openapi: 3.2.0
info:
  title: OAUTH Clients API
  version: ''
servers:
- url: https://{tenant}.{region}.qlikcloud.com
  variables:
    region:
      default: us
      description: The region the tenant is hosted in
    tenant:
      default: your-tenant
      description: Name of the tenant that will be called
tags:
- name: OAuth Clients
paths:
  /api/v1/oauth-clients:
    get:
      tags:
      - OAuth Clients
      summary: List OAuth clients
      responses:
        '200':
          content:
            application/json:
              schema:
                oneOf:
                - $ref: '#/components/schemas/OAuthClientAdminListResponse'
                - $ref: '#/components/schemas/OAuthClientListResponse'
          description: OK
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '500':
          $ref: '#/components/responses/InternalServerError'
        '503':
          $ref: '#/components/responses/ServiceUnavailable'
      parameters:
      - in: query
        name: filter
        schema:
          type: string
        example: appType eq "spa" and clientId eq "b3ee66d6f21d1611efa89a425f656f6f"
        required: false
        description: The filter query that should be used to filter the list of oauth clients.  The filter syntax is defined in RFC 7644. Valid attributes for filtering are `clientId`, `clientName`, `appType`, `tenantId`, and `createdByType`.
      - in: query
        name: limit
        schema:
          type: number
          default: 20
          maximum: 100
          minimum: 1
        description: The number of OAuth client entries to retrieve.
      - in: query
        name: next
        schema:
          type: string
        required: false
        description: The next page cursor
      - in: query
        name: prev
        schema:
          type: string
        required: false
        description: The previous page cursor
      - in: query
        name: sort
        schema:
          enum:
          - +clientId
          - -clientId
          - +clientName
          - -clientName
          - +appType
          - -appType
          - +tenantId
          - -tenantId
          - +createdAt
          - -createdAt
          - +updatedAt
          - -updatedAt
          type: string
        required: false
        description: The attribute to sort by, beginning with + for ascending and - for descending. Valid attributes for sorting are clientId, clientName, appType, tenantId, createdAt, updatedAt.
      - in: query
        name: totalResults
        schema:
          type: boolean
          default: false
        example: true
        required: false
        description: Boolean query parameter that determines if the total count of results should be included in the response. If true, the response includes the total number of results in the `totalResults` field. If false or not included in the query, `totalResults` will be excluded from the response.
      description: Retrieve all OAuth clients.
      operationId: readAllOAuthClients
      x-qlik-visibility: public
      x-qlik-stability: stable
      x-qlik-deprecated: false
      x-qlik-tier:
        tier: '1'
        limit: 1000
    post:
      tags:
      - OAuth Clients
      summary: Create an OAuth client
      responses:
        '201':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthClientCreateResponse'
          description: Created
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '500':
          $ref: '#/components/responses/InternalServerError'
        '503':
          $ref: '#/components/responses/ServiceUnavailable'
      description: Create a new OAuth client. Requires `TenantAdmin` role when created in-tenant. `appType` cannot be changed after creation. Consent method and published state can be changed after creation. For supported `appType`, use `PATCH /oauth-clients/{id}/connection-configs/me` to change consent method, and `POST /oauth-clients/{id}/actions/publish` to change the client to published after creation.
      operationId: createOAuthClient
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/OAuthClientCreateRequest'
        required: true
      x-qlik-visibility: public
      x-qlik-stability: stable
      x-qlik-deprecated: false
      x-qlik-tier:
        tier: '2'
        limit: 100
  /api/v1/oauth-clients/{id}:
    get:
      tags:
      - OAuth Clients
      summary: Get an OAuth client
      responses:
        '200':
          content:
            application/json:
              schema:
                oneOf:
                - $ref: '#/components/schemas/OAuthClientAdminReadResponse'
                - $ref: '#/components/schemas/OAuthClientReadResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/InternalServerError'
        '503':
          $ref: '#/components/responses/ServiceUnavailable'
      parameters:
      - in: path
        name: id
        schema:
          type: string
        required: true
        description: The unique identifier for the OAuth client
      description: Retrieves the specified OAuth client.
      operationId: readOAuthClient
      x-qlik-visibility: public
      x-qlik-stability: stable
      x-qlik-deprecated: false
      x-qlik-tier:
        tier: '1'
        limit: 1000
    patch:
      tags:
      - OAuth Clients
      summary: Update an OAuth client
      responses:
        '202':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthClientPatchResponse'
          description: Accepted - Client secret was generated
        '204':
          description: No Content
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/InternalServerError'
        '503':
          $ref: '#/components/responses/ServiceUnavailable'
      parameters:
      - in: path
        name: id
        schema:
          type: string
        required: true
        description: The unique identifier for the OAuth client
      description: Updates the specified OAuth client. Returns 202 Accepted with a client secret in the response body if a client secret is generated during the update (e.g., when adding client_secret to allowedAuthMethods). Otherwise returns 204 No Content.
      operationId: patchOAuthClient
      requestBody:
        content:
          application/json:
            schema:
              type: array
              items:
                $ref: '#/components/schemas/OAuthClientUpdate'
        required: true
      x-qlik-visibility: public
      x-qlik-stability: stable
      x-qlik-deprecated: false
      x-qlik-tier:
        tier: '2'
        limit: 100
    delete:
      tags:
      - OAuth Clients
      summary: Delete an OAuth client
      responses:
        '204':
          description: No Content
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/InternalServerError'
        '503':
          $ref: '#/components/responses/ServiceUnavailable'
      parameters:
      - in: path
        name: id
        schema:
          type: string
        required: true
        description: The unique identifier for the OAuth client
      - in: header
        name: qlik-confirm-delete
        schema:
          type: string
        required: true
        description: A confirmation string that should match the id of the oauth-client resource to be deleted
      description: Delete the specified OAuth client.
      operationId: deleteOAuthClient
      x-qlik-visibility: public
      x-qlik-stability: stable
      x-qlik-deprecated: false
      x-qlik-tier:
        tier: '2'
        limit: 100
  /api/v1/oauth-clients/{id}/actions/publish:
    post:
      tags:
      - OAuth Clients
      summary: Publish an OAuth client
      responses:
        '201':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthClientPublishResponse'
          description: Created
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/InternalServerError'
        '503':
          $ref: '#/components/responses/ServiceUnavailable'
      parameters:
      - in: path
        name: id
        schema:
          type: string
        required: true
        description: The unique identifier for the OAuth client
      description: Publishes the specified OAuth client. By default, OAuth clients are bound to the tenant that created it. Publishing shares the client and makes it available to all other tenants within a region. Third-party applications connecting to Qlik Cloud can then have the same client ID for all Qlik Cloud tenants.
      operationId: publishOAuthClient
      x-qlik-visibility: public
      x-qlik-stability: stable
      x-qlik-deprecated: false
      x-qlik-tier:
        tier: '2'
        limit: 100
  /api/v1/oauth-clients/{id}/client-secrets:
    post:
      tags:
      - OAuth Clients
      summary: Create an OAuth client secret
      responses:
        '201':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthClientSecretResponse'
          description: Created
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          $ref: '#/components/responses/ClientSecretCreateExceedLimit'
        '500':
          $ref: '#/components/responses/InternalServerError'
        '503':
          $ref: '#/components/responses/ServiceUnavailable'
      parameters:
      - in: path
        name: id
        schema:
          type: string
        required: true
        description: The unique identifier for the OAuth client
      description: Create a new client secret for the specified OAuth client. An OAuth client can have a maximum of 5 client secrets at one time.
      operationId: createOAuthClientSecret
      x-qlik-visibility: public
      x-qlik-stability: stable
      x-qlik-deprecated: false
      x-qlik-tier:
        tier: '2'
        limit: 100
  /api/v1/oauth-clients/{id}/client-secrets/{hint}:
    delete:
      tags:
      - OAuth Clients
      summary: Delete an OAuth client secret
      responses:
        '204':
          description: No Content
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/InternalServerError'
        '503':
          $ref: '#/components/responses/ServiceUnavailable'
      parameters:
      - in: path
        name: hint
        schema:
          type: string
        required: true
        description: The unique identifier for the OAuth secret
      - in: path
        name: id
        schema:
          type: string
        required: true
        description: The unique identifier for the OAuth client
      description: Deletes a specific client secret for an OAuth client.
      operationId: deleteOAuthClientSecret
      x-qlik-visibility: public
      x-qlik-stability: stable
      x-qlik-deprecated: false
      x-qlik-tier:
        tier: '2'
        limit: 100
  /api/v1/oauth-clients/{id}/connection-configs/me:
    get:
      tags:
      - OAuth Clients
      summary: Get connection config for an OAuth client
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ConnectionConfigReadResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/InternalServerError'
        '503':
          $ref: '#/components/responses/ServiceUnavailable'
      parameters:
      - in: path
        name: id
        schema:
          type: string
        required: true
        description: The unique identifier for an OAuth client
      description: Get configuration for consent method and status.
      operationId: readConnectionConfig
      x-qlik-visibility: public
      x-qlik-stability: stable
      x-qlik-deprecated: false
      x-qlik-tier:
        tier: '1'
        limit: 1000
    patch:
      tags:
      - OAuth Clients
      summary: Update connection config for an OAuth client
      responses:
        '204':
          description: No Content
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/InternalServerError'
        '503':
          $ref: '#/components/responses/ServiceUnavailable'
      parameters:
      - in: path
        name: id
        schema:
          type: string
        required: true
        description: The unique identifier for the OAuth client
      description: Updates the consent method for the specified OAuth client.
      operationId: patchConnectionConfig
      requestBody:
        content:
          application/json:
            schema:
              type: array
              items:
                $ref: '#/components/schemas/OAuthConnectionConfigUpdate'
        required: true
      x-qlik-visibility: public
      x-qlik-stability: stable
      x-qlik-deprecated: false
      x-qlik-tier:
        tier: '2'
        limit: 100
    delete:
      tags:
      - OAuth Clients
      summary: Delete connection config for an OAuth client
      responses:
        '204':
          description: No Content
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/InternalServerError'
        '503':
          $ref: '#/components/responses/ServiceUnavailable'
      parameters:
      - in: path
        name: id
        schema:
          type: string
        required: true
        description: The unique identifier for the OAuth client
      description: Deletes the connection config for the calling tenant, related to the supplied client id.
      operationId: deleteConnectionConfig
      x-qlik-visibility: public
      x-qlik-stability: stable
      x-qlik-deprecated: false
      x-qlik-tier:
        tier: '2'
        limit: 100
components:
  schemas:
    OAuthClientPublishResponse:
      type: object
      required:
      - publishedAt
      properties:
        publishedAt:
          type: string
          format: date-time
          description: The timestamp which is set, if the client is published.
      description: Response schema for successfully publishing an OAuth client
    OAuthClientSecretResponse:
      type: object
      required:
      - clientId
      - clientSecret
      - hint
      properties:
        hint:
          type: string
          readOnly: true
          description: Client application hint
        clientId:
          type: string
          readOnly: true
          description: Client application id
        createdAt:
          type: string
          format: date-time
          description: The timestamp for when the client-secret record was created.
        createdBy:
          type: string
          description: The identifier for the user that created the client-secret record.
        clientSecret:
          type: string
          readOnly: true
          description: Client application secret
      description: Response schema for creating an OAuth client application secret
    OAuthClientListResponse:
      type: object
      required:
      - data
      - links
      properties:
        data:
          type: array
          items:
            $ref: '#/components/schemas/OAuthClientReadResponse'
        links:
          $ref: '#/components/schemas/Links'
      description: Response schema for listing OAuth clients
    OAuthClientAdminListItem:
      type: object
      allOf:
      - $ref: '#/components/schemas/OAuthClientBase'
      required:
      - clientId
      properties:
        jwksUri:
          type: string
          example: https://example.com/.well-known/jwks.json
          maxLength: 2048
          description: URI of the JSON Web Key Set (JWKS) for the client
          x-qlik-private: true
        clientId:
          type: string
          readOnly: true
          maxLength: 512
          description: Client application id
        publicKeys:
          type: array
          items:
            $ref: '#/components/schemas/JWK'
          description: List of public keys for JWT authentication
        redirectUris:
          type: array
          items:
            type: string
            maxItems: 5
            maxLength: 256
            uniqueItems: true
          description: List of allowed redirect URIs for login
        clientSecrets:
          $ref: '#/components/schemas/ClientSecrets'
        allowedOrigins:
          type: array
          items:
            type: string
            maxItems: 5
            maxLength: 256
            uniqueItems: true
          description: List of allowed origins for client
        connectionConfig:
          $ref: '#/components/schemas/ConnectionConfigReadResponse'
        allowedAuthMethods:
          type: array
          items:
            enum:
            - client_secret
            - private_key_jwt
            type: string
          description: List of allowed authentication methods for the client
      description: Schema for a OAuth client when listing as an admin user
    Error:
      type: object
      required:
      - code
      - title
      properties:
        code:
          type: string
          description: The unique code for the error
        title:
          type: string
          description: A summary of the error
        detail:
          type: string
          description: Additional details about the error
    ClientSecrets:
      type: array
      items:
        type: object
        required:
        - hint
        properties:
          hint:
            type: string
            maxLength: 5
            description: Hint of a client application secret
          createdAt:
            type: string
            format: date-time
            description: The timestamp for when the client-secret record was created.
          createdBy:
            type: string
            description: The identifier for the user that created the client-secret record.
      readOnly: true
      description: Hints of any client application secrets
    ConnectionConfigReadResponse:
      type: object
      required:
      - consentMethod
      properties:
        status:
          type: string
          readOnly: true
          description: Status
        consentMethod:
          type: string
          readOnly: true
          description: Consent method
        deletedByOwner:
          type: boolean
          readOnly: true
          description: OAuth client has been deleted by owning tenant, only applies for published clients.
      description: Response schema for reading a connection config
    JWK:
      type: object
      required:
      - kty
      - use
      - alg
      - kid
      properties:
        e:
          type: string
          example: AQAB
          description: Exponent for RSA keys
        n:
          type: string
          example: 0vx7agoebGcQSuuPiLJXZptN9nndrQmbXEps2aiAFbWhM78LhWx
          description: Modulus for RSA keys
        x:
          type: string
          example: WKn-ZIGevcwGIyyrzFoZNBdaq9_TsqzGl96oc0CWuis
          description: X coordinate for EC keys
        y:
          type: string
          example: y77t-RvAHRKTsSGdIYUfweuOvwrvDD-Q3Hv5J0fSKbE
          description: Y coordinate for EC keys
        alg:
          enum:
          - RS256
          - RS512
          - ES384
          type: string
          example: RS256
          description: Algorithm intended for use with the key
        crv:
          type: string
          example: P-384
          description: Curve for EC keys
        kid:
          type: string
          example: key-1
          description: Key ID
        kty:
          enum:
          - RSA
          - EC
          type: string
          example: RSA
          description: Key type (e.g., RSA, EC)
        use:
          enum:
          - sig
          type: string
          example: sig
          description: Intended use of the key (typically "sig" for signature)
      description: JSON Web Key (JWK) for the public key used to verify the signature of a client assertion JWT
    Links:
      type: object
      properties:
        next:
          $ref: '#/components/schemas/Link'
        prev:
          $ref: '#/components/schemas/Link'
        self:
          $ref: '#/components/schemas/Link'
    OAuthClientAdminReadResponse:
      type: object
      allOf:
      - $ref: '#/components/schemas/OAuthClientBase'
      required:
      - clientId
      properties:
        jwksUri:
          type: string
          example: https://example.com/.well-known/jwks.json
          maxLength: 2048
          description: URI of the JSON Web Key Set (JWKS) for the client
          x-qlik-private: true
        clientId:
          type: string
          readOnly: true
          maxLength: 512
          description: Client application id
        publicKeys:
          type: array
          items:
            $ref: '#/components/schemas/JWK'
          description: List of public keys for JWT authentication
        redirectUris:
          type: array
          items:
            type: string
            maxItems: 5
            maxLength: 256
            uniqueItems: true
          description: List of allowed redirect URIs for login
        clientSecrets:
          $ref: '#/components/schemas/ClientSecrets'
        allowedOrigins:
          type: array
          items:
            type: string
            maxItems: 5
            maxLength: 256
            uniqueItems: true
          description: List of allowed origins for client
        allowedAuthMethods:
          type: array
          items:
            enum:
            - client_secret
            - private_key_jwt
            type: string
          description: List of allowed authentication methods for the client
      description: Response schema for reading an OAuth client as an admin user
    ErrorResponse:
      type: object
      properties:
        errors:
          type: array
          items:
            $ref: '#/components/schemas/Error'
    OAuthClientReadResponse:
      type: object
      allOf:
      - $ref: '#/components/schemas/OAuthClientBase'
      required:
      - clientId
      properties:
        clientId:
          type: string
          readOnly: true
          maxLength: 512
          description: Client application id
      description: Response schema for reading an OAuth client
    OAuthClientUpdate:
      type: object
      required:
      - op
      - path
      properties:
        op:
          enum:
          - add
          - remove
          - replace
          type: string
          description: The operation to be performed
        path:
          enum:
          - /allowedOrigins
          - /clientName
          - /clientUri
          - /description
          - /logoUri
          - /redirectUris
          - /allowedScopes
          - /allowedGrantTypes
          - /publicKeys
          - /allowedAuthMethods
          - /jwksUri
          type: string
          description: The path for the given resource field to patch
        value:
          oneOf:
          - type: string
          - type: array
            items:
              type: string
          description: The value to be used for this operation.
      description: A JSON Patch document as defined in http://tools.ietf.org/html/rfc6902
    Link:
      type: object
      required:
      - href
      properties:
        href:
          type: string
          format: uri
          description: URL that defines the resource
    OAuthClientPatchResponse:
      type: object
      required:
      - clientSecret
      properties:
        clientSecret:
          type: string
          readOnly: true
          description: The generated client application secret
      description: Response schema for PATCH /oauth-clients when a client secret is generated
    OAuthClientBase:
      type: object
      required:
      - appType
      - clientName
      - createdAt
      - ownerId
      properties:
        appType:
          enum:
          - web
          - native
          - spa
          - anonymous-embed
          type: string
          maxLength: 64
          description: Application type
        jwksUri:
          type: string
          example: https://example.com/.well-known/jwks.json
          maxLength: 2048
          description: URI of the JSON Web Key Set (JWKS) for the client
          x-qlik-private: true
        logoUri:
          type: string
          maxLength: 2048
          description: URI for logo of client
        clientUri:
          type: string
          maxLength: 2048
          description: URI for homepage of client
        createdAt:
          type: string
          format: date-time
          description: The timestamp for when the oauth-clients record was created.
        deletedAt:
          type: string
          format: date-time
          description: The timestamp for when the oauth-clients record was deleted.
        updatedAt:
          type: string
          format: date-time
          description: The timestamp for when the oauth-clients record was updated.
        clientName:
          type: string
          maxLength: 512
          description: Client application name
        disableTag:
          type: string
          readOnly: true
          description: Is set if client disabled
        publicKeys:
          type: array
          items:
            $ref: '#/components/schemas/JWK'
          description: List of public keys for JWT authentication
        description:
          type: string
          maxLength: 4096
          description: Client description
        publishedAt:
          type: string
          format: date-time
          description: The timestamp which is set, if the client is published.
        allowedScopes:
          type: array
          items:
            type: string
            maxLength: 256
            uniqueItems: true
          description: List of allowed scopes for this client. For a full list of scopes see [qlik.dev/authenticate/oauth/scopes/](https://qlik.dev/authenticate/oauth/scopes/).
        clientSecrets:
          type: array
          items:
            type: object
            required:
            - hint
            properties:
              hint:
                type: string
                maxLength: 5
                description: Hint of a client application secret
              createdAt:
                type: string
                format: date-time
                example: '2025-12-03T14:59:46.331Z'
                description: The timestamp for when the client-secret record was created.
              createdBy:
                type: string
                description: The identifier for the user that created the client-secret record.
          readOnly: true
          description: Hints of any client application secrets
        createdByType:
          type: string
          readOnly: true
          description: The type of caller that created this client. Possible values are `user`, `service`, and `dcr` for Dynamic Client Registration.
        connectionConfig:
          type: object
          properties:
            consentMethod:
              enum:
              - required
              - trusted
              type: string
              example: required
              description: Specifies the consent method for the connection.
          description: Optional settings for configuring the client connection.
        allowedGrantTypes:
          type: array
          items:
            enum:
            - client_credentials
            - urn:qlik:oauth:user-impersonation
            type: string
          description: 'Allowed grant types, only for use with appType: ''web'''
        allowedAuthMethods:
          type: array
          items:
            enum:
            - client_secret
            - private_key_jwt
            type: string
          description: List of allowed authentication methods for the client
      description: Base schema for OAuth client requests and responses
    OAuthClientAdminListResponse:
      type: object
      required:
      - data
      - links
      properties:
        data:
          type: array
          items:
            $ref: '#/components/schemas/OAuthClientAdminListItem'
        links:
          $ref: '#/components/schemas/Links'
        totalResults:
          type:
          - integer
          - 'null'
          description: Total number of oauth clients, included only if `totalResults` query parameter is set to true.
      description: Response schema for listing OAuth clients as an admin user
    OAuthClientCreateResponse:
      type: object
      allOf:
      - $ref: '#/components/schemas/OAuthClientBase'
      required:
      - clientId
      - clientSecret
      properties:
        clientId:
          type: string
          readOnly: true
          maxLength: 512
          description: Client application id
        publicKeys:
          type: array
          items:
            $ref: '#/components/schemas/JWK'
          description: List of public keys for JWT authentication
        clientSecret:
          type: string
          readOnly: true
          maxLength: 64
          description: Client application secret
        redirectUris:
          type: array
          items:
            type: string
            maxItems: 5
            maxLength: 256
            uniqueItems: true
          description: List of allowed redirect URIs for login
        allowedOrigins:
          type: array
          items:
            type: string
            maxItems: 5
            maxLength: 256
            uniqueItems: true
          description: List of allowed redirect URIs for login
        allowedAuthMethods:
          type: array
          items:
            enum:
            - client_secret
            - private_key_jwt
            type: string
          description: List of allowed authentication methods for the client
      description: Response schema for OAuth client creation
    OAuthConnectionConfigUpdate:
      type: object
      required:
      - op
      - path
      - value
      properties:
        op:
          enum:
          - replace
          type: string
          description: The operation to be performed
        path:
          enum:
          - /consentMethod
          type: string
          description: The path for the given resource field to patch
        value:
          enum:
          - required
          - trusted
          type: string
          description: The value to be used for this operation.
      description: A JSON Patch document as defined in http://tools.ietf.org/html/rfc6902
    OAuthClientCreateRequest:
      type: object
      required:
      - appType
      - clientName
      properties:
        appType:
          enum:
          - web
          - native
          - spa
          - anonymous-embed
          type: string
          maxLength: 64
          description: Application type
        jwksUri:
          type: string
          example: https://example.com/.well-known/jwks.json
          maxLength: 2048
          description: URI of the JSON Web Key Set (JWKS) for the client
          x-qlik-private: true
        logoUri:
          type: string
          maxLength: 2048
          description: URI for logo of client
        clientUri:
          type: string
          maxLength: 2048
          description: URI for homepage of client
        clientName:
          type: string
          maxLength: 512
          description: Client application name
        publicKeys:
          type: array
          items:
            $ref: '#/components/schemas/JWK'
          description: List of public keys for JWT authentication (required when using private_key_jwt)
        description:
          type: string
          maxLength: 4096
          description: Client description
        redirectUris:
          type: array
          items:
            type: string
            maxItems: 5
            maxLength: 256
            uniqueItems: true
          description: List of allowed redirect URIs for login
        allowedScopes:
          type: array
          items:
            type: string
            maxLength: 256
            uniqueItems: true
          description: List of allowed scopes for this client. For a full list of scopes see [qlik.dev/authenticate/oauth/scopes/](https://qlik.dev/authenticate/oauth/scopes/).
        allowedOrigins:
          type: array
          items:
            type: string
            maxItems: 5
            maxLength: 256
            uniqueItems: true
          description: List of allowed origins for this client, only available with SPA application type
        connectionConfig:
          type: object
          properties:
            consentMethod:
              enum:
              - trusted
              type: string
              description: Specifies the consent method for the connection. The only allowed value is "trusted."
          description: Optional settings for configuring the client connection.
        allowedGrantTypes:
          type: array
          items:
            enum:
            - client_credentials
            - urn:qlik:oauth:user-impersonation
            type: string
          description: 'Allowed grant types, only for use with appType: ''web'''
        allowedAuthMethods:
          type: array
          items:
            enum:
            - client_secret
            - private_key_jwt
            type: string
            description: An authentication method for the client
          description: List of allowed authentication methods for the client
      description: Request schema for OAuth client creation
  responses:
    NotFound:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
      description: Not Found
    Forbidden:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
      description: Forbidden
    Unauthorized:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
      description: Unauthorized
    ClientSecretCreateExceedLimit:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
      description: The max number of client secrets is 5
    BadRequest:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
      description: Bad Request
    InternalServerError:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
      description: Internal Server Error
    ServiceUnavailable:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
      description: Service Unavailable