openapi: 3.0.1 info: title: Dynamic Client Registration API description: > This specification defines the APIs for a TPP to submit a Software Statement Assertion to an ASPSP for the purpose of creating OAuth clients that are registered with ASPSP. version: v3.1.0 paths: /register: post: summary: Register a client by way of a Software Statement Assertion description: Endpoint will be secured by way of Mutual Authentication over TLS tags: - Client Registration - Conditional parameters: [] responses: '201': $ref: '#/components/responses/OBClientRegistration1' '400': $ref: '#/components/responses/400Error' requestBody: $ref: '#/components/requestBodies/ClientRegistration' '/register/{ClientId}': get: summary: Get a client by way of Client ID tags: - Client Registration - Optional parameters: - $ref: '#/components/parameters/ClientId' - $ref: '#/components/parameters/Authorization' responses: '200': $ref: '#/components/responses/OBClientRegistration1' '401': $ref: '#/components/responses/401Error' '403': $ref: '#/components/responses/403Error' security: - TPPOAuth2Security: [] put: summary: Update a client by way of Client ID tags: - Client Registration - Optional parameters: - $ref: '#/components/parameters/ClientId' - $ref: '#/components/parameters/Authorization' responses: '200': $ref: '#/components/responses/OBClientRegistration1' '400': $ref: '#/components/responses/400Error' '401': $ref: '#/components/responses/401Error' '403': $ref: '#/components/responses/403Error' security: - TPPOAuth2Security: [] requestBody: $ref: '#/components/requestBodies/ClientRegistration' delete: summary: Delete a client by way of Client ID tags: - Client Registration - Optional parameters: - $ref: '#/components/parameters/ClientId' - $ref: '#/components/parameters/Authorization' responses: '204': description: Client deleted '401': $ref: '#/components/responses/401Error' '403': $ref: '#/components/responses/403Error' '405': $ref: '#/components/responses/403Error' security: - TPPOAuth2Security: [] components: parameters: Authorization: in: header name: Authorization required: true description: 'An Authorisation Token as per https://tools.ietf.org/html/rfc6750' schema: type: string ClientId: name: ClientId description: The client ID in: path required: true schema: type: string requestBodies: ClientRegistration: description: A request to register a Software Statement Assertion with an ASPSP content: application/json: schema: type: string format: OBClientRegistration1 required: true responses: OBClientRegistration1: description: Client registration content: application/json: schema: allOf: - $ref: '#/components/schemas/OBRegistrationProperties1' - required: - client_id 400Error: description: Request failed due to client error content: application/json: schema: $ref: '#/components/schemas/RegistrationError' 401Error: description: Request failed due to unknown or invalid Client or invalid access token headers: WWW-Authenticate: description: >- Response header field specified in https://tools.ietf.org/html/rfc6750 schema: type: string 403Error: description: 'The client does not have permission to read, update or delete the Client' 405Error: description: Method Not Allowed schemas: SupportedAlgorithms: type: string enum: - RS256 - PS256 - ES256 OBRegistrationProperties1: type: object required: - redirect_uris - token_endpoint_auth_method - grant_types - software_statement - application_type - id_token_signed_response_alg - request_object_signing_alg - tls_client_auth_dn properties: client_id: description: OAuth 2.0 client identifier string type: string minLength: 1 maxLength: 36 client_secret: description: OAuth 2.0 client secret string type: string minLength: 1 maxLength: 36 client_id_issued_at: description: >- Time at which the client identifier was issued expressed as seconds since 1970-01-01T00:00:00Z as measured in UTC type: integer format: int32 minimum: 0 client_secret_expires_at: description: >- Time at which the client secret will expire expressed as seconds since 1970-01-01T00:00:00Z as measured in UTC. Set to 0 if does not expire type: integer format: int32 minimum: 0 redirect_uris: type: array items: type: string format: uri minLength: 1 maxLength: 256 token_endpoint_auth_method: type: string enum: - private_key_jwt - tls_client_auth grant_types: type: array items: type: string enum: - client_credentials - authorization_code - refresh_token minItems: 1 response_types: type: array items: type: string enum: - code - code id_token software_id: type: string scope: type: array items: type: string minLength: 1 maxLength: 32 software_statement: type: string format: JWT application_type: type: string enum: - web - mobile id_token_signed_response_alg: $ref: '#/components/schemas/SupportedAlgorithms' request_object_signing_alg: $ref: '#/components/schemas/SupportedAlgorithms' token_endpoint_auth_signing_alg: $ref: '#/components/schemas/SupportedAlgorithms' tls_client_auth_dn: type: string minLength: 1 maxLength: 128 OBClientRegistration1: allOf: - type: object required: - iss - iat - exp - aud - jti properties: iss: description: >- Unique identifier for the TPP. Implemented as Base62 encoded GUID type: string pattern: '^[0-9a-zA-Z]{1,18}$' minLength: 1 maxLength: 18 iat: description: >- The time at which the request was issued by the TPP expressed as seconds since 1970-01-01T00:00:00Z as measured in UTC type: integer format: int32 minimum: 0 exp: description: >- The time at which the request expires expressed as seconds since 1970-01-01T00:00:00Z as measured in UTC type: integer format: int32 minimum: 0 aud: description: > The audience for the request. This should be the unique identifier for the ASPSP issued by the issuer of the software statement. Implemented as Base62 encoded GUID type: string pattern: '^[0-9a-zA-Z]{1,18}$' minLength: 1 maxLength: 18 jti: description: Unique identifier for the JWT implemented as UUID v4 type: string pattern: >- ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-4[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$ minLength: 36 maxLength: 36 - $ref: '#/components/schemas/OBRegistrationProperties1' RegistrationError: type: object required: - error properties: error: type: string enum: - invalid_redirect_uri - invalid_client_metadata - invalid_software_statement - unapproved_software_statement error_description: type: string minLength: 1 maxLength: 500 securitySchemes: TPPOAuth2Security: type: oauth2 description: >- TPP client credential authorisation flow with the ASPSP. No scopes defined as per specification flows: clientCredentials: tokenUrl: 'https://authserver.example/token' scopes: {}