openapi: 3.0.3 info: title: Authlete Authorization Endpoint Client Management API description: "Welcome to the **Authlete API documentation**. Authlete is an **API-first service** where every aspect of the \nplatform is configurable via API. This documentation will help you authenticate and integrate with Authlete to \nbuild powerful OAuth 2.0 and OpenID Connect servers.\n\nAt a high level, the Authlete API is grouped into two categories:\n\n- **Management APIs**: Enable you to manage services and clients.\n- **Runtime APIs**: Allow you to build your own Authorization Servers or Verifiable Credential (VC) issuers.\n\n## \U0001F310 API Servers\n\nAuthlete is a global service with clusters available in multiple regions across the world:\n\n- \U0001F1FA\U0001F1F8 **US**: `https://us.authlete.com`\n- \U0001F1EF\U0001F1F5 **Japan**: `https://jp.authlete.com`\n- \U0001F1EA\U0001F1FA **Europe**: `https://eu.authlete.com`\n- \U0001F1E7\U0001F1F7 **Brazil**: `https://br.authlete.com`\n\nOur customers can host their data in the region that best meets their requirements.\n\n## \U0001F511 Authentication\n\nAll API endpoints are secured using **Bearer token authentication**. You must include an access token in every request:\n\n```\nAuthorization: Bearer YOUR_ACCESS_TOKEN\n```\n\n### Getting Your Access Token\n\nAuthlete supports two types of access tokens:\n\n**Service Access Token** - Scoped to a single service (authorization server instance)\n\n1. Log in to [Authlete Console](https://console.authlete.com)\n2. Navigate to your service → **Settings** → **Access Tokens**\n3. Click **Create Token** and select permissions (e.g., `service.read`, `client.write`)\n4. Copy the generated token\n\n**Organization Token** - Scoped to your entire organization\n\n1. Log in to [Authlete Console](https://console.authlete.com)\n2. Navigate to **Organization Settings** → **Access Tokens**\n3. Click **Create Token** and select org-level permissions\n4. Copy the generated token\n\n> ⚠️ **Important Note**: Tokens inherit the permissions of the account that creates them. Service tokens can only \n> access their specific service, while organization tokens can access all services within your org.\n\n### Token Security Best Practices\n\n- **Never commit tokens to version control** - Store in environment variables or secure secret managers\n- **Rotate regularly** - Generate new tokens periodically and revoke old ones\n- **Scope appropriately** - Request only the permissions your application needs\n- **Revoke unused tokens** - Delete tokens you're no longer using from the console\n\n### Quick Test\n\nVerify your token works with a simple API call:\n\n```bash\ncurl -X GET https://us.authlete.com/api/service/get/list \\\n -H \"Authorization: Bearer YOUR_ACCESS_TOKEN\"\n```\n\n## \U0001F393 Tutorials\n\nIf you're new to Authlete or want to see sample implementations, these resources will help you get started:\n\n- [Getting Started with Authlete](https://www.authlete.com/developers/getting_started/)\n- [From Sign-Up to the First API Request](https://www.authlete.com/developers/tutorial/signup/)\n\n## \U0001F6E0 Contact Us\n\nIf you have any questions or need assistance, our team is here to help:\n\n- [Contact Page](https://www.authlete.com/contact/)\n" version: 3.0.16 license: name: Apache 2.0 url: https://www.apache.org/licenses/LICENSE-2.0.html servers: - description: 🇺🇸 US Cluster url: https://us.authlete.com - description: 🇯🇵 Japan Cluster url: https://jp.authlete.com - description: 🇪🇺 Europe Cluster url: https://eu.authlete.com - description: 🇧🇷 Brazil Cluster url: https://br.authlete.com security: - bearer: [] tags: - name: Client Management description: API endpoints for managing OAuth clients, including creation, update, and deletion of clients. x-tag-expanded: false paths: /api/{serviceId}/client/get/{clientId}: get: summary: Get Client description: 'Get a client. ' parameters: - in: path name: serviceId description: A service ID. required: true schema: type: string - in: path name: clientId schema: type: string required: true description: A client ID. responses: '200': description: '' content: application/json: schema: $ref: '#/components/schemas/client' example: applicationType: WEB attributes: - key: attribute1-key value: attribute1-value - key: attribute2-key value: attribute2-value authTimeRequired: false bcUserCodeRequired: false clientId: 26478243745571 clientIdAlias: my-client clientIdAliasEnabled: true clientName: My client clientSecret: gXz97ISgLs4HuXwOZWch8GEmgL4YMvUJwu3er_kDVVGcA0UOhA9avLPbEmoeZdagi9yC_-tEiT2BdRyH9dbrQQ clientType: CONFIDENTIAL createdAt: 1639468356000 defaultMaxAge: 0 derivedSectorIdentifier: my-client.example.com developer: john dynamicallyRegistered: false frontChannelRequestObjectEncryptionRequired: false grantTypes: - AUTHORIZATION_CODE - REFRESH_TOKEN idTokenSignAlg: RS256 modifiedAt: 1639468356000 number: 6164 parRequired: false redirectUris: - https://my-client.example.com/cb1 - https://my-client.example.com/cb2 requestObjectEncryptionAlgMatchRequired: false requestObjectEncryptionEncMatchRequired: false requestObjectRequired: false responseTypes: - CODE - TOKEN serviceNumber: 5041 subjectType: PUBLIC tlsClientCertificateBoundAccessTokens: false tokenAuthMethod: CLIENT_SECRET_BASIC '400': $ref: '#/components/responses/400' '401': $ref: '#/components/responses/401' '403': $ref: '#/components/responses/403' '500': $ref: '#/components/responses/500' operationId: client_get_api x-code-samples: - lang: shell label: curl source: 'curl -v https://us.authlete.com/api/21653835348762/client/get/26478243745571 \ -H ''Authorization: Bearer V5a40R6dWvw2gMkCOBFdZcM95q4HC0Z-T0YKD9-nR6F'' ' - lang: java label: java source: 'AuthleteConfiguration conf = ...; AuthleteApi api = AuthleteApiFactory.create(conf); long clientId = ...; api.getClient(clientId); ' - lang: python source: 'conf = ... api = AuthleteApiImpl(conf) clientId = ... api.getClient(clientId) ' tags: - Client Management /api/{serviceId}/client/get/list: get: summary: List Clients description: 'Get a list of clients on a service. If the access token can view a full service (including an admin), all clients within the service are returned. Otherwise, only clients that the access token can view within the service are returned. - ViewClient: [] ' parameters: - in: path name: serviceId description: A service ID. required: true schema: type: string - in: query name: developer schema: type: string required: false description: 'The developer of client applications. The default value is null. If this parameter is not set to `null`, client application of the specified developer are returned. Otherwise, all client applications that belong to the service are returned. ' - in: query name: start schema: type: integer format: int32 required: false description: Start index (inclusive) of the result set. The default value is 0. Must not be a negative number. - in: query name: end schema: type: integer format: int32 required: false description: End index (exclusive) of the result set. The default value is 5. Must not be a negative number. responses: '200': description: '' content: application/json: schema: $ref: '#/components/schemas/client_get_list_response' examples: full: summary: Example showing full client view. value: clients: - applicationType: WEB attributes: - key: attribute1-key value: attribute1-value - key: attribute2-key value: attribute2-value authTimeRequired: false bcUserCodeRequired: false clientId: 26478243745571 clientIdAlias: my-client clientIdAliasEnabled: true clientName: My client clientSecret: gXz97ISgLs4HuXwOZWch8GEmgL4YMvUJwu3er_kDVVGcA0UOhA9avLPbEmoeZdagi9yC_-tEiT2BdRyH9dbrQQ clientType: CONFIDENTIAL createdAt: 1639468356000 defaultMaxAge: 0 derivedSectorIdentifier: my-client.example.com dynamicallyRegistered: false frontChannelRequestObjectEncryptionRequired: false grantTypes: - AUTHORIZATION_CODE - REFRESH_TOKEN idTokenSignAlg: RS256 modifiedAt: 1639468356000 number: 6164 parRequired: false redirectUris: - https://my-client.example.com/cb1 - https://my-client.example.com/cb2 requestObjectEncryptionAlgMatchRequired: false requestObjectEncryptionEncMatchRequired: false requestObjectRequired: false responseTypes: - CODE - TOKEN serviceNumber: 5041 subjectType: PUBLIC tlsClientCertificateBoundAccessTokens: false tokenAuthMethod: CLIENT_SECRET_BASIC end: 3 start: 0 totalCount: 1 limited: summary: Example showing limited client view. value: clients: - clientId: 26478243745571 clientIdAlias: my-client clientIdAliasEnabled: true clientName: My client clientType: CONFIDENTIAL number: 6164 end: 3 start: 0 totalCount: 1 '400': $ref: '#/components/responses/400' '401': $ref: '#/components/responses/401' '403': $ref: '#/components/responses/403' '500': $ref: '#/components/responses/500' operationId: client_get_list_api x-code-samples: - lang: shell label: curl source: 'curl -v https://us.authlete.com/api/21653835348762/client/get/list?developer=john\&start=0\&end=5 \ -H ''Authorization: Bearer V5a40R6dWvw2gMkCOBFdZcM95q4HC0Z-T0YKD9-nR6F'' ' - lang: java label: java source: 'AuthleteConfiguration conf = ...; AuthleteApi api = AuthleteApiFactory.create(conf); String developer = "john"; int start = 0; int end = 5; api.getClientList(developer, start, end); ' - lang: python source: 'conf = ... api = AuthleteApiImpl(conf) developer = ''john'' start = 0 end = 5 api.getClientList(developer, start, end) ' tags: - Client Management /api/{serviceId}/client/create: post: summary: Create Client description: 'Create a new client. ' parameters: - in: path name: serviceId description: A service ID. required: true schema: type: string requestBody: required: false content: application/json: schema: $ref: '#/components/schemas/client' example: developer: john clientName: My Client clientIdAlias: my-client clientIdAliasEnabled: true clientType: CONFIDENTIAL applicationType: WEB grantTypes: - AUTHORIZATION_CODE - REFRESH_TOKEN responseTypes: - CODE - TOKEN redirectUris: - https://my-client.example.com/cb1 - https://my-client.example.com/cb2 tokenAuthMethod: CLIENT_SECRET_BASIC attributes: - key: attribute1-key value: attribute1-value - key: attribute2-key value: attribute2-value responses: '200': description: Client created successfully (legacy compatibility) content: application/json: schema: $ref: '#/components/schemas/client' example: applicationType: WEB clientId: 26478243745571 '201': description: Client created successfully content: application/json: schema: $ref: '#/components/schemas/client' example: applicationType: WEB attributes: - key: attribute1-key value: attribute1-value - key: attribute2-key value: attribute2-value authTimeRequired: false bcUserCodeRequired: false clientId: 26478243745571 clientIdAlias: my-client clientIdAliasEnabled: true clientName: My client clientSecret: gXz97ISgLs4HuXwOZWch8GEmgL4YMvUJwu3er_kDVVGcA0UOhA9avLPbEmoeZdagi9yC_-tEiT2BdRyH9dbrQQ clientType: CONFIDENTIAL createdAt: 1639468356000 defaultMaxAge: 0 derivedSectorIdentifier: my-client.example.com developer: john dynamicallyRegistered: false frontChannelRequestObjectEncryptionRequired: false grantTypes: - AUTHORIZATION_CODE - REFRESH_TOKEN idTokenSignAlg: RS256 modifiedAt: 1639468356000 number: 6164 parRequired: false redirectUris: - https://my-client.example.com/cb1 - https://my-client.example.com/cb2 requestObjectEncryptionAlgMatchRequired: false requestObjectEncryptionEncMatchRequired: false requestObjectRequired: false responseTypes: - CODE - TOKEN serviceNumber: 5041 subjectType: PUBLIC tlsClientCertificateBoundAccessTokens: false tokenAuthMethod: CLIENT_SECRET_BASIC '400': $ref: '#/components/responses/400' '401': $ref: '#/components/responses/401' '403': $ref: '#/components/responses/403' '500': $ref: '#/components/responses/500' operationId: client_create_api x-code-samples: - lang: shell label: curl source: 'curl -v -X POST https://us.authlete.com/api/21653835348762/client/create \ -H ''Content-Type:application/json'' \ -H ''Authorization: Bearer V5a40R6dWvw2gMkCOBFdZcM95q4HC0Z-T0YKD9-nR6F'' \ -d ''{ "developer": "john", "clientName": "My Client", ... }'' ' - lang: java label: java source: 'AuthleteConfiguration conf = ...; AuthleteApi api = AuthleteApiFactory.create(conf); Client client = new Client(); client.setDeveloper("john"); client.setClientName("My Client"); ... api.createClient(client); ' - lang: python source: 'conf = ... api = AuthleteApiImpl(conf) client = Client() client.developer = ''john'' client.clientName = ''My Client'' ... api.createClient(client) ' tags: - Client Management /api/{serviceId}/client/update/{clientId}: post: summary: Update Client description: 'Update a client. ' parameters: - in: path name: serviceId description: A service ID. required: true schema: type: string - in: path name: clientId schema: type: string required: true description: A client ID. requestBody: required: false content: application/json: schema: $ref: '#/components/schemas/client' example: applicationType: WEB attributes: - key: attribute1-key value: attribute1-value - key: attribute2-key value: attribute2-value authTimeRequired: false bcUserCodeRequired: false clientIdAlias: my-client clientIdAliasEnabled: true clientName: My updated client clientType: CONFIDENTIAL defaultMaxAge: 0 derivedSectorIdentifier: my-client.example.com developer: john dynamicallyRegistered: false frontChannelRequestObjectEncryptionRequired: false grantTypes: - AUTHORIZATION_CODE - REFRESH_TOKEN idTokenSignAlg: RS256 parRequired: false redirectUris: - https://my-client.example.com/cb1 - https://my-client.example.com/cb2 requestObjectEncryptionAlgMatchRequired: false requestObjectEncryptionEncMatchRequired: false requestObjectRequired: false responseTypes: - CODE - TOKEN subjectType: PUBLIC tlsClientCertificateBoundAccessTokens: false tokenAuthMethod: CLIENT_SECRET_BASIC application/x-www-form-urlencoded: schema: $ref: '#/components/schemas/client' responses: '200': description: '' content: application/json: schema: $ref: '#/components/schemas/client' example: applicationType: WEB attributes: - key: attribute1-key value: attribute1-value - key: attribute2-key value: attribute2-value authTimeRequired: false bcUserCodeRequired: false clientId: 26478243745571 clientIdAlias: my-client clientIdAliasEnabled: true clientName: My updated client clientSecret: gXz97ISgLs4HuXwOZWch8GEmgL4YMvUJwu3er_kDVVGcA0UOhA9avLPbEmoeZdagi9yC_-tEiT2BdRyH9dbrQQ clientType: CONFIDENTIAL createdAt: 1639468356000 defaultMaxAge: 0 derivedSectorIdentifier: my-client.example.com developer: john dynamicallyRegistered: false frontChannelRequestObjectEncryptionRequired: false grantTypes: - AUTHORIZATION_CODE - REFRESH_TOKEN idTokenSignAlg: RS256 modifiedAt: 1639557082764 number: 6164 parRequired: false redirectUris: - https://my-client.example.com/cb1 - https://my-client.example.com/cb2 requestObjectEncryptionAlgMatchRequired: false requestObjectEncryptionEncMatchRequired: false requestObjectRequired: false responseTypes: - CODE - TOKEN serviceNumber: 5041 subjectType: PUBLIC tlsClientCertificateBoundAccessTokens: false tokenAuthMethod: CLIENT_SECRET_BASIC '400': $ref: '#/components/responses/400' '401': $ref: '#/components/responses/401' '403': $ref: '#/components/responses/403' '404': description: The client was not found. '500': $ref: '#/components/responses/500' operationId: client_update_api x-code-samples: - lang: shell label: curl source: 'curl -v -X POST https://us.authlete.com/api/21653835348762/client/update/26478243745571 \ -H ''Content-Type:application/json'' \ -H ''Authorization: Bearer V5a40R6dWvw2gMkCOBFdZcM95q4HC0Z-T0YKD9-nR6F'' \ -d ''{ "clientName": "My updated client", ... }'' ' - lang: java label: java source: 'AuthleteConfiguration conf = ...; AuthleteApi api = AuthleteApiFactory.create(conf); // Get an existing client. long clientId = ...; Client client = api.getClient(clientId); // Update "client name". client.setClientName("My updated client"); api.updateClient(client); ' - lang: python source: 'conf = ... api = AuthleteApiImpl(conf) # Get an existing client. clientId = ... client = api.getClient(clientId) # Update "client name". client.clientName = ''My updated client'' api.updatedClient(client) ' tags: - Client Management /api/{serviceId}/client/delete/{clientId}: delete: summary: Delete Client ⚡ description: 'Delete a client. ' parameters: - in: path name: serviceId description: A service ID. required: true schema: type: string - in: path name: clientId schema: type: string required: true description: The client ID. responses: '204': description: The client was successfully deleted. '400': $ref: '#/components/responses/400' '401': $ref: '#/components/responses/401' '403': $ref: '#/components/responses/403' '404': description: The client was not found. '500': $ref: '#/components/responses/500' operationId: client_delete_api x-code-samples: - lang: shell label: curl source: 'curl -v -X DELETE https://us.authlete.com/api/21653835348762/client/delete/26478243745571 \ -H ''Authorization: Bearer V5a40R6dWvw2gMkCOBFdZcM95q4HC0Z-T0YKD9-nR6F'' ' - lang: java label: java source: 'AuthleteConfiguration conf = ...; AuthleteApi api = AuthleteApiFactory.create(conf); long clientId = ...; api.deleteClient(clientId); ' - lang: python source: 'conf = ... api = AuthleteApiImpl(conf) clientId = ... api.deleteClient(clientId) ' tags: - Client Management /api/{serviceId}/client/lock_flag/update/{clientIdentifier}: post: summary: Update Client Lock description: 'Lock and unlock a client ' parameters: - in: path name: serviceId description: A service ID. required: true schema: type: string - in: path name: clientIdentifier schema: type: string required: true description: A client ID. requestBody: required: false content: application/json: schema: $ref: '#/components/schemas/client_flag_update_request' example: clientLocked: true application/x-www-form-urlencoded: schema: $ref: '#/components/schemas/client_flag_update_request' responses: '200': description: '' content: application/json: schema: $ref: '#/components/schemas/client_flag_update_response' '400': $ref: '#/components/responses/400' '401': $ref: '#/components/responses/401' '403': $ref: '#/components/responses/403' '500': $ref: '#/components/responses/500' operationId: client_flag_update_api tags: - Client Management /api/{serviceId}/client/secret/refresh/{clientIdentifier}: get: summary: Rotate Client Secret description: 'Refresh the client secret of a client. A new value of the client secret will be generated by the Authlete server. If you want to specify a new value, use `/api/client/secret/update` API. ' parameters: - in: path name: serviceId description: A service ID. required: true schema: type: string - in: path name: clientIdentifier schema: type: string required: true description: 'The client ID or the client ID alias of a client. ' responses: '200': description: '' content: application/json: schema: $ref: '#/components/schemas/client_secret_refresh_response' example: resultCode: A148001 resultMessage: '[A148001] Successfully refreshed the client secret of the client (ID = 26478243745571).' newClientSecret: 6Rg_WDO23F0HSZe8GzE5_ZxRHD2pCA02M7T87s0MNOmnf8hg9eYScgeH6P_tb42yiaRuptJmMY12jwWuoy2KeA oldClientSecret: gXz97ISgLs4HuXwOZWch8GEmgL4YMvUJwu3er_kDVVGcA0UOhA9avLPbEmoeZdagi9yC_-tEiT2BdRyH9dbrQQ '400': $ref: '#/components/responses/400' '401': $ref: '#/components/responses/401' '403': $ref: '#/components/responses/403' '500': $ref: '#/components/responses/500' operationId: client_secret_refresh_api x-code-samples: - lang: shell label: curl source: 'curl -v https://us.authlete.com/api/21653835348762/client/secret/refresh/26478243745571 \ -H ''Authorization: Bearer V5a40R6dWvw2gMkCOBFdZcM95q4HC0Z-T0YKD9-nR6F'' ' - lang: java label: java source: 'AuthleteConfiguration conf = ...; AuthleteApi api = AuthleteApiFactory.create(conf); String clientIdentifier = ...; api.refreshClientSecret(clientIdentifier); ' - lang: python source: 'conf = ... api = AuthleteApiImpl(conf) clientIdentifier = ... api.refreshClientSecret(clientIdentifier) ' tags: - Client Management /api/{serviceId}/client/secret/update/{clientIdentifier}: post: summary: Update Client Secret description: 'Update the client secret of a client. If you want to have the Authlete server generate a new value of the client secret, use `/api/client/secret/refresh` API. ' parameters: - in: path name: serviceId description: A service ID. required: true schema: type: string - in: path name: clientIdentifier schema: type: string required: true description: 'The client ID or the client ID alias of a client. ' requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/client_secret_update_request' example: clientSecret: my_updated_client_secret application/x-www-form-urlencoded: schema: $ref: '#/components/schemas/client_secret_update_request' responses: '200': description: '' content: application/json: schema: $ref: '#/components/schemas/client_secret_update_response' example: resultCode: A149001 resultMessage: '[A149001] Successfully updated the client secret of the client (ID = 26478243745571).' newClientSecret: my_updated_client_secret oldClientSecret: 6Rg_WDO23F0HSZe8GzE5_ZxRHD2pCA02M7T87s0MNOmnf8hg9eYScgeH6P_tb42yiaRuptJmMY12jwWuoy2KeA '400': $ref: '#/components/responses/400' '401': $ref: '#/components/responses/401' '403': $ref: '#/components/responses/403' '500': $ref: '#/components/responses/500' operationId: client_secret_update_api x-code-samples: - lang: shell label: curl source: 'curl -v https://us.authlete.com/api/21653835348762/client/secret/update/26478243745571 \ -H ''Content-Type:application/json'' \ -H ''Authorization: Bearer V5a40R6dWvw2gMkCOBFdZcM95q4HC0Z-T0YKD9-nR6F'' \ -d ''{ "clientSecret": "..." }'' ' - lang: java label: java source: 'AuthleteConfiguration conf = ...; AuthleteApi api = AuthleteApiFactory.create(conf); String clientIdentifier = ...; String clientSecret = "my_updated_client_secret"; api.updateClientSecret(clientIdentifier, clientSecret); ' - lang: python source: 'conf = ... api = AuthleteApiImpl(conf) clientIdentifier = ... clientSecret = ''my_new_client_secret'' api.updateClientSecret(clientIdentifier, clientSecret) ' tags: - Client Management /api/{serviceId}/client/authorization/get/list: x-code-samples: - lang: shell label: curl source: 'curl -v https://us.authlete.com/api/client/authorization/get/list?subject=john\&start=0\&end=5 \ -u ''21653835348762:uE4NgqeIpuSV_XejQ7Ds3jsgA1yXhjR1MXJ1LbPuyls'' ' - lang: java label: java source: 'AuthleteConfiguration conf = ...; AuthleteApi api = AuthleteApiFactory.create(conf); ClientAuthorizationGetListRequest req = new ClientAuthorizationGetListRequest(); req.setSubject("john"); req.setStart(0); req.setEnd(5); api.getClientAuthorizationList(req); ' - lang: python source: 'conf = ... api = AuthleteApiImpl(conf) req = ClientAuthorizationGetListRequest() req.subject = ''john'' req.start = 0 req.end = 5 api.getClientAuthorizationList(req) ' get: summary: Get Authorized Applications description: 'Get a list of client applications that an end-user has authorized. The subject parameter is required and can be provided as a query parameter. ' parameters: - in: path name: serviceId description: A service ID. required: true schema: type: string - in: query name: subject schema: type: string required: true description: 'Unique user ID of an end-user. ' - in: query name: developer schema: type: string required: false description: 'Unique ID of a client developer. ' - in: query name: start schema: type: integer format: int32 required: false description: Start index of search results (inclusive). The default value is 0. - in: query name: end schema: type: integer format: int32 required: false description: 'End index of search results (exclusive). The default value is 5. ' responses: '200': description: '' content: application/json: schema: $ref: '#/components/schemas/client_authorization_get_list_response' example: clients: - clientId: 26478243745571 clientIdAlias: my-client clientIdAliasEnabled: true clientName: My client clientType: CONFIDENTIAL number: 6164 end: 5 start: 0 subject: john totalCount: 1 '400': $ref: '#/components/responses/400' '401': $ref: '#/components/responses/401' '403': $ref: '#/components/responses/403' '500': $ref: '#/components/responses/500' operationId: client_authorization_get_list_api tags: - Client Management post: summary: Get Authorized Applications description: 'Get a list of client applications that an end-user has authorized. The subject parameter is required. ' parameters: - in: path name: serviceId description: A service ID. required: true schema: type: string requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/client_authorization_get_list_request' application/x-www-form-urlencoded: schema: $ref: '#/components/schemas/client_authorization_get_list_request' responses: '200': description: '' content: application/json: schema: $ref: '#/components/schemas/client_authorization_get_list_response' '400': $ref: '#/components/responses/400' '401': $ref: '#/components/responses/401' '403': $ref: '#/components/responses/403' '500': $ref: '#/components/responses/500' operationId: client_authorization_get_list_api_post tags: - Client Management /api/{serviceId}/client/authorization/get/list/{subject}: get: summary: Get Authorized Applications (by Subject) description: 'Get a list of client applications that an end-user has authorized. In this variant, the subject is provided in the path. ' parameters: - in: path name: serviceId description: A service ID. required: true schema: type: string - in: path name: subject schema: type: string required: true description: 'Unique user ID of an end-user. ' - in: query name: developer schema: type: string required: false description: 'Unique ID of a client developer. ' - in: query name: start schema: type: integer format: int32 required: false description: Start index of search results (inclusive). The default value is 0. - in: query name: end schema: type: integer format: int32 required: false description: 'End index of search results (exclusive). The default value is 5. ' responses: '200': description: '' content: application/json: schema: $ref: '#/components/schemas/client_authorization_get_list_response' '400': $ref: '#/components/responses/400' '401': $ref: '#/components/responses/401' '403': $ref: '#/components/responses/403' '500': $ref: '#/components/responses/500' operationId: client_authorization_get_list_by_subject_api tags: - Client Management /api/{serviceId}/client/authorization/update/{clientId}: post: summary: Update Client Tokens description: 'Update attributes of all existing access tokens given to a client application. ' parameters: - in: path name: serviceId description: A service ID. required: true schema: type: string - in: path name: clientId schema: type: string required: true description: 'A client ID. ' requestBody: required: false content: application/json: schema: $ref: '#/components/schemas/client_authorization_update_request' example: subject: john scopes: - history.read application/x-www-form-urlencoded: schema: $ref: '#/components/schemas/client_authorization_update_request' responses: '200': description: '' content: application/json: schema: $ref: '#/components/schemas/client_authorization_update_response' example: resultCode: A138001 resultMessage: '[A138001] Updated 1 access token(s) issued to the client (ID = 26478243745571) of the service (API Key = 21653835348762).' '400': $ref: '#/components/responses/400' '401': $ref: '#/components/responses/401' '403': $ref: '#/components/responses/403' '404': description: The client was not found. '500': $ref: '#/components/responses/500' operationId: client_authorization_update_api x-code-samples: - lang: shell label: curl source: 'curl -v -X POST https://us.authlete.com/api/21653835348762/client/authorization/update/26478243745571 \ -H ''Content-Type:application/json'' \ -H ''Authorization: Bearer V5a40R6dWvw2gMkCOBFdZcM95q4HC0Z-T0YKD9-nR6F'' \ -d ''{ "subject": "john", "scopes": [ "history.read" ] }'' ' - lang: java label: java source: 'AuthleteConfiguration conf = ...; AuthleteApi api = AuthleteApiFactory.create(conf); long clientId = ...; ClientAuthorizationUpdateRequest req = new ClientAuthorizationUpdateRequest(); req.setSubject("john"); req.setScopes(new String[]{ "history.read" }); api.updateClientAuthorization(clientId, req); ' - lang: python source: 'conf = ... api = AuthleteApiImpl(conf) clientId = ... req = ClientAuthorizationUpdateRequest() req.subject = ''john'' req.scopes = [ ''history.read'' ] api.updateClientAuthorization(clientId, req) ' tags: - Client Management /api/{serviceId}/client/authorization/delete/{clientId}: x-code-samples: - lang: shell label: curl source: 'curl -v -X DELETE https://us.authlete.com/api/21653835348762/client/authorization/delete/26478243745571?subject=john \ -H ''Authorization: Bearer V5a40R6dWvw2gMkCOBFdZcM95q4HC0Z-T0YKD9-nR6F'' ' - lang: java label: java source: 'AuthleteConfiguration conf = ...; AuthleteApi api = AuthleteApiFactory.create(conf); long clientId = ...; String subject = "john"; api.deleteClientAuthorization(clientId, subject); ' - lang: python source: 'conf = ... api = AuthleteApiImpl(conf) clientId = ... subject = ''john'' api.deleteClientAuthorization(clientId, subject) ' delete: summary: Delete Client Tokens description: 'Delete all existing access tokens issued to a client application by an end-user. The subject parameter is required and must be provided as a query parameter. ' parameters: - in: path name: serviceId description: A service ID. required: true schema: type: string - in: path name: clientId schema: type: string required: true description: 'A client ID. ' - in: query name: subject schema: type: string required: true description: 'Unique user ID of an end-user. ' responses: '200': description: '' content: application/json: schema: $ref: '#/components/schemas/client_authorization_delete_response' example: resultCode: A137001 resultMessage: '[A137001] Deleted 3 access token(s) issued to the client (ID = 26478243745571) of the service (API Key = 21653835348762).' '400': $ref: '#/components/responses/400' '401': $ref: '#/components/responses/401' '403': $ref: '#/components/responses/403' '500': $ref: '#/components/responses/500' operationId: client_authorization_delete_api tags: - Client Management post: summary: Delete Client Tokens description: 'Delete all existing access tokens issued to a client application by an end-user. The subject parameter is required. ' parameters: - in: path name: serviceId description: A service ID. required: true schema: type: string - in: path name: clientId schema: type: string required: true description: 'A client ID. ' requestBody: required: true content: application/json: schema: type: object properties: subject: type: string description: Unique user ID of an end-user. required: - subject application/x-www-form-urlencoded: schema: type: object properties: subject: type: string description: Unique user ID of an end-user. required: - subject responses: '200': description: '' content: application/json: schema: $ref: '#/components/schemas/client_authorization_delete_response' operationId: client_authorization_delete_api_post tags: - Client Management /api/{serviceId}/client/authorization/delete/{clientId}/{subject}: delete: summary: Delete Client Tokens (by Subject) description: 'Delete all existing access tokens issued to a client application by an end-user. In this variant, the subject is provided in the path. ' parameters: - in: path name: serviceId description: A service ID. required: true schema: type: string - in: path name: clientId schema: type: string required: true description: 'A client ID. ' - in: path name: subject schema: type: string required: true description: 'Unique user ID of an end-user. ' responses: '200': description: '' content: application/json: schema: $ref: '#/components/schemas/client_authorization_delete_response' '400': $ref: '#/components/responses/400' '401': $ref: '#/components/responses/401' '403': $ref: '#/components/responses/403' '500': $ref: '#/components/responses/500' operationId: client_authorization_delete_by_subject_api tags: - Client Management /api/{serviceId}/client/granted_scopes/get/{clientId}: x-code-samples: - lang: shell label: curl source: 'curl -v https://us.authlete.com/api/21653835348762/client/granted_scopes/get/26478243745571?subject=john \ -H ''Authorization: Bearer V5a40R6dWvw2gMkCOBFdZcM95q4HC0Z-T0YKD9-nR6F'' ' - lang: java label: java source: 'AuthleteConfiguration conf = ...; AuthleteApi api = AuthleteApiFactory.create(conf); long clientId = 26478243745571; String subject = "john"; api.getGrantedScopes(clientId, subject); ' - lang: python source: 'conf = ... api = AuthleteApiImpl(conf) clientId = 26478243745571 subject = ''john'' api.getGrantedScopes(clientId, subject) ' get: summary: Get Granted Scopes description: 'Get the set of scopes that a user has granted to a client application. ' x-mint: metadata: description: Get the set of scopes that a user has granted to a client application. content: ' Possible values for `requestableScopes` parameter in the response from this API are as follows. ## null The user has not granted authorization to the client application in the past, or records about the combination of the user and the client application have been deleted from Authlete''s DB. ## An empty set The user has granted authorization to the client application in the past, but no scopes are associated with the authorization. ## A set with at least one element The user has granted authorization to the client application in the past and some scopes are associated with the authorization. These scopes are returned. Example: `[ "profile", "email" ]` The subject parameter is required and must be provided as a query parameter. ' parameters: - in: path name: serviceId description: A service ID. required: true schema: type: string example: '715948317' - in: path name: clientId schema: type: string required: true description: 'A client ID. ' example: '1140735077' - in: query name: subject schema: type: string required: true description: 'Unique user ID of an end-user. ' responses: '200': description: Successfully retrieved granted scopes content: application/json: schema: $ref: '#/components/schemas/client_authorization_delete_response' example: type: GrantedScopesGetResponse serviceApiKey: 21653835348762 clientId: 26478243745571 subject: john latestGrantedScopes: - history.read mergedGrantedScopes: - history.read - timeline.read '400': $ref: '#/components/responses/400' '401': $ref: '#/components/responses/401' '403': $ref: '#/components/responses/403' '500': $ref: '#/components/responses/500' operationId: client_granted_scopes_get_api tags: - Client Management post: summary: Get Granted Scopes description: 'Get the set of scopes that a user has granted to a client application. The subject parameter is required. ' parameters: - in: path name: serviceId description: A service ID. required: true schema: type: string - in: path name: clientId schema: type: string required: true description: 'A client ID. ' requestBody: required: true content: application/json: schema: type: object properties: subject: type: string description: Unique user ID of an end-user. required: - subject application/x-www-form-urlencoded: schema: type: object properties: subject: type: string description: Unique user ID of an end-user. required: - subject responses: '200': description: '' content: application/json: schema: $ref: '#/components/schemas/client_authorization_delete_response' operationId: client_granted_scopes_get_api_post tags: - Client Management /api/{serviceId}/client/granted_scopes/get/{clientId}/{subject}: get: summary: Get Granted Scopes (by Subject) description: 'Get the set of scopes that a user has granted to a client application. In this variant, the subject is provided in the path. ' parameters: - in: path name: serviceId description: A service ID. required: true schema: type: string - in: path name: clientId schema: type: string required: true description: 'A client ID. ' - in: path name: subject schema: type: string required: true description: 'Unique user ID of an end-user. ' responses: '200': description: Successfully retrieved granted scopes content: application/json: schema: $ref: '#/components/schemas/client_authorization_delete_response' '400': $ref: '#/components/responses/400' '401': $ref: '#/components/responses/401' '403': $ref: '#/components/responses/403' '500': $ref: '#/components/responses/500' operationId: client_granted_scopes_get_by_subject_api tags: - Client Management /api/{serviceId}/client/granted_scopes/delete/{clientId}: delete: summary: Delete Granted Scopes description: 'Delete the set of scopes that an end-user has granted to a client application. Even if records about granted scopes are deleted by calling this API, existing access tokens are not deleted and scopes of existing access tokens are not changed. The subject parameter is required and must be provided as a query parameter. ' parameters: - in: path name: serviceId description: A service ID. required: true schema: type: string - in: path name: clientId schema: type: string required: true description: 'A client ID. ' - in: query name: subject schema: type: string required: true description: 'Unique user ID of an end-user. ' responses: '200': description: '' content: application/json: schema: $ref: '#/components/schemas/client_granted_scopes_delete_response' '400': $ref: '#/components/responses/400' '401': $ref: '#/components/responses/401' '403': $ref: '#/components/responses/403' '500': $ref: '#/components/responses/500' operationId: client_granted_scopes_delete_api x-code-samples: - lang: shell label: curl source: 'curl -v -X DELETE https://us.authlete.com/api/21653835348762/client/granted_scopes/delete/26478243745571?subject=john \ -H ''Authorization: Bearer V5a40R6dWvw2gMkCOBFdZcM95q4HC0Z-T0YKD9-nR6F'' ' - lang: java label: java source: 'AuthleteConfiguration conf = ...; AuthleteApi api = AuthleteApiFactory.create(conf); long clientId = ...; String subject = "john"; api.deleteGrantedScopes(clientId, subject); ' - lang: python source: 'conf = ... api = AuthleteApiImpl(conf) clientId = ... subject = ''john'' api.deleteClientAuthorization(clientId, subject) ' tags: - Client Management /api/{serviceId}/client/granted_scopes/delete/{clientId}/{subject}: delete: summary: Delete Granted Scopes (by Subject) description: 'Delete the set of scopes that an end-user has granted to a client application. In this variant, the subject is provided in the path. ' parameters: - in: path name: serviceId description: A service ID. required: true schema: type: string - in: path name: clientId schema: type: string required: true description: 'A client ID. ' - in: path name: subject schema: type: string required: true description: 'Unique user ID of an end-user. ' responses: '200': description: '' content: application/json: schema: $ref: '#/components/schemas/client_granted_scopes_delete_response' '400': $ref: '#/components/responses/400' '401': $ref: '#/components/responses/401' '403': $ref: '#/components/responses/403' '500': $ref: '#/components/responses/500' operationId: client_granted_scopes_delete_by_subject_api tags: - Client Management /api/{serviceId}/client/extension/requestable_scopes/get/{clientId}: get: summary: Get Requestable Scopes description: 'Get the requestable scopes per client ' parameters: - in: path name: serviceId description: A service ID. required: true schema: type: string - in: path name: clientId schema: type: string required: true description: 'A client ID. ' responses: '200': description: '' content: application/json: schema: $ref: '#/components/schemas/client_extension_requestable_scopes_get_response' '400': $ref: '#/components/responses/400' '401': $ref: '#/components/responses/401' '403': $ref: '#/components/responses/403' '500': $ref: '#/components/responses/500' operationId: client_extension_requestables_scopes_get_api tags: - Client Management /api/{serviceId}/client/extension/requestable_scopes/update/{clientId}: post: summary: Update Requestable Scopes description: 'Update requestable scopes of a client ' parameters: - in: path name: serviceId description: A service ID. required: true schema: type: string - in: path name: clientId schema: type: string required: true description: 'A client ID. ' requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/client_extension_requestable_scopes_update_request' responses: '200': description: Requestable scopes updated successfully content: application/json: schema: $ref: '#/components/schemas/client_extension_requestable_scopes_update_response' '400': $ref: '#/components/responses/400' '401': $ref: '#/components/responses/401' '403': $ref: '#/components/responses/403' '500': $ref: '#/components/responses/500' operationId: client_extension_requestables_scopes_update_api_post tags: - Client Management put: summary: Update Requestable Scopes description: 'Update requestable scopes of a client ' parameters: - in: path name: serviceId description: A service ID. required: true schema: type: string - in: path name: clientId schema: type: string required: true description: 'A client ID. ' requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/client_extension_requestable_scopes_update_request' responses: '200': description: Requestable scopes updated successfully content: application/json: schema: $ref: '#/components/schemas/client_extension_requestable_scopes_update_response' '400': $ref: '#/components/responses/400' '401': $ref: '#/components/responses/401' '403': $ref: '#/components/responses/403' '500': $ref: '#/components/responses/500' operationId: client_extension_requestables_scopes_update_api tags: - Client Management /api/{serviceId}/client/extension/requestable_scopes/delete/{clientId}: delete: summary: Delete Requestable Scopes description: 'Delete requestable scopes of a client ' parameters: - in: path name: serviceId description: A service ID. required: true schema: type: string - in: path name: clientId schema: type: string required: true description: 'A client ID. ' responses: '204': description: Requestable scopes was successfully deleted. '400': $ref: '#/components/responses/400' '401': $ref: '#/components/responses/401' '403': $ref: '#/components/responses/403' '500': $ref: '#/components/responses/500' operationId: client_extension_requestables_scopes_delete_api tags: - Client Management components: schemas: client_authorization_update_response: type: object properties: resultCode: type: string description: The code which represents the result of the API call. resultMessage: type: string description: A short message which explains the result of the API call. grant_type: type: string description: 'The grant type of the access token when the access token was created. ' enum: - AUTHORIZATION_CODE - IMPLICIT - PASSWORD - CLIENT_CREDENTIALS - REFRESH_TOKEN - CIBA - DEVICE_CODE - TOKEN_EXCHANGE - JWT_BEARER - PRE_AUTHORIZED_CODE client_registration_type: type: string description: "Values for the `client_registration_types` RP metadata and the\n `client_registration_types_supported` OP metadata that are defined in\n [OpenID Connect Federation 1.0](https://openid.net/specs/openid-connect-federation-1_0.html).\n" enum: - AUTOMATIC - EXPLICIT client_extension: type: object properties: requestableScopes: type: array items: type: string description: 'The set of scopes that the client application is allowed to request. This paramter will be one of the following. ' x-mint: metadata: description: The set of scopes that the client application is allowed to request. This paramter will be one of the following. content: "\n - `null`\n - an empty set\n - a set with at least one element\n\nWhen the value of this parameter is `null`, it means that the set of scopes that the client\napplication is allowed to request is the set of the scopes that the service supports. When the\nvalue of this parameter is an empty set, it means that the client application is not allowed to\nrequest any scopes. When the value of this parameter is a set with at least one element, it means\nthat the set is the set of scopes that the client application is allowed to request.\n\n" requestableScopesEnabled: type: boolean description: 'The flag to indicate whether "Requestable Scopes per Client" is enabled or not. If `true`, you can define the set of scopes which this client application can request. If `false`, this client application can request any scope which is supported by the authorization server. ' accessTokenDuration: type: integer format: int64 description: 'The value of the duration of access tokens per client in seconds. In normal cases, the value of the service''s `accessTokenDuration` property is used as the duration of access tokens issued by the service. However, if this `accessTokenDuration` property holds a non-zero positive number and its value is less than the duration configured by the service, the value is used as the duration of access tokens issued to the client application. Note that the duration of access tokens can be controlled by the scope attribute `access_token.duration`, too. Authlete chooses the minimum value among the candidates. ' refreshTokenDuration: type: integer format: int64 description: 'The value of the duration of refresh tokens per client in seconds. In normal cases, the value of the service''s `refreshTokenDuration` property is used as the duration of refresh tokens issued by the service. However, if this `refreshTokenDuration` property holds a non-zero positive number and its value is less than the duration configured by the service, the value is used as the duration of refresh tokens issued to the client application. Note that the duration of refresh tokens can be controlled by the scope attribute `refresh_token.duration`, too. Authlete chooses the minimum value among the candidates. ' idTokenDuration: type: integer format: int64 description: 'The value of the duration of ID tokens per client in seconds. In normal cases, the value of the service''s `idTokenDuration` property is used as the duration of ID tokens issued by the service. However, if this `idTokenDuration` property holds a non-zero positive number and its value is less than the duration configured by the service, the value is used as the duration of ID tokens issued to the client application. Note that the duration of refresh tokens can be controlled by the scope attribute `id_token.duration`, too. Authlete chooses the minimum value among the candidates. ' tokenExchangePermitted: type: boolean description: 'Get the flag indicating whether the client is explicitly given a permission to make token exchange requests ([RFC 8693][https://www.rfc-editor.org/rfc/rfc8693.html]) ' client: type: object additionalProperties: true example: number: 1140735077 serviceNumber: 715948317 clientName: My Test Client clientId: '1140735077' clientSecret: gXz97ISgLs4HuXwOZWch8GEmgL4YMvUJwu3er_kDVVGcA0UOhA9avLPbEmoeZdagi9yC_-tEiT2BdRyH9dbrQQ clientType: PUBLIC redirectUris: - https://example.com/callback responseTypes: - CODE grantTypes: - AUTHORIZATION_CODE properties: number: type: integer format: int32 readOnly: true description: 'The sequential number of the client. The value of this property is assigned by Authlete. ' serviceNumber: type: integer format: int32 readOnly: true description: 'The sequential number of the service of the client application. The value of this property is assigned by Authlete. ' clientName: type: string description: 'The name of the client application. This property corresponds to `client_name` in [OpenID Connect Dynamic Client Registration 1.0, 2. Client Metadata](https://openid.net/specs/openid-connect-registration-1_0.html#ClientMetadata). ' clientNames: type: array items: $ref: '#/components/schemas/tagged_value' description: 'Client names with language tags. If the client application has different names for different languages, this property can be used to register the names. ' description: type: string description: The description about the client application. descriptions: type: array items: $ref: '#/components/schemas/tagged_value' description: 'Descriptions about the client application with language tags. If the client application has different descriptions for different languages, this property can be used to register the descriptions. ' clientId: type: integer format: int64 readOnly: true description: The client identifier used in Authlete API calls. The value of this property is assigned by Authlete. clientSecret: type: string readOnly: true description: 'The client secret. A random 512-bit value encoded by base64url (86 letters). The value of this property is assigned by Authlete. ' x-mint: metadata: description: The client secret. A random 512-bit value encoded by base64url (86 letters). The value of this property is assigned by Authlete. content: ' Note that Authlete issues a client secret even to a "public" client application, but the client application should not use the client secret unless it changes its client type to "confidential". That is, a public client application should behave as if it had not been issued a client secret. To be specific, a token request from a public client of Authlete should not come along with a client secret although [RFC 6749, 3.2.1. Client Authentication](https://datatracker.ietf.org/doc/html/rfc6749#section-3.2.1) says as follows. > Confidential clients or other clients issued client credentials MUST authenticate with the authorization server as described in Section 2.3 when making requests to the token endpoint. ' clientIdAlias: type: string description: 'The value of the client''s `client_id` property used in OAuth and OpenID Connect calls. By default, this is a string version of the `clientId` property. ' clientIdAliasEnabled: type: boolean description: Deprecated. Always set to `true`. clientType: $ref: '#/components/schemas/client_type' applicationType: $ref: '#/components/schemas/application_type' logoUri: type: string description: 'The URL pointing to the logo image of the client application. This property corresponds to `logo_uri` in [OpenID Connect Dynamic Client Registration 1.0, 2. Client Metadata](https://openid.net/specs/openid-connect-registration-1_0.html#ClientMetadata). ' logoUris: type: array items: $ref: '#/components/schemas/tagged_value' description: 'Logo image URLs with language tags. If the client application has different logo images for different languages, this property can be used to register URLs of the images. ' contacts: type: array items: type: string description: 'An array of email addresses of people responsible for the client application. This property corresponds to contacts in [OpenID Connect Dynamic Client Registration 1.0, 2. Client Metadata](https://openid.net/specs/openid-connect-registration-1_0.html#ClientMetadata). ' tlsClientCertificateBoundAccessTokens: type: boolean description: 'The flag to indicate whether this client use TLS client certificate bound access tokens. ' dynamicallyRegistered: type: boolean readOnly: true description: 'The flag to indicate whether this client has been registered dynamically. For more details, see [RFC 7591](https://datatracker.ietf.org/doc/html/rfc7591). ' softwareId: type: string description: 'The unique identifier string assigned by the client developer or software publisher used by registration endpoints to identify the client software to be dynamically registered. This property corresponds to the `software_id metadata` defined in [2. Client Metadata](https://datatracker.ietf.org/doc/html/rfc7591#section-2) of [RFC 7591](https://datatracker.ietf.org/doc/html/rfc7591). ' developer: type: string description: 'The unique identifier of the developer who created this client application. ' softwareVersion: type: string description: 'The version identifier string for the client software identified by the software ID. This property corresponds to the software_version metadata defined in [2. Client Metadata](https://datatracker.ietf.org/doc/html/rfc7591#section-2) of [RFC 7591](https://datatracker.ietf.org/doc/html/rfc7591). ' registrationAccessTokenHash: type: string description: 'The hash of the registration access token for this client. ' createdAt: type: integer format: int64 readOnly: true description: The time at which this client was created. The value is represented as milliseconds since the UNIX epoch (1970-01-01). modifiedAt: type: integer format: int64 readOnly: true description: The time at which this client was last modified. The value is represented as milliseconds since the UNIX epoch (1970-01-01). grantTypes: type: array items: $ref: '#/components/schemas/grant_type' description: 'A string array of grant types which the client application declares that it will restrict itself to using. This property corresponds to `grant_types` in [OpenID Connect Dynamic Client Registration 1.0, 2. Client Metadata](https://openid.net/specs/openid-connect-registration-1_0.html#ClientMetadata). ' responseTypes: type: array items: $ref: '#/components/schemas/response_type' description: 'A string array of response types which the client application declares that it will restrict itself to using. This property corresponds to `response_types` in [OpenID Connect Dynamic Client Registration 1.0, 2. Client Metadata](https://openid.net/specs/openid-connect-registration-1_0.html#ClientMetadata). ' redirectUris: type: array items: type: string description: 'Redirect URIs that the client application uses to receive a response from the authorization endpoint. Requirements for a redirect URI are as follows. ' x-mint: metadata: description: Redirect URIs that the client application uses to receive a response from the authorization endpoint. Requirements for a redirect URI are as follows. content: ' **Requirements by RFC 6749** (From [RFC 6749, 3.1.2. Redirection Endpoint](https://datatracker.ietf.org/doc/html/rfc6749#section-3.1.2)) - Must be an absolute URI. - Must not have a fragment component. **Requirements by OpenID Connect** (From "[OpenID Connect Dynamic Client Registration 1.0, 2. Client Metadata](https://openid.net/specs/openid-connect-registration-1_0.html#ClientMetadata), application_type") - The scheme of the redirect URI used for Implicit Grant by a client application whose application is `web` must be `https`. This is checked at runtime by Authlete. - The hostname of the redirect URI used for Implicit Grant by a client application whose application type is `web` must not be `localhost`. This is checked at runtime by Authlete. - The scheme of the redirect URI used by a client application whose application type is `native` must be either (1) a custom scheme or (2) `http`, which is allowed only when the hostname part is `localhost`. This is checked at runtime by Authlete. ## Requirements by Authlete - Must consist of printable ASCII letters only. - Must not exceed 200 letters. Note that Authlete allows the application type to be `null`. In other words, a client application does not have to choose `web` or `native` as its application type. If the application type is `null`, the requirements by OpenID Connect are not checked at runtime. An authorization request from a client application which has not registered any redirect URI fails unless at least all the following conditions are satisfied. - The client type of the client application is `confidential`. - The value of `response_type` request parameter is `code`. - The authorization request has the `redirect_uri` request parameter. - The value of `scope` request parameter does not contain `openid`. RFC 6749 allows partial match of redirect URI under some conditions (see [RFC 6749, 3.1.2.2. Registration Requirements](https://datatracker.ietf.org/doc/html/rfc6749#section-3.1.2.2) for details), but OpenID Connect requires exact match. ' authorizationSignAlg: $ref: '#/components/schemas/jws_alg' authorizationEncryptionAlg: $ref: '#/components/schemas/jwe_alg' authorizationEncryptionEnc: $ref: '#/components/schemas/jwe_enc' tokenAuthMethod: $ref: '#/components/schemas/client_auth_method' tokenAuthSignAlg: $ref: '#/components/schemas/jws_alg' selfSignedCertificateKeyId: type: string description: 'The key ID of a JWK containing a self-signed certificate of this client. ' tlsClientAuthSubjectDn: type: string description: 'The string representation of the expected subject distinguished name of the certificate this client will use in mutual TLS authentication. See `tls_client_auth_subject_dn` in "Mutual TLS Profiles for OAuth Clients, 2.3. Dynamic Client Registration" for details. ' tlsClientAuthSanDns: type: string description: 'The string representation of the expected DNS subject alternative name of the certificate this client will use in mutual TLS authentication. See `tls_client_auth_san_dns` in "Mutual TLS Profiles for OAuth Clients, 2.3. Dynamic Client Registration" for details. ' tlsClientAuthSanUri: type: string description: 'The string representation of the expected URI subject alternative name of the certificate this client will use in mutual TLS authentication. See `tls_client_auth_san_uri` in "Mutual TLS Profiles for OAuth Clients, 2.3. Dynamic Client Registration" for details. ' tlsClientAuthSanIp: type: string description: 'The string representation of the expected IP address subject alternative name of the certificate this client will use in mutual TLS authentication. See `tls_client_auth_san_ip` in "Mutual TLS Profiles for OAuth Clients, 2.3. Dynamic Client Registration" for details. ' tlsClientAuthSanEmail: type: string description: 'The string representation of the expected email address subject alternative name of the certificate this client will use in mutual TLS authentication. See `tls_client_auth_san_email` in "Mutual TLS Profiles for OAuth Clients, 2.3. Dynamic Client Registration" for details. ' parRequired: type: boolean description: 'The flag to indicate whether this client is required to use the pushed authorization request endpoint. This property corresponds to the `require_pushed_authorization_requests` client metadata defined in "OAuth 2.0 Pushed Authorization Requests". ' requestObjectRequired: type: boolean description: 'The flag to indicate whether authorization requests from this client are always required to utilize a request object by using either `request` or `request_uri` request parameter. If this flag is set to `true` and the service''s `traditionalRequestObjectProcessingApplied` is set to `false`, authorization requests from this client are processed as if `require_signed_request_object` client metadata of this client is `true`. The metadata is defined in "JAR (JWT Secured Authorization Request)". ' requestSignAlg: $ref: '#/components/schemas/jws_alg' requestEncryptionAlg: $ref: '#/components/schemas/jwe_alg' requestEncryptionEnc: $ref: '#/components/schemas/jwe_enc' requestUris: type: array items: type: string description: 'An array of URLs each of which points to a request object. Authlete requires that URLs used as values for `request_uri` request parameter be pre-registered. This property is used for the pre-registration. See [OpenID Connect Core 1.0, 6.2. Passing a Request Object by Reference](https://openid.net/specs/openid-connect-core-1_0.html#RequestUriParameter) for details. ' defaultMaxAge: type: integer format: int32 description: 'The default maximum authentication age in seconds. This value is used when an authorization request from the client application does not have `max_age` request parameter. This property corresponds to `default_max_age` in [OpenID Connect Dynamic Client Registration 1.0, 2. Client Metadata](https://openid.net/specs/openid-connect-registration-1_0.html#ClientMetadata). ' defaultAcrs: type: array items: type: string description: 'The default ACRs (Authentication Context Class References). This value is used when an authorization request from the client application has neither `acr_values` request parameter nor `acr` claim in claims request parameter. ' idTokenSignAlg: $ref: '#/components/schemas/jws_alg' idTokenEncryptionAlg: $ref: '#/components/schemas/jwe_alg' idTokenEncryptionEnc: $ref: '#/components/schemas/jwe_enc' authTimeRequired: type: boolean description: 'The flag to indicate whether this client requires `auth_time` claim to be embedded in the ID token. This property corresponds to `require_auth_time` in [OpenID Connect Dynamic Client Registration 1.0, 2. Client Metadata](https://openid.net/specs/openid-connect-registration-1_0.html#ClientMetadata). ' subjectType: $ref: '#/components/schemas/subject_type' sectorIdentifierUri: type: string description: 'The value of the sector identifier URI. This represents the `sector_identifier_uri` client metadata which is defined in [OpenID Connect Dynamic Client Registration 1.0, 2. Client Metadata](https://openid.net/specs/openid-connect-registration-1_0.html#ClientMetadata) ' derivedSectorIdentifier: type: string readOnly: true description: 'The sector identifier host component as derived from either the `sector_identifier_uri` or the registered redirect URI. If no `sector_identifier_uri` is registered and multiple redirect URIs are also registered, the value of this property is `null`. ' jwksUri: type: string description: 'The URL pointing to the JWK Set of the client application. The content pointed to by the URL is JSON which complies with the format described in [JSON Web Key (JWK), 5. JWK Set Format](https://datatracker.ietf.org/doc/html/rfc7517#section-5). The JWK Set must not include private keys of the client application. ' x-mint: metadata: description: The URL pointing to the JWK Set of the client application. The content pointed to by the URL is JSON which complies with the format described in [JSON Web Key (JWK), 5. JWK Set Format](https://datatracker.ietf.org/doc/html/rfc7517#section-5). The JWK Set must not include private keys of the client application. content: ' If the client application requests encryption for ID tokens (from the authorization/token/userinfo endpoints) and/or signs request objects, it must make available its JWK Set containing public keys for the encryption and/or the signature at the URL of `jwksUri`. The service (Authlete) fetches the JWK Set from the URL as necessary. [OpenID Connect Dynamic Client Registration 1.0](https://openid.net/specs/openid-connect-registration-1_0.html) says that `jwks` must not be used when the client can use `jwks_uri`, but Authlete allows both properties to be registered at the same time. However, Authlete does not use the content of `jwks` when `jwksUri` is registered. This property corresponds to `jwks_uri` in [OpenID Connect Dynamic Client Registration 1.0, 2. Client Metadata](https://openid.net/specs/openid-connect-registration-1_0.html#ClientMetadata). ' jwks: type: string description: 'The content of the JWK Set of the client application. The format is described in [JSON Web Key (JWK), 5. JWK Set Format](https://datatracker.ietf.org/doc/html/rfc7517#section-5). The JWK Set must not include private keys of the client application. ' x-mint: metadata: description: The content of the JWK Set of the client application. The format is described in [JSON Web Key (JWK), 5. JWK Set Format](https://datatracker.ietf.org/doc/html/rfc7517#section-5). The JWK Set must not include private keys of the client application. content: ' [OpenID Connect Dynamic Client Registration 1.0](https://openid.net/specs/openid-connect-registration-1_0.html) says that `jwks` must not be used when the client can use `jwks_uri`, but Authlete allows both properties to be registered at the same time. However, Authlete does not use the content of `jwks` when `jwksUri` is registered. This property corresponds to `jwks_uri` in [OpenID Connect Dynamic Client Registration 1.0, 2. Client Metadata](https://openid.net/specs/openid-connect-registration-1_0.html#ClientMetadata). ' userInfoSignAlg: nullable: true $ref: '#/components/schemas/jws_alg' userInfoEncryptionAlg: nullable: true $ref: '#/components/schemas/jwe_alg' userInfoEncryptionEnc: nullable: true $ref: '#/components/schemas/jwe_enc' loginUri: type: string description: 'The URL which a third party can use to initiate a login by the client application. This property corresponds to `initiate_login_uri` in [OpenID Connect Dynamic Client Registration 1.0, 2. Client Metadata](https://openid.net/specs/openid-connect-registration-1_0.html#ClientMetadata). ' tosUri: type: string description: 'The URL pointing to the "Terms Of Service" page. This property corresponds to `tos_uri` in [OpenID Connect Dynamic Client Registration 1.0, 2. Client Metadata](https://openid.net/specs/openid-connect-registration-1_0.html#ClientMetadata). ' tosUris: type: array items: $ref: '#/components/schemas/tagged_value' description: 'URLs of "Terms Of Service" pages with language tags. If the client application has different "Terms Of Service" pages for different languages, this property can be used to register the URLs. ' policyUri: type: string description: 'The URL pointing to the page which describes the policy as to how end-user''s profile data is used. This property corresponds to `policy_uri` in [OpenID Connect Dynamic Client Registration 1.0, 2. Client Metadata](https://openid.net/specs/openid-connect-registration-1_0.html#ClientMetadata). ' policyUris: type: array items: $ref: '#/components/schemas/tagged_value' description: 'URLs of policy pages with language tags. If the client application has different policy pages for different languages, this property can be used to register the URLs. ' clientUri: type: string description: 'The URL pointing to the home page of the client application. This property corresponds to `client_uri` in [OpenID Connect Dynamic Client Registration 1.0, 2. Client Metadata](https://openid.net/specs/openid-connect-registration-1_0.html#ClientMetadata). ' clientUris: type: array items: $ref: '#/components/schemas/tagged_value' description: 'Home page URLs with language tags. If the client application has different home pages for different languages, this property can be used to register the URLs. ' bcDeliveryMode: type: string description: 'The backchannel token delivery mode. This property corresponds to the `backchannel_token_delivery_mode` metadata. The backchannel token delivery mode is defined in the specification of "CIBA (Client Initiated Backchannel Authentication)". ' bcNotificationEndpoint: type: string description: 'The backchannel client notification endpoint. This property corresponds to the `backchannel_client_notification_endpoint` metadata. The backchannel token delivery mode is defined in the specification of "CIBA (Client Initiated Backchannel Authentication)". ' bcRequestSignAlg: $ref: '#/components/schemas/jws_alg' bcUserCodeRequired: type: boolean description: 'The boolean flag to indicate whether a user code is required when this client makes a backchannel authentication request. This property corresponds to the `backchannel_user_code_parameter` metadata. ' attributes: type: array items: $ref: '#/components/schemas/pair' description: 'The attributes of this client. ' extension: $ref: '#/components/schemas/client_extension' authorizationDetailsTypes: type: array items: type: string description: 'The authorization details types that this client may use as values of the `type` field in `authorization_details`. This property corresponds to the `authorization_details_types` metadata. See [OAuth 2.0 Rich Authorization Requests (RAR)](https://datatracker.ietf.org/doc/draft-ietf-oauth-rar/) for details. Note that the property name was renamed from authorizationDataTypes to authorizationDetailsTypes to align with the change made by the 5th draft of the RAR specification. ' customMetadata: type: string description: 'The custom client metadata in JSON format. ' x-mint: metadata: description: The custom client metadata in JSON format. content: ' Standard specifications define client metadata as necessary. The following are such examples. * [OpenID Connect Dynamic Client Registration 1.0](https://openid.net/specs/openid-connect-registration-1_0.html) * [RFC 7591 OAuth 2.0 Dynamic Client Registration Protocol](https://www.rfc-editor.org/rfc/rfc7591.html) * [RFC 8705 OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access Tokens](https://www.rfc-editor.org/rfc/rfc8705.html) * [OpenID Connect Client-Initiated Backchannel Authentication Flow - Core 1.0](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html) * [The OAuth 2.0 Authorization Framework: JWT Secured Authorization Request (JAR)](https://datatracker.ietf.org/doc/draft-ietf-oauth-jwsreq/) * [Financial-grade API: JWT Secured Authorization Response Mode for OAuth 2.0 (JARM)](https://openid.net/specs/openid-financial-api-jarm.html) * [OAuth 2.0 Pushed Authorization Requests (PAR)](https://datatracker.ietf.org/doc/rfc9126/) * [OAuth 2.0 Rich Authorization Requests (RAR)](https://datatracker.ietf.org/doc/draft-ietf-oauth-rar/) Standard client metadata included in Client Registration Request and Client Update Request (cf. [OIDC DynReg](https://openid.net/specs/openid-connect-registration-1_0.html), [RFC 7591](https://www.rfc-editor.org/rfc/rfc7591.html) and [RFC 7592](https://www.rfc-editor.org/rfc/rfc7592.html)) are, if supported by Authlete, set to corresponding properties of the client application. For example, the value of the `client_name` client metadata in Client Registration/Update Request is set to the clientName property. On the other hand, unrecognized client metadata are discarded. By listing up custom client metadata in advance by using the `supportedCustomClientMetadata` property of Service, Authlete can recognize them and stores their values into the database. The stored custom client metadata values can be referenced by this property. ' frontChannelRequestObjectEncryptionRequired: type: boolean description: 'The flag indicating whether encryption of request object is required when the request object is passed through the front channel. ' x-mint: metadata: description: The flag indicating whether encryption of request object is required when the request object is passed through the front channel. content: ' This flag does not affect the processing of request objects at the Pushed Authorization Request Endpoint, which is defined in [OAuth 2.0 Pushed Authorization Requests](https://datatracker.ietf.org/doc/rfc9126/). Unecrypted request objects are accepted at the endpoint even if this flag is `true`. This flag does not indicate whether a request object is always required. There is a different flag, `requestObjectRequired`, for the purpose. Even if this flag is `false`, encryption of request object is required if the `frontChannelRequestObjectEncryptionRequired` flag of the service is `true`. ' requestObjectEncryptionAlgMatchRequired: type: boolean description: 'The flag indicating whether the JWE alg of encrypted request object must match the `request_object_encryption_alg` client metadata. ' x-mint: metadata: description: The flag indicating whether the JWE alg of encrypted request object must match the `request_object_encryption_alg` client metadata. content: "\nThe `request_object_encryption_alg` client metadata itself is defined in [OpenID Connect Dynamic\nClient Registration 1.0](https://openid.net/specs/openid-connect-registration-1_0.html) as follows.\n\n> request_object_encryption_alg\n>\n> OPTIONAL. JWE [JWE] alg algorithm [JWA] the RP is declaring that it may use for encrypting Request\n Objects sent to the OP. This parameter SHOULD be included when symmetric encryption will be used,\n since this signals to the OP that a client_secret value needs to be returned from which the\n symmetric key will be derived, that might not otherwise be returned. The RP MAY still use other\n supported encryption algorithms or send unencrypted Request Objects, even when this parameter\n is present. If both signing and encryption are requested, the Request Object will be signed\n then encrypted, with the result being a Nested JWT, as defined in [JWT]. The default, if omitted,\n is that the RP is not declaring whether it might encrypt any Request Objects.\n\nThe point here is \"The RP MAY still use other supported encryption algorithms or send unencrypted\nRequest Objects, even when this parameter is present.\"\n\nThe property that represents the client metadata is `requestEncryptionAlg`. See the description\nof `requestEncryptionAlg` for details.\n\nEven if this flag is `false`, the match is required if the `requestObjectEncryptionAlgMatchRequired`\nflag of the service is `true`.\n\n" requestObjectEncryptionEncMatchRequired: type: boolean description: 'The flag indicating whether the JWE enc of encrypted request object must match the `request_object_encryption_enc` client metadata. ' x-mint: metadata: description: The flag indicating whether the JWE enc of encrypted request object must match the `request_object_encryption_enc` client metadata. content: "\nThe `request_object_encryption_enc` client metadata itself is defined in [OpenID Connect Dynamic\nClient Registration 1.0](https://openid.net/specs/openid-connect-registration-1_0.html) as follows.\n\n> request_object_encryption_enc\n>\n> OPTIONAL. JWE enc algorithm [JWA] the RP is declaring that it may use for encrypting Request\n Objects sent to the OP. If request_object_encryption_alg is specified, the default for this\n value is A128CBC-HS256. When request_object_encryption_enc is included, request_object_encryption_alg\n MUST also be provided.\n\nThe property that represents the client metadata is `requestEncryptionEnc`. See the description\nof `requestEncryptionEnc` for details.\n\nEven if this flag is `false`, the match is required if the `requestObjectEncryptionEncMatchRequired`\nflag of the service is `true`.\n\n" digestAlgorithm: type: string description: 'The digest algorithm that this client requests the server to use when it computes digest values of [external attachments](https://openid.net/specs/openid-connect-4-identity-assurance-1_0.html#name-external-attachments), which may be referenced from within ID tokens or userinfo responses (or any place that can have the `verified_claims` claim). Possible values are listed in the [Hash Algorithm Registry](https://www.iana.org/assignments/named-information/named-information.xhtml#hash-alg) of IANA (Internet Assigned Numbers Authority), but the server does not necessarily support all the values there. When this property is omitted, `sha-256` is used as the default algorithm. This property corresponds to the `digest_algorithm` client metadata which was defined by the third implementer''s draft of [OpenID Connect for Identity Assurance 1.0](https://openid.net/specs/openid-connect-4-identity-assurance-1_0.html). ' singleAccessTokenPerSubject: type: boolean description: 'If `Enabled` is selected, an attempt to issue a new access token invalidates existing access tokens that are associated with the same combination of subject and client. Note that, however, attempts by Client Credentials Flow do not invalidate existing access tokens because access tokens issued by Client Credentials Flow are not associated with any end-user''s subject. Even if `Disabled` is selected here, single access token per subject is effective if `singleAccessTokenPerSubject` of the `Service` this client belongs to is Enabled. ' pkceRequired: type: boolean description: 'The flag to indicate whether the use of Proof Key for Code Exchange (PKCE) is always required for authorization requests by Authorization Code Flow. If `true`, `code_challenge` request parameter is always required for authorization requests using Authorization Code Flow. See [RFC 7636](https://tools.ietf.org/html/rfc7636) (Proof Key for Code Exchange by OAuth Public Clients) for details about `code_challenge` request parameter. ' pkceS256Required: type: boolean description: 'The flag to indicate whether `S256` is always required as the code challenge method whenever [PKCE (RFC 7636)](https://tools.ietf.org/html/rfc7636) is used. If this flag is set to `true`, `code_challenge_method=S256` must be included in the authorization request whenever it includes the `code_challenge` request parameter. Neither omission of the `code_challenge_method` request parameter nor use of plain (`code_challenge_method=plain`) is allowed. ' dpopRequired: type: boolean description: 'If the DPoP is required for this client ' automaticallyRegistered: type: boolean description: 'The flag indicating whether this client was registered by the "automatic" client registration of OIDC Federation. ' explicitlyRegistered: type: boolean description: 'The flag indicating whether this client was registered by the "explicit" client registration of OIDC Federation. ' rsRequestSigned: type: boolean description: 'The flag indicating whether this service signs responses from the resource server. ' rsSignedRequestKeyId: type: string description: 'The key ID of a JWK containing the public key used by this client to sign requests to the resource server. ' clientRegistrationTypes: type: array items: $ref: '#/components/schemas/client_registration_type' description: 'The client registration types that the client has declared it may use. ' organizationName: type: string description: 'The human-readable name representing the organization that manages this client. This property corresponds to the organization_name client metadata that is defined in OpenID Connect Federation 1.0. ' signedJwksUri: type: string description: 'The URI of the endpoint that returns this client''s JWK Set document in the JWT format. This property corresponds to the `signed_jwks_uri` client metadata defined in OpenID Connect Federation 1.0. ' entityId: type: string description: 'the entity ID of this client. ' trustAnchorId: type: string description: 'The entity ID of the trust anchor of the trust chain that was used when this client was registered or updated by the mechanism defined in OpenID Connect Federation 1.0 ' trustChain: type: array items: type: string description: 'The trust chain that was used when this client was registered or updated by the mechanism defined in OpenID Connect Federation 1.0 ' trustChainExpiresAt: type: integer format: int64 description: 'the expiration time of the trust chain that was used when this client was registered or updated by the mechanism defined in OpenID Connect Federation 1.0. The value is represented as milliseconds elapsed since the Unix epoch (1970-01-01). ' trustChainUpdatedAt: type: integer format: int64 description: 'the time at which the trust chain was updated by the mechanism defined in OpenID Connect Federation 1.0 ' locked: type: boolean description: 'The flag which indicates whether this client is locked. ' credentialOfferEndpoint: type: string description: 'The URL of the credential offer endpoint at which this client (wallet) receives a credential offer from the credential issuer. ' fapiModes: type: array items: $ref: '#/components/schemas/fapi_mode' description: 'The FAPI modes for this client. ' x-mint: metadata: description: The FAPI modes for this client. content: ' When the value of this property is not `null`, Authlete always processes requests from this client based on the specified FAPI modes if the FAPI feature is enabled in Authlete, the FAPI profile is supported by the service, and the FAPI modes for the service are set to `null`. For instance, when this property is set to an array containing `FAPI1_ADVANCED` only, Authlete always processes requests from this client based on "Financial-grade API Security Profile 1.0 - Part 2: Advanced" if the FAPI feature is enabled in Authlete, the FAPI profile is supported by the service, and the FAPI modes for the service are set to `null`. ' responseModes: type: array items: type: string enum: - QUERY - FRAGMENT - FORM_POST - JWT - QUERY_JWT - FRAGMENT_JWT - FORM_POST_JWT description: The response modes that this client may use. credentialResponseEncryptionRequired: type: boolean description: True if credential responses to this client must be always encrypted. mtlsEndpointAliasesUsed: type: boolean description: 'The flag indicating whether the client intends to prefer mutual TLS endpoints over non-MTLS endpoints. This property corresponds to the `use_mtls_endpoint_aliases` client metadata that is defined in [FAPI 2.0 Security Profile, 8.1.1. use_mtls_endpoint_aliases](https://openid.bitbucket.io/fapi/fapi-2_0-security-profile.html#section-8.1.1). ' inScopeForTokenMigration: type: boolean description: "The flag indicating whether this client is in scope for token migration \noperations.\n" metadataDocumentLocation: type: string format: uri description: 'Location of the Client ID Metadata Document that was used for this client. ' metadataDocumentExpiresAt: type: integer format: int64 description: 'Expiration time of the metadata document (UNIX time in milliseconds). ' metadataDocumentUpdatedAt: type: integer format: int64 description: 'Last-updated time of the metadata document (UNIX time in milliseconds). ' discoveredByMetadataDocument: type: boolean description: 'Indicates whether this client was discovered via a Client ID Metadata Document. ' clientSource: type: string description: 'Source of this client record. ' enum: - DYNAMIC_REGISTRATION - AUTOMATIC_REGISTRATION - EXPLICIT_REGISTRATION - METADATA_DOCUMENT - STATIC_REGISTRATION client_extension_requestable_scopes_get_response: type: object properties: requestableScopes: type: array nullable: true items: type: string description: 'The requestable scopes for this client. This is null if the Requestable Scopes per Client feature is not enabled for this client. ' response_type: type: string enum: - NONE - CODE - TOKEN - ID_TOKEN - CODE_TOKEN - CODE_ID_TOKEN - ID_TOKEN_TOKEN - CODE_ID_TOKEN_TOKEN client_limited: type: object properties: number: type: integer format: int32 readOnly: true description: 'The sequential number of the client. The value of this property is assigned by Authlete. ' clientName: type: string description: 'The name of the client application. This property corresponds to `client_name` in [OpenID Connect Dynamic Client Registration 1.0, 2. Client Metadata](https://openid.net/specs/openid-connect-registration-1_0.html#ClientMetadata). ' clientNames: type: array items: $ref: '#/components/schemas/tagged_value' description: 'Client names with language tags. If the client application has different names for different languages, this property can be used to register the names. ' description: type: string description: The description about the client application. descriptions: type: array items: $ref: '#/components/schemas/tagged_value' description: 'Descriptions about the client application with language tags. If the client application has different descriptions for different languages, this property can be used to register the descriptions. ' clientId: type: integer format: int64 readOnly: true description: The client identifier used in Authlete API calls. The value of this property is assigned by Authlete. clientIdAlias: type: string description: 'The value of the client''s `client_id` property used in OAuth and OpenID Connect calls. By default, this is a string version of the `clientId` property. ' clientIdAliasEnabled: type: boolean description: Deprecated. Always set to `true`. clientType: $ref: '#/components/schemas/client_type' client_secret_update_request: type: object required: - clientSecret properties: clientSecret: type: string description: 'The new value of the client secret. Valid characters for a client secret are `A-Z`, `a-z`, `0-9`, `-`, and `_`. The maximum length of a client secret is 86. ' jwe_alg: type: string nullable: true description: 'this is the ''alg'' header value for encrypted JWT tokens. Depending upon the context, this refers to key transport scheme to be used by the client and by the server. For instance: - as `authorizationEncryptionAlg` value, it refers to the encoding algorithm used by server for transporting they keys on JARM objects - as `requestEncryptionAlg` value, it refers to the expected key transport encoding algorithm that server expect from client when encrypting a Request Object - as `idTokenEncryptionAlg` value, it refers to the algorithm used by the server to key transport of id_tokens **Please note that some of the algorithms are more secure than others, some are not supported very well cross platforms and some (like RSA1_5) is known to be weak**. ' enum: - RSA1_5 - RSA_OAEP - RSA_OAEP_256 - A128KW - A192KW - A256KW - DIR - ECDH_ES - ECDH_ES_A128KW - ECDH_ES_A192KW - ECDH_ES_A256KW - A128GCMKW - A192GCMKW - A256GCMKW - PBES2_HS256_A128KW - PBES2_HS384_A192KW - PBES2_HS512_A256KW tagged_value: type: object properties: tag: type: string description: The language tag part. value: type: string description: The value part. client_authorization_delete_response: type: object properties: resultCode: type: string description: The code which represents the result of the API call. resultMessage: type: string description: A short message which explains the result of the API call. serviceApiKey: type: integer format: int64 description: A short message which explains the result of the API call. clientId: type: integer format: int64 description: Get the client ID. subject: type: string description: 'Get the subject (= unique identifier) of the user who has granted authorization to the client. ' latestGrantedScopes: type: array items: type: string description: 'Get the scopes granted to the client application by the last authorization process by the user (who is identified by the subject). ' mergedGrantedScopes: type: array items: type: string description: 'Get the scopes granted to the client application by all the past authorization processes. Note that revoked scopes are not included. ' modifiedAt: type: integer format: int64 description: 'Get the timestamp in milliseconds since Unix epoch at which this record was modified. ' jws_alg: type: string nullable: true description: "The signature algorithm for JWT. This value is represented on 'alg' attribute\nof the header of JWT.\n\nit's semantics depends upon where is this defined, for instance:\n - as service accessTokenSignAlg value, it defines that access token are JWT and the algorithm used to sign it. Check your [KB article](https://kb.authlete.com/en/s/oauth-and-openid-connect/a/jwt-based-access-token).\n - as client authorizationSignAlg value, it represents the signature algorithm used when [creating a JARM response](https://kb.authlete.com/en/s/oauth-and-openid-connect/a/enabling-jarm).\n - or as client requestSignAlg value, it specifies which is the expected signature used by [client on a Request Object](https://kb.authlete.com/en/s/oauth-and-openid-connect/a/request-objects).\n" enum: - NONE - HS256 - HS384 - HS512 - RS256 - RS384 - RS512 - ES256 - ES384 - ES512 - PS256 - PS384 - PS512 - ES256K - EdDSA client_extension_requestable_scopes_update_request: type: object properties: requestableScopes: type: array items: type: string description: 'The set of scopes that the client application is allowed to request. This parameter will be one of the following. Details are described in the description. - an empty set - a set with at least one element If this parameter contains scopes that the service does not support, those scopes are just ignored. Also, if this parameter is `null` or is not included in the request, it is equivalent to calling `/client/extension/requestable_scopes/delete` API. ' client_secret_refresh_response: type: object properties: resultCode: type: string description: The code which represents the result of the API call. resultMessage: type: string description: A short message which explains the result of the API call. newClientSecret: type: string description: 'The new client secret. ' oldClientSecret: type: string description: 'The old client secret. ' application_type: type: string description: 'The application type. The value of this property affects the validation steps for a redirect URI. See the description about `redirectUris` property for more details. ' enum: - WEB - NATIVE fapi_mode: type: string enum: - FAPI1_ADVANCED - FAPI1_BASELINE - FAPI2_MESSAGE_SIGNING_AUTH_REQ - FAPI2_MESSAGE_SIGNING_AUTH_RES - FAPI2_MESSAGE_SIGNING_INTROSPECTION_RES - FAPI2_SECURITY client_get_list_response: type: object properties: start: type: integer format: int32 description: 'Start index (inclusive) of the result set of the query. ' end: type: integer format: int32 description: 'End index (exclusive) of the result set of the query. ' totalCount: type: integer format: int32 description: 'Total number of clients that belong to the service. This doesn''t mean the number of clients contained in the response. ' clients: type: array items: $ref: '#/components/schemas/client' description: 'An array of clients. ' client_flag_update_response: type: object required: - resultCode - resultMessage properties: resultCode: type: string description: The code which represents the result of the API call. resultMessage: type: string description: A short message which explains the result of the API call. client_type: type: string description: 'The client type, either `CONFIDENTIAL` or `PUBLIC`. See [RFC 6749, 2.1. Client Types](https://datatracker.ietf.org/doc/html/rfc6749#section-2.1) for details. ' enum: - PUBLIC - CONFIDENTIAL result: type: object properties: resultCode: type: string description: The code which represents the result of the API call. resultMessage: type: string description: A short message which explains the result of the API call. client_extension_requestable_scopes_update_response: type: object properties: requestableScopes: type: array items: type: string jwe_enc: type: string nullable: true description: "This is the encryption algorithm to be used when encrypting a JWT on client or server side.\nDepending upon the context, this refers to encryption done by the client or by the server. For instance:\n - as `authorizationEncryptionEnc` value, it refers to the encryption algorithm used by server when creating a JARM response\n - as `requestEncryptionEnc` value, it refers to the expected encryption algorithm used by the client when encrypting a Request Object\n - as `idTokenEncryptionEnc` value, it refers to the algorithm used by the server to encrypt id_tokens\n" enum: - A128CBC_HS256 - A192CBC_HS384 - A256CBC_HS512 - A128GCM - A192GCM - A256GCM client_authorization_update_request: type: object required: - subject properties: subject: type: string description: 'The subject (= unique identifier) of the end-user who has granted authorization to the client application. ' scopes: type: array items: type: string description: 'An array of new scopes. Optional. If a non-null value is given, the new scopes are set to all existing access tokens. If an API call is made using `"Content-Type: application/x-www-form-urlencoded"`, scope names listed in this request parameter should be delimited by spaces (after form encoding, spaces are converted to `+`). ' client_auth_method: type: string description: 'The client authentication method that the client application declares that it uses at the token endpoint. This property corresponds to `token_endpoint_auth_method` in [OpenID Connect Dynamic Client Registration 1.0, 2. Client Metadata](https://openid.net/specs/openid-connect-registration-1_0.html#ClientMetadata). ' enum: - NONE - CLIENT_SECRET_BASIC - CLIENT_SECRET_POST - CLIENT_SECRET_JWT - PRIVATE_KEY_JWT - TLS_CLIENT_AUTH - SELF_SIGNED_TLS_CLIENT_AUTH - ATTEST_JWT_CLIENT_AUTH client_granted_scopes_delete_response: type: object properties: resultCode: type: string description: The code which represents the result of the API call. resultMessage: type: string description: A short message which explains the result of the API call. pair: type: object properties: key: type: string description: The key part. value: type: string description: The value part. subject_type: type: string description: 'The subject type that the client application requests. Details about the subject type are described in [OpenID Connect Core 1.0, 8. Subjct Identifier Types](https://openid.net/specs/openid-connect-core-1_0.html#SubjectIDTypes). This property corresponds to `subject_type` in [OpenID Connect Dynamic Client Registration 1.0, 2. Client Metadata](https://openid.net/specs/openid-connect-registration-1_0.html#ClientMetadata). ' enum: - PUBLIC - PAIRWISE client_secret_update_response: type: object properties: resultCode: type: string description: The code which represents the result of the API call. resultMessage: type: string description: A short message which explains the result of the API call. newClientSecret: type: string description: 'The new client secret. ' oldClientSecret: type: string description: 'The old client secret. ' client_flag_update_request: type: object required: - clientLocked properties: clientLocked: type: boolean description: 'The flag value to be set ' client_authorization_get_list_response: type: object properties: start: type: integer format: int32 description: 'Start index of search results (inclusive). ' end: type: integer format: int32 description: 'End index of search results (exclusive). ' developer: type: string description: 'Unique ID of a client developer. ' subject: type: string description: 'Unique user ID of an end-user. ' totalCount: type: integer format: int32 description: 'Unique ID of a client developer. ' clients: type: array items: $ref: '#/components/schemas/client_limited' description: 'An array of clients. ' client_authorization_get_list_request: type: object properties: subject: type: string description: Unique user ID of an end-user. developer: type: string description: Unique ID of a client developer. start: type: integer format: int32 description: Start index of search results (inclusive). end: type: integer format: int32 description: End index of search results (exclusive). required: - subject responses: '403': description: '' content: application/json: schema: $ref: '#/components/schemas/result' example: resultCode: A001215 resultMessage: '[A001215] /auth/authorization, The client (ID = 26837717140341) is locked.' '401': description: '' content: application/json: schema: $ref: '#/components/schemas/result' example: resultCode: A001202 resultMessage: '[A001202] /auth/authorization, Authorization header is missing.' '400': description: '' content: application/json: schema: $ref: '#/components/schemas/result' example: resultCode: A001201 resultMessage: '[A001201] /auth/authorization, TLS must be used.' '500': description: '' content: application/json: schema: $ref: '#/components/schemas/result' example: resultCode: A001101 resultMessage: '[A001101] /auth/authorization, Authlete Server error.' securitySchemes: bearer: type: http scheme: bearer bearerFormat: JWT description: 'Authenticate every request with a **Service Access Token** or **Organization Token**. Set the token value in the `Authorization: Bearer ` header. **Service Access Token**: Scoped to a single service. Use when automating service-level configuration or runtime flows. **Organization Token**: Scoped to the organization; inherits permissions across services. Use for org-wide automation or when managing multiple services programmatically. Both token types are issued by the Authlete console or provisioning APIs. '