<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Auditing Cloud Identity Federation

## AWS IAM Federation APIs

| Command | Description |
|---|---|
| `aws iam list-saml-providers` | List all SAML identity providers |
| `aws iam get-saml-provider --saml-provider-arn <arn>` | Get SAML provider metadata |
| `aws iam list-open-id-connect-providers` | List all OIDC providers |
| `aws iam get-open-id-connect-provider --open-id-connect-provider-arn <arn>` | Get OIDC provider details |
| `aws iam list-roles` | List roles for federation trust review |
| `aws sts get-caller-identity` | Verify current federated identity |

## Azure AD Graph APIs

| Endpoint | Description |
|---|---|
| `GET /v1.0/domains` | List domains with federation status |
| `GET /v1.0/policies/crossTenantAccessPolicy/partners` | Cross-tenant access partners |
| `GET /v1.0/servicePrincipals?$filter=preferredSingleSignOnMode eq 'saml'` | SAML-enabled apps |
| `GET /v1.0/identity/conditionalAccess/policies` | Conditional access for federated users |

## GCP IAM APIs

| Command | Description |
|---|---|
| `gcloud iam workload-identity-pools list` | List workload identity pools |
| `gcloud iam workload-identity-pools providers list` | List providers in a pool |
| `gcloud iam workload-identity-pools providers describe` | Provider attribute mappings |

## Agent Script

```bash
# Audit AWS SAML providers
node agent.js aws-saml

# Audit AWS OIDC providers
node agent.js aws-oidc

# Audit Azure AD federation
node agent.js azure

# Audit GCP workload identity federation
node agent.js gcp --project my-project-id
```
