Create

DecoyAccessTokenInput requests a freestanding session access-token decoy minted under an existing User.

DecoyConnectorClientInput requests a ConnectorClientCredential decoy planted under an existing app+connector.

DecoyUserClientCredentialInput requests a UserClientCredential decoy planted under an existing User. The User's typ selects the credential usage: HUMAN -> pcc, SERVICE -> spc. Any other typ (SYSTEM, AGENT) is rejected at the handler.

DecoyWorkloadFederationInput requests a WorkloadFederationTrust decoy bound to an existing Provider. Decoys reuse an already-registered Provider because Trust matching requires a real JWKS for JWT signature verification before the decoy_id check fires.

condition_expression is the same CEL shape the regular WF Trust API takes -- operators express whatever matching they want against the JWT claims map (claims.aud, claims.sub, custom claims). Compiled

• validated by the WF controller's CreateTrust at create time.

Decoy is the public projection of a planted honey-credential. Read-only surface; the variant-specific back-references live in c1models and are not exposed here.

DecoyVendingMaterial carries the freshly-vended secret material returned exactly once at Create or Rotate.

This message contains a oneof named material. Only a single field of the following list may be set at a time:

• clientCredential
• accessToken
• workloadFederation