code: func (h *Handler) validateTrustedCluster(w http.ResponseWriter, r *http.Request, p httprouter.Params) (interface{}, error) {
  	var validateRequestRaw auth.ValidateTrustedClusterRequestRaw
  	if err := httplib.ReadJSON(r, &validateRequestRaw); err != nil {
  		return nil, trace.Wrap(err)
  	}
  
  	validateRequest, err := validateRequestRaw.ToNative()
  	if err != nil {
  		return nil, trace.Wrap(err)
  	}
  
  	validateResponse, err := h.auth.ValidateTrustedCluster(validateRequest)
  	if err != nil {
  		if trace.IsAccessDenied(err) {
  			return nil, trace.AccessDenied("access denied: the cluster token has been rejected")
  		} else {
  			log.Error(err)
  			return nil, trace.Wrap(err)
  		}
  	}
  
  	validateResponseRaw, err := validateResponse.ToRaw()
  	if err != nil {
  		return nil, trace.Wrap(err)
  	}
  
  	return validateResponseRaw, nil
  }
docs: // validateTrustedCluster validates the token for a trusted cluster and returns it's own host and user certificate authority.
  //
  // POST /webapi/trustedclusters/validate
  //
  // * Request body:
  //
  // {
  //     "token": "foo",
  //     "certificate_authorities": ["AQ==", "Ag=="]
  // }
  //
  // * Response:
  //
  // {
  //     "certificate_authorities": ["AQ==", "Ag=="]
  // }