Identity
OIDC / SAML configuration · HTTPS issuer/metadata · PKCE/signed assertions · no raw secrets
Evidence ceiling E3Proof boundary
ENTERPRISE ONBOARDING
Bind the institution without surrendering institutional control.
Finality stores configuration and evidence references, not raw customer private keys or raw connector secrets. High-risk external bindings require distinct approvals, and production activation stays false until the customer-owned dependencies are actually present.
Integration surfaces
Customer-owned dependencies stay customer-owned
The onboarding contract separates configuration readiness from externally observed operation.
Lifecycle
SCIM 2.0 Users + Groups · tenant-bound ETags · deactivation removes group membership
Key custody
Customer KMS/HSM key reference · rotation policy · non-exportable private keys · dual approval for external activation
Authoritative sources
HTTPS endpoint reference · secret reference · connectivity verification hash · external evidence reference
Telemetry
SIEM / OpenTelemetry endpoint binding · secret reference · external connectivity evidence
Service credentials
Scoped · expiring · hashed at rest · secret returned once · revocable
Webhooks
HTTPS-only target · SSRF guard · secret reference · HMAC/replay/DLQ reference semantics
Operations
Recovery receipts · incident kill switch · hash-chained audit · redacted telemetry export
Activation APIs
Protected institutional mutations
All mutation endpoints require authenticated role/tenant authorization and remain fail-closed when the durable store is unavailable.
POST /api/v1/institutional/identity-connections
Bindable OIDC / SAML / SCIM configuration
POST /api/v1/institutional/scim/users
Tenant-scoped SCIM user lifecycle
POST /api/v1/institutional/scim/groups
Tenant-scoped SCIM group lifecycle
POST /api/v1/institutional/approvals
Dual-approval request
POST /api/v1/institutional/key-policies
Customer key-custody policy
POST /api/v1/institutional/bindings
Authoritative-source or SIEM/OpenTelemetry binding
POST /api/v1/institutional/service-credentials
Scoped secret-once credential
POST /api/v1/institutional/data-policies
Purpose/residency/retention policy
POST /api/v1/institutional/recovery-drills
Recovery evidence receipt
POST /api/v1/institutional/incidents
Incident state + high-risk stop
Example classification
Integration examples are explicitly classified
Developer examples retain the same truth boundary as the rest of the public estate.
Implemented read-only interface
Read-only readiness, control, release and activation-state APIs.
Implemented local demonstration
Seller-controlled SCIM, DPoP, approval, webhook, data-policy, audit and recovery reference semantics.
Future institution interface
External customer OIDC/SAML, KMS/HSM, authoritative-source, SIEM/OpenTelemetry and hidden E4 bindings after a real institution supplies them.