openapi: 3.0.0
info:
  title: Auth0 Authentication actions clients API
  description: Auth0 Authentication API. Endpoints for authentication and authorization using OpenID Connect, OAuth 2.0, SAML, WS-Federation, and Passwordless flows.
  version: 1.0.0
servers:
- url: '{auth0_domain}'
  description: The Authentication API is served over HTTPS.
  variables:
    auth0_domain:
      description: Auth0 domain
      default: https://demo.us.auth0.com
tags:
- name: clients
paths:
  /clients:
    get:
      summary: Get Clients
      description: "Retrieve clients (applications and SSO integrations) matching provided filters. A list of fields to include or exclude may also be specified.\nFor more information, read <a href=\"https://www.auth0.com/docs/get-started/applications\"> Applications in Auth0</a> and <a href=\"https://www.auth0.com/docs/authenticate/single-sign-on\"> Single Sign-On</a>.\n\n<ul>\n  <li>\n    The following can be retrieved with any scope:\n    <code>client_id</code>, <code>app_type</code>, <code>name</code>, and <code>description</code>.\n  </li>\n  <li>\n    The following properties can only be retrieved with the <code>read:clients</code> or\n    <code>read:client_keys</code> scope:\n    <code>callbacks</code>, <code>oidc_logout</code>, <code>allowed_origins</code>,\n    <code>web_origins</code>, <code>tenant</code>, <code>global</code>, <code>config_route</code>,\n    <code>callback_url_template</code>, <code>jwt_configuration</code>,\n    <code>jwt_configuration.lifetime_in_seconds</code>, <code>jwt_configuration.secret_encoded</code>,\n    <code>jwt_configuration.scopes</code>, <code>jwt_configuration.alg</code>, <code>api_type</code>,\n    <code>logo_uri</code>, <code>allowed_clients</code>, <code>owners</code>, <code>custom_login_page</code>,\n    <code>custom_login_page_off</code>, <code>sso</code>, <code>addons</code>, <code>form_template</code>,\n    <code>custom_login_page_codeview</code>, <code>resource_servers</code>, <code>client_metadata</code>,\n    <code>mobile</code>, <code>mobile.android</code>, <code>mobile.ios</code>, <code>allowed_logout_urls</code>,\n    <code>token_endpoint_auth_method</code>, <code>is_first_party</code>, <code>oidc_conformant</code>,\n    <code>is_token_endpoint_ip_header_trusted</code>, <code>initiate_login_uri</code>, <code>grant_types</code>,\n    <code>refresh_token</code>, <code>refresh_token.rotation_type</code>, <code>refresh_token.expiration_type</code>,\n    <code>refresh_token.leeway</code>, <code>refresh_token.token_lifetime</code>, <code>refresh_token.policies</code>, <code>organization_usage</code>,\n    <code>organization_require_behavior</code>.\n  </li>\n  <li>\n    The following properties can only be retrieved with the\n    <code>read:client_keys</code> or <code>read:client_credentials</code> scope:\n    <code>encryption_key</code>, <code>encryption_key.pub</code>, <code>encryption_key.cert</code>,\n    <code>client_secret</code>, <code>client_authentication_methods</code> and <code>signing_key</code>.\n  </li>\n</ul>\n"
      tags:
      - clients
      parameters:
      - name: fields
        in: query
        description: Comma-separated list of fields to include or exclude (based on value provided for include_fields) in the result. Leave empty to retrieve all fields.
        schema:
          type: string
          pattern: ^((name)|(description)|(callbacks)|(oidc_backchannel_logout)|(oidc_logout)|(session_transfer)|(allowed_origins)|(web_origins)|(client_id)|(tenant)|(global)|(config_route)|(callback_url_template)|(jwt_configuration)|(jwt_configuration\.lifetime_in_seconds)|(jwt_configuration\.secret_encoded)|(jwt_configuration\.scopes)|(jwt_configuration\.alg)|(api_type)|(logo_uri)|(allowed_clients)|(owners)|(custom_login_page)|(custom_login_page_on)|(sso)|(addons)|(form_template)|(custom_login_page_preview)|(encryption_key)|(encryption_key\.pub)|(encryption_key\.cert)|(client_secret)|(signing_keys)|(mobile)|(mobile\.android)|(mobile\.ios)|(token_endpoint_auth_method)|(allowed_logout_urls)|(app_type)|(is_first_party)|(oidc_conformant)|(client_metadata)|(is_token_endpoint_ip_header_trusted)|(initiate_login_uri)|(grant_types)|(refresh_token)|(refresh_token\.rotation_type)|(refresh_token\.expiration_type)|(refresh_token\.leeway)|(refresh_token\.policies)|(refresh_token\.token_lifetime)|(default_organization)|(organization_usage)|(organization_require_behavior)|(organization_discovery_methods)|(client_authentication_methods)|(client_authentication_methods\.private_key_jwt)|(require_pushed_authorization_requests)|(require_proof_of_possession)|(id_token)|(signed_request_object)|(signed_request_object\.required)|(signed_request_object\.credentials)|(compliance_level)|(skip_non_verifiable_callback_uri_confirmation_prompt)|(token_exchange)|(token_exchange\.allow_any_profile_of_type)|(token_quota)|(identity_assertion_authorization_grant)|(third_party_security_mode)|(subject_type_authorization)|(resource_server_identifier)|(express_configuration)|(my_organization_configuration)|(async_approval_notification_channels)|(token_vault_privileged_access)|(token_vault_privileged_access\.credentials)|(registration_type)|(external_metadata_type)|(external_metadata_created_by)|(external_client_id)|(redirection_policy))(,((name)|(description)|(callbacks)|(oidc_backchannel_logout)|(oidc_logout)|(session_transfer)|(allowed_origins)|(web_origins)|(client_id)|(tenant)|(global)|(config_route)|(callback_url_template)|(jwt_configuration)|(jwt_configuration\.lifetime_in_seconds)|(jwt_configuration\.secret_encoded)|(jwt_configuration\.scopes)|(jwt_configuration\.alg)|(api_type)|(logo_uri)|(allowed_clients)|(owners)|(custom_login_page)|(custom_login_page_on)|(sso)|(addons)|(form_template)|(custom_login_page_preview)|(encryption_key)|(encryption_key\.pub)|(encryption_key\.cert)|(client_secret)|(signing_keys)|(mobile)|(mobile\.android)|(mobile\.ios)|(token_endpoint_auth_method)|(allowed_logout_urls)|(app_type)|(is_first_party)|(oidc_conformant)|(client_metadata)|(is_token_endpoint_ip_header_trusted)|(initiate_login_uri)|(grant_types)|(refresh_token)|(refresh_token\.rotation_type)|(refresh_token\.expiration_type)|(refresh_token\.leeway)|(refresh_token\.policies)|(refresh_token\.token_lifetime)|(default_organization)|(organization_usage)|(organization_require_behavior)|(organization_discovery_methods)|(client_authentication_methods)|(client_authentication_methods\.private_key_jwt)|(require_pushed_authorization_requests)|(require_proof_of_possession)|(id_token)|(signed_request_object)|(signed_request_object\.required)|(signed_request_object\.credentials)|(compliance_level)|(skip_non_verifiable_callback_uri_confirmation_prompt)|(token_exchange)|(token_exchange\.allow_any_profile_of_type)|(token_quota)|(identity_assertion_authorization_grant)|(third_party_security_mode)|(subject_type_authorization)|(resource_server_identifier)|(express_configuration)|(my_organization_configuration)|(async_approval_notification_channels)|(token_vault_privileged_access)|(token_vault_privileged_access\.credentials)|(registration_type)|(external_metadata_type)|(external_metadata_created_by)|(external_client_id)|(redirection_policy)))*$
      - name: include_fields
        in: query
        description: Whether specified fields are to be included (true) or excluded (false).
        schema:
          type: boolean
      - name: page
        in: query
        description: Page index of the results to return. First page is 0.
        schema:
          type: integer
          minimum: 0
      - name: per_page
        in: query
        description: Number of results per page. Default value is 50, maximum value is 100
        schema:
          type: integer
          minimum: 0
          maximum: 100
      - name: include_totals
        in: query
        description: Return results inside an object that contains the total result count (true) or as a direct array of results (false, default).
        schema:
          type: boolean
      - name: from
        in: query
        description: Optional Id from which to start selection.
        schema:
          type: string
      - name: take
        in: query
        description: Number of results per page. Defaults to 50.
        schema:
          type: integer
          minimum: 1
          maximum: 100
      - name: is_global
        in: query
        description: Optional filter on the global client parameter.
        schema:
          type: boolean
      - name: is_first_party
        in: query
        description: Optional filter on whether or not a client is a first-party client.
        schema:
          type: boolean
      - name: app_type
        in: query
        description: Optional filter by a comma-separated list of application types.
        schema:
          type: string
          pattern: ^((native)|(spa)|(regular_web)|(non_interactive)|(resource_server)|(express_configuration)|(rms)|(box)|(cloudbees)|(concur)|(dropbox)|(mscrm)|(echosign)|(egnyte)|(newrelic)|(office365)|(salesforce)|(sentry)|(sharepoint)|(slack)|(springcm)|(zendesk)|(zoom)|(sso_integration)|(oag))(,((native)|(spa)|(regular_web)|(non_interactive)|(resource_server)|(express_configuration)|(rms)|(box)|(cloudbees)|(concur)|(dropbox)|(mscrm)|(echosign)|(egnyte)|(newrelic)|(office365)|(salesforce)|(sentry)|(sharepoint)|(slack)|(springcm)|(zendesk)|(zoom)|(sso_integration)|(oag)))*$
      - name: external_client_id
        in: query
        description: Optional filter by the <a href="https://www.ietf.org/archive/id/draft-ietf-oauth-client-id-metadata-document-04.html">Client ID Metadata Document</a> URI for CIMD-registered clients.
        schema:
          type: string
          minLength: 1
          maxLength: 120
      - name: q
        in: query
        description: 'Advanced Query in <a href="https://lucene.apache.org/core/2_9_4/queryparsersyntax.html">Lucene</a> syntax.<br /><b>Permitted Queries</b>:<br /><ul><li><i>client_grant.organization_id:{organization_id}</i></li><li><i>client_grant.allow_any_organization:true</i></li></ul><b>Additional Restrictions</b>:<br /><ul><li>Cannot be used in combination with other filters</li><li>Requires use of the <i>from</i> and <i>take</i> paging parameters (checkpoint paginatinon)</li><li>Reduced rate limits apply. See <a href="https://auth0.com/docs/troubleshoot/customer-support/operational-policies/rate-limit-policy/rate-limit-configurations/enterprise-public">Rate Limit Configurations</a></li></ul><i><b>Note</b>: Recent updates may not be immediately reflected in query results</i>'
        schema:
          type: string
      responses:
        '200':
          description: Clients successfully retrieved.
          content:
            application/json:
              schema:
                oneOf:
                - type: array
                  items:
                    $ref: '#/components/schemas/Client'
                - $ref: '#/components/schemas/ListClientsOffsetPaginatedResponseContent'
                - $ref: '#/components/schemas/ListClientsPaginatedResponseContent'
        '400':
          description: Invalid request query string. The message will vary depending on the cause.
        '401':
          description: Invalid token.
          x-description-1: Client is not global.
          x-description-2: Invalid signature received for JSON Web Token validation.
        '403':
          description: 'Insufficient scope; expected any of: read:clients, read:client_keys, read:client_summary'
          x-description-1: Some fields cannot be read with the permissions granted by the bearer token scopes. The message will vary depending on the fields and the scopes.
        '429':
          description: Too many requests. Check the X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset headers.
      operationId: get_clients
      x-release-lifecycle: GA
      x-operation-name: list
      x-operation-request-parameters-name: ListClientsRequestParameters
      x-operation-group: clients
      security:
      - bearerAuth: []
      - oAuth2ClientCredentials:
        - read:clients
        - read:client_keys
        - read:client_credentials
        - read:client_summary
    post:
      summary: Create a Client
      description: "Create a new client (application or SSO integration). For more information, read <a href=\"https://www.auth0.com/docs/get-started/auth0-overview/create-applications\">Create Applications</a>\n<a href=\"https://www.auth0.com/docs/authenticate/single-sign-on/api-endpoints-for-single-sign-on>\">API Endpoints for Single Sign-On</a>. \n\nNotes: \n- We recommend leaving the `client_secret` parameter unspecified to allow the generation of a safe secret.\n- The <code>client_authentication_methods</code> and <code>token_endpoint_auth_method</code> properties are mutually exclusive. Use \n<code>client_authentication_methods</code> to configure the client with Private Key JWT authentication method. Otherwise, use <code>token_endpoint_auth_method</code>\nto configure the client with client secret (basic or post) or with no authentication method (none).\n- When using <code>client_authentication_methods</code> to configure the client with Private Key JWT authentication method, specify fully defined credentials. \nThese credentials will be automatically enabled for Private Key JWT authentication on the client. \n- To configure <code>client_authentication_methods</code>, the <code>create:client_credentials</code> scope is required.\n- To configure <code>client_authentication_methods</code>, the property <code>jwt_configuration.alg</code> must be set to RS256.\n\n<div class=\"alert alert-warning\">SSO Integrations created via this endpoint will accept login requests and share user profile information.</div>\n"
      tags:
      - clients
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateClientRequestContent'
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/CreateClientRequestContent'
      responses:
        '201':
          description: Client successfully created.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CreateClientResponseContent'
        '400':
          description: Invalid request body. The message will vary depending on the cause.
        '401':
          description: Invalid token.
          x-description-1: Client is not global.
          x-description-2: Invalid signature received for JSON Web Token validation.
        '403':
          description: 'Insufficient scope; expected any of: create:clients.'
          x-description-1: The account is not allowed to perform this operation.
          x-description-2: You reached the limit of entities of this type for this tenant.
          x-description-3: Organizations are only available to first party clients on user-based flows. Properties organization_usage and organization_require_behavior must be unset for third party clients.
        '409':
          description: Another client exists with the same alias.
        '429':
          description: Too many requests. Check the X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset headers.
      operationId: post_clients
      x-release-lifecycle: GA
      x-operation-name: create
      x-operation-group: clients
      security:
      - bearerAuth: []
      - oAuth2ClientCredentials:
        - create:clients
  /clients/cimd/preview:
    post:
      summary: Preview and Validate Client ID Metadata Document
      description: "\n      Fetches and validates a Client ID Metadata Document without creating a client.\n      Returns the raw metadata and how it would be mapped to Auth0 client fields.\n      This endpoint is useful for testing metadata URIs before creating CIMD clients.\n    "
      tags:
      - clients
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PreviewCimdMetadataRequestContent'
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/PreviewCimdMetadataRequestContent'
      responses:
        '200':
          description: Metadata successfully fetched and validated, or retrieval error returned with errors array.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PreviewCimdMetadataResponseContent'
        '400':
          description: Invalid external_client_id. The message will vary depending on the cause.
        '401':
          description: Invalid token.
          x-description-1: Invalid signature received for JSON Web Token validation.
        '403':
          description: 'Insufficient scope; expected any of: create:clients, update:clients.'
        '429':
          description: Too many requests. Check the X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset headers.
        '500':
          description: An internal server error occurred.
      operationId: post_clients_cimd_preview
      x-release-lifecycle: GA
      x-operation-name: previewCimdMetadata
      x-operation-group: clients
      security:
      - bearerAuth: []
      - oAuth2ClientCredentials:
        - read:clients
  /clients/cimd/register:
    post:
      summary: Register or Update a CIMD Client Via Metadata URI
      description: "\n      Idempotent registration for Client ID Metadata Document (CIMD) clients.\n      Uses external_client_id as the unique identifier for upsert operations.\n      **Create:** Returns 201 when a new client is created (requires \\"
      tags:
      - clients
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RegisterCimdClientRequestContent'
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/RegisterCimdClientRequestContent'
      responses:
        '200':
          description: CIMD client successfully updated (idempotent).
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RegisterCimdClientResponseContent'
        '201':
          description: CIMD client successfully created.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RegisterCimdClientResponseContent'
        '400':
          description: Invalid request body. The message will vary depending on the cause.
          x-description-1: The Client Metadata document at [URL] cannot be applied.
          x-description-2: The Client Metadata at [URL] could not be retrieved.
        '401':
          description: Invalid token.
          x-description-1: Invalid signature received for JSON Web Token validation.
        '403':
          description: 'Insufficient scope; expected any of: create:clients, update:clients.'
        '429':
          description: Too many requests. Check the X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset headers.
        '500':
          description: An internal server error occurred.
      operationId: post_clients_cimd_register
      x-release-lifecycle: GA
      x-operation-name: registerCimdClient
      x-operation-group: clients
      security:
      - bearerAuth: []
      - oAuth2ClientCredentials:
        - create:clients
        - update:clients
  /clients/{client_id}/credentials:
    get:
      summary: Get Client Credentials
      description: 'Get the details of a client credential.


        <b>Important</b>: To enable credentials to be used for a client authentication method, set the <code>client_authentication_methods</code> property on the client. To enable credentials to be used for JWT-Secured Authorization requests set the <code>signed_request_object</code> property on the client.

        '
      tags:
      - clients
      parameters:
      - name: client_id
        in: path
        description: ID of the client.
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Credentials successfully retrieved.
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/ClientCredential'
        '401':
          description: Invalid token.
          x-description-1: Invalid signature received for JSON Web Token validation.
        '403':
          description: 'Insufficient scope; expected any of: read:client_credentials.'
        '404':
          description: Client not found.
        '429':
          description: Too many requests. Check the X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset headers.
      operationId: get_credentials
      x-release-lifecycle: GA
      x-operation-name: list
      x-operation-group:
      - clients
      - credentials
      security:
      - bearerAuth: []
      - oAuth2ClientCredentials:
        - read:client_credentials
    post:
      summary: Create a Client Credential
      description: "Create a client credential associated to your application. Credentials can be used to configure Private Key JWT and mTLS authentication methods, as well as for JWT-secured Authorization requests.\n\n<h5>Public Key</h5>Public Key credentials can be used to set up Private Key JWT client authentication and JWT-secured Authorization requests.\n\nSample: <pre><code>{\n  \"credential_type\": \"public_key\",\n  \"name\": \"string\",\n  \"pem\": \"string\",\n  \"alg\": \"RS256\",\n  \"parse_expiry_from_cert\": false,\n  \"expires_at\": \"2022-12-31T23:59:59Z\"\n}</code></pre>\n<h5>Certificate (CA-signed & self-signed)</h5>Certificate credentials can be used to set up mTLS client authentication. CA-signed certificates can be configured either with a signed certificate or with just the certificate Subject DN.\n\nCA-signed Certificate Sample (pem): <pre><code>{\n  \"credential_type\": \"x509_cert\",\n  \"name\": \"string\",\n  \"pem\": \"string\"\n}</code></pre>CA-signed Certificate Sample (subject_dn): <pre><code>{\n  \"credential_type\": \"cert_subject_dn\",\n  \"name\": \"string\",\n  \"subject_dn\": \"string\"\n}</code></pre>Self-signed Certificate Sample: <pre><code>{\n  \"credential_type\": \"cert_subject_dn\",\n  \"name\": \"string\",\n  \"pem\": \"string\"\n}</code></pre>\n\nThe credential will be created but not yet enabled for use until you set the corresponding properties in the client:\n<ul>\n  <li>To enable the credential for Private Key JWT or mTLS authentication methods, set the <code>client_authentication_methods</code> property on the client. For more information, read <a href=\"https://auth0.com/docs/get-started/applications/configure-private-key-jwt\">Configure Private Key JWT Authentication</a> and <a href=\"https://auth0.com/docs/get-started/applications/configure-mtls\">Configure mTLS Authentication</a></li>\n  <li>To enable the credential for JWT-secured Authorization requests, set the <code>signed_request_object</code>property on the client. For more information, read <a href=\"https://auth0.com/docs/get-started/applications/configure-jar\">Configure JWT-secured Authorization Requests (JAR)</a></li>\n</ul>\n"
      tags:
      - clients
      parameters:
      - name: client_id
        in: path
        description: ID of the client.
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PostClientCredentialRequestContent'
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/PostClientCredentialRequestContent'
      responses:
        '201':
          description: Credential successfully created.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PostClientCredentialResponseContent'
        '400':
          description: Invalid request body. The message will vary depending on the cause.
        '401':
          description: Invalid token.
          x-description-1: Invalid signature received for JSON Web Token validation.
        '403':
          description: 'Insufficient scope; expected any of: create:client_credentials.'
        '404':
          description: Client not found.
        '429':
          description: Too many requests. Check the X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset headers.
      operationId: post_credentials
      x-release-lifecycle: GA
      x-operation-name: create
      x-operation-group:
      - clients
      - credentials
      security:
      - bearerAuth: []
      - oAuth2ClientCredentials:
        - create:client_credentials
  /clients/{client_id}/credentials/{credential_id}:
    get:
      summary: Get Client Credential Details
      description: 'Get the details of a client credential.


        <b>Important</b>: To enable credentials to be used for a client authentication method, set the <code>client_authentication_methods</code> property on the client. To enable credentials to be used for JWT-Secured Authorization requests set the <code>signed_request_object</code> property on the client.

        '
      tags:
      - clients
      parameters:
      - name: client_id
        in: path
        description: ID of the client.
        required: true
        schema:
          type: string
      - name: credential_id
        in: path
        description: ID of the credential.
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Credential successfully retrieved.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetClientCredentialResponseContent'
        '401':
          description: Invalid token.
          x-description-1: Invalid signature received for JSON Web Token validation.
        '403':
          description: 'Insufficient scope; expected any of: read:client_credentials.'
        '404':
          description: Client not found.
          x-description-1: Credential does not exist
        '429':
          description: Too many requests. Check the X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset headers.
      operationId: get_credentials_by_credential_id
      x-release-lifecycle: GA
      x-operation-name: get
      x-operation-group:
      - clients
      - credentials
      security:
      - bearerAuth: []
      - oAuth2ClientCredentials:
        - read:client_credentials
    delete:
      summary: Delete a Client Credential
      description: Delete a client credential you previously created. May be enabled or disabled. For more information, read <a href="https://www.auth0.com/docs/get-started/authentication-and-authorization-flow/client-credentials-flow">Client Credential Flow</a>.
      tags:
      - clients
      parameters:
      - name: client_id
        in: path
        description: ID of the client.
        required: true
        schema:
          type: string
      - name: credential_id
        in: path
        description: ID of the credential to delete.
        required: true
        schema:
          type: string
      responses:
        '204':
          description: Credential successfully deleted.
        '400':
          description: Invalid request URI. The message will vary depending on the cause.
        '401':
          description: Invalid token.
          x-description-1: Invalid signature received for JSON Web Token validation.
        '403':
          description: 'Insufficient scope; expected any of: delete:client_credentials.'
        '429':
          description: Too many requests. Check the X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset headers.
      operationId: delete_credentials_by_credential_id
      x-release-lifecycle: GA
      x-operation-name: delete
      x-operation-group:
      - clients
      - credentials
      security:
      - bearerAuth: []
      - oAuth2ClientCredentials:
        - delete:client_credentials
    patch:
      summary: Update a Client Credential
      description: Change a client credential you previously created. May be enabled or disabled. For more information, read <a href="https://www.auth0.com/docs/get-started/authentication-and-authorization-flow/client-credentials-flow">Client Credential Flow</a>.
      tags:
      - clients
      parameters:
      - name: client_id
        in: path
        description: ID of the client.
        required: true
        schema:
          type: string
      - name: credential_id
        in: path
        description: ID of the credential.
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PatchClientCredentialRequestContent'
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/PatchClientCredentialRequestContent'
      responses:
        '201':
          description: Credential successfully updated.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PatchClientCredentialResponseContent'
        '400':
          description: Invalid request body. The message will vary depending on the cause.
        '401':
          description: Invalid token.
          x-description-1: Invalid signature received for JSON Web Token validation.
        '403':
          description: 'Insufficient scope; expected any of: update:client_credentials.'
        '404':
          description: Client not found.
          x-description-1: Credential does not exist
        '429':
          description: Too many requests. Check the X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset headers.
      operationId: patch_credentials_by_credential_id
      x-release-lifecycle: GA
      x-operation-name: update
      x-operation-group:
      - clients
      - credentials
      security:
      - bearerAuth: []
      - oAuth2ClientCredentials:
        - update:client_credentials
  /clients/{id}:
    get:
      summary: Get Client by ID
      description: "Retrieve client details by ID. Clients are SSO connections or Applications linked with your Auth0 tenant. A list of fields to include or exclude may also be specified. \nFor more information, read <a href=\"https://www.auth0.com/docs/get-started/applications\"> Applications in Auth0</a> and <a href=\"https://www.auth0.com/docs/authenticate/single-sign-on\"> Single Sign-On</a>.\n<ul>\n  <li>\n    The following properties can be retrieved with any of the scopes:\n    <code>client_id</code>, <code>app_type</code>, <code>name</code>, and <code>description</code>.\n  </li>\n  <li>\n    The following properties can only be retrieved with the <code>read:clients</code> or\n    <code>read:client_keys</code> scopes:\n    <code>callbacks</code>, <code>oidc_logout</code>, <code>allowed_origins</code>,\n    <code>web_origins</code>, <code>tenant</code>, <code>global</code>, <code>config_route</code>,\n    <code>callback_url_template</code>, <code>jwt_configuration</code>,\n    <code>jwt_configuration.lifetime_in_seconds</code>, <code>jwt_configuration.secret_encoded</code>,\n    <code>jwt_configuration.scopes</code>, <code>jwt_configuration.alg</code>, <code>api_type</code>,\n    <code>logo_uri</code>, <code>allowed_clients</code>, <code>owners</code>, <code>custom_login_page</code>,\n    <code>custom_login_page_off</code>, <code>sso</code>, <code>addons</code>, <code>form_template</code>,\n    <code>custom_login_page_codeview</code>, <code>resource_servers</code>, <code>client_metadata</code>,\n    <code>mobile</code>, <code>mobile.android</code>, <code>mobile.ios</code>, <code>allowed_logout_urls</code>,\n    <code>token_endpoint_auth_method</code>, <code>is_first_party</code>, <code>oidc_conformant</code>,\n    <code>is_token_endpoint_ip_header_trusted</code>, <code>initiate_login_uri</code>, <code>grant_types</code>,\n    <code>refresh_token</code>, <code>refresh_token.rotation_type</code>, <code>refresh_token.expiration_type</code>,\n    <code>refresh_token.leeway</code>, <code>refresh_token.token_lifetime</code>, <code>refresh_token.policies</code>, <code>organization_usage</code>,\n    <code>organization_require_behavior</code>.\n  </li>\n  <li>\n    The following properties can only be retrieved with the <code>read:client_keys</code> or <code>read:client_credentials</code> scopes:\n    <code>encryption_key</code>, <code>encryption_key.pub</code>, <code>encryption_key.cert</code>,\n    <code>client_secret</code>, <code>client_authentication_methods</code> and <code>signing_key</code>.\n  </li>\n</ul>\n"
      tags:
      - clients
      parameters:
      - name: id
        in: path
        description: ID of the client to retrieve.
        required: true
        schema:
          type: string
      - name: fields
        in: query
        description: Comma-separated list of fields to include or exclude (based on value provided for include_fields) in the result. Leave empty to retrieve all fields.
        schema:
          type: string
          pattern: ^((name)|(description)|(callbacks)|(oidc_backchannel_logout)|(oidc_logout)|(session_transfer)|(allowed_origins)|(web_origins)|(client_id)|(tenant)|(global)|(config_route)|(callback_url_template)|(jwt_configuration)|(jwt_configuration\.lifetime_in_seconds)|(jwt_configuration\.secret_encoded)|(jwt_configuration\.scopes)|(jwt_configuration\.alg)|(api_type)|(logo_uri)|(allowed_clients)|(owners)|(custom_login_page)|(custom_login_page_on)|(sso)|(addons)|(form_template)|(custom_login_page_preview)|(encryption_key)|(encryption_key\.pub)|(encryption_key\.cert)|(client_secret)|(signing_keys)|(mobile)|(mobile\.android)|(mobile\.ios)|(token_endpoint_auth_method)|(allowed_logout_urls)|(app_type)|(is_first_party)|(oidc_conformant)|(client_metadata)|(is_token_endpoint_ip_header_trusted)|(initiate_login_uri)|(grant_types)|(refresh_token)|(refresh_token\.rotation_type)|(refresh_token\.expiration_type)|(refresh_token\.leeway)|(refresh_token\.policies)|(refresh_token\.token_lifetime)|(default_organization)|(organization_usage)|(organization_require_behavior)|(organization_discovery_methods)|(client_authentication_methods)|(client_authentication_methods\.private_key_jwt)|(require_pushed_authorization_requests)|(require_proof_of_possession)|(id_token)|(signed_request_object)|(signed_request_object\.required)|(signed_request_object\.credentials)|(compliance_level)|(skip_non_verifiable_callback_uri_confirmation_prompt)|(token_exchange)|(token_exchange\.allow_any_profile_of_type)|(token_quota)|(identity_assertion_authorization_grant)|(third_party_security_mode)|(subject_type_authorization)|(resource_server_identifier)|(express_configuration)|(my_organization_configuration)|(async_approval_notification_channels)|(token_vault_privileged_access)|(token_vault_privileged_access\.credentials)|(registration_type)|(external_metadata_type)|(external_metadata_created_by)|(external_client_id)|(redirection_policy))(,((name)|(description)|(callbacks)|(oidc_backchannel_logout)|(oidc_logout)|(session_transfer)|(allowed_origins)|(web_origins)|(client_id)|(tenant)|(global)|(config_route)|(callback_url_template)|(jwt_configuration)|(jwt_configuration\.lifetime_in_seconds)|(jwt_configuration\.secret_encoded)|(jwt_configuration\.scopes)|(jwt_configuration\.alg)|(api_type)|(logo_uri)|(allowed_clients)|(owners)|(custom_login_page)|(custom_login_page_on)|(sso)|(addons)|(form_template)|(custom_login_page_preview)|(encryption_key)|(encryption_key\.pub)|(encryption_key\.cert)|(client_secret)|(signing_keys)|(mobile)|(mobile\.android)|(mobile\.ios)|(token_endpoint_auth_method)|(allowed_logout_urls)|(app_type)|(is_first_party)|(oidc_conformant)|(client_metadata)|(is_token_endpoint_ip_header_trusted)|(initiate_login_uri)|(grant_types)|(refresh_token)|(refresh_token\.rotation_type)|(refresh_token\.expiration_type)|(refresh_token\.leeway)|(refresh_token\.policies)|(refresh_token\.token_lifetime)|(default_organization)|(organization_usage)|(organization_require_behavior)|(organization_discovery_methods)|(client_authentication_methods)|(client_authentication_methods\.private_key_jwt)|(require_pushed_authorization_requests)|(require_proof_of_possession)|(id_token)|(signed_request_object)|(signed_request_object\.required)|(signed_request_object\.credentials)|(compliance_level)|(skip_non_verifiable_callback_uri_confirmation_prompt)|(token_exchange)|(token_exchange\.allow_any_profile_of_type)|(token_quota)|(identity_assertion_authorization_grant)|(third_party_security_mode)|(subject_type_authorization)|(resource_server_identifier)|(express_configuration)|(my_organization_configuration)|(async_approval_notification_channels)|(token_vault_privileged_access)|(token_vault_privileged_access\.credentials)|(registration_type)|(external_metadata_type)|(external_metadata_created_by)|(external_client_id)|(redirection_policy)))*$
      - name: include_fields
        in: query
        description: Whether specified fields are to be included (true) or excluded (false).
        schema:
          type: boolean
      responses:
        '200':
          description: Client successfully retrieved.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetClientResponseContent'
        '400':
          description: Invalid request URI. The message will vary depending on the cause.
          x-description-1: Invalid request query string. The message will vary depending on the cause.
        '401':
          description: Invalid token.
          x-description-1: Client is not global.
          x-description-2: Invalid signature received for JSON Web Token validation.
        '403':
          description: 'Insufficient scope; expected any of: read:clients, read:client_keys, read:client_credentials, read:client_summary.'
          x-description-1: Some fields cannot be read with the permissions granted by the bearer token scopes. The message will vary depending on the fields and the scopes.
        '404':
          description: Client not found.
        '429':
          description: Too many requests. Check the X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset headers.
      operationId: get_clients_by_id
      x-release-lifecycle: GA
      x-operation-name: get
      x-operation-request-parameters-name: GetClientRequestParameters
      x-operation-group: clients
      security:
      - bearerAuth: []
      - oAuth2ClientCredentials:
        - read:clients
        - read:client_keys
        - read:client_credentials
        - read:client_summary
    delete:
      summary: Delete a Client
      description: Delete a client and related configuration (rules, connections, etc).
      tags:
      - clients
      parameters:
      - name: id
        in: path
        description: ID of the client to delete.
        required: true
        schema:
          type: string
      responses:
        '204':
          description: Client successfully deleted.
        '400':
          description: Invalid request URI. The message will vary depending on the cause.
          x-description-1: Global client cannot be deleted.
        '401':
          description: Invalid token.
          x-description-1: Client is not global.
          x-description-2: Invalid signature received for JSON Web Token validation.
        '403':
          description: 'Insufficient scope; expected any of: delete:clients.'
        '429':
          description: Too many requests. Check the X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset headers.
      operationId: delete_clients_by_id
      x-release-lifecycle: GA
      x-operation-name: delete
      x-operation-group: clients
      security:
      - bearerAuth: []
      - oAuth2ClientCredentials:
        - delete:clients
    patch:
      summary: Update a Client
      description: 'Updates a client''s settings. For more information, read <a href="https://www.auth0.com/docs/get-started/applications"> Applications in Auth0</a> and <a href="https://www.auth0.com/docs/authenticate/single-sign-on"> Single Sign-On</a>.


        Notes:

        - The `client_secret` and `signing_key` attributes can only be updated with the `update:client_keys` scope.

        - The <code>client_authentication_methods</code> and <code>token_endpoint_auth_method</code> properties are mutually exclusive. Use <code>client_authentication_methods</code> to configure the client with Private Key JWT authentication method. Otherwise, use <code>token_endpoint_auth_method</code> to configure the client with client secret (basic or post) or with no authentication method (none).

        - When using <code>client_authentication_methods</code> to configure the client with Private Key JWT authentication method, only specify the credential IDs that were generated when creating the credentials on the client.

        - To configure <code>client_authentication_methods</code>, the <code>update:client_credentials</code> scope is required.

        - To configure <code>client_authentication_methods</code>, the property <code>jwt_configuration.alg</code> must be set to RS256.

        - To change a client''s <code>is_first_party</code> property to <code>false</code>, the <code>organization_usage</code> and <code>organization_require_behavior</code> properties must be unset.

        '
      tags:
      - clients
      parameters:
      - name: id
        in: path
        description: ID of the client to update.
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateClientRequestContent'
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/UpdateClientRequestContent'
      responses:
        '200':
          description: Client successfully updated.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UpdateClientResponseContent'
        '400':
          description: Invalid request URI. The message will vary depending on the cause.
          x-description-1: Invalid request body. The message will vary depending on the cause.
        '401':
          description: Invalid token.
          x-description-1: Client is not global.
          x-description-2: Invalid signature received for JSON Web Token validation.
        '403':
          description: 'Insufficient scope; expected any of: update:clients, update:client_keys.'
          x-description-1: Some fields cannot be updated with the permissions granted by the bearer token scopes. The message will vary depending on the fields and the scopes.
          x-description-2: The account is not allowed to perform this operation.
          x-description-3: Organizations are only available to first party clients on user-based flows. Properties organization_usage and organization_require_behavior must be unset for third party clients.
        '404':
          description: Client not found.
        '429':
          description: Too many requests. Check the X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset headers.
      operationId: patch_clients_by_id
      x-release-lifecycle: GA
      x-operation-name: update
      x-operation-group: clients
      security:
      - bearerAuth: []
      - oAuth2ClientCredentials:
        - update:clients
        - update:client_keys
        - update:client_credentials
        - update:client_token_vault_privileged_access
  /clients/{id}/connections:
    get:
      summary: Get Enabled Connections for a Client
      description: "Retrieve all connections that are enabled for the specified <a href=\"https://www.auth0.com/docs/get-started/applications\"> Application</a>, using checkpoint pagination. A list of fields to include or exclude for each connection may also be specified.\n<ul>\n  <li>\n    This endpoint requires the <code>read:connections</code> scope and any one of <code>read:clients</code> or <code>read:client_summary</code>.\n  </li>\n  <li>\n    <b>Note</b>: The first time you call this endpoint, omit the <code>from</code> parameter. If there are more results, a <code>next</code> value is included in the response. You can use this for subsequent API calls. When <code>next</code> is no longer included in the response, no further results are remaining.\n  </li>\n</ul>\n"
      tags:
      - clients
      parameters:
      - name: id
        in: path
        description: ID of the client for which to retrieve enabled connections.
        required: true
        schema:
          type: string
      - name: strategy
        in: query
        description: Provide strategies to only retrieve connections with such strategies
        style: form
        explode: true
        schema:
          type: array
          items:
            $ref: '#/components/schemas/ConnectionStrategyEnum'
      - name: from
        in: query
        description: Optional Id from which to start selection.
        schema:
          type: string
          maxLength: 1000
      - name: take
        in: query
        description: Number of results per page. Defaults to 50.
        schema:
          type: integer
          minimum: 1
          maximum: 100
      - name: fields
        in: query
        description: A comma separated list of fields to include or exclude (depending on include_fields) from the result, empty to retrieve all fields
        schema:
          type: string
          maxLength: 1000
          pattern: ^((name)|(display_name)|(strategy)|(options)|(id)|(provisioning_ticket_url)|(metadata)|(show_as_button)|(clients)|(authentication)|(connected_accounts)|(cross_app_access_requesting_app)|(cross_app_access_resource_app))(,((name)|(display_name)|(strategy)|(options)|(id)|(provisioning_ticket_url)|(metadata)|(show_as_button)|(clients)|(authentication)|(connected_accounts)|(cross_app_access_requesting_app)|(cross_app_access_resource_app)))*$
      - name: include_fields
        in: query
        description: <code>true</code> if the fields specified are to be included in the result, <code>false</code> otherwise (defaults to <code>true</code>)
        schema:
          type: boolean
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListClientConnectionsResponseContent'
        '400':
          description: Invalid request URI. The message will vary depending on the cause.
          x-description-1: Invalid query string. The message will vary depending on the cause.
        '401':
          description: Invalid token.
          x-description-1: Invalid signature received for JSON Web Token validation.
        '403':
          description: 'Insufficient scope; expected: read:connections and any of: read:clients or read:client_summary.'
        '404':
          description: Client does not exist.
        '429':
          description: Too many requests. Check the X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset headers.
      operationId: get_client_connections
      x-release-lifecycle: GA
      x-operation-name: get
      x-operation-group:
      - clients
      - connections
      security:
      - bearerAuth: []
      - oAuth2ClientCredentials:
        - read:connections
        - read:clients
        - read:client_summary
  /clients/{id}/rotate-secret:
    post:
      summary: Rotate a Client Secret
      description: 'Rotate a client secret.


        This endpoint cannot be used with clients configured with Private Key JWT authentication method (client_authentication_methods configured with private_key_jwt). The generated secret is NOT base64 encoded.


        For more information, read <a href="https://www.auth0.com/docs/get-started/applications/rotate-client-secret">Rotate Client Secrets</a>.'
      tags:
      - clients
      parameters:
      - name: id
        in: path
        description: ID of the client that will rotate secrets.
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Secret successfully rotated.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RotateClientSecretResponseContent'
        '400':
          description: Invalid request URI. The message will vary depending on the cause.
          x-description-1: Invalid request body. The message will vary depending on the cause.
        '401':
          description: Invalid token.
          x-description-1: Client is not global.
          x-description-2: Invalid signature received for JSON Web Token validation.
        '403':
          description: 'Insufficient scope; expected any of: update:client_keys.'
          x-description-1: Some fields cannot be updated with the permissions granted by the bearer token scopes. The message will vary depending on the fields and the scopes.
        '404':
          description: Client not found.
        '429':
          description: Too many requests. Check the X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset headers.
      operationId: post_rotate-secret
      x-release-lifecycle: GA
      x-operation-name: rotateSecret
      x-operation-group: clients
      security:
      - bearerAuth: []
      - oAuth2ClientCredentials:
        - update:client_keys
components:
  schemas:
    ClientAddonSalesforceSandboxAPI:
      type: object
      description: Salesforce Sandbox addon configuration.
      additionalProperties: true
      properties:
        clientid:
          type: string
          description: Consumer Key assigned by Salesforce to the Connected App.
        principal:
          type: string
          description: Name of the property in the user object that maps to a Salesforce username. e.g. `email`.
        communityName:
          type: string
          description: Community name.
        community_url_section:
          type: string
          description: Community url section.
    ClientSessionTransferConfiguration:
      type:
      - object
      - 'null'
      description: Native to Web SSO Configuration
      additionalProperties: false
      properties:
        can_create_session_transfer_token:
          type: boolean
          description: Indicates whether an app can issue a Session Transfer Token through Token Exchange. If set to 'false', the app will not be able to issue a Session Transfer Token. Usually configured in the native application. Default value is `false`.
          default: false
        enforce_cascade_revocation:
          type: boolean
          description: Indicates whether revoking the parent Refresh Token that initiated a Native to Web flow and was used to issue a Session Transfer Token should trigger a cascade revocation affecting its dependent child entities. Usually configured in the native application. Default value is `true`, applicable only in Native to Web SSO context.
          default: true
        allowed_authentication_methods:
          type:
          - array
          - 'null'
          description: Indicates whether an app can create a session from a Session Transfer Token received via indicated methods. Can include `cookie` and/or `query`. Usually configured in the web application. Default value is an empty array [].
          items:
            $ref: '#/components/schemas/ClientSessionTransferAllowedAuthenticationMethodsEnum'
        enforce_device_binding:
          $ref: '#/components/schemas/ClientSessionTransferDeviceBindingEnum'
        allow_refresh_token:
          type: boolean
          description: Indicates whether Refresh Tokens are allowed to be issued when authenticating with a Session Transfer Token. Usually configured in the web application. Default value is `false`.
          default: false
        enforce_online_refresh_tokens:
          type: boolean
          description: Indicates whether Refresh Tokens created during a Native to Web session are tied to that session's lifetime. This determines if such refresh tokens should be automatically revoked when their corresponding sessions are. Usually configured in the web application. Default value is `true`, applicable only in Native to Web SSO context.
          default: true
        delegation:
          $ref: '#/components/schemas/ClientSessionTransferDelegationConfiguration'
          x-release-lifecycle: EA
    ClientMyOrganizationResponseConfiguration:
      type: object
      description: Configuration related to the My Organization Configuration for the client.
      additionalProperties: false
      required:
      - allowed_strategies
      - connection_deletion_behavior
      x-release-lifecycle: EA
      properties:
        connection_profile_id:
          type: string
          description: The connection profile ID that this client should validate against.
          format: connection-profile-id
        user_attribute_profile_id:
          type: string
          description: The user attribute profile ID that this client should validate against.
          format: user-attribute-profile-id
        allowed_strategies:
          type: array
          description: The allowed connection strategies for the My Organization Configuration.
          items:
            $ref: '#/components/schemas/ClientMyOrganizationConfigurationAllowedStrategiesEnum'
        connection_deletion_behavior:
          $ref: '#/components/schemas/ClientMyOrganizationDeletionBehaviorEnum'
    ClientExternalMetadataCreatedByEnum:
      type: string
      description: Indicates who created the external metadata client. The value <code>admin</code> indicates the client was registered via the Management API. The value <code>client</code> indicates the client was registered dynamically. This field is only present when external_metadata_type is set.
      enum:
      - admin
      - client
    ClientSignedRequestObjectWithPublicKey:
      type: object
      description: JWT-secured Authorization Requests (JAR) settings.
      additionalProperties: false
      properties:
        required:
          type: boolean
          description: Indicates whether the JAR requests are mandatory
          default: false
        credentials:
          type: array
          minItems: 0
          items:
            $ref: '#/components/schemas/PublicKeyCredential'
    ExpressConfigurationOrNull:
      type:
      - object
      - 'null'
      description: Application specific configuration for use with the OIN Express Configuration feature.
      additionalProperties: false
      required:
      - initiate_login_uri_template
      - user_attribute_profile_id
      - connection_profile_id
      - enable_client
      - enable_organization
      - okta_oin_client_id
      - admin_login_domain
      properties:
        initiate_login_uri_template:
          type: string
          description: 'The URI users should bookmark to log in to this application. Variable substitution is permitted for the following properties: organization_name, organization_id, and connection_name.'
          format: ec-initiate-login-uri-template-url
        user_attribute_profile_id:
          type: string
          description: The ID of the user attribute profile to use for this application.
          format: user-attribute-profile-id
        connection_profile_id:
          type: string
          description: The ID of the connection profile to use for this application.
          format: connection-profile-id
        enable_client:
          type: boolean
          description: When true, all connections made via express configuration will be enabled for this application.
        enable_organization:
          type: boolean
          description: When true, all connections made via express configuration will have the associated organization enabled.
        linked_clients:
          type: array
          description: List of client IDs that are linked to this express configuration (e.g. web or mobile clients).
          items:
            $ref: '#/components/schemas/LinkedClientConfiguration'
        okta_oin_client_id:
          type: string
          description: This is the unique identifier for the Okta OIN Express Configuration Client, which Okta will use for this application.
          format: client-id
        admin_login_domain:
          type: string
          description: This is the domain that admins are expected to log in via for authenticating for express configuration. It can be either the canonical domain or a registered custom domain.
          minLength: 1
        oin_submission_id:
          type: string
          description: The identifier of the published application in the OKTA OIN.
          minLength: 1
          maxLength: 200
    RefreshTokenExpirationTypeEnum:
      type: string
      description: 'Refresh token expiration types, one of: expiring, non-expiring'
      default: non-expiring
      enum:
      - expiring
      - non-expiring
    ClientTokenEndpointAuthMethodEnum:
      type: string
      description: Defines the requested authentication method for the token endpoint. Can be `none` (public client without a client secret), `client_secret_post` (client uses HTTP POST parameters), or `client_secret_basic` (client uses HTTP Basic).
      default: none
      enum:
      - none
      - client_secret_post
      - client_secret_basic
    ClientAddonAWS:
      type: object
      description: AWS addon configuration.
      additionalProperties: true
      properties:
        principal:
          type: string
          description: AWS principal ARN, e.g. `arn:aws:iam::010616021751:saml-provider/idpname`
        role:
          type: string
          description: AWS role ARN, e.g. `arn:aws:iam::010616021751:role/foo`
        lifetime_in_seconds:
          type: integer
          description: AWS token lifetime in seconds
          minimum: 900
          maximum: 43200
    CreateTokenQuota:
      type: object
      additionalProperties: false
      required:
      - client_credentials
      x-release-lifecycle: EA
      properties:
        client_credentials:
          $ref: '#/components/schemas/TokenQuotaClientCredentials'
    PublicKeyCredential:
      type: object
      additionalProperties: false
      required:
      - credential_type
      - pem
      properties:
        credential_type:
          $ref: '#/components/schemas/PublicKeyCredentialTypeEnum'
        name:
          type: string
          description: Friendly name for a credential.
          default: ''
          maxLength: 128
        pem:
          type: string
          description: PEM-formatted public key (SPKI and PKCS1) or X509 certificate. Must be JSON escaped.
          default: "-----BEGIN PUBLIC KEY-----\r\nMIIBIjANBg...\r\n-----END PUBLIC KEY-----\r\n"
        alg:
          $ref: '#/components/schemas/PublicKeyCredentialAlgorithmEnum'
        parse_expiry_from_cert:
          type: boolean
          description: Parse expiry from x509 certificate. If true, attempts to parse the expiry date from the provided PEM. Applies to `public_key` credential type.
          default: false
        expires_at:
          type: string
          description: The ISO 8601 formatted date representing the expiration of the credential. If not specified (not recommended), the credential never expires. Applies to `public_key` credential type.
          default: '2023-02-07T12:40:17.807Z'
          format: date-time
        kid:
          type: string
          description: Optional kid (Key ID), used to uniquely identify the credential. If not specified, a kid value will be auto-generated. The kid header parameter in JWTs sent by your client should match this value. Valid format is [0-9a-zA-Z-_]{10,64}
          minLength: 10
          maxLength: 64
          pattern: ^([0-9a-zA-Z-_]{10,64})$
    ConnectionForList:
      type: object
      additionalProperties: false
      properties:
        name:
          type: string
          description: The name of the connection
          default: My connection
        display_name:
          type: string
          description: Connection name used in login screen
        options:
          $ref: '#/components/schemas/ConnectionOptions'
        id:
          type: string
          description: The connection's identifier
          default: con_0000000000000001
        strategy:
          type: string
          description: The type of the connection, related to the identity provider
          default: auth0
        realms:
          type: array
          description: 'Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm.'
          items:
            type: string
            description: The realm where this connection belongs
            format: connection-realm
        is_domain_connection:
          type: boolean
          description: True if the connection is domain level
        show_as_button:
          type: boolean
          description: Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD.
        metadata:
          $ref: '#/components/schemas/ConnectionsMetadata'
        authentication:
          $ref: '#/components/schemas/ConnectionAuthenticationPurpose'
          x-release-lifecycle: GA
        connected_accounts:
          $ref: '#/components/schemas/ConnectionConnectedAccountsPurpose'
          x-release-lifecycle: GA
    LinkedClientConfiguration:
      type: object
      description: Configuration for linked clients in the OIN Express Configuration feature.
      additionalProperties: false
      required:
      - client_id
      properties:
        client_id:
          type: string
          description: The ID of the linked client.
          format: client-id
    ClientOIDCBackchannelLogoutSessionMetadata:
      type:
      - object
      - 'null'
      description: Controls whether session metadata is included in the logout token. Default value is null.
      additionalProperties: true
      properties:
        include:
          type: boolean
          description: The `include` property determines whether session metadata is included in the logout token.
    GetClientCredentialResponseContent:
      type: object
      additionalProperties: true
      properties:
        id:
          type: string
          description: ID of the credential. Generated on creation.
          default: cred_1m7sfABoNTTKYwTQ8qt6tX
        name:
          type: string
          description: The name given to the credential by the user.
          default: ''
        kid:
          type: string
          description: The key identifier of the credential, generated on creation.
          default: IZSSTECp...
        alg:
          $ref: '#/components/schemas/ClientCredentialAlgorithmEnum'
        credential_type:
          $ref: '#/components/schemas/ClientCredentialTypeEnum'
        subject_dn:
          type: string
          description: The X509 certificate's Subject Distinguished Name
        thumbprint_sha256:
          type: string
          description: The X509 certificate's SHA256 thumbprint
        created_at:
          type: string
          description: The ISO 8601 formatted date the credential was created.
          format: date-time
        updated_at:
          type: string
          description: The ISO 8601 formatted date the credential was updated.
          format: date-time
        expires_at:
          type: string
          description: The ISO 8601 formatted date representing the expiration of the credential.
          format: date-time
    RegisterCimdClientRequestContent:
      type: object
      additionalProperties: false
      required:
      - external_client_id
      properties:
        external_client_id:
          type: string
          description: URL to the Client ID Metadata Document. Acts as the unique identifier for upsert operations.
          minLength: 1
          maxLength: 120
          format: absolute-https-uri-or-empty
    ClientAddonSAPAPI:
      type: object
      description: SAP API addon configuration.
      additionalProperties: true
      properties:
        clientid:
          type: string
          description: If activated in the OAuth 2.0 client configuration (transaction SOAUTH2) the SAML attribute client_id must be set and equal the client_id form parameter of the access token request.
        usernameAttribute:
          type: string
          description: Name of the property in the user object that maps to a SAP username. e.g. `email`.
        tokenEndpointUrl:
          type: string
          description: Your SAP OData server OAuth2 token endpoint URL.
          format: url
        scope:
          type: string
          description: Requested scope for SAP APIs.
        servicePassword:
          type: string
          description: Service account password to use to authenticate API calls to the token endpoint.
        nameIdentifierFormat:
          type: string
          description: NameID element of the Subject which can be used to express the user's identity. Defaults to `urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified`.
    ClientAddonWSFed:
      type: object
      description: WS-Fed (WIF) addon indicator. Actual configuration is stored in `callback` and `client_aliases` properties on the client.
      additionalProperties: true
    ClientSessionTransferDelegationConfiguration:
      type:
      - object
      - 'null'
      description: Configuration for delegation (impersonation) access using Session Transfer Tokens
      additionalProperties: false
      x-release-lifecycle: EA
      properties:
        allow_delegated_access:
          type: boolean
          description: Indicates whether delegation (impersonation) access is allowed using Session Transfer Tokens. Default value is `false`.
          default: false
        enforce_device_binding:
          $ref: '#/components/schemas/ClientSessionTransferDelegationDeviceBindingEnum'
    PatchClientCredentialResponseContent:
      type: object
      additionalProperties: true
      properties:
        id:
          type: string
          description: ID of the credential. Generated on creation.
          default: cred_1m7sfABoNTTKYwTQ8qt6tX
        name:
          type: string
          description: The name given to the credential by the user.
          default: ''
        kid:
          type: string
          description: The key identifier of the credential, generated on creation.
          default: IZSSTECp...
        alg:
          $ref: '#/components/schemas/ClientCredentialAlgorithmEnum'
        credential_type:
          $ref: '#/components/schemas/ClientCredentialTypeEnum'
        subject_dn:
          type: string
          description: The X509 certificate's Subject Distinguished Name
        thumbprint_sha256:
          type: string
          description: The X509 certificate's SHA256 thumbprint
        created_at:
          type: string
          description: The ISO 8601 formatted date the credential was created.
          format: date-time
        updated_at:
          type: string
          description: The ISO 8601 formatted date the credential was updated.
          format: date-time
        expires_at:
          type: string
          description: The ISO 8601 formatted date representing the expiration of the credential.
          format: date-time
    ClientAddonZoom:
      type: object
      description: Zoom SSO configuration.
      additionalProperties: true
      properties:
        account:
          type: string
          description: Zoom account name usually first segment of your Zoom URL, e.g. `https://acme-org.zoom.us` would be `acme-org`.
    ClientAuthenticationMethodPrivateKeyJWTCredentials:
      type: array
      description: A list of unique and previously created credential IDs enabled on the client for Private Key JWT authentication.
      minItems: 0
      items:
        $ref: '#/components/schemas/CredentialId'
    NativeSocialLoginApple:
      type: object
      description: Native Social Login support for the Apple connection
      additionalProperties: false
      minProperties: 1
      properties:
        enabled:
          type: boolean
          description: Determine whether or not to allow signing in natively using an Apple authorization code
          default: false
    ClientMyOrganizationPatchConfiguration:
      type:
      - object
      - 'null'
      description: Configuration related to the My Organization Configuration for the client.
      additionalProperties: false
      required:
      - allowed_strategies
      - connection_deletion_behavior
      x-release-lifecycle: EA
      properties:
        connection_profile_id:
          type: string
          description: The connection profile ID that this client should validate against.
          format: connection-profile-id
        user_attribute_profile_id:
          type: string
          description: The user attribute profile ID that this client should validate against.
          format: user-attribute-profile-id
        allowed_strategies:
          type: array
          description: The allowed connection strategies for the My Organization Configuration.
          items:
            $ref: '#/components/schemas/ClientMyOrganizationConfigurationAllowedStrategiesEnum'
        connection_deletion_behavior:
          $ref: '#/components/schemas/ClientMyOrganizationDeletionBehaviorEnum'
    ClientAddonNewRelic:
      type: object
      description: New Relic SSO configuration.
      additionalProperties: true
      properties:
        account:
          type: string
          description: Your New Relic Account ID found in your New Relic URL after the `/accounts/` path. e.g. `https://rpm.newrelic.com/accounts/123456/query` would be `123456`.
    ClientDefaultOrganization:
      type:
      - object
      - 'null'
      description: Defines the default Organization ID and flows
      additionalProperties: false
      required:
      - organization_id
      - flows
      properties:
        organization_id:
          type: string
          description: The default Organization ID to be used
          format: organization-id
        flows:
          type: array
          description: The default Organization usage
          items:
            $ref: '#/components/schemas/ClientDefaultOrganizationFlowsEnum'
    ClientAddonSentry:
      type: object
      description: Sentry SSO configuration.
      additionalProperties: true
      properties:
        org_slug:
          type: string
          description: Generated slug for your Sentry organization. Found in your Sentry URL. e.g. `https://sentry.acme.com/acme-org/` would be `acme-org`.
        base_url:
          type: string
          description: URL prefix only if running Sentry Community Edition, otherwise leave should be blank.
    PatchClientCredentialRequestContent:
      type: object
      additionalProperties: false
      minProperties: 1
      properties:
        expires_at:
          type:
          - string
          - 'null'
          description: The ISO 8601 formatted date representing the expiration of the credential.
          format: date-time
    X509CertificateCredentialTypeEnum:
      type: string
      enum:
      - x509_cert
    ClientAddonSAMLMapping:
      type: object
      additionalProperties: true
    ClientCreateAuthenticationMethod:
      type: object
      description: Defines client authentication methods.
      additionalProperties: false
      minProperties: 1
      maxProperties: 1
      properties:
        private_key_jwt:
          $ref: '#/components/schemas/ClientCreateAuthenticationMethodPrivateKeyJWT'
        tls_client_auth:
          $ref: '#/components/schemas/ClientCreateAuthenticationMethodTLSClientAuth'
        self_signed_tls_client_auth:
          $ref: '#/components/schemas/CreateClientAuthenticationMethodSelfSignedTLSClientAuth'
    CreateClientAuthenticationMethodSelfSignedTLSClientAuth:
      type: object
      description: Defines `self_signed_tls_client_auth` client authentication method. If the property is defined, the client is configured to use mTLS authentication method utilizing self-signed certificate.
      additionalProperties: false
      required:
      - credentials
      properties:
        credentials:
          $ref: '#/components/schemas/CreateClientAuthenticationMethodSelfSignedTLSClientAuthCredentials'
    NativeSocialLoginGoogle:
      type: object
      description: Native Social Login support for the google-oauth2 connection
      additionalProperties: false
      minProperties: 1
      properties:
        enabled:
          type: boolean
          description: Determine whether or not to allow signing in natively using a Google ID token
          default: false
    ClientExternalMetadataTypeEnum:
      type: string
      description: Indicates the type of external metadata used to register the client. This field is omitted for regular clients. The value <code>cimd</code> identifies clients registered via a Client ID Metadata Document.
      enum:
      - cimd
    ClientRefreshTokenConfiguration:
      type:
      - object
      - 'null'
      description: Refresh token configuration
      additionalProperties: false
      required:
      - rotation_type
      - expiration_type
      properties:
        rotation_type:
          $ref: '#/components/schemas/RefreshTokenRotationTypeEnum'
        expiration_type:
          $ref: '#/components/schemas/RefreshTokenExpirationTypeEnum'
        leeway:
          type: integer
          description: Period in seconds where the previous refresh token can be exchanged without triggering breach detection
          default: 0
          minimum: 0
        token_lifetime:
          type: integer
          description: Period (in seconds) for which refresh tokens will remain valid
          minimum: 1
          maximum: 157788000
        infinite_token_lifetime:
          type: boolean
          description: Prevents tokens from having a set lifetime when `true` (takes precedence over `token_lifetime` values)
        idle_token_lifetime:
          type: integer
          description: Period (in seconds) for which refresh tokens will remain valid without use
          minimum: 1
        infinite_idle_token_lifetime:
          type: boolean
          description: Prevents tokens from expiring without use when `true` (takes precedence over `idle_token_lifetime` values)
          default: false
        policies:
          type:
          - array
          - 'null'
          description: A collection of policies governing multi-resource refresh token exchange (MRRT), defining how refresh tokens can be used across different resource servers
          minItems: 1
          items:
            $ref: '#/components/schemas/ClientRefreshTokenPolicy'
    CimdMappedPrivateKeyJwtCredential:
      type: object
      additionalProperties: true
      required:
      - credential_type
      - kid
      - alg
      properties:
        credential_type:
          type: string
          description: Type of credential (e.g., public_key)
        kid:
          type: string
          description: Key identifier from JWKS or calculated thumbprint
        alg:
          type: string
          description: Algorithm (e.g., RS256, RS384, PS256)
    ClientOrganizationRequireBehaviorEnum:
      type: string
      description: 'Defines how to proceed during an authentication transaction when `client.organization_usage: ''require''`. Can be `no_prompt` (default), `pre_login_prompt` or `post_login_prompt`. `post_login_prompt` requires `oidc_conformant: true`.'
      default: no_prompt
      enum:
      - no_prompt
      - pre_login_prompt
      - post_login_prompt
    CreateClientResponseContent:
      type: object
      additionalProperties: true
      properties:
        client_id:
          type: string
          description: ID of this client.
          default: AaiyAPdpYdesoKnqjj8HJqRn4T5titww
        tenant:
          type: string
          description: Name of the tenant this client belongs to.
          default: ''
        name:
          type: string
          description: 'Name of this client (min length: 1 character, does not allow `<` or `>`).'
          default: My application
        description:
          type: string
          description: 'Free text description of this client (max length: 140 characters).'
          default: ''
        global:
          type: boolean
          description: Whether this is your global 'All Applications' client representing legacy tenant settings (true) or a regular client (false).
          default: false
        client_secret:
          type: string
          description: Client secret (which you must not make public).
          default: MG_TNT2ver-SylNat-_VeMmd-4m0Waba0jr1troztBniSChEw0glxEmgEi2Kw40H
        app_type:
          $ref: '#/components/schemas/ClientAppTypeEnum'
        logo_uri:
          type: string
          description: URL of the logo to display for this client. Recommended size is 150x150 pixels.
        is_first_party:
          type: boolean
          description: Whether this client a first party client (true) or not (false).
          default: false
        oidc_conformant:
          type: boolean
          description: Whether this client conforms to <a href='https://auth0.com/docs/api-auth/tutorials/adoption'>strict OIDC specifications</a> (true) or uses legacy features (false).
          default: false
        callbacks:
          type: array
          description: Comma-separated list of URLs whitelisted for Auth0 to use as a callback to the client after authentication.
          items:
            type: string
        allowed_origins:
          type: array
          description: Comma-separated list of URLs allowed to make requests from JavaScript to Auth0 API (typically used with CORS). By default, all your callback URLs will be allowed. This field allows you to enter other origins if necessary. You can also use wildcards at the subdomain level (e.g., https://*.contoso.com). Query strings and hash information are not taken into account when validating these URLs.
          items:
            type: string
        web_origins:
          type: array
          description: Comma-separated list of allowed origins for use with <a href='https://auth0.com/docs/cross-origin-authentication'>Cross-Origin Authentication</a>, <a href='https://auth0.com/docs/flows/concepts/device-auth'>Device Flow</a>, and <a href='https://auth0.com/docs/protocols/oauth2#how-response-mode-works'>web message response mode</a>.
          items:
            type: string
        client_aliases:
          type: array
          description: List of audiences/realms for SAML protocol. Used by the wsfed addon.
          items:
            type: string
        allowed_clients:
          type: array
          description: List of allow clients and API ids that are allowed to make delegation requests. Empty means all all your clients are allowed.
          items:
            type: string
        allowed_logout_urls:
          type: array
          description: Comma-separated list of URLs that are valid to redirect to after logout from Auth0. Wildcards are allowed for subdomains.
          items:
            type: string
        session_transfer:
          $ref: '#/components/schemas/ClientSessionTransferConfiguration'
        oidc_logout:
          $ref: '#/components/schemas/ClientOIDCBackchannelLogoutSettings'
        grant_types:
          type: array
          description: List of grant types supported for this application. Can include `authorization_code`, `implicit`, `refresh_token`, `client_credentials`, `password`, `http://auth0.com/oauth/grant-type/password-realm`, `http://auth0.com/oauth/grant-type/mfa-oob`, `http://auth0.com/oauth/grant-type/mfa-otp`, `http://auth0.com/oauth/grant-type/mfa-recovery-code`, `urn:openid:params:grant-type:ciba`, `urn:ietf:params:oauth:grant-type:device_code`, and `urn:auth0:params:oauth:grant-type:token-exchange:federated-connection-access-token`.
          items:
            type: string
        jwt_configuration:
          $ref: '#/components/schemas/ClientJwtConfiguration'
        signing_keys:
          $ref: '#/components/schemas/ClientSigningKeys'
        encryption_key:
          $ref: '#/components/schemas/ClientEncryptionKey'
        sso:
          type: boolean
          description: Applies only to SSO clients and determines whether Auth0 will handle Single Sign On (true) or whether the Identity Provider will (false).
          default: false
        sso_disabled:
          type: boolean
          description: Whether Single Sign On is disabled (true) or enabled (true). Defaults to true.
          default: false
        cross_origin_authentication:
          type: boolean
          description: Whether this client can be used to make cross-origin authentication requests (true) or it is not allowed to make such requests (false).
        cross_origin_loc:
          type: string
          description: URL of the location in your site where the cross origin verification takes place for the cross-origin auth flow when performing Auth in your own domain instead of Auth0 hosted login page.
          format: url
        custom_login_page_on:
          type: boolean
          description: Whether a custom login page is to be used (true) or the default provided login page (false).
          default: true
        custom_login_page:
          type: string
          description: The content (HTML, CSS, JS) of the custom login page.
          default: ''
        custom_login_page_preview:
          type: string
          description: The content (HTML, CSS, JS) of the custom login page. (Used on Previews)
          default: ''
        form_template:
          type: string
          description: HTML form template to be used for WS-Federation.
          default: ''
        addons:
          $ref: '#/components/schemas/ClientAddons'
        token_endpoint_auth_method:
          $ref: '#/components/schemas/ClientTokenEndpointAuthMethodEnum'
        is_token_endpoint_ip_header_trusted:
          type: boolean
          description: If true, trust that the IP specified in the `auth0-forwarded-for` header is the end-user's IP for brute-force-protection on token endpoint.
          default: false
        client_metadata:
          $ref: '#/components/schemas/ClientMetadata'
        mobile:
          $ref: '#/components/schemas/ClientMobile'
        initiate_login_uri:
          type: string
          description: Initiate login uri, must be https
          format: absolute-https-uri-with-placeholders-or-empty
        native_social_login: {}
        refresh_token:
          $ref: '#/components/schemas/ClientRefreshTokenConfiguration'
        default_organization:
          $ref: '#/components/schemas/ClientDefaultOrganization'
        organization_usage:
          $ref: '#/components/schemas/ClientOrganizationUsageEnum'
        organization_require_behavior:
          $ref: '#/components/schemas/ClientOrganizationRequireBehaviorEnum'
        organization_discovery_methods:
          type: array
          description: Defines the available methods for organization discovery during the `pre_login_prompt`. Users can discover their organization either by `email`, `organization_name` or both.
          minItems: 1
          x-release-lifecycle: EA
          items:
            $ref: '#/components/schemas/ClientOrganizationDiscoveryEnum'
        client_authentication_methods:
          $ref: '#/components/schemas/ClientAuthenticationMethod'
        require_pushed_authorization_requests:
          type: boolean
          description: Makes the use of Pushed Authorization Requests mandatory for this client
          default: false
        require_proof_of_possession:
          type: boolean
          description: Makes the use of Proof-of-Possession mandatory for this client
          default: false
        signed_request_object:
          $ref: '#/components/schemas/ClientSignedRequestObjectWithCredentialId'
        compliance_level:
          $ref: '#/components/schemas/ClientComplianceLevelEnum'
        skip_non_verifiable_callback_uri_confirmation_prompt:
          type: boolean
          description: 'Controls whether a confirmation prompt is shown during login flows when the redirect URI uses non-verifiable callback URIs (for example, a custom URI schema such as `myapp://`, or `localhost`).

            If set to true, a confirmation prompt will not be shown. We recommend that this is set to false for improved protection from malicious apps.

            See https://auth0.com/docs/secure/security-guidance/measures-against-app-impersonation for more information.'
        token_exchange:
          $ref: '#/components/schemas/ClientTokenExchangeConfiguration'
          x-release-lifecycle: GA
        par_request_expiry:
          type:
          - integer
          - 'null'
          description: Specifies how long, in seconds, a Pushed Authorization Request URI remains valid
          minimum: 10
          maximum: 600
        token_quota:
          $ref: '#/components/schemas/TokenQuota'
          x-release-lifecycle: EA
        express_configuration:
          $ref: '#/components/schemas/ExpressConfiguration'
        my_organization_configuration:
          $ref: '#/components/schemas/ClientMyOrganizationResponseConfiguration'
          x-release-lifecycle: EA
        third_party_security_mode:
          $ref: '#/components/schemas/ClientThirdPartySecurityModeEnum'
          x-release-lifecycle: GA
        redirection_policy:
          $ref: '#/components/schemas/ClientRedirectionPolicyEnum'
          x-release-lifecycle: GA
        resource_server_identifier:
          type: string
          description: The identifier of the resource server that this client is linked to.
        async_approval_notification_channels:
          $ref: '#/components/schemas/ClientAsyncApprovalNotificationsChannelsAPIPostConfiguration'
        external_metadata_type:
          $ref: '#/components/schemas/ClientExternalMetadataTypeEnum'
        external_metadata_created_by:
          $ref: '#/components/schemas/ClientExternalMetadataCreatedByEnum'
        external_client_id:
          type: string
          description: An alternate client identifier to be used during authorization flows. Only supports CIMD-based client identifiers.
          format: absolute-https-uri-or-empty
        jwks_uri:
          type: string
          description: URL for the JSON Web Key Set (JWKS) containing the public keys used for private_key_jwt authentication. Only present for CIMD clients using private_key_jwt authentication.
          format: absolute-https-uri-or-empty
    ClientTokenExchangeTypeEnum:
      type: string
      description: 'Token exchange type. `on_behalf_of_token_exchange`: enables On-Behalf-Of token exchange (Generally Available). `custom_authentication`: enables custom token exchange profiles (Early Access, requires entitlement).'
      minLength: 1
      enum:
      - custom_authentication
      - on_behalf_of_token_exchange
    ClientSessionTransferDeviceBindingEnum:
      type: string
      description: Indicates whether device binding security should be enforced for the app. If set to 'ip', the app will enforce device binding by IP, meaning that consumption of Session Transfer Token must be done from the same IP of the issuer. Likewise, if set to 'asn', device binding is enforced by ASN, meaning consumption of Session Transfer Token must be done from the same ASN as the issuer. If set to 'none', device binding is not enforced. Usually configured in the web application. Default value is `ip`.
      default: ip
      enum:
      - ip
      - asn
      - none
    ClientAuthenticationMethodTLSClientAuthCredentials:
      type: array
      description: A list of unique and previously created credential IDs enabled on the client for CA-based mTLS authentication.
      minItems: 0
      items:
        $ref: '#/components/schemas/CredentialId'
    ClientAsyncApprovalNotificationsChannelsAPIPatchConfiguration:
      type:
      - array
      - 'null'
      description: Array of notification channels for contacting the user when their approval is required. Valid values are `guardian-push`, `email`.
      minItems: 1
      items:
        $ref: '#/components/schemas/AsyncApprovalNotificationsChannelsEnum'
    ClientOrganizationUsageEnum:
      type: string
      description: Defines how to proceed during an authentication transaction with regards an organization. Can be `deny` (default), `allow` or `require`.
      default: deny
      enum:
      - deny
      - allow
      - require
    CertificateSubjectDNCredential:
      type: object
      additionalProperties: false
      required:
      - credential_type
      properties:
        credential_type:
          $ref: '#/components/schemas/CertificateSubjectDNCredentialTypeEnum'
        name:
          type: string
          description: Friendly name for a credential.
          default: ''
          maxLength: 128
        subject_dn:
          type: string
          description: Subject Distinguished Name. Mutually exclusive with `pem` property. Applies to `cert_subject_dn` credential type.
          minLength: 1
          maxLength: 256
        pem:
          type: string
          description: PEM-formatted X509 certificate. Must be JSON escaped. Mutually exclusive with `subject_dn` property.
          default: "-----BEGIN CERTIFICATE-----\r\nMIIBIjANBg...\r\n-----END CERTIFICATE-----\r\n"
          minLength: 1
          maxLength: 4096
    Client:
      type: object
      additionalProperties: true
      properties:
        client_id:
          type: string
          description: ID of this client.
          default: AaiyAPdpYdesoKnqjj8HJqRn4T5titww
        tenant:
          type: string
          description: Name of the tenant this client belongs to.
          default: ''
        name:
          type: string
          description: 'Name of this client (min length: 1 character, does not allow `<` or `>`).'
          default: My application
        description:
          type: string
          description: 'Free text description of this client (max length: 140 characters).'
          default: ''
        global:
          type: boolean
          description: Whether this is your global 'All Applications' client representing legacy tenant settings (true) or a regular client (false).
          default: false
        client_secret:
          type: string
          description: Client secret (which you must not make public).
          default: MG_TNT2ver-SylNat-_VeMmd-4m0Waba0jr1troztBniSChEw0glxEmgEi2Kw40H
        app_type:
          $ref: '#/components/schemas/ClientAppTypeEnum'
        logo_uri:
          type: string
          description: URL of the logo to display for this client. Recommended size is 150x150 pixels.
        is_first_party:
          type: boolean
          description: Whether this client a first party client (true) or not (false).
          default: false
        oidc_conformant:
          type: boolean
          description: Whether this client conforms to <a href='https://auth0.com/docs/api-auth/tutorials/adoption'>strict OIDC specifications</a> (true) or uses legacy features (false).
          default: false
        callbacks:
          type: array
          description: Comma-separated list of URLs whitelisted for Auth0 to use as a callback to the client after authentication.
          items:
            type: string
        allowed_origins:
          type: array
          description: Comma-separated list of URLs allowed to make requests from JavaScript to Auth0 API (typically used with CORS). By default, all your callback URLs will be allowed. This field allows you to enter other origins if necessary. You can also use wildcards at the subdomain level (e.g., https://*.contoso.com). Query strings and hash information are not taken into account when validating these URLs.
          items:
            type: string
        web_origins:
          type: array
          description: Comma-separated list of allowed origins for use with <a href='https://auth0.com/docs/cross-origin-authentication'>Cross-Origin Authentication</a>, <a href='https://auth0.com/docs/flows/concepts/device-auth'>Device Flow</a>, and <a href='https://auth0.com/docs/protocols/oauth2#how-response-mode-works'>web message response mode</a>.
          items:
            type: string
        client_aliases:
          type: array
          description: List of audiences/realms for SAML protocol. Used by the wsfed addon.
          items:
            type: string
        allowed_clients:
          type: array
          description: List of allow clients and API ids that are allowed to make delegation requests. Empty means all all your clients are allowed.
          items:
            type: string
        allowed_logout_urls:
          type: array
          description: Comma-separated list of URLs that are valid to redirect to after logout from Auth0. Wildcards are allowed for subdomains.
          items:
            type: string
        session_transfer:
          $ref: '#/components/schemas/ClientSessionTransferConfiguration'
        oidc_logout:
          $ref: '#/components/schemas/ClientOIDCBackchannelLogoutSettings'
        grant_types:
          type: array
          description: List of grant types supported for this application. Can include `authorization_code`, `implicit`, `refresh_token`, `client_credentials`, `password`, `http://auth0.com/oauth/grant-type/password-realm`, `http://auth0.com/oauth/grant-type/mfa-oob`, `http://auth0.com/oauth/grant-type/mfa-otp`, `http://auth0.com/oauth/grant-type/mfa-recovery-code`, `urn:openid:params:grant-type:ciba`, `urn:ietf:params:oauth:grant-type:device_code`, and `urn:auth0:params:oauth:grant-type:token-exchange:federated-connection-access-token`.
          items:
            type: string
        jwt_configuration:
          $ref: '#/components/schemas/ClientJwtConfiguration'
        signing_keys:
          $ref: '#/components/schemas/ClientSigningKeys'
        encryption_key:
          $ref: '#/components/schemas/ClientEncryptionKey'
        sso:
          type: boolean
          description: Applies only to SSO clients and determines whether Auth0 will handle Single Sign On (true) or whether the Identity Provider will (false).
          default: false
        sso_disabled:
          type: boolean
          description: Whether Single Sign On is disabled (true) or enabled (true). Defaults to true.
          default: false
        cross_origin_authentication:
          type: boolean
          description: Whether this client can be used to make cross-origin authentication requests (true) or it is not allowed to make such requests (false).
        cross_origin_loc:
          type: string
          description: URL of the location in your site where the cross origin verification takes place for the cross-origin auth flow when performing Auth in your own domain instead of Auth0 hosted login page.
          format: url
        custom_login_page_on:
          type: boolean
          description: Whether a custom login page is to be used (true) or the default provided login page (false).
          default: true
        custom_login_page:
          type: string
          description: The content (HTML, CSS, JS) of the custom login page.
          default: ''
        custom_login_page_preview:
          type: string
          description: The content (HTML, CSS, JS) of the custom login page. (Used on Previews)
          default: ''
        form_template:
          type: string
          description: HTML form template to be used for WS-Federation.
          default: ''
        addons:
          $ref: '#/components/schemas/ClientAddons'
        token_endpoint_auth_method:
          $ref: '#/components/schemas/ClientTokenEndpointAuthMethodEnum'
        is_token_endpoint_ip_header_trusted:
          type: boolean
          description: If true, trust that the IP specified in the `auth0-forwarded-for` header is the end-user's IP for brute-force-protection on token endpoint.
          default: false
        client_metadata:
          $ref: '#/components/schemas/ClientMetadata'
        mobile:
          $ref: '#/components/schemas/ClientMobile'
        initiate_login_uri:
          type: string
          description: Initiate login uri, must be https
          format: absolute-https-uri-with-placeholders-or-empty
        native_social_login: {}
        refresh_token:
          $ref: '#/components/schemas/ClientRefreshTokenConfiguration'
        default_organization:
          $ref: '#/components/schemas/ClientDefaultOrganization'
        organization_usage:
          $ref: '#/components/schemas/ClientOrganizationUsageEnum'
        organization_require_behavior:
          $ref: '#/components/schemas/ClientOrganizationRequireBehaviorEnum'
        organization_discovery_methods:
          type: array
          description: Defines the available methods for organization discovery during the `pre_login_prompt`. Users can discover their organization either by `email`, `organization_name` or both.
          minItems: 1
          x-release-lifecycle: EA
          items:
            $ref: '#/components/schemas/ClientOrganizationDiscoveryEnum'
        client_authentication_methods:
          $ref: '#/components/schemas/ClientAuthenticationMethod'
        require_pushed_authorization_requests:
          type: boolean
          description: Makes the use of Pushed Authorization Requests mandatory for this client
          default: false
        require_proof_of_possession:
          type: boolean
          description: Makes the use of Proof-of-Possession mandatory for this client
          default: false
        signed_request_object:
          $ref: '#/components/schemas/ClientSignedRequestObjectWithCredentialId'
        compliance_level:
          $ref: '#/components/schemas/ClientComplianceLevelEnum'
        skip_non_verifiable_callback_uri_confirmation_prompt:
          type: boolean
          description: 'Controls whether a confirmation prompt is shown during login flows when the redirect URI uses non-verifiable callback URIs (for example, a custom URI schema such as `myapp://`, or `localhost`).

            If set to true, a confirmation prompt will not be shown. We recommend that this is set to false for improved protection from malicious apps.

            See https://auth0.com/docs/secure/security-guidance/measures-against-app-impersonation for more information.'
        token_exchange:
          $ref: '#/components/schemas/ClientTokenExchangeConfiguration'
          x-release-lifecycle: GA
        par_request_expiry:
          type:
          - integer
          - 'null'
          description: Specifies how long, in seconds, a Pushed Authorization Request URI remains valid
          minimum: 10
          maximum: 600
        token_quota:
          $ref: '#/components/schemas/TokenQuota'
          x-release-lifecycle: EA
        express_configuration:
          $ref: '#/components/schemas/ExpressConfiguration'
        my_organization_configuration:
          $ref: '#/components/schemas/ClientMyOrganizationResponseConfiguration'
          x-release-lifecycle: EA
        third_party_security_mode:
          $ref: '#/components/schemas/ClientThirdPartySecurityModeEnum'
          x-release-lifecycle: GA
        redirection_policy:
          $ref: '#/components/schemas/ClientRedirectionPolicyEnum'
          x-release-lifecycle: GA
        resource_server_identifier:
          type: string
          description: The identifier of the resource server that this client is linked to.
        async_approval_notification_channels:
          $ref: '#/components/schemas/ClientAsyncApprovalNotificationsChannelsAPIPostConfiguration'
        external_metadata_type:
          $ref: '#/components/schemas/ClientExternalMetadataTypeEnum'
        external_metadata_created_by:
          $ref: '#/components/schemas/ClientExternalMetadataCreatedByEnum'
        external_client_id:
          type: string
          description: An alternate client identifier to be used during authorization flows. Only supports CIMD-based client identifiers.
          format: absolute-https-uri-or-empty
        jwks_uri:
          type: string
          description: URL for the JSON Web Key Set (JWKS) containing the public keys used for private_key_jwt authentication. Only present for CIMD clients using private_key_jwt authentication.
          format: absolute-https-uri-or-empty
    AsyncApprovalNotificationsChannelsEnum:
      type: string
      enum:
      - guardian-push
      - email
    ConnectionOptions:
      type: object
      description: In order to return options in the response, the `read:connections_options` scope must be present
      additionalProperties: true
    ClientOIDCBackchannelLogoutInitiatorsEnum:
      type: string
      description: The `selected_initiators` property contains the list of initiators to be enabled for the given application.
      enum:
      - rp-logout
      - idp-logout
      - password-changed
      - session-expired
      - session-revoked
      - account-deleted
      - email-identifier-changed
      - mfa-phone-unenrolled
      - account-deactivated
    TokenQuota:
      type: object
      additionalProperties: false
      required:
      - client_credentials
      x-release-lifecycle: EA
      properties:
        client_credentials:
          $ref: '#/components/schemas/TokenQuotaClientCredentials'
    ListClientsPaginatedResponseContent:
      type: object
      additionalProperties: false
      properties:
        next:
          type: string
          description: Opaque identifier for use with the <i>from</i> query parameter for the next page of results.<br/>This identifier is valid for 24 hours.
        clients:
          type: array
          items:
            $ref: '#/components/schemas/Client'
    ClientAddonOAG:
      type:
      - object
      - 'null'
      description: Okta Access Gateway SSO configuration
      additionalProperties: false
      properties: {}
    ClientDefaultOrganizationFlowsEnum:
      type: string
      enum:
      - client_credentials
    RotateClientSecretResponseContent:
      type: object
      additionalProperties: true
      properties:
        client_id:
          type: string
          description: ID of this client.
          default: AaiyAPdpYdesoKnqjj8HJqRn4T5titww
        tenant:
          type: string
          description: Name of the tenant this client belongs to.
          default: ''
        name:
          type: string
          description: 'Name of this client (min length: 1 character, does not allow `<` or `>`).'
          default: My application
        description:
          type: string
          description: 'Free text description of this client (max length: 140 characters).'
          default: ''
        global:
          type: boolean
          description: Whether this is your global 'All Applications' client representing legacy tenant settings (true) or a regular client (false).
          default: false
        client_secret:
          type: string
          description: Client secret (which you must not make public).
          default: MG_TNT2ver-SylNat-_VeMmd-4m0Waba0jr1troztBniSChEw0glxEmgEi2Kw40H
        app_type:
          $ref: '#/components/schemas/ClientAppTypeEnum'
        logo_uri:
          type: string
          description: URL of the logo to display for this client. Recommended size is 150x150 pixels.
        is_first_party:
          type: boolean
          description: Whether this client a first party client (true) or not (false).
          default: false
        oidc_conformant:
          type: boolean
          description: Whether this client conforms to <a href='https://auth0.com/docs/api-auth/tutorials/adoption'>strict OIDC specifications</a> (true) or uses legacy features (false).
          default: false
        callbacks:
          type: array
          description: Comma-separated list of URLs whitelisted for Auth0 to use as a callback to the client after authentication.
          items:
            type: string
        allowed_origins:
          type: array
          description: Comma-separated list of URLs allowed to make requests from JavaScript to Auth0 API (typically used with CORS). By default, all your callback URLs will be allowed. This field allows you to enter other origins if necessary. You can also use wildcards at the subdomain level (e.g., https://*.contoso.com). Query strings and hash information are not taken into account when validating these URLs.
          items:
            type: string
        web_origins:
          type: array
          description: Comma-separated list of allowed origins for use with <a href='https://auth0.com/docs/cross-origin-authentication'>Cross-Origin Authentication</a>, <a href='https://auth0.com/docs/flows/concepts/device-auth'>Device Flow</a>, and <a href='https://auth0.com/docs/protocols/oauth2#how-response-mode-works'>web message response mode</a>.
          items:
            type: string
        client_aliases:
          type: array
          description: List of audiences/realms for SAML protocol. Used by the wsfed addon.
          items:
            type: string
        allowed_clients:
          type: array
          description: List of allow clients and API ids that are allowed to make delegation requests. Empty means all all your clients are allowed.
          items:
            type: string
        allowed_logout_urls:
          type: array
          description: Comma-separated list of URLs that are valid to redirect to after logout from Auth0. Wildcards are allowed for subdomains.
          items:
            type: string
        session_transfer:
          $ref: '#/components/schemas/ClientSessionTransferConfiguration'
        oidc_logout:
          $ref: '#/components/schemas/ClientOIDCBackchannelLogoutSettings'
        grant_types:
          type: array
          description: List of grant types supported for this application. Can include `authorization_code`, `implicit`, `refresh_token`, `client_credentials`, `password`, `http://auth0.com/oauth/grant-type/password-realm`, `http://auth0.com/oauth/grant-type/mfa-oob`, `http://auth0.com/oauth/grant-type/mfa-otp`, `http://auth0.com/oauth/grant-type/mfa-recovery-code`, `urn:openid:params:grant-type:ciba`, `urn:ietf:params:oauth:grant-type:device_code`, and `urn:auth0:params:oauth:grant-type:token-exchange:federated-connection-access-token`.
          items:
            type: string
        jwt_configuration:
          $ref: '#/components/schemas/ClientJwtConfiguration'
        signing_keys:
          $ref: '#/components/schemas/ClientSigningKeys'
        encryption_key:
          $ref: '#/components/schemas/ClientEncryptionKey'
        sso:
          type: boolean
          description: Applies only to SSO clients and determines whether Auth0 will handle Single Sign On (true) or whether the Identity Provider will (false).
          default: false
        sso_disabled:
          type: boolean
          description: Whether Single Sign On is disabled (true) or enabled (true). Defaults to true.
          default: false
        cross_origin_authentication:
          type: boolean
          description: Whether this client can be used to make cross-origin authentication requests (true) or it is not allowed to make such requests (false).
        cross_origin_loc:
          type: string
          description: URL of the location in your site where the cross origin verification takes place for the cross-origin auth flow when performing Auth in your own domain instead of Auth0 hosted login page.
          format: url
        custom_login_page_on:
          type: boolean
          description: Whether a custom login page is to be used (true) or the default provided login page (false).
          default: true
        custom_login_page:
          type: string
          description: The content (HTML, CSS, JS) of the custom login page.
          default: ''
        custom_login_page_preview:
          type: string
          description: The content (HTML, CSS, JS) of the custom login page. (Used on Previews)
          default: ''
        form_template:
          type: string
          description: HTML form template to be used for WS-Federation.
          default: ''
        addons:
          $ref: '#/components/schemas/ClientAddons'
        token_endpoint_auth_method:
          $ref: '#/components/schemas/ClientTokenEndpointAuthMethodEnum'
        is_token_endpoint_ip_header_trusted:
          type: boolean
          description: If true, trust that the IP specified in the `auth0-forwarded-for` header is the end-user's IP for brute-force-protection on token endpoint.
          default: false
        client_metadata:
          $ref: '#/components/schemas/ClientMetadata'
        mobile:
          $ref: '#/components/schemas/ClientMobile'
        initiate_login_uri:
          type: string
          description: Initiate login uri, must be https
          format: absolute-https-uri-with-placeholders-or-empty
        native_social_login: {}
        refresh_token:
          $ref: '#/components/schemas/ClientRefreshTokenConfiguration'
        default_organization:
          $ref: '#/components/schemas/ClientDefaultOrganization'
        organization_usage:
          $ref: '#/components/schemas/ClientOrganizationUsageEnum'
        organization_require_behavior:
          $ref: '#/components/schemas/ClientOrganizationRequireBehaviorEnum'
        organization_discovery_methods:
          type: array
          description: Defines the available methods for organization discovery during the `pre_login_prompt`. Users can discover their organization either by `email`, `organization_name` or both.
          minItems: 1
          x-release-lifecycle: EA
          items:
            $ref: '#/components/schemas/ClientOrganizationDiscoveryEnum'
        client_authentication_methods:
          $ref: '#/components/schemas/ClientAuthenticationMethod'
        require_pushed_authorization_requests:
          type: boolean
          description: Makes the use of Pushed Authorization Requests mandatory for this client
          default: false
        require_proof_of_possession:
          type: boolean
          description: Makes the use of Proof-of-Possession mandatory for this client
          default: false
        signed_request_object:
          $ref: '#/components/schemas/ClientSignedRequestObjectWithCredentialId'
        compliance_level:
          $ref: '#/components/schemas/ClientComplianceLevelEnum'
        skip_non_verifiable_callback_uri_confirmation_prompt:
          type: boolean
          description: 'Controls whether a confirmation prompt is shown during login flows when the redirect URI uses non-verifiable callback URIs (for example, a custom URI schema such as `myapp://`, or `localhost`).

            If set to true, a confirmation prompt will not be shown. We recommend that this is set to false for improved protection from malicious apps.

            See https://auth0.com/docs/secure/security-guidance/measures-against-app-impersonation for more information.'
        token_exchange:
          $ref: '#/components/schemas/ClientTokenExchangeConfiguration'
          x-release-lifecycle: GA
        par_request_expiry:
          type:
          - integer
          - 'null'
          description: Specifies how long, in seconds, a Pushed Authorization Request URI remains valid
          minimum: 10
          maximum: 600
        token_quota:
          $ref: '#/components/schemas/TokenQuota'
          x-release-lifecycle: EA
        express_configuration:
          $ref: '#/components/schemas/ExpressConfiguration'
        my_organization_configuration:
          $ref: '#/components/schemas/ClientMyOrganizationResponseConfiguration'
          x-release-lifecycle: EA
        third_party_security_mode:
          $ref: '#/components/schemas/ClientThirdPartySecurityModeEnum'
          x-release-lifecycle: GA
        redirection_policy:
          $ref: '#/components/schemas/ClientRedirectionPolicyEnum'
          x-release-lifecycle: GA
        resource_server_identifier:
          type: string
          description: The identifier of the resource server that this client is linked to.
        async_approval_notification_channels:
          $ref: '#/components/schemas/ClientAsyncApprovalNotificationsChannelsAPIPostConfiguration'
        external_metadata_type:
          $ref: '#/components/schemas/ClientExternalMetadataTypeEnum'
        external_metadata_created_by:
          $ref: '#/components/schemas/ClientExternalMetadataCreatedByEnum'
        external_client_id:
          type: string
          description: An alternate client identifier to be used during authorization flows. Only supports CIMD-based client identifiers.
          format: absolute-https-uri-or-empty
        jwks_uri:
          type: string
          description: URL for the JSON Web Key Set (JWKS) containing the public keys used for private_key_jwt authentication. Only present for CIMD clients using private_key_jwt authentication.
          format: absolute-https-uri-or-empty
    ClientMyOrganizationPostConfiguration:
      type: object
      description: Configuration related to the My Organization Configuration for the client.
      additionalProperties: false
      required:
      - allowed_strategies
      - connection_deletion_behavior
      x-release-lifecycle: EA
      properties:
        connection_profile_id:
          type: string
          description: The connection profile ID that this client should validate against.
          format: connection-profile-id
        user_attribute_profile_id:
          type: string
          description: The user attribute profile ID that this client should validate against.
          format: user-attribute-profile-id
        allowed_strategies:
          type: array
          description: The allowed connection strategies for the My Organization Configuration.
          items:
            $ref: '#/components/schemas/ClientMyOrganizationConfigurationAllowedStrategiesEnum'
        connection_deletion_behavior:
          $ref: '#/components/schemas/ClientMyOrganizationDeletionBehaviorEnum'
    PostClientCredentialResponseContent:
      type: object
      additionalProperties: true
      properties:
        id:
          type: string
          description: ID of the credential. Generated on creation.
          default: cred_1m7sfABoNTTKYwTQ8qt6tX
        name:
          type: string
          description: The name given to the credential by the user.
          default: ''
        kid:
          type: string
          description: The key identifier of the credential, generated on creation.
          default: IZSSTECp...
        alg:
          $ref: '#/components/schemas/ClientCredentialAlgorithmEnum'
        credential_type:
          $ref: '#/components/schemas/ClientCredentialTypeEnum'
        subject_dn:
          type: string
          description: The X509 certificate's Subject Distinguished Name
        thumbprint_sha256:
          type: string
          description: The X509 certificate's SHA256 thumbprint
        created_at:
          type: string
          description: The ISO 8601 formatted date the credential was created.
          format: date-time
        updated_at:
          type: string
          description: The ISO 8601 formatted date the credential was updated.
          format: date-time
        expires_at:
          type: string
          description: The ISO 8601 formatted date representing the expiration of the credential.
          format: date-time
    ClientCreateAuthenticationMethodTLSClientAuth:
      type: object
      description: Defines `tls_client_auth` client authentication method. If the property is defined, the client is configured to use CA-based mTLS authentication method.
      additionalProperties: false
      required:
      - credentials
      properties:
        credentials:
          $ref: '#/components/schemas/ClientCreateAuthenticationMethodTLSClientAuthCredentials'
    ConnectionAuthenticationPurpose:
      type: object
      description: Configure the purpose of a connection to be used for authentication during login.
      additionalProperties: false
      required:
      - active
      x-release-lifecycle: GA
      properties:
        active:
          type: boolean
    CimdValidationResult:
      type: object
      description: Validation result for the Client ID Metadata Document
      additionalProperties: true
      required:
      - valid
      - violations
      - warnings
      properties:
        valid:
          type: boolean
          description: Whether the metadata document passed validation
        violations:
          type: array
          description: Array of validation violation messages (if any)
          items:
            type: string
        warnings:
          type: array
          description: Array of warning messages (if any)
          items:
            type: string
    ClientAuthenticationMethodSelfSignedTLSClientAuthCredentials:
      type: array
      description: A list of unique and previously created credential IDs enabled on the client for mTLS authentication utilizing self-signed certificate.
      minItems: 0
      items:
        $ref: '#/components/schemas/CredentialId'
    PreviewCimdMetadataRequestContent:
      type: object
      additionalProperties: false
      required:
      - external_client_id
      properties:
        external_client_id:
          type: string
          description: URL to the Client ID Metadata Document
          minLength: 1
          maxLength: 120
          format: absolute-https-uri-or-empty
    ClientAddonSpringCM:
      type: object
      description: SpringCM SSO configuration.
      additionalProperties: true
      properties:
        acsurl:
          type: string
          description: SpringCM ACS URL, e.g. `https://na11.springcm.com/atlas/sso/SSOEndpoint.ashx`.
    ClientTokenEndpointAuthMethodOrNullEnum:
      type:
      - string
      - 'null'
      description: Defines the requested authentication method for the token endpoint. Can be `none` (public client without a client secret), `client_secret_post` (client uses HTTP POST parameters), or `client_secret_basic` (client uses HTTP Basic).
      default: none
      enum:
      - none
      - client_secret_post
      - client_secret_basic
      - null
    ClientOIDCBackchannelLogoutInitiators:
      type: object
      description: Configuration for OIDC backchannel logout initiators
      additionalProperties: true
      properties:
        mode:
          $ref: '#/components/schemas/ClientOIDCBackchannelLogoutInitiatorsModeEnum'
        selected_initiators:
          type: array
          items:
            $ref: '#/components/schemas/ClientOIDCBackchannelLogoutInitiatorsEnum'
    ClientAddonSalesforce:
      type: object
      description: Salesforce SSO configuration.
      additionalProperties: true
      properties:
        entity_id:
          type: string
          description: Arbitrary logical URL that identifies the Saleforce resource. e.g. `https://acme-org.com`.
          format: url
    CredentialId:
      type: object
      additionalProperties: false
      required:
      - id
      properties:
        id:
          type: string
          description: Credential ID
          format: credential-id
    ClientSessionTransferAllowedAuthenticationMethodsEnum:
      type: string
      enum:
      - cookie
      - query
    ClientAddonLayer:
      type: object
      description: Layer addon configuration.
      additionalProperties: true
      required:
      - providerId
      - keyId
      - privateKey
      properties:
        providerId:
          type: string
          description: Provider ID of your Layer account
        keyId:
          type: string
          description: Authentication Key identifier used to sign the Layer token.
        privateKey:
          type: string
          description: Private key for signing the Layer token.
        principal:
          type: string
          description: Name of the property used as the unique user id in Layer. If not specified `user_id` is used.
        expiration:
          type: integer
          description: Optional expiration in minutes for the generated token. Defaults to 5 minutes.
          minimum: 0
    ClientRefreshTokenPolicy:
      type: object
      additionalProperties: false
      required:
      - audience
      - scope
      properties:
        audience:
          type: string
          description: The identifier of the resource server to which the Multi Resource Refresh Token Policy applies
          minLength: 1
          maxLength: 600
        scope:
          type: array
          description: The resource server permissions granted under the Multi Resource Refresh Token Policy, defining the context in which an access token can be used
          items:
            type: string
            description: A resource server permission granted under the Multi Resource Refresh Token Policy
            minLength: 1
            maxLength: 280
    ClientCredentialAlgorithmEnum:
      type: string
      description: 'Algorithm which will be used with the credential. Supported algorithms: RS256,RS384,PS256'
      default: RS256
      enum:
      - RS256
      - RS384
      - PS256
    ClientAddonBox:
      type: object
      description: Box SSO indicator (no configuration settings needed for Box SSO).
      additionalProperties: true
    ClientSessionTransferDelegationDeviceBindingEnum:
      type: string
      description: Indicates the device binding enforcement for delegation (impersonation) access. If set to 'ip', device binding is enforced by IP. If set to 'asn', device binding is enforced by ASN. Default value is `ip`.
      default: ip
      enum:
      - ip
      - asn
    ExpressConfiguration:
      type: object
      description: Application specific configuration for use with the OIN Express Configuration feature.
      additionalProperties: false
      required:
      - initiate_login_uri_template
      - user_attribute_profile_id
      - connection_profile_id
      - enable_client
      - enable_organization
      - okta_oin_client_id
      - admin_login_domain
      properties:
        initiate_login_uri_template:
          type: string
          description: 'The URI users should bookmark to log in to this application. Variable substitution is permitted for the following properties: organization_name, organization_id, and connection_name.'
          format: ec-initiate-login-uri-template-url
        user_attribute_profile_id:
          type: string
          description: The ID of the user attribute profile to use for this application.
          format: user-attribute-profile-id
        connection_profile_id:
          type: string
          description: The ID of the connection profile to use for this application.
          format: connection-profile-id
        enable_client:
          type: boolean
          description: When true, all connections made via express configuration will be enabled for this application.
        enable_organization:
          type: boolean
          description: When true, all connections made via express configuration will have the associated organization enabled.
        linked_clients:
          type: array
          description: List of client IDs that are linked to this express configuration (e.g. web or mobile clients).
          items:
            $ref: '#/components/schemas/LinkedClientConfiguration'
        okta_oin_client_id:
          type: string
          description: This is the unique identifier for the Okta OIN Express Configuration Client, which Okta will use for this application.
          format: client-id
        admin_login_domain:
          type: string
          description: This is the domain that admins are expected to log in via for authenticating for express configuration. It can be either the canonical domain or a registered custom domain.
          minLength: 1
        oin_submission_id:
          type: string
          description: The identifier of the published application in the OKTA OIN.
          minLength: 1
          maxLength: 200
    ClientCreateAuthenticationMethodPrivateKeyJWT:
      type: object
      description: Defines `private_key_jwt` client authentication method. If this property is defined, the client is enabled to use the Private Key JWT authentication method.
      additionalProperties: false
      required:
      - credentials
      properties:
        credentials:
          $ref: '#/components/schemas/ClientCreateAuthenticationMethodPrivateKeyJWTCredentials'
    ClientAddonSSOIntegration:
      type: object
      additionalProperties: true
      properties:
        name:
          type: string
          description: SSO integration name
        version:
          type: string
          description: SSO integration version installed
    ClientAddonSlack:
      type: object
      description: Slack team or workspace name usually first segment in your Slack URL. e.g. `https://acme-org.slack.com` would be `acme-org`.
      additionalProperties: true
      required:
      - team
      properties:
        team:
          type: string
          description: Slack team name.
    ClientAddonFirebase:
      type: object
      description: Google Firebase addon configuration.
      additionalProperties: true
      properties:
        secret:
          type: string
          description: Google Firebase Secret. (SDK 2 only).
        private_key_id:
          type: string
          description: Optional ID of the private key to obtain kid header in the issued token (SDK v3+ tokens only).
        private_key:
          type: string
          description: Private Key for signing the token (SDK v3+ tokens only).
        client_email:
          type: string
          description: ID of the Service Account you have created (shown as `client_email` in the generated JSON file, SDK v3+ tokens only).
        lifetime_in_seconds:
          type: integer
          description: Optional expiration in seconds for the generated token. Defaults to 3600 seconds (SDK v3+ tokens only).
    ClientAddonCloudBees:
      type: object
      description: CloudBees SSO indicator (no configuration settings needed for CloudBees SSO).
      additionalProperties: true
    ClientTokenExchangeConfiguration:
      type: object
      description: Configuration for token exchange.
      additionalProperties: false
      x-release-lifecycle: GA
      properties:
        allow_any_profile_of_type:
          type: array
          description: List the enabled token exchange types for this client.
          minItems: 0
          items:
            $ref: '#/components/schemas/ClientTokenExchangeTypeEnum'
    ClientAddonSharePointExternalURL:
      description: External SharePoint application URLs if exposed to the Internet.
      oneOf:
      - type: array
        items:
          type: string
      - type: string
    UpdateClientRequestContent:
      type: object
      additionalProperties: false
      minProperties: 1
      properties:
        name:
          type: string
          description: The name of the client. Must contain at least one character. Does not allow '<' or '>'.
          pattern: ^[^<>]+$
        description:
          type: string
          description: 'Free text description of the purpose of the Client. (Max character length: <code>140</code>)'
          maxLength: 140
        client_secret:
          type: string
          description: The secret used to sign tokens for the client
          minLength: 1
        logo_uri:
          type: string
          description: 'The URL of the client logo (recommended size: 150x150)'
          format: absolute-uri-or-empty
        callbacks:
          type: array
          description: A set of URLs that are valid to call back from Auth0 when authenticating users
          items:
            type: string
            format: callback-url
        oidc_logout:
          $ref: '#/components/schemas/ClientOIDCBackchannelLogoutSettings'
        oidc_backchannel_logout:
          $ref: '#/components/schemas/ClientOIDCBackchannelLogoutSettings'
          x-release-lifecycle: deprecated
          description: Configuration for OIDC backchannel logout (deprecated, in favor of oidc_logout)
        session_transfer:
          $ref: '#/components/schemas/ClientSessionTransferConfiguration'
        allowed_origins:
          type: array
          description: A set of URLs that represents valid origins for CORS
          items:
            type: string
            format: url-with-placeholders
        web_origins:
          type: array
          description: A set of URLs that represents valid web origins for use with web message response mode
          items:
            type: string
            format: url-with-placeholders
        grant_types:
          type: array
          description: A set of grant types that the client is authorized to use. Can include `authorization_code`, `implicit`, `refresh_token`, `client_credentials`, `password`, `http://auth0.com/oauth/grant-type/password-realm`, `http://auth0.com/oauth/grant-type/mfa-oob`, `http://auth0.com/oauth/grant-type/mfa-otp`, `http://auth0.com/oauth/grant-type/mfa-recovery-code`, `urn:openid:params:grant-type:ciba`, `urn:ietf:params:oauth:grant-type:device_code`, and `urn:auth0:params:oauth:grant-type:token-exchange:federated-connection-access-token`.
          items:
            type: string
            minLength: 1
        client_aliases:
          type: array
          description: List of audiences for SAML protocol
          items:
            type: string
            minLength: 1
        allowed_clients:
          type: array
          description: Ids of clients that will be allowed to perform delegation requests. Clients that will be allowed to make delegation request. By default, all your clients will be allowed. This field allows you to specify specific clients
          items:
            type: string
            minLength: 1
        allowed_logout_urls:
          type: array
          description: URLs that are valid to redirect to after logout from Auth0
          items:
            type: string
            format: url-with-placeholders
        jwt_configuration:
          $ref: '#/components/schemas/ClientJwtConfiguration'
          description: An object that holds settings related to how JWTs are created
        encryption_key:
          $ref: '#/components/schemas/ClientEncryptionKey'
          description: The client's encryption key
        sso:
          type: boolean
          description: '<code>true</code> to use Auth0 instead of the IdP to do Single Sign On, <code>false</code> otherwise (default: <code>false</code>)'
        cross_origin_authentication:
          type: boolean
          description: <code>true</code> if this client can be used to make cross-origin authentication requests, <code>false</code> otherwise if cross origin is disabled
        cross_origin_loc:
          type:
          - string
          - 'null'
          description: URL for the location in your site where the cross origin verification takes place for the cross-origin auth flow when performing Auth in your own domain instead of Auth0 hosted login page.
          format: url-or-null
        sso_disabled:
          type: boolean
          description: '<code>true</code> to disable Single Sign On, <code>false</code> otherwise (default: <code>false</code>)'
        custom_login_page_on:
          type: boolean
          description: <code>true</code> if the custom login page is to be used, <code>false</code> otherwise.
        token_endpoint_auth_method:
          $ref: '#/components/schemas/ClientTokenEndpointAuthMethodOrNullEnum'
        is_token_endpoint_ip_header_trusted:
          type: boolean
          description: If true, trust that the IP specified in the `auth0-forwarded-for` header is the end-user's IP for brute-force-protection on token endpoint.
          default: false
        app_type:
          $ref: '#/components/schemas/ClientAppTypeEnum'
        is_first_party:
          type: boolean
          description: Whether this client a first party client or not
          default: true
        oidc_conformant:
          type: boolean
          description: Whether this client will conform to strict OIDC specifications
          default: false
        custom_login_page:
          type: string
          description: The content (HTML, CSS, JS) of the custom login page
        custom_login_page_preview:
          type: string
        token_quota:
          $ref: '#/components/schemas/UpdateTokenQuota'
          x-release-lifecycle: EA
        form_template:
          type: string
          description: Form template for WS-Federation protocol
        addons:
          $ref: '#/components/schemas/ClientAddons'
        client_metadata:
          $ref: '#/components/schemas/ClientMetadata'
        mobile:
          $ref: '#/components/schemas/ClientMobile'
          description: Configuration related to native mobile apps
        initiate_login_uri:
          type: string
          description: Initiate login uri, must be https
          format: absolute-https-uri-with-placeholders-or-empty
        native_social_login:
          $ref: '#/components/schemas/NativeSocialLogin'
        refresh_token:
          $ref: '#/components/schemas/ClientRefreshTokenConfiguration'
        default_organization:
          $ref: '#/components/schemas/ClientDefaultOrganization'
        organization_usage:
          $ref: '#/components/schemas/ClientOrganizationUsagePatchEnum'
        organization_require_behavior:
          $ref: '#/components/schemas/ClientOrganizationRequireBehaviorPatchEnum'
        organization_discovery_methods:
          type:
          - array
          - 'null'
          description: Defines the available methods for organization discovery during the `pre_login_prompt`. Users can discover their organization either by `email`, `organization_name` or both.
          minItems: 1
          x-release-lifecycle: EA
          items:
            $ref: '#/components/schemas/ClientOrganizationDiscoveryEnum'
        client_authentication_methods:
          $ref: '#/components/schemas/ClientAuthenticationMethod'
        require_pushed_authorization_requests:
          type: boolean
          description: Makes the use of Pushed Authorization Requests mandatory for this client
          default: false
        require_proof_of_possession:
          type: boolean
          description: Makes the use of Proof-of-Possession mandatory for this client
          default: false
        signed_request_object:
          $ref: '#/components/schemas/ClientSignedRequestObjectWithCredentialId'
        compliance_level:
          $ref: '#/components/schemas/ClientComplianceLevelEnum'
        skip_non_verifiable_callback_uri_confirmation_prompt:
          type:
          - boolean
          - 'null'
          description: 'Controls whether a confirmation prompt is shown during login flows when the redirect URI uses non-verifiable callback URIs (for example, a custom URI schema such as `myapp://`, or `localhost`).

            If set to true, a confirmation prompt will not be shown. We recommend that this is set to false for improved protection from malicious apps.

            See https://auth0.com/docs/secure/security-guidance/measures-against-app-impersonation for more information.'
        token_exchange:
          $ref: '#/components/schemas/ClientTokenExchangeConfigurationOrNull'
          x-release-lifecycle: GA
        par_request_expiry:
          type:
          - integer
          - 'null'
          description: Specifies how long, in seconds, a Pushed Authorization Request URI remains valid
          minimum: 10
          maximum: 600
        express_configuration:
          $ref: '#/components/schemas/ExpressConfigurationOrNull'
        my_organization_configuration:
          $ref: '#/components/schemas/ClientMyOrganizationPatchConfiguration'
          x-release-lifecycle: EA
        async_approval_notification_channels:
          $ref: '#/components/schemas/ClientAsyncApprovalNotificationsChannelsAPIPatchConfiguration'
        third_party_security_mode:
          $ref: '#/components/schemas/ClientThirdPartySecurityModeEnum'
          x-release-lifecycle: GA
        redirection_policy:
          $ref: '#/components/schemas/ClientRedirectionPolicyEnum'
          x-release-lifecycle: GA
    NativeSocialLoginFacebook:
      type: object
      description: Native Social Login support for the Facebook connection
      additionalProperties: false
      minProperties: 1
      properties:
        enabled:
          type: boolean
          description: Determine whether or not to allow signing in natively using Facebook
          default: false
    ClientOrganizationDiscoveryEnum:
      type: string
      description: Method for discovering organizations during the `pre_login_prompt`. `email` allows users to find their organization by entering their email address and performing domain matching, while `organization_name` requires users to enter the organization name directly. These methods can be combined.
      enum:
      - email
      - organization_name
    ClientAuthenticationMethodTLSClientAuth:
      type: object
      description: Defines `tls_client_auth` client authentication method. If the property is defined, the client is configured to use CA-based mTLS authentication method.
      additionalProperties: false
      required:
      - credentials
      properties:
        credentials:
          $ref: '#/components/schemas/ClientAuthenticationMethodTLSClientAuthCredentials'
    SigningAlgorithmEnum:
      type: string
      description: Algorithm used to sign JWTs. Can be `HS256` (default) or `RS256`. `PS256` available via addon.
      default: HS256
      enum:
      - HS256
      - RS256
      - RS512
      - PS256
    ClientComplianceLevelEnum:
      type:
      - string
      - 'null'
      description: Defines the compliance level for this client, which may restrict it's capabilities
      enum:
      - none
      - fapi1_adv_pkj_par
      - fapi1_adv_mtls_par
      - fapi2_sp_pkj_mtls
      - fapi2_sp_mtls_mtls
      - null
    ClientAddonDropbox:
      type: object
      description: Dropbox SSO indicator (no configuration settings needed for Dropbox SSO).
      additionalProperties: true
    ClientOIDCBackchannelLogoutInitiatorsModeEnum:
      type: string
      description: The `mode` property determines the configuration method for enabling initiators. `custom` enables only the initiators listed in the selected_initiators array, `all` enables all current and future initiators.
      enum:
      - custom
      - all
    UpdateClientResponseContent:
      type: object
      additionalProperties: true
      properties:
        client_id:
          type: string
          description: ID of this client.
          default: AaiyAPdpYdesoKnqjj8HJqRn4T5titww
        tenant:
          type: string
          description: Name of the tenant this client belongs to.
          default: ''
        name:
          type: string
          description: 'Name of this client (min length: 1 character, does not allow `<` or `>`).'
          default: My application
        description:
          type: string
          description: 'Free text description of this client (max length: 140 characters).'
          default: ''
        global:
          type: boolean
          description: Whether this is your global 'All Applications' client representing legacy tenant settings (true) or a regular client (false).
          default: false
        client_secret:
          type: string
          description: Client secret (which you must not make public).
          default: MG_TNT2ver-SylNat-_VeMmd-4m0Waba0jr1troztBniSChEw0glxEmgEi2Kw40H
        app_type:
          $ref: '#/components/schemas/ClientAppTypeEnum'
        logo_uri:
          type: string
          description: URL of the logo to display for this client. Recommended size is 150x150 pixels.
        is_first_party:
          type: boolean
          description: Whether this client a first party client (true) or not (false).
          default: false
        oidc_conformant:
          type: boolean
          description: Whether this client conforms to <a href='https://auth0.com/docs/api-auth/tutorials/adoption'>strict OIDC specifications</a> (true) or uses legacy features (false).
          default: false
        callbacks:
          type: array
          description: Comma-separated list of URLs whitelisted for Auth0 to use as a callback to the client after authentication.
          items:
            type: string
        allowed_origins:
          type: array
          description: Comma-separated list of URLs allowed to make requests from JavaScript to Auth0 API (typically used with CORS). By default, all your callback URLs will be allowed. This field allows you to enter other origins if necessary. You can also use wildcards at the subdomain level (e.g., https://*.contoso.com). Query strings and hash information are not taken into account when validating these URLs.
          items:
            type: string
        web_origins:
          type: array
          description: Comma-separated list of allowed origins for use with <a href='https://auth0.com/docs/cross-origin-authentication'>Cross-Origin Authentication</a>, <a href='https://auth0.com/docs/flows/concepts/device-auth'>Device Flow</a>, and <a href='https://auth0.com/docs/protocols/oauth2#how-response-mode-works'>web message response mode</a>.
          items:
            type: string
        client_aliases:
          type: array
          description: List of audiences/realms for SAML protocol. Used by the wsfed addon.
          items:
            type: string
        allowed_clients:
          type: array
          description: List of allow clients and API ids that are allowed to make delegation requests. Empty means all all your clients are allowed.
          items:
            type: string
        allowed_logout_urls:
          type: array
          description: Comma-separated list of URLs that are valid to redirect to after logout from Auth0. Wildcards are allowed for subdomains.
          items:
            type: string
        session_transfer:
          $ref: '#/components/schemas/ClientSessionTransferConfiguration'
        oidc_logout:
          $ref: '#/components/schemas/ClientOIDCBackchannelLogoutSettings'
        grant_types:
          type: array
          description: List of grant types supported for this application. Can include `authorization_code`, `implicit`, `refresh_token`, `client_credentials`, `password`, `http://auth0.com/oauth/grant-type/password-realm`, `http://auth0.com/oauth/grant-type/mfa-oob`, `http://auth0.com/oauth/grant-type/mfa-otp`, `http://auth0.com/oauth/grant-type/mfa-recovery-code`, `urn:openid:params:grant-type:ciba`, `urn:ietf:params:oauth:grant-type:device_code`, and `urn:auth0:params:oauth:grant-type:token-exchange:federated-connection-access-token`.
          items:
            type: string
        jwt_configuration:
          $ref: '#/components/schemas/ClientJwtConfiguration'
        signing_keys:
          $ref: '#/components/schemas/ClientSigningKeys'
        encryption_key:
          $ref: '#/components/schemas/ClientEncryptionKey'
        sso:
          type: boolean
          description: Applies only to SSO clients and determines whether Auth0 will handle Single Sign On (true) or whether the Identity Provider will (false).
          default: false
        sso_disabled:
          type: boolean
          description: Whether Single Sign On is disabled (true) or enabled (true). Defaults to true.
          default: false
        cross_origin_authentication:
          type: boolean
          description: Whether this client can be used to make cross-origin authentication requests (true) or it is not allowed to make such requests (false).
        cross_origin_loc:
          type: string
          description: URL of the location in your site where the cross origin verification takes place for the cross-origin auth flow when performing Auth in your own domain instead of Auth0 hosted login page.
          format: url
        custom_login_page_on:
          type: boolean
          description: Whether a custom login page is to be used (true) or the default provided login page (false).
          default: true
        custom_login_page:
          type: string
          description: The content (HTML, CSS, JS) of the custom login page.
          default: ''
        custom_login_page_preview:
          type: string
          description: The content (HTML, CSS, JS) of the custom login page. (Used on Previews)
          default: ''
        form_template:
          type: string
          description: HTML form template to be used for WS-Federation.
          default: ''
        addons:
          $ref: '#/components/schemas/ClientAddons'
        token_endpoint_auth_method:
          $ref: '#/components/schemas/ClientTokenEndpointAuthMethodEnum'
        is_token_endpoint_ip_header_trusted:
          type: boolean
          description: If true, trust that the IP specified in the `auth0-forwarded-for` header is the end-user's IP for brute-force-protection on token endpoint.
          default: false
        client_metadata:
          $ref: '#/components/schemas/ClientMetadata'
        mobile:
          $ref: '#/components/schemas/ClientMobile'
        initiate_login_uri:
          type: string
          description: Initiate login uri, must be https
          format: absolute-https-uri-with-placeholders-or-empty
        native_social_login: {}
        refresh_token:
          $ref: '#/components/schemas/ClientRefreshTokenConfiguration'
        default_organization:
          $ref: '#/components/schemas/ClientDefaultOrganization'
        organization_usage:
          $ref: '#/components/schemas/ClientOrganizationUsageEnum'
        organization_require_behavior:
          $ref: '#/components/schemas/ClientOrganizationRequireBehaviorEnum'
        organization_discovery_methods:
          type: array
          description: Defines the available methods for organization discovery during the `pre_login_prompt`. Users can discover their organization either by `email`, `organization_name` or both.
          minItems: 1
          x-release-lifecycle: EA
          items:
            $ref: '#/components/schemas/ClientOrganizationDiscoveryEnum'
        client_authentication_methods:
          $ref: '#/components/schemas/ClientAuthenticationMethod'
        require_pushed_authorization_requests:
          type: boolean
          description: Makes the use of Pushed Authorization Requests mandatory for this client
          default: false
        require_proof_of_possession:
          type: boolean
          description: Makes the use of Proof-of-Possession mandatory for this client
          default: false
        signed_request_object:
          $ref: '#/components/schemas/ClientSignedRequestObjectWithCredentialId'
        compliance_level:
          $ref: '#/components/schemas/ClientComplianceLevelEnum'
        skip_non_verifiable_callback_uri_confirmation_prompt:
          type: boolean
          description: 'Controls whether a confirmation prompt is shown during login flows when the redirect URI uses non-verifiable callback URIs (for example, a custom URI schema such as `myapp://`, or `localhost`).

            If set to true, a confirmation prompt will not be shown. We recommend that this is set to false for improved protection from malicious apps.

            See https://auth0.com/docs/secure/security-guidance/measures-against-app-impersonation for more information.'
        token_exchange:
          $ref: '#/components/schemas/ClientTokenExchangeConfiguration'
          x-release-lifecycle: GA
        par_request_expiry:
          type:
          - integer
          - 'null'
          description: Specifies how long, in seconds, a Pushed Authorization Request URI remains valid
          minimum: 10
          maximum: 600
        token_quota:
          $ref: '#/components/schemas/TokenQuota'
          x-release-lifecycle: EA
        express_configuration:
          $ref: '#/components/schemas/ExpressConfiguration'
        my_organization_configuration:
          $ref: '#/components/schemas/ClientMyOrganizationResponseConfiguration'
          x-release-lifecycle: EA
        third_party_security_mode:
          $ref: '#/components/schemas/ClientThirdPartySecurityModeEnum'
          x-release-lifecycle: GA
        redirection_policy:
          $ref: '#/components/schemas/ClientRedirectionPolicyEnum'
          x-release-lifecycle: GA
        resource_server_identifier:
          type: string
          description: The identifier of the resource server that this client is linked to.
        async_approval_notification_channels:
          $ref: '#/components/schemas/ClientAsyncApprovalNotificationsChannelsAPIPostConfiguration'
        external_metadata_type:
          $ref: '#/components/schemas/ClientExternalMetadataTypeEnum'
        external_metadata_created_by:
          $ref: '#/components/schemas/ClientExternalMetadataCreatedByEnum'
        external_client_id:
          type: string
          description: An alternate client identifier to be used during authorization flows. Only supports CIMD-based client identifiers.
          format: absolute-https-uri-or-empty
        jwks_uri:
          type: string
          description: URL for the JSON Web Key Set (JWKS) containing the public keys used for private_key_jwt authentication. Only present for CIMD clients using private_key_jwt authentication.
          format: absolute-https-uri-or-empty
    ClientAddonZendesk:
      type: object
      description: Zendesk SSO configuration.
      additionalProperties: true
      properties:
        accountName:
          type: string
          description: Zendesk account name usually first segment in your Zendesk URL. e.g. `https://acme-org.zendesk.com` would be `acme-org`.
    ClientRedirectionPolicyEnum:
      type: string
      description: Controls whether Auth0 redirects users to the application's callback URL on authentication errors or in email verification flows. `open_redirect_protection` shows an error page instead of redirecting, and hides the callback domain from email templates. `allow_always` enables standard redirect behavior. Defaults to `open_redirect_protection` for third-party clients. Only applies when `is_first_party` is `false` and `third_party_security_mode` is `strict`. To learn more, read <a href="https://auth0.com/docs/get-started/applications/third-party-applications/security-controls#redirect-protection">Redirect protection</a>.
      enum:
      - allow_always
      - open_redirect_protection
      x-release-lifecycle: GA
    ConnectionConnectedAccountsPurpose:
      type: object
      description: Configure the purpose of a connection to be used for connected accounts and Token Vault.
      additionalProperties: false
      required:
      - active
      x-release-lifecycle: GA
      properties:
        active:
          type: boolean
        cross_app_access:
          type: boolean
    ClientMyOrganizationConfigurationAllowedStrategiesEnum:
      type: string
      description: The allowed connection strategy values for the My Organization Configuration.
      enum:
      - pingfederate
      - adfs
      - waad
      - google-apps
      - okta
      - oidc
      - samlp
    ClientAuthenticationMethod:
      type:
      - object
      - 'null'
      description: Defines client authentication methods.
      additionalProperties: false
      minProperties: 1
      maxProperties: 1
      properties:
        private_key_jwt:
          $ref: '#/components/schemas/ClientAuthenticationMethodPrivateKeyJWT'
        tls_client_auth:
          $ref: '#/components/schemas/ClientAuthenticationMethodTLSClientAuth'
        self_signed_tls_client_auth:
          $ref: '#/components/schemas/ClientAuthenticationMethodSelfSignedTLSClientAuth'
    ClientSigningKeys:
      type:
      - array
      - 'null'
      description: Signing certificates associated with this client.
      items:
        $ref: '#/components/schemas/ClientSigningKey'
    ClientAddonWAMS:
      type: object
      description: Windows Azure Mobile Services addon configuration.
      additionalProperties: true
      properties:
        masterkey:
          type: string
          description: Your master key for Windows Azure Mobile Services.
    NativeSocialLogin:
      type: object
      description: Configure native social settings
      additionalProperties: false
      minProperties: 1
      properties:
        apple:
          $ref: '#/components/schemas/NativeSocialLoginApple'
        facebook:
          $ref: '#/components/schemas/NativeSocialLoginFacebook'
        google:
          $ref: '#/components/schemas/NativeSocialLoginGoogle'
    ClientMyOrganizationDeletionBehaviorEnum:
      type: string
      description: The deletion behavior for this client.
      default: allow
      enum:
      - allow
      - allow_if_empty
    ClientAuthenticationMethodSelfSignedTLSClientAuth:
      type: object
      description: Defines `self_signed_tls_client_auth` client authentication method. If the property is defined, the client is configured to use mTLS authentication method utilizing self-signed certificate.
      additionalProperties: false
      required:
      - credentials
      properties:
        credentials:
          $ref: '#/components/schemas/ClientAuthenticationMethodSelfSignedTLSClientAuthCredentials'
    ClientCreateAuthenticationMethodTLSClientAuthCredentials:
      type: array
      description: Fully defined credentials that will be enabled on the client for CA-based mTLS authentication.
      minItems: 0
      items:
        $ref: '#/components/schemas/CertificateSubjectDNCredential'
    ClientEncryptionKey:
      type:
      - object
      - 'null'
      description: Encryption used for WsFed responses with this client.
      additionalProperties: true
      properties:
        pub:
          type: string
          description: Encryption Public RSA Key.
        cert:
          type: string
          description: Encryption certificate for public key in X.509 (.CER) format.
        subject:
          type: string
          description: Encryption certificate name for this certificate in the format `/CN={domain}`.
    CimdMappedClientAuthenticationMethodsPrivateKeyJwt:
      type: object
      description: Private Key JWT authentication configuration
      additionalProperties: true
      required:
      - credentials
      properties:
        credentials:
          type: array
          description: Credentials derived from the JWKS document
          items:
            $ref: '#/components/schemas/CimdMappedPrivateKeyJwtCredential'
    ClientAddonOffice365:
      type: object
      description: Microsoft Office 365 SSO configuration.
      additionalProperties: true
      properties:
        domain:
          type: string
          description: Your Office 365 domain name. e.g. `acme-org.com`.
        connection:
          type: string
          description: Optional Auth0 database connection for testing an already-configured Office 365 tenant.
    GetClientResponseContent:
      type: object
      additionalProperties: true
      properties:
        client_id:
          type: string
          description: ID of this client.
          default: AaiyAPdpYdesoKnqjj8HJqRn4T5titww
        tenant:
          type: string
          description: Name of the tenant this client belongs to.
          default: ''
        name:
          type: string
          description: 'Name of this client (min length: 1 character, does not allow `<` or `>`).'
          default: My application
        description:
          type: string
          description: 'Free text description of this client (max length: 140 characters).'
          default: ''
        global:
          type: boolean
          description: Whether this is your global 'All Applications' client representing legacy tenant settings (true) or a regular client (false).
          default: false
        client_secret:
          type: string
          description: Client secret (which you must not make public).
          default: MG_TNT2ver-SylNat-_VeMmd-4m0Waba0jr1troztBniSChEw0glxEmgEi2Kw40H
        app_type:
          $ref: '#/components/schemas/ClientAppTypeEnum'
        logo_uri:
          type: string
          description: URL of the logo to display for this client. Recommended size is 150x150 pixels.
        is_first_party:
          type: boolean
          description: Whether this client a first party client (true) or not (false).
          default: false
        oidc_conformant:
          type: boolean
          description: Whether this client conforms to <a href='https://auth0.com/docs/api-auth/tutorials/adoption'>strict OIDC specifications</a> (true) or uses legacy features (false).
          default: false
        callbacks:
          type: array
          description: Comma-separated list of URLs whitelisted for Auth0 to use as a callback to the client after authentication.
          items:
            type: string
        allowed_origins:
          type: array
          description: Comma-separated list of URLs allowed to make requests from JavaScript to Auth0 API (typically used with CORS). By default, all your callback URLs will be allowed. This field allows you to enter other origins if necessary. You can also use wildcards at the subdomain level (e.g., https://*.contoso.com). Query strings and hash information are not taken into account when validating these URLs.
          items:
            type: string
        web_origins:
          type: array
          description: Comma-separated list of allowed origins for use with <a href='https://auth0.com/docs/cross-origin-authentication'>Cross-Origin Authentication</a>, <a href='https://auth0.com/docs/flows/concepts/device-auth'>Device Flow</a>, and <a href='https://auth0.com/docs/protocols/oauth2#how-response-mode-works'>web message response mode</a>.
          items:
            type: string
        client_aliases:
          type: array
          description: List of audiences/realms for SAML protocol. Used by the wsfed addon.
          items:
            type: string
        allowed_clients:
          type: array
          description: List of allow clients and API ids that are allowed to make delegation requests. Empty means all all your clients are allowed.
          items:
            type: string
        allowed_logout_urls:
          type: array
          description: Comma-separated list of URLs that are valid to redirect to after logout from Auth0. Wildcards are allowed for subdomains.
          items:
            type: string
        session_transfer:
          $ref: '#/components/schemas/ClientSessionTransferConfiguration'
        oidc_logout:
          $ref: '#/components/schemas/ClientOIDCBackchannelLogoutSettings'
        grant_types:
          type: array
          description: List of grant types supported for this application. Can include `authorization_code`, `implicit`, `refresh_token`, `client_credentials`, `password`, `http://auth0.com/oauth/grant-type/password-realm`, `http://auth0.com/oauth/grant-type/mfa-oob`, `http://auth0.com/oauth/grant-type/mfa-otp`, `http://auth0.com/oauth/grant-type/mfa-recovery-code`, `urn:openid:params:grant-type:ciba`, `urn:ietf:params:oauth:grant-type:device_code`, and `urn:auth0:params:oauth:grant-type:token-exchange:federated-connection-access-token`.
          items:
            type: string
        jwt_configuration:
          $ref: '#/components/schemas/ClientJwtConfiguration'
        signing_keys:
          $ref: '#/components/schemas/ClientSigningKeys'
        encryption_key:
          $ref: '#/components/schemas/ClientEncryptionKey'
        sso:
          type: boolean
          description: Applies only to SSO clients and determines whether Auth0 will handle Single Sign On (true) or whether the Identity Provider will (false).
          default: false
        sso_disabled:
          type: boolean
          description: Whether Single Sign On is disabled (true) or enabled (true). Defaults to true.
          default: false
        cross_origin_authentication:
          type: boolean
          description: Whether this client can be used to make cross-origin authentication requests (true) or it is not allowed to make such requests (false).
        cross_origin_loc:
          type: string
          description: URL of the location in your site where the cross origin verification takes place for the cross-origin auth flow when performing Auth in your own domain instead of Auth0 hosted login page.
          format: url
        custom_login_page_on:
          type: boolean
          description: Whether a custom login page is to be used (true) or the default provided login page (false).
          default: true
        custom_login_page:
          type: string
          description: The content (HTML, CSS, JS) of the custom login page.
          default: ''
        custom_login_page_preview:
          type: string
          description: The content (HTML, CSS, JS) of the custom login page. (Used on Previews)
          default: ''
        form_template:
          type: string
          description: HTML form template to be used for WS-Federation.
          default: ''
        addons:
          $ref: '#/components/schemas/ClientAddons'
        token_endpoint_auth_method:
          $ref: '#/components/schemas/ClientTokenEndpointAuthMethodEnum'
        is_token_endpoint_ip_header_trusted:
          type: boolean
          description: If true, trust that the IP specified in the `auth0-forwarded-for` header is the end-user's IP for brute-force-protection on token endpoint.
          default: false
        client_metadata:
          $ref: '#/components/schemas/ClientMetadata'
        mobile:
          $ref: '#/components/schemas/ClientMobile'
        initiate_login_uri:
          type: string
          description: Initiate login uri, must be https
          format: absolute-https-uri-with-placeholders-or-empty
        native_social_login: {}
        refresh_token:
          $ref: '#/components/schemas/ClientRefreshTokenConfiguration'
        default_organization:
          $ref: '#/components/schemas/ClientDefaultOrganization'
        organization_usage:
          $ref: '#/components/schemas/ClientOrganizationUsageEnum'
        organization_require_behavior:
          $ref: '#/components/schemas/ClientOrganizationRequireBehaviorEnum'
        organization_discovery_methods:
          type: array
          description: Defines the available methods for organization discovery during the `pre_login_prompt`. Users can discover their organization either by `email`, `organization_name` or both.
          minItems: 1
          x-release-lifecycle: EA
          items:
            $ref: '#/components/schemas/ClientOrganizationDiscoveryEnum'
        client_authentication_methods:
          $ref: '#/components/schemas/ClientAuthenticationMethod'
        require_pushed_authorization_requests:
          type: boolean
          description: Makes the use of Pushed Authorization Requests mandatory for this client
          default: false
        require_proof_of_possession:
          type: boolean
          description: Makes the use of Proof-of-Possession mandatory for this client
          default: false
        signed_request_object:
          $ref: '#/components/schemas/ClientSignedRequestObjectWithCredentialId'
        compliance_level:
          $ref: '#/components/schemas/ClientComplianceLevelEnum'
        skip_non_verifiable_callback_uri_confirmation_prompt:
          type: boolean
          description: 'Controls whether a confirmation prompt is shown during login flows when the redirect URI uses non-verifiable callback URIs (for example, a custom URI schema such as `myapp://`, or `localhost`).

            If set to true, a confirmation prompt will not be shown. We recommend that this is set to false for improved protection from malicious apps.

            See https://auth0.com/docs/secure/security-guidance/measures-against-app-impersonation for more information.'
        token_exchange:
          $ref: '#/components/schemas/ClientTokenExchangeConfiguration'
          x-release-lifecycle: GA
        par_request_expiry:
          type:
          - integer
          - 'null'
          description: Specifies how long, in seconds, a Pushed Authorization Request URI remains valid
          minimum: 10
          maximum: 600
        token_quota:
          $ref: '#/components/schemas/TokenQuota'
          x-release-lifecycle: EA
        express_configuration:
          $ref: '#/components/schemas/ExpressConfiguration'
        my_organization_configuration:
          $ref: '#/components/schemas/ClientMyOrganizationResponseConfiguration'
          x-release-lifecycle: EA
        third_party_security_mode:
          $ref: '#/components/schemas/ClientThirdPartySecurityModeEnum'
          x-release-lifecycle: GA
        redirection_policy:
          $ref: '#/components/schemas/ClientRedirectionPolicyEnum'
          x-release-lifecycle: GA
        resource_server_identifier:
          type: string
          description: The identifier of the resource server that this client is linked to.
        async_approval_notification_channels:
          $ref: '#/components/schemas/ClientAsyncApprovalNotificationsChannelsAPIPostConfiguration'
        external_metadata_type:
          $ref: '#/components/schemas/ClientExternalMetadataTypeEnum'
        external_metadata_created_by:
          $ref: '#/components/schemas/ClientExternalMetadataCreatedByEnum'
        external_client_id:
          type: string
          description: An alternate client identifier to be used during authorization flows. Only supports CIMD-based client identifiers.
          format: absolute-https-uri-or-empty
        jwks_uri:
          type: string
          description: URL for the JSON Web Key Set (JWKS) containing the public keys used for private_key_jwt authentication. Only present for CIMD clients using private_key_jwt authentication.
          format: absolute-https-uri-or-empty
    UpdateTokenQuota:
      type:
      - object
      - 'null'
      additionalProperties: false
      required:
      - client_credentials
      x-release-lifecycle: EA
      properties:
        client_credentials:
          $ref: '#/components/schemas/TokenQuotaClientCredentials'
    ListClientsOffsetPaginatedResponseContent:
      type: object
      additionalProperties: false
      properties:
        start:
          type: number
        limit:
          type: number
        total:
          type: number
        clients:
          type: array
          items:
            $ref: '#/components/schemas/Client'
    ClientAddons:
      type: object
      description: Addons enabled for this client and their associated configurations.
      additionalProperties: false
      properties:
        aws:
          $ref: '#/components/schemas/ClientAddonAWS'
        azure_blob:
          $ref: '#/components/schemas/ClientAddonAzureBlob'
        azure_sb:
          $ref: '#/components/schemas/ClientAddonAzureSB'
        rms:
          $ref: '#/components/schemas/ClientAddonRMS'
        mscrm:
          $ref: '#/components/schemas/ClientAddonMSCRM'
        slack:
          $ref: '#/components/schemas/ClientAddonSlack'
        sentry:
          $ref: '#/components/schemas/ClientAddonSentry'
        box:
          $ref: '#/components/schemas/ClientAddonBox'
        cloudbees:
          $ref: '#/components/schemas/ClientAddonCloudBees'
        concur:
          $ref: '#/components/schemas/ClientAddonConcur'
        dropbox:
          $ref: '#/components/schemas/ClientAddonDropbox'
        echosign:
          $ref: '#/components/schemas/ClientAddonEchoSign'
        egnyte:
          $ref: '#/components/schemas/ClientAddonEgnyte'
        firebase:
          $ref: '#/components/schemas/ClientAddonFirebase'
        newrelic:
          $ref: '#/components/schemas/ClientAddonNewRelic'
        office365:
          $ref: '#/components/schemas/ClientAddonOffice365'
        salesforce:
          $ref: '#/components/schemas/ClientAddonSalesforce'
        salesforce_api:
          $ref: '#/components/schemas/ClientAddonSalesforceAPI'
        salesforce_sandbox_api:
          $ref: '#/components/schemas/ClientAddonSalesforceSandboxAPI'
        samlp:
          $ref: '#/components/schemas/ClientAddonSAML'
        layer:
          $ref: '#/components/schemas/ClientAddonLayer'
        sap_api:
          $ref: '#/components/schemas/ClientAddonSAPAPI'
        sharepoint:
          $ref: '#/components/schemas/ClientAddonSharePoint'
        springcm:
          $ref: '#/components/schemas/ClientAddonSpringCM'
        wams:
          $ref: '#/components/schemas/ClientAddonWAMS'
        wsfed:
          $ref: '#/components/schemas/ClientAddonWSFed'
        zendesk:
          $ref: '#/components/schemas/ClientAddonZendesk'
        zoom:
          $ref: '#/components/schemas/ClientAddonZoom'
        sso_integration:
          $ref: '#/components/schemas/ClientAddonSSOIntegration'
        oag:
          $ref: '#/components/schemas/ClientAddonOAG'
    ConnectionsMetadata:
      type: object
      description: Metadata associated with the connection in the form of an object with string values (max 255 chars).  Maximum of 10 metadata properties allowed.
      additionalProperties:
        type:
        - string
        - 'null'
        maxLength: 255
      maxProperties: 10
    ClientAddonSharePoint:
      type: object
      description: SharePoint SSO configuration.
      additionalProperties: true
      properties:
        url:
          type: string
          description: Internal SharePoint application URL.
        external_url:
          $ref: '#/components/schemas/ClientAddonSharePointExternalURL'
    ClientTokenExchangeConfigurationOrNull:
      type:
      - object
      - 'null'
      description: Configuration for token exchange.
      additionalProperties: false
      x-release-lifecycle: GA
      properties:
        allow_any_profile_of_type:
          type: array
          description: List the enabled token exchange types for this client.
          minItems: 0
          items:
            $ref: '#/components/schemas/ClientTokenExchangeTypeEnum'
    ClientAuthenticationMethodPrivateKeyJWT:
      type: object
      description: Defines `private_key_jwt` client authentication method. If this property is defined, the client is enabled to use the Private Key JWT authentication method.
      additionalProperties: false
      required:
      - credentials
      properties:
        credentials:
          $ref: '#/components/schemas/ClientAuthenticationMethodPrivateKeyJWTCredentials'
    ListClientConnectionsResponseContent:
      type: object
      additionalProperties: true
      required:
      - connections
      properties:
        connections:
          type: array
          items:
            $ref: '#/components/schemas/ConnectionForList'
        next:
          type: string
          description: Encoded next token
    ClientAddonSalesforceAPI:
      type: object
      description: Salesforce API addon configuration.
      additionalProperties: true
      properties:
        clientid:
          type: string
          description: Consumer Key assigned by Salesforce to the Connected App.
        principal:
          type: string
          description: Name of the property in the user object that maps to a Salesforce username. e.g. `email`.
        communityName:
          type: string
          description: Community name.
        community_url_section:
          type: string
          description: Community url section.
    ClientOrganizationUsagePatchEnum:
      type:
      - string
      - 'null'
      description: Defines how to proceed during an authentication transaction with regards an organization. Can be `deny` (default), `allow` or `require`.
      default: deny
      enum:
      - deny
      - allow
      - require
      - null
    ClientMetadata:
      type: object
      description: "Metadata associated with the client, in the form of an object with string values (max 255 chars).  Maximum of 10 metadata properties allowed.  Field names (max 255 chars) are alphanumeric and may only include the following special characters:  :,-+=_*?\"/\\()<>@\t[Tab] [Space]"
      additionalProperties: true
      maxProperties: 10
    ClientAddonEchoSign:
      type: object
      description: Adobe EchoSign SSO configuration.
      additionalProperties: true
      properties:
        domain:
          type: string
          description: Your custom domain found in your EchoSign URL. e.g. `https://acme-org.echosign.com` would be `acme-org`.
    ClientAppTypeEnum:
      type: string
      description: The type of application this client represents
      enum:
      - native
      - spa
      - regular_web
      - non_interactive
      - resource_server
      - express_configuration
      - rms
      - box
      - cloudbees
      - concur
      - dropbox
      - mscrm
      - echosign
      - egnyte
      - newrelic
      - office365
      - salesforce
      - sentry
      - sharepoint
      - slack
      - springcm
      - zendesk
      - zoom
      - sso_integration
      - oag
    ClientAddonEgnyte:
      type: object
      description: Egnyte SSO configuration.
      additionalProperties: true
      properties:
        domain:
          type: string
          description: Your custom domain found in your Egnyte URL. e.g. `https://acme-org.egnyte.com` would be `acme-org`.
    PublicKeyCredentialTypeEnum:
      type: string
      description: 'Credential type. Supported types: public_key.'
      default: public_key
      enum:
      - public_key
    ClientAddonRMS:
      type: object
      description: Active Directory Rights Management Service SSO configuration.
      additionalProperties: true
      required:
      - url
      properties:
        url:
          type: string
          description: URL of your Rights Management Server. It can be internal or external, but users will have to be able to reach it.
          format: url
    CreateClientRequestContent:
      type: object
      additionalProperties: false
      required:
      - name
      properties:
        name:
          type: string
          description: 'Name of this client (min length: 1 character, does not allow `<` or `>`).'
          pattern: ^[^<>]+$
        description:
          type: string
          description: 'Free text description of this client (max length: 140 characters).'
          maxLength: 140
        logo_uri:
          type: string
          description: URL of the logo to display for this client. Recommended size is 150x150 pixels.
          format: absolute-uri-or-empty
        callbacks:
          type: array
          description: Comma-separated list of URLs whitelisted for Auth0 to use as a callback to the client after authentication.
          items:
            type: string
            format: callback-url
        oidc_logout:
          $ref: '#/components/schemas/ClientOIDCBackchannelLogoutSettings'
        oidc_backchannel_logout:
          $ref: '#/components/schemas/ClientOIDCBackchannelLogoutSettings'
          x-release-lifecycle: deprecated
          description: Configuration for OIDC backchannel logout (deprecated, in favor of oidc_logout)
        session_transfer:
          $ref: '#/components/schemas/ClientSessionTransferConfiguration'
        allowed_origins:
          type: array
          description: Comma-separated list of URLs allowed to make requests from JavaScript to Auth0 API (typically used with CORS). By default, all your callback URLs will be allowed. This field allows you to enter other origins if necessary. You can also use wildcards at the subdomain level (e.g., https://*.contoso.com). Query strings and hash information are not taken into account when validating these URLs.
          items:
            type: string
            format: url-with-placeholders
        web_origins:
          type: array
          description: Comma-separated list of allowed origins for use with <a href='https://auth0.com/docs/cross-origin-authentication'>Cross-Origin Authentication</a>, <a href='https://auth0.com/docs/flows/concepts/device-auth'>Device Flow</a>, and <a href='https://auth0.com/docs/protocols/oauth2#how-response-mode-works'>web message response mode</a>.
          items:
            type: string
            format: url-with-placeholders
        client_aliases:
          type: array
          description: List of audiences/realms for SAML protocol. Used by the wsfed addon.
          items:
            type: string
            minLength: 1
        allowed_clients:
          type: array
          description: List of allow clients and API ids that are allowed to make delegation requests. Empty means all all your clients are allowed.
          items:
            type: string
            minLength: 1
        allowed_logout_urls:
          type: array
          description: Comma-separated list of URLs that are valid to redirect to after logout from Auth0. Wildcards are allowed for subdomains.
          items:
            type: string
            format: url-with-placeholders
        grant_types:
          type: array
          description: List of grant types supported for this application. Can include `authorization_code`, `implicit`, `refresh_token`, `client_credentials`, `password`, `http://auth0.com/oauth/grant-type/password-realm`, `http://auth0.com/oauth/grant-type/mfa-oob`, `http://auth0.com/oauth/grant-type/mfa-otp`, `http://auth0.com/oauth/grant-type/mfa-recovery-code`, `urn:openid:params:grant-type:ciba`, `urn:ietf:params:oauth:grant-type:device_code`, and `urn:auth0:params:oauth:grant-type:token-exchange:federated-connection-access-token`.
          items:
            type: string
            minLength: 1
        token_endpoint_auth_method:
          $ref: '#/components/schemas/ClientTokenEndpointAuthMethodEnum'
        is_token_endpoint_ip_header_trusted:
          type: boolean
          description: If true, trust that the IP specified in the `auth0-forwarded-for` header is the end-user's IP for brute-force-protection on token endpoint.
          default: false
        app_type:
          $ref: '#/components/schemas/ClientAppTypeEnum'
        is_first_party:
          type: boolean
          description: Whether this client a first party client or not
          default: true
        oidc_conformant:
          type: boolean
          description: Whether this client conforms to <a href='https://auth0.com/docs/api-auth/tutorials/adoption'>strict OIDC specifications</a> (true) or uses legacy features (false).
          default: false
        jwt_configuration:
          $ref: '#/components/schemas/ClientJwtConfiguration'
        encryption_key:
          $ref: '#/components/schemas/ClientEncryptionKey'
        sso:
          type: boolean
          description: Applies only to SSO clients and determines whether Auth0 will handle Single Sign On (true) or whether the Identity Provider will (false).
        cross_origin_authentication:
          type: boolean
          description: Whether this client can be used to make cross-origin authentication requests (true) or it is not allowed to make such requests (false).
          default: false
        cross_origin_loc:
          type: string
          description: URL of the location in your site where the cross origin verification takes place for the cross-origin auth flow when performing Auth in your own domain instead of Auth0 hosted login page.
          format: url
        sso_disabled:
          type: boolean
          description: '<code>true</code> to disable Single Sign On, <code>false</code> otherwise (default: <code>false</code>)'
        custom_login_page_on:
          type: boolean
          description: <code>true</code> if the custom login page is to be used, <code>false</code> otherwise. Defaults to <code>true</code>
        custom_login_page:
          type: string
          description: The content (HTML, CSS, JS) of the custom login page.
          minLength: 1
        custom_login_page_preview:
          type: string
          description: The content (HTML, CSS, JS) of the custom login page. (Used on Previews)
          minLength: 1
        form_template:
          type: string
          description: HTML form template to be used for WS-Federation.
          minLength: 1
        addons:
          $ref: '#/components/schemas/ClientAddons'
        client_metadata:
          $ref: '#/components/schemas/ClientMetadata'
        mobile:
          $ref: '#/components/schemas/ClientMobile'
        initiate_login_uri:
          type: string
          description: Initiate login uri, must be https
          format: absolute-https-uri-with-placeholders-or-empty
        native_social_login:
          $ref: '#/components/schemas/NativeSocialLogin'
        refresh_token:
          $ref: '#/components/schemas/ClientRefreshTokenConfiguration'
        default_organization:
          $ref: '#/components/schemas/ClientDefaultOrganization'
        organization_usage:
          $ref: '#/components/schemas/ClientOrganizationUsageEnum'
        organization_require_behavior:
          $ref: '#/components/schemas/ClientOrganizationRequireBehaviorEnum'
        organization_discovery_methods:
          type: array
          description: Defines the available methods for organization discovery during the `pre_login_prompt`. Users can discover their organization either by `email`, `organization_name` or both.
          minItems: 1
          x-release-lifecycle: EA
          items:
            $ref: '#/components/schemas/ClientOrganizationDiscoveryEnum'
        client_authentication_methods:
          $ref: '#/components/schemas/ClientCreateAuthenticationMethod'
        require_pushed_authorization_requests:
          type: boolean
          description: Makes the use of Pushed Authorization Requests mandatory for this client
          default: false
        require_proof_of_possession:
          type: boolean
          description: Makes the use of Proof-of-Possession mandatory for this client
          default: false
        signed_request_object:
          $ref: '#/components/schemas/ClientSignedRequestObjectWithPublicKey'
        compliance_level:
          $ref: '#/components/schemas/ClientComplianceLevelEnum'
        skip_non_verifiable_callback_uri_confirmation_prompt:
          type: boolean
          description: 'Controls whether a confirmation prompt is shown during login flows when the redirect URI uses non-verifiable callback URIs (for example, a custom URI schema such as `myapp://`, or `localhost`).

            If set to true, a confirmation prompt will not be shown. We recommend that this is set to false for improved protection from malicious apps.

            See https://auth0.com/docs/secure/security-guidance/measures-against-app-impersonation for more information.'
        token_exchange:
          $ref: '#/components/schemas/ClientTokenExchangeConfiguration'
          x-release-lifecycle: GA
        par_request_expiry:
          type:
          - integer
          - 'null'
          description: Specifies how long, in seconds, a Pushed Authorization Request URI remains valid
          minimum: 10
          maximum: 600
        token_quota:
          $ref: '#/components/schemas/CreateTokenQuota'
          x-release-lifecycle: EA
        resource_server_identifier:
          type: string
          description: The identifier of the resource server that this client is linked to.
          minLength: 1
          maxLength: 600
        third_party_security_mode:
          $ref: '#/components/schemas/ClientThirdPartySecurityModeEnum'
          x-release-lifecycle: GA
        redirection_policy:
          $ref: '#/components/schemas/ClientRedirectionPolicyEnum'
          x-release-lifecycle: GA
        express_configuration:
          $ref: '#/components/schemas/ExpressConfiguration'
        my_organization_configuration:
          $ref: '#/components/schemas/ClientMyOrganizationPostConfiguration'
          x-release-lifecycle: EA
        async_approval_notification_channels:
          $ref: '#/components/schemas/ClientAsyncApprovalNotificationsChannelsAPIPostConfiguration'
    PreviewCimdMetadataResponseContent:
      type: object
      additionalProperties: true
      properties:
        client_id:
          type: string
          description: The client_id of an existing client registered with this external_client_id, if one exists.
        errors:
          type: array
          description: Array of retrieval errors (populated when the metadata document could not be fetched). When present, validation is omitted.
          items:
            type: string
        validation:
          $ref: '#/components/schemas/CimdValidationResult'
        mapped_fields:
          $ref: '#/components/schemas/CimdMappedClientFields'
    X509CertificateCredential:
      type: object
      additionalProperties: false
      required:
      - credential_type
      - pem
      properties:
        credential_type:
          $ref: '#/components/schemas/X509CertificateCredentialTypeEnum'
        name:
          type: string
          description: Friendly name for a credential.
          default: ''
          maxLength: 128
        pem:
          type: string
          description: PEM-formatted X509 certificate. Must be JSON escaped.
          default: "-----BEGIN CERTIFICATE-----\r\nMIIBIjANBg...\r\n-----END CERTIFICATE-----\r\n"
          minLength: 1
          maxLength: 4096
    ClientAddonAzureSB:
      type: object
      description: Azure Storage Bus addon configuration.
      additionalProperties: true
      properties:
        namespace:
          type: string
          description: Your Azure Service Bus namespace. Usually the first segment of your Service Bus URL (e.g. `https://acme-org.servicebus.windows.net` would be `acme-org`).
        sasKeyName:
          type: string
          description: Your shared access policy name defined in your Service Bus entity.
        sasKey:
          type: string
          description: Primary Key associated with your shared access policy.
        entityPath:
          type: string
          description: Entity you want to request a token for. e.g. `my-queue`.'
        expiration:
          type: integer
          description: Optional expiration in minutes for the generated token. Defaults to 5 minutes.
    ClientCreateAuthenticationMethodPrivateKeyJWTCredentials:
      type: array
      description: Fully defined credentials that will be enabled on the client for Private Key JWT authentication.
      minItems: 0
      items:
        $ref: '#/components/schemas/PublicKeyCredential'
    ClientSignedRequestObjectWithCredentialId:
      type: object
      description: JWT-secured Authorization Requests (JAR) settings.
      additionalProperties: false
      properties:
        required:
          type: boolean
          description: Indicates whether the JAR requests are mandatory
          default: false
        credentials:
          type: array
          minItems: 0
          items:
            $ref: '#/components/schemas/CredentialId'
    CimdMappedClientAuthenticationMethods:
      type: object
      description: Client authentication methods derived from the JWKS document
      additionalProperties: true
      properties:
        private_key_jwt:
          $ref: '#/components/schemas/CimdMappedClientAuthenticationMethodsPrivateKeyJwt'
    ClientThirdPartySecurityModeEnum:
      type: string
      description: 'Security mode for third-party clients. `strict` enforces <a href="https://auth0.com/docs/get-started/applications/third-party-applications/security-controls">enhanced security controls</a>: OAuth 2.1 alignment, explicit API authorization, and a curated set of supported features. `permissive` preserves <a href="https://auth0.com/docs/get-started/applications/third-party-applications/permissive-mode">pre-existing behavior</a> and is only available to tenants with prior third-party client usage. Set on creation and cannot be modified.'
      enum:
      - strict
      - permissive
      x-release-lifecycle: GA
    ClientJwtConfiguration:
      type: object
      description: Configuration related to JWTs for the client.
      additionalProperties: true
      properties:
        lifetime_in_seconds:
          type: integer
          description: Number of seconds the JWT will be valid for (affects `exp` claim).
          default: 36000
        secret_encoded:
          type: boolean
          description: Whether the client secret is base64 encoded (true) or unencoded (false).
          default: true
        scopes:
          $ref: '#/components/schemas/ClientJwtConfigurationScopes'
        alg:
          $ref: '#/components/schemas/SigningAlgorithmEnum'
    ClientMobileAndroid:
      type: object
      description: Android native app configuration.
      additionalProperties: true
      properties:
        app_package_name:
          type: string
          description: App package name found in AndroidManifest.xml.
          default: ''
        sha256_cert_fingerprints:
          type: array
          description: SHA256 fingerprints of the app's signing certificate. Multiple fingerprints can be used to support different versions of your app, such as debug and production builds.
          minItems: 1
          items:
            type: string
            minLength: 1
    ClientAsyncApprovalNotificationsChannelsAPIPostConfiguration:
      type: array
      description: Array of notification channels for contacting the user when their approval is required. Valid values are `guardian-push`, `email`.
      minItems: 1
      items:
        $ref: '#/components/schemas/AsyncApprovalNotificationsChannelsEnum'
    ClientMobileiOS:
      type: object
      description: iOS native app configuration.
      additionalProperties: true
      properties:
        team_id:
          type: string
          description: Identifier assigned to the Apple account that signs and uploads the app to the store.
          default: ''
        app_bundle_identifier:
          type: string
          description: Assigned by developer to the app as its unique identifier inside the store. Usually this is a reverse domain plus the app name, e.g. `com.you.MyApp`.
          default: ''
    RefreshTokenRotationTypeEnum:
      type: string
      description: 'Refresh token rotation types, one of: rotating, non-rotating'
      default: non-rotating
      enum:
      - rotating
      - non-rotating
    PostClientCredentialRequestContent:
      type: object
      additionalProperties: false
      required:
      - credential_type
      properties:
        credential_type:
          $ref: '#/components/schemas/ClientCredentialTypeEnum'
        name:
          type: string
          description: Friendly name for a credential.
          default: ''
          maxLength: 128
        subject_dn:
          type: string
          description: Subject Distinguished Name. Mutually exclusive with `pem` property. Applies to `cert_subject_dn` credential type.
          minLength: 1
          maxLength: 256
        pem:
          type: string
          description: PEM-formatted public key (SPKI and PKCS1) or X509 certificate. Must be JSON escaped.
          default: "-----BEGIN PUBLIC KEY-----\r\nMIIBIjANBg...\r\n-----END PUBLIC KEY-----\r\n"
        alg:
          $ref: '#/components/schemas/PublicKeyCredentialAlgorithmEnum'
        parse_expiry_from_cert:
          type: boolean
          description: Parse expiry from x509 certificate. If true, attempts to parse the expiry date from the provided PEM. Applies to `public_key` credential type.
          default: false
        expires_at:
          type: string
          description: The ISO 8601 formatted date representing the expiration of the credential. If not specified (not recommended), the credential never expires. Applies to `public_key` credential type.
          default: '2023-02-07T12:40:17.807Z'
          format: date-time
        kid:
          type: string
          description: Optional kid (Key ID), used to uniquely identify the credential. If not specified, a kid value will be auto-generated. The kid header parameter in JWTs sent by your client should match this value. Valid format is [0-9a-zA-Z-_]{10,64}
          minLength: 10
          maxLength: 64
          pattern: ^([0-9a-zA-Z-_]{10,64})$
    ClientMobile:
      type: object
      description: Additional configuration for native mobile apps.
      additionalProperties: true
      properties:
        android:
          $ref: '#/components/schemas/ClientMobileAndroid'
        ios:
          $ref: '#/components/schemas/ClientMobileiOS'
    ClientAddonAzureBlob:
      type: object
      description: Azure Blob Storage addon configuration.
      additionalProperties: true
      properties:
        accountName:
          type: string
          description: Your Azure storage account name. Usually first segment in your Azure storage URL. e.g. `https://acme-org.blob.core.windows.net` would be the account name `acme-org`.
          pattern: ^([a-z0-9]){3,24}$
        storageAccessKey:
          type: string
          description: Access key associated with this storage account.
          pattern: ^([A-Za-z0-9+/]){86}==$
        containerName:
          type: string
          description: Container to request a token for. e.g. `my-container`.
          pattern: ^([a-z0-9]){1}([a-z0-9-]){2,62}$
        blobName:
          type: string
          description: Entity to request a token for. e.g. `my-blob`. If blank the computed SAS will apply to the entire storage container.
          pattern: ^(.){1,1024}$
        expiration:
          type: integer
          description: Expiration in minutes for the generated token (default of 5 minutes).
          minimum: 0
        signedIdentifier:
          type: string
          description: Shared access policy identifier defined in your storage account resource.
        blob_read:
          type: boolean
          description: Indicates if the issued token has permission to read the content, properties, metadata and block list. Use the blob as the source of a copy operation.
        blob_write:
          type: boolean
          description: Indicates if the issued token has permission to create or write content, properties, metadata, or block list. Snapshot or lease the blob. Resize the blob (page blob only). Use the blob as the destination of a copy operation within the same account.
        blob_delete:
          type: boolean
          description: Indicates if the issued token has permission to delete the blob.
        container_read:
          type: boolean
          description: Indicates if the issued token has permission to read the content, properties, metadata or block list of any blob in the container. Use any blob in the container as the source of a copy operation
        container_write:
          type: boolean
          description: Indicates that for any blob in the container if the issued token has permission to create or write content, properties, metadata, or block list. Snapshot or lease the blob. Resize the blob (page blob only). Use the blob as the destination of a copy operation within the same account.
        container_delete:
          type: boolean
          description: Indicates if issued token has permission to delete any blob in the container.
        container_list:
          type: boolean
          description: Indicates if the issued token has permission to list blobs in the container.
    ClientSigningKey:
      type: object
      additionalProperties: true
      properties:
        pkcs7:
          type: string
          description: Signing certificate public key and chain in PKCS#7 (.P7B) format.
          default: ''
        cert:
          type: string
          description: Signing certificate public key in X.509 (.CER) format.
          default: ''
        subject:
          type: string
          description: Subject name for this certificate in the format `/CN={domain}`.
          default: ''
    ClientJwtConfigurationScopes:
      type: object
      description: Configuration related to id token claims for the client.
      additionalProperties: true
    TokenQuotaClientCredentials:
      type: object
      description: The token quota configuration
      additionalProperties: false
      minProperties: 1
      properties:
        enforce:
          type: boolean
          description: If enabled, the quota will be enforced and requests in excess of the quota will fail. If disabled, the quota will not be enforced, but notifications for requests exceeding the quota will be available in logs.
        per_day:
          type: integer
          description: Maximum number of issued tokens per day
          minimum: 1
          maximum: 2147483647
        per_hour:
          type: integer
          description: Maximum number of issued tokens per hour
          minimum: 1
          maximum: 2147483647
    ClientAddonConcur:
      type: object
      description: Concur SSO indicator (no configuration settings needed for Concur SSO).
      additionalProperties: true
    ClientAddonMSCRM:
      type: object
      description: Microsoft Dynamics CRM SSO configuration.
      additionalProperties: true
      required:
      - url
      properties:
        url:
          type: string
          description: Microsoft Dynamics CRM application URL.
          format: url
    ConnectionStrategyEnum:
      type: string
      enum:
      - ad
      - adfs
      - amazon
      - apple
      - dropbox
      - bitbucket
      - auth0-oidc
      - auth0
      - baidu
      - bitly
      - box
      - custom
      - daccount
      - dwolla
      - email
      - evernote-sandbox
      - evernote
      - exact
      - facebook
      - fitbit
      - github
      - google-apps
      - google-oauth2
      - instagram
      - ip
      - line
      - linkedin
      - oauth1
      - oauth2
      - office365
      - oidc
      - okta
      - paypal
      - paypal-sandbox
      - pingfederate
      - planningcenter
      - salesforce-community
      - salesforce-sandbox
      - salesforce
      - samlp
      - sharepoint
      - shopify
      - shop
      - sms
      - soundcloud
      - thirtysevensignals
      - twitter
      - untappd
      - vkontakte
      - waad
      - weibo
      - windowslive
      - wordpress
      - yahoo
      - yandex
      - auth0-adldap
    CimdMappedClientFields:
      type: object
      description: Auth0 client fields mapped from the Client ID Metadata Document
      additionalProperties: true
      properties:
        external_client_id:
          type: string
          description: The URL of the Client ID Metadata Document
        name:
          type: string
          description: Client name
        app_type:
          type: string
          description: Application type (e.g., web, native)
        callbacks:
          type: array
          description: Callback URLs
          items:
            type: string
        logo_uri:
          type: string
          description: Logo URI
        description:
          type: string
          description: Human-readable brief description of this client presentable to the end-user
        grant_types:
          type: array
          description: List of grant types
          items:
            type: string
        token_endpoint_auth_method:
          type: string
          description: Token endpoint authentication method
        jwks_uri:
          type: string
          description: URL for the JSON Web Key Set containing the public keys for private_key_jwt authentication
        client_authentication_methods:
          $ref: '#/components/schemas/CimdMappedClientAuthenticationMethods'
    CertificateSubjectDNCredentialTypeEnum:
      type: string
      enum:
      - cert_subject_dn
    CreateClientAuthenticationMethodSelfSignedTLSClientAuthCredentials:
      type: array
      description: Fully defined credentials that will be enabled on the client for mTLS authentication utilizing self-signed certificate.
      minItems: 0
      items:
        $ref: '#/components/schemas/X509CertificateCredential'
    ClientOIDCBackchannelLogoutSettings:
      type: object
      description: Configuration for OIDC backchannel logout
      additionalProperties: true
      properties:
        backchannel_logout_urls:
          type: array
          description: Comma-separated list of URLs that are valid to call back from Auth0 for OIDC backchannel logout. Currently only one URL is allowed.
          items:
            type: string
            format: absolute-https-uri-with-placeholders-or-empty
        backchannel_logout_initiators:
          $ref: '#/components/schemas/ClientOIDCBackchannelLogoutInitiators'
        backchannel_logout_session_metadata:
          $ref: '#/components/schemas/ClientOIDCBackchannelLogoutSessionMetadata'
    ClientAddonSAML:
      type: object
      description: SAML2 addon indicator (no configuration settings needed for SAML2 addon).
      additionalProperties: true
      properties:
        mappings:
          $ref: '#/components/schemas/ClientAddonSAMLMapping'
        audience:
          type: string
        recipient:
          type: string
        createUpnClaim:
          type: boolean
        mapUnknownClaimsAsIs:
          type: boolean
        passthroughClaimsWithNoMapping:
          type: boolean
        mapIdentities:
          type: boolean
        signatureAlgorithm:
          type: string
        digestAlgorithm:
          type: string
        issuer:
          type: string
        destination:
          type: string
        lifetimeInSeconds:
          type: integer
        signResponse:
          type: boolean
        nameIdentifierFormat:
          type: string
        nameIdentifierProbes:
          type: array
          items:
            type: string
            minLength: 1
        authnContextClassRef:
          type: string
    ClientCredentialTypeEnum:
      type: string
      description: The type of credential.
      enum:
      - public_key
      - cert_subject_dn
      - x509_cert
    ClientCredential:
      type: object
      additionalProperties: true
      properties:
        id:
          type: string
          description: ID of the credential. Generated on creation.
          default: cred_1m7sfABoNTTKYwTQ8qt6tX
        name:
          type: string
          description: The name given to the credential by the user.
          default: ''
        kid:
          type: string
          description: The key identifier of the credential, generated on creation.
          default: IZSSTECp...
        alg:
          $ref: '#/components/schemas/ClientCredentialAlgorithmEnum'
        credential_type:
          $ref: '#/components/schemas/ClientCredentialTypeEnum'
        subject_dn:
          type: string
          description: The X509 certificate's Subject Distinguished Name
        thumbprint_sha256:
          type: string
          description: The X509 certificate's SHA256 thumbprint
        created_at:
          type: string
          description: The ISO 8601 formatted date the credential was created.
          format: date-time
        updated_at:
          type: string
          description: The ISO 8601 formatted date the credential was updated.
          format: date-time
        expires_at:
          type: string
          description: The ISO 8601 formatted date representing the expiration of the credential.
          format: date-time
    PublicKeyCredentialAlgorithmEnum:
      type: string
      description: Algorithm which will be used with the credential. Can be one of RS256, RS384, PS256. If not specified, RS256 will be used. Applies to `public_key` credential type.
      default: RS256
      enum:
      - RS256
      - RS384
      - PS256
    RegisterCimdClientResponseContent:
      type: object
      description: Response after successfully registering or updating a CIMD client
      additionalProperties: true
      required:
      - client_id
      - mapped_fields
      - validation
      properties:
        client_id:
          type: string
          description: The Auth0 client_id of the created or updated client
        mapped_fields:
          $ref: '#/components/schemas/CimdMappedClientFields'
        validation:
          $ref: '#/components/schemas/CimdValidationResult'
    ClientOrganizationRequireBehaviorPatchEnum:
      type:
      - string
      - 'null'
      description: 'Defines how to proceed during an authentication transaction when `client.organization_usage: ''require''`. Can be `no_prompt` (default), `pre_login_prompt` or `post_login_prompt`. `post_login_prompt` requires `oidc_conformant: true`.'
      default: no_prompt
      enum:
      - no_prompt
      - pre_login_prompt
      - post_login_prompt
      - null