The client apbs should have bind actions that allows users to autoamtically create variants in UPS. The idea is not to call UPS from the bind action but rather have the bind action create a secret that is used by the UPS sidecar service which in turn creates the variant and syncs it back.