'

# List external identity providers
curl -s -H "Authorization: Bearer ${ACCESS_TOKEN}" \
  "https://graph.microsoft.com/v1.0/identity/identityProviders" \
  | jq '.value[] | {displayName, identityProviderType, clientId}'
```

## AD FS PowerShell

```powershell
# Export all relying party trusts
Get-AdfsRelyingPartyTrust | Select-Object Name, Identifier, Enabled,
  TokenLifetime, EncryptClaims, SignedSamlRequestsRequired |
  ConvertTo-Json | Out-File adfs-trusts.json

# Check token signing certificates
Get-AdfsCertificate -CertificateType Token-Signing |
  Select-Object Thumbprint, StoreLocation, IsPrimary

# AD FS event log — trust modifications (EID 510)
Get-WinEvent -FilterHashtable @{
  LogName='AD FS/Admin'; Id=510
} -MaxEvents 50 | Select-Object TimeCreated, Message
```

## Okta IdP API

```bash
# List identity providers
curl -s -H "Authorization: SSWS ${OKTA_API_TOKEN}" \
  "https://${OKTA_DOMAIN}/api/v1/idps" | \
  jq '.[] | {id, type, name, status, protocol: .protocol.type}'

# Get IdP signing keys
curl -s -H "Authorization: SSWS ${OKTA_API_TOKEN}" \
  "https://${OKTA_DOMAIN}/api/v1/idps/IDP_ID/credentials/keys" | jq .

# Deactivate a rogue IdP
curl -s -X POST -H "Authorization: SSWS ${OKTA_API_TOKEN}" \
  "https://${OKTA_DOMAIN}/api/v1/idps/IDP_ID/lifecycle/deactivate"
```

## Key Checks

| Check | Method | Expected Result |
|-------|--------|-----------------|
| Certificate key size | Inspect signing cert | ≥ 2048-bit RSA |
| Certificate expiry | Check NotAfter | > 30 days remaining |
| Audience restriction | SAML assertion config | Set for each RP |
| Signed requests | RP trust settings | Required |
| Trust inventory | Compare to documented | No unknown trusts |
