{
  "info": {
    "title": "oauth-clients",
    "version": ""
  },
  "paths": {
    "/api/v1/oauth-clients": {
      "get": {
        "tags": [
          "oauth-clients"
        ],
        "summary": "List OAuth clients",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "oneOf": [
                    {
                      "$ref": "#/components/schemas/OAuthClientAdminListResponse"
                    },
                    {
                      "$ref": "#/components/schemas/OAuthClientListResponse"
                    }
                  ]
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "$ref": "#/components/responses/Unauthorized"
          },
          "403": {
            "$ref": "#/components/responses/Forbidden"
          },
          "500": {
            "$ref": "#/components/responses/InternalServerError"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "parameters": [
          {
            "in": "query",
            "name": "filter",
            "schema": {
              "type": "string"
            },
            "example": "appType eq \"spa\" and clientId eq \"b3ee66d6f21d1611efa89a425f656f6f\"",
            "required": false,
            "description": "The filter query that should be used to filter the list of oauth clients.  The filter syntax is defined in RFC 7644. Valid attributes for filtering are `clientId`, `clientName`, `appType`, `tenantId`, and `createdByType`."
          },
          {
            "in": "query",
            "name": "limit",
            "schema": {
              "type": "number",
              "default": 20,
              "maximum": 100,
              "minimum": 1
            },
            "description": "The number of OAuth client entries to retrieve."
          },
          {
            "in": "query",
            "name": "next",
            "schema": {
              "type": "string"
            },
            "required": false,
            "description": "The next page cursor"
          },
          {
            "in": "query",
            "name": "prev",
            "schema": {
              "type": "string"
            },
            "required": false,
            "description": "The previous page cursor"
          },
          {
            "in": "query",
            "name": "sort",
            "schema": {
              "enum": [
                "+clientId",
                "-clientId",
                "+clientName",
                "-clientName",
                "+appType",
                "-appType",
                "+tenantId",
                "-tenantId",
                "+createdAt",
                "-createdAt",
                "+updatedAt",
                "-updatedAt"
              ],
              "type": "string"
            },
            "required": false,
            "description": "The attribute to sort by, beginning with + for ascending and - for descending. Valid attributes for sorting are clientId, clientName, appType, tenantId, createdAt, updatedAt."
          },
          {
            "in": "query",
            "name": "totalResults",
            "schema": {
              "type": "boolean",
              "default": false
            },
            "example": true,
            "required": false,
            "description": "Boolean query parameter that determines if the total count of results should be included in the response. If true, the response includes the total number of results in the `totalResults` field. If false or not included in the query, `totalResults` will be excluded from the response."
          }
        ],
        "description": "Retrieve all OAuth clients.",
        "operationId": "readAllOAuthClients",
        "x-qlik-visibility": "public",
        "x-qlik-stability": "stable",
        "x-qlik-deprecated": false,
        "x-qlik-tier": {
          "tier": "1",
          "limit": 1000
        }
      },
      "post": {
        "tags": [
          "oauth-clients"
        ],
        "summary": "Create an OAuth client",
        "responses": {
          "201": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/OAuthClientCreateResponse"
                }
              }
            },
            "description": "Created"
          },
          "400": {
            "$ref": "#/components/responses/BadRequest"
          },
          "401": {
            "$ref": "#/components/responses/Unauthorized"
          },
          "403": {
            "$ref": "#/components/responses/Forbidden"
          },
          "500": {
            "$ref": "#/components/responses/InternalServerError"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "description": "Create a new OAuth client. Requires `TenantAdmin` role when created in-tenant. `appType` cannot be changed after creation. Consent method and published state can be changed after creation. For supported `appType`, use `PATCH /oauth-clients/{id}/connection-configs/me` to change consent method, and `POST /oauth-clients/{id}/actions/publish` to change the client to published after creation.",
        "operationId": "createOAuthClient",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/OAuthClientCreateRequest"
              }
            }
          },
          "required": true
        },
        "x-qlik-visibility": "public",
        "x-qlik-stability": "stable",
        "x-qlik-deprecated": false,
        "x-qlik-tier": {
          "tier": "2",
          "limit": 100
        }
      }
    },
    "/api/v1/oauth-clients/{id}": {
      "get": {
        "tags": [
          "oauth-clients"
        ],
        "summary": "Get an OAuth client",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "oneOf": [
                    {
                      "$ref": "#/components/schemas/OAuthClientAdminReadResponse"
                    },
                    {
                      "$ref": "#/components/schemas/OAuthClientReadResponse"
                    }
                  ]
                }
              }
            },
            "description": "OK"
          },
          "400": {
            "$ref": "#/components/responses/BadRequest"
          },
          "401": {
            "$ref": "#/components/responses/Unauthorized"
          },
          "403": {
            "$ref": "#/components/responses/Forbidden"
          },
          "404": {
            "$ref": "#/components/responses/NotFound"
          },
          "500": {
            "$ref": "#/components/responses/InternalServerError"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "schema": {
              "type": "string"
            },
            "required": true,
            "description": "The unique identifier for the OAuth client"
          }
        ],
        "description": "Retrieves the specified OAuth client.",
        "operationId": "readOAuthClient",
        "x-qlik-visibility": "public",
        "x-qlik-stability": "stable",
        "x-qlik-deprecated": false,
        "x-qlik-tier": {
          "tier": "1",
          "limit": 1000
        }
      },
      "patch": {
        "tags": [
          "oauth-clients"
        ],
        "summary": "Update an OAuth client",
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/OAuthClientPatchResponse"
                }
              }
            },
            "description": "Accepted - Client secret was generated"
          },
          "204": {
            "description": "No Content"
          },
          "400": {
            "$ref": "#/components/responses/BadRequest"
          },
          "401": {
            "$ref": "#/components/responses/Unauthorized"
          },
          "403": {
            "$ref": "#/components/responses/Forbidden"
          },
          "404": {
            "$ref": "#/components/responses/NotFound"
          },
          "500": {
            "$ref": "#/components/responses/InternalServerError"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "schema": {
              "type": "string"
            },
            "required": true,
            "description": "The unique identifier for the OAuth client"
          }
        ],
        "description": "Updates the specified OAuth client. Returns 202 Accepted with a client secret in the response body if a client secret is generated during the update (e.g., when adding client_secret to allowedAuthMethods). Otherwise returns 204 No Content.",
        "operationId": "patchOAuthClient",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "type": "array",
                "items": {
                  "$ref": "#/components/schemas/OAuthClientUpdate"
                }
              }
            }
          },
          "required": true
        },
        "x-qlik-visibility": "public",
        "x-qlik-stability": "stable",
        "x-qlik-deprecated": false,
        "x-qlik-tier": {
          "tier": "2",
          "limit": 100
        }
      },
      "delete": {
        "tags": [
          "oauth-clients"
        ],
        "summary": "Delete an OAuth client",
        "responses": {
          "204": {
            "description": "No Content"
          },
          "400": {
            "$ref": "#/components/responses/BadRequest"
          },
          "401": {
            "$ref": "#/components/responses/Unauthorized"
          },
          "403": {
            "$ref": "#/components/responses/Forbidden"
          },
          "404": {
            "$ref": "#/components/responses/NotFound"
          },
          "500": {
            "$ref": "#/components/responses/InternalServerError"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "schema": {
              "type": "string"
            },
            "required": true,
            "description": "The unique identifier for the OAuth client"
          },
          {
            "in": "header",
            "name": "qlik-confirm-delete",
            "schema": {
              "type": "string"
            },
            "required": true,
            "description": "A confirmation string that should match the id of the oauth-client resource to be deleted"
          }
        ],
        "description": "Delete the specified OAuth client.",
        "operationId": "deleteOAuthClient",
        "x-qlik-visibility": "public",
        "x-qlik-stability": "stable",
        "x-qlik-deprecated": false,
        "x-qlik-tier": {
          "tier": "2",
          "limit": 100
        }
      }
    },
    "/api/v1/oauth-clients/{id}/actions/publish": {
      "post": {
        "tags": [
          "oauth-clients"
        ],
        "summary": "Publish an OAuth client",
        "responses": {
          "201": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/OAuthClientPublishResponse"
                }
              }
            },
            "description": "Created"
          },
          "400": {
            "$ref": "#/components/responses/BadRequest"
          },
          "401": {
            "$ref": "#/components/responses/Unauthorized"
          },
          "403": {
            "$ref": "#/components/responses/Forbidden"
          },
          "404": {
            "$ref": "#/components/responses/NotFound"
          },
          "500": {
            "$ref": "#/components/responses/InternalServerError"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "schema": {
              "type": "string"
            },
            "required": true,
            "description": "The unique identifier for the OAuth client"
          }
        ],
        "description": "Publishes the specified OAuth client. By default, OAuth clients are bound to the tenant that created it. Publishing shares the client and makes it available to all other tenants within a region. Third-party applications connecting to Qlik Cloud can then have the same client ID for all Qlik Cloud tenants.",
        "operationId": "publishOAuthClient",
        "x-qlik-visibility": "public",
        "x-qlik-stability": "stable",
        "x-qlik-deprecated": false,
        "x-qlik-tier": {
          "tier": "2",
          "limit": 100
        }
      }
    },
    "/api/v1/oauth-clients/{id}/client-secrets": {
      "post": {
        "tags": [
          "oauth-clients"
        ],
        "summary": "Create an OAuth client secret",
        "responses": {
          "201": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/OAuthClientSecretResponse"
                }
              }
            },
            "description": "Created"
          },
          "400": {
            "$ref": "#/components/responses/BadRequest"
          },
          "401": {
            "$ref": "#/components/responses/Unauthorized"
          },
          "403": {
            "$ref": "#/components/responses/Forbidden"
          },
          "404": {
            "$ref": "#/components/responses/NotFound"
          },
          "409": {
            "$ref": "#/components/responses/ClientSecretCreateExceedLimit"
          },
          "500": {
            "$ref": "#/components/responses/InternalServerError"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "schema": {
              "type": "string"
            },
            "required": true,
            "description": "The unique identifier for the OAuth client"
          }
        ],
        "description": "Create a new client secret for the specified OAuth client. An OAuth client can have a maximum of 5 client secrets at one time.",
        "operationId": "createOAuthClientSecret",
        "x-qlik-visibility": "public",
        "x-qlik-stability": "stable",
        "x-qlik-deprecated": false,
        "x-qlik-tier": {
          "tier": "2",
          "limit": 100
        }
      }
    },
    "/api/v1/oauth-clients/{id}/client-secrets/{hint}": {
      "delete": {
        "tags": [
          "oauth-clients"
        ],
        "summary": "Delete an OAuth client secret",
        "responses": {
          "204": {
            "description": "No Content"
          },
          "400": {
            "$ref": "#/components/responses/BadRequest"
          },
          "401": {
            "$ref": "#/components/responses/Unauthorized"
          },
          "403": {
            "$ref": "#/components/responses/Forbidden"
          },
          "404": {
            "$ref": "#/components/responses/NotFound"
          },
          "500": {
            "$ref": "#/components/responses/InternalServerError"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "parameters": [
          {
            "in": "path",
            "name": "hint",
            "schema": {
              "type": "string"
            },
            "required": true,
            "description": "The unique identifier for the OAuth secret"
          },
          {
            "in": "path",
            "name": "id",
            "schema": {
              "type": "string"
            },
            "required": true,
            "description": "The unique identifier for the OAuth client"
          }
        ],
        "description": "Deletes a specific client secret for an OAuth client.",
        "operationId": "deleteOAuthClientSecret",
        "x-qlik-visibility": "public",
        "x-qlik-stability": "stable",
        "x-qlik-deprecated": false,
        "x-qlik-tier": {
          "tier": "2",
          "limit": 100
        }
      }
    },
    "/api/v1/oauth-clients/{id}/connection-configs/me": {
      "get": {
        "tags": [
          "oauth-clients"
        ],
        "summary": "Get connection config for an OAuth client",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ConnectionConfigReadResponse"
                }
              }
            },
            "description": "OK"
          },
          "400": {
            "$ref": "#/components/responses/BadRequest"
          },
          "401": {
            "$ref": "#/components/responses/Unauthorized"
          },
          "403": {
            "$ref": "#/components/responses/Forbidden"
          },
          "404": {
            "$ref": "#/components/responses/NotFound"
          },
          "500": {
            "$ref": "#/components/responses/InternalServerError"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "schema": {
              "type": "string"
            },
            "required": true,
            "description": "The unique identifier for an OAuth client"
          }
        ],
        "description": "Get configuration for consent method and status.",
        "operationId": "readConnectionConfig",
        "x-qlik-visibility": "public",
        "x-qlik-stability": "stable",
        "x-qlik-deprecated": false,
        "x-qlik-tier": {
          "tier": "1",
          "limit": 1000
        }
      },
      "patch": {
        "tags": [
          "oauth-clients"
        ],
        "summary": "Update connection config for an OAuth client",
        "responses": {
          "204": {
            "description": "No Content"
          },
          "400": {
            "$ref": "#/components/responses/BadRequest"
          },
          "401": {
            "$ref": "#/components/responses/Unauthorized"
          },
          "403": {
            "$ref": "#/components/responses/Forbidden"
          },
          "404": {
            "$ref": "#/components/responses/NotFound"
          },
          "500": {
            "$ref": "#/components/responses/InternalServerError"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "schema": {
              "type": "string"
            },
            "required": true,
            "description": "The unique identifier for the OAuth client"
          }
        ],
        "description": "Updates the consent method for the specified OAuth client.",
        "operationId": "patchConnectionConfig",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "type": "array",
                "items": {
                  "$ref": "#/components/schemas/OAuthConnectionConfigUpdate"
                }
              }
            }
          },
          "required": true
        },
        "x-qlik-visibility": "public",
        "x-qlik-stability": "stable",
        "x-qlik-deprecated": false,
        "x-qlik-tier": {
          "tier": "2",
          "limit": 100
        }
      },
      "delete": {
        "tags": [
          "oauth-clients"
        ],
        "summary": "Delete connection config for an OAuth client",
        "responses": {
          "204": {
            "description": "No Content"
          },
          "400": {
            "$ref": "#/components/responses/BadRequest"
          },
          "401": {
            "$ref": "#/components/responses/Unauthorized"
          },
          "403": {
            "$ref": "#/components/responses/Forbidden"
          },
          "404": {
            "$ref": "#/components/responses/NotFound"
          },
          "500": {
            "$ref": "#/components/responses/InternalServerError"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "schema": {
              "type": "string"
            },
            "required": true,
            "description": "The unique identifier for the OAuth client"
          }
        ],
        "description": "Deletes the connection config for the calling tenant, related to the supplied client id.",
        "operationId": "deleteConnectionConfig",
        "x-qlik-visibility": "public",
        "x-qlik-stability": "stable",
        "x-qlik-deprecated": false,
        "x-qlik-tier": {
          "tier": "2",
          "limit": 100
        }
      }
    }
  },
  "openapi": "3.0.0",
  "components": {
    "responses": {
      "BadRequest": {
        "content": {
          "application/json": {
            "schema": {
              "$ref": "#/components/schemas/ErrorResponse"
            }
          }
        },
        "description": "Bad Request"
      },
      "ClientSecretCreateExceedLimit": {
        "content": {
          "application/json": {
            "schema": {
              "$ref": "#/components/schemas/ErrorResponse"
            }
          }
        },
        "description": "The max number of client secrets is 5"
      },
      "Forbidden": {
        "content": {
          "application/json": {
            "schema": {
              "$ref": "#/components/schemas/ErrorResponse"
            }
          }
        },
        "description": "Forbidden"
      },
      "InternalServerError": {
        "content": {
          "application/json": {
            "schema": {
              "$ref": "#/components/schemas/ErrorResponse"
            }
          }
        },
        "description": "Internal Server Error"
      },
      "NotFound": {
        "content": {
          "application/json": {
            "schema": {
              "$ref": "#/components/schemas/ErrorResponse"
            }
          }
        },
        "description": "Not Found"
      },
      "ServiceUnavailable": {
        "content": {
          "application/json": {
            "schema": {
              "$ref": "#/components/schemas/ErrorResponse"
            }
          }
        },
        "description": "Service Unavailable"
      },
      "Unauthorized": {
        "content": {
          "application/json": {
            "schema": {
              "$ref": "#/components/schemas/ErrorResponse"
            }
          }
        },
        "description": "Unauthorized"
      }
    },
    "schemas": {
      "ClientSecrets": {
        "type": "array",
        "items": {
          "type": "object",
          "required": [
            "hint"
          ],
          "properties": {
            "hint": {
              "type": "string",
              "maxLength": 5,
              "description": "Hint of a client application secret"
            },
            "createdAt": {
              "type": "string",
              "format": "date-time",
              "description": "The timestamp for when the client-secret record was created."
            },
            "createdBy": {
              "type": "string",
              "description": "The identifier for the user that created the client-secret record."
            }
          }
        },
        "readOnly": true,
        "description": "Hints of any client application secrets"
      },
      "ConnectionConfigReadResponse": {
        "type": "object",
        "required": [
          "consentMethod"
        ],
        "properties": {
          "status": {
            "type": "string",
            "readOnly": true,
            "description": "Status"
          },
          "consentMethod": {
            "type": "string",
            "readOnly": true,
            "description": "Consent method"
          },
          "deletedByOwner": {
            "type": "boolean",
            "readOnly": true,
            "description": "OAuth client has been deleted by owning tenant, only applies for published clients."
          }
        },
        "description": "Response schema for reading a connection config"
      },
      "Error": {
        "type": "object",
        "required": [
          "code",
          "title"
        ],
        "properties": {
          "code": {
            "type": "string",
            "description": "The unique code for the error"
          },
          "title": {
            "type": "string",
            "description": "A summary of the error"
          },
          "detail": {
            "type": "string",
            "description": "Additional details about the error"
          }
        }
      },
      "ErrorResponse": {
        "type": "object",
        "properties": {
          "errors": {
            "type": "array",
            "items": {
              "$ref": "#/components/schemas/Error"
            }
          }
        }
      },
      "JWK": {
        "type": "object",
        "required": [
          "kty",
          "use",
          "alg",
          "kid"
        ],
        "properties": {
          "e": {
            "type": "string",
            "example": "AQAB",
            "description": "Exponent for RSA keys"
          },
          "n": {
            "type": "string",
            "example": "0vx7agoebGcQSuuPiLJXZptN9nndrQmbXEps2aiAFbWhM78LhWx",
            "description": "Modulus for RSA keys"
          },
          "x": {
            "type": "string",
            "example": "WKn-ZIGevcwGIyyrzFoZNBdaq9_TsqzGl96oc0CWuis",
            "description": "X coordinate for EC keys"
          },
          "y": {
            "type": "string",
            "example": "y77t-RvAHRKTsSGdIYUfweuOvwrvDD-Q3Hv5J0fSKbE",
            "description": "Y coordinate for EC keys"
          },
          "alg": {
            "enum": [
              "RS256",
              "RS512",
              "ES384"
            ],
            "type": "string",
            "example": "RS256",
            "description": "Algorithm intended for use with the key"
          },
          "crv": {
            "type": "string",
            "example": "P-384",
            "description": "Curve for EC keys"
          },
          "kid": {
            "type": "string",
            "example": "key-1",
            "description": "Key ID"
          },
          "kty": {
            "enum": [
              "RSA",
              "EC"
            ],
            "type": "string",
            "example": "RSA",
            "description": "Key type (e.g., RSA, EC)"
          },
          "use": {
            "enum": [
              "sig"
            ],
            "type": "string",
            "example": "sig",
            "description": "Intended use of the key (typically \"sig\" for signature)"
          }
        },
        "description": "JSON Web Key (JWK) for the public key used to verify the signature of a client assertion JWT"
      },
      "Link": {
        "type": "object",
        "required": [
          "href"
        ],
        "properties": {
          "href": {
            "type": "string",
            "format": "uri",
            "description": "URL that defines the resource"
          }
        }
      },
      "Links": {
        "type": "object",
        "properties": {
          "next": {
            "$ref": "#/components/schemas/Link"
          },
          "prev": {
            "$ref": "#/components/schemas/Link"
          },
          "self": {
            "$ref": "#/components/schemas/Link"
          }
        }
      },
      "OAuthClientAdminListItem": {
        "type": "object",
        "allOf": [
          {
            "$ref": "#/components/schemas/OAuthClientBase"
          }
        ],
        "required": [
          "clientId"
        ],
        "properties": {
          "jwksUri": {
            "type": "string",
            "example": "https://example.com/.well-known/jwks.json",
            "maxLength": 2048,
            "description": "URI of the JSON Web Key Set (JWKS) for the client",
            "x-qlik-private": true
          },
          "clientId": {
            "type": "string",
            "readOnly": true,
            "maxLength": 512,
            "description": "Client application id"
          },
          "publicKeys": {
            "type": "array",
            "items": {
              "$ref": "#/components/schemas/JWK"
            },
            "description": "List of public keys for JWT authentication"
          },
          "redirectUris": {
            "type": "array",
            "items": {
              "type": "string",
              "maxItems": 5,
              "maxLength": 256,
              "uniqueItems": true
            },
            "description": "List of allowed redirect URIs for login"
          },
          "clientSecrets": {
            "$ref": "#/components/schemas/ClientSecrets"
          },
          "allowedOrigins": {
            "type": "array",
            "items": {
              "type": "string",
              "maxItems": 5,
              "maxLength": 256,
              "uniqueItems": true
            },
            "description": "List of allowed origins for client"
          },
          "connectionConfig": {
            "$ref": "#/components/schemas/ConnectionConfigReadResponse"
          },
          "allowedAuthMethods": {
            "type": "array",
            "items": {
              "enum": [
                "client_secret",
                "private_key_jwt"
              ],
              "type": "string"
            },
            "description": "List of allowed authentication methods for the client"
          }
        },
        "description": "Schema for a OAuth client when listing as an admin user"
      },
      "OAuthClientAdminListResponse": {
        "type": "object",
        "required": [
          "data",
          "links"
        ],
        "properties": {
          "data": {
            "type": "array",
            "items": {
              "$ref": "#/components/schemas/OAuthClientAdminListItem"
            }
          },
          "links": {
            "$ref": "#/components/schemas/Links"
          },
          "totalResults": {
            "type": "integer",
            "nullable": true,
            "description": "Total number of oauth clients, included only if `totalResults` query parameter is set to true."
          }
        },
        "description": "Response schema for listing OAuth clients as an admin user"
      },
      "OAuthClientAdminReadResponse": {
        "type": "object",
        "allOf": [
          {
            "$ref": "#/components/schemas/OAuthClientBase"
          }
        ],
        "required": [
          "clientId"
        ],
        "properties": {
          "jwksUri": {
            "type": "string",
            "example": "https://example.com/.well-known/jwks.json",
            "maxLength": 2048,
            "description": "URI of the JSON Web Key Set (JWKS) for the client",
            "x-qlik-private": true
          },
          "clientId": {
            "type": "string",
            "readOnly": true,
            "maxLength": 512,
            "description": "Client application id"
          },
          "publicKeys": {
            "type": "array",
            "items": {
              "$ref": "#/components/schemas/JWK"
            },
            "description": "List of public keys for JWT authentication"
          },
          "redirectUris": {
            "type": "array",
            "items": {
              "type": "string",
              "maxItems": 5,
              "maxLength": 256,
              "uniqueItems": true
            },
            "description": "List of allowed redirect URIs for login"
          },
          "clientSecrets": {
            "$ref": "#/components/schemas/ClientSecrets"
          },
          "allowedOrigins": {
            "type": "array",
            "items": {
              "type": "string",
              "maxItems": 5,
              "maxLength": 256,
              "uniqueItems": true
            },
            "description": "List of allowed origins for client"
          },
          "allowedAuthMethods": {
            "type": "array",
            "items": {
              "enum": [
                "client_secret",
                "private_key_jwt"
              ],
              "type": "string"
            },
            "description": "List of allowed authentication methods for the client"
          }
        },
        "description": "Response schema for reading an OAuth client as an admin user"
      },
      "OAuthClientBase": {
        "type": "object",
        "required": [
          "appType",
          "clientName",
          "createdAt",
          "ownerId"
        ],
        "properties": {
          "appType": {
            "enum": [
              "web",
              "native",
              "spa",
              "anonymous-embed"
            ],
            "type": "string",
            "maxLength": 64,
            "description": "Application type"
          },
          "jwksUri": {
            "type": "string",
            "example": "https://example.com/.well-known/jwks.json",
            "maxLength": 2048,
            "description": "URI of the JSON Web Key Set (JWKS) for the client",
            "x-qlik-private": true
          },
          "logoUri": {
            "type": "string",
            "maxLength": 2048,
            "description": "URI for logo of client"
          },
          "clientUri": {
            "type": "string",
            "maxLength": 2048,
            "description": "URI for homepage of client"
          },
          "createdAt": {
            "type": "string",
            "format": "date-time",
            "description": "The timestamp for when the oauth-clients record was created."
          },
          "deletedAt": {
            "type": "string",
            "format": "date-time",
            "description": "The timestamp for when the oauth-clients record was deleted."
          },
          "updatedAt": {
            "type": "string",
            "format": "date-time",
            "description": "The timestamp for when the oauth-clients record was updated."
          },
          "clientName": {
            "type": "string",
            "maxLength": 512,
            "description": "Client application name"
          },
          "disableTag": {
            "type": "string",
            "readOnly": true,
            "description": "Is set if client disabled"
          },
          "publicKeys": {
            "type": "array",
            "items": {
              "$ref": "#/components/schemas/JWK"
            },
            "description": "List of public keys for JWT authentication"
          },
          "description": {
            "type": "string",
            "maxLength": 4096,
            "description": "Client description"
          },
          "publishedAt": {
            "type": "string",
            "format": "date-time",
            "description": "The timestamp which is set, if the client is published."
          },
          "allowedScopes": {
            "type": "array",
            "items": {
              "type": "string",
              "maxLength": 256,
              "uniqueItems": true
            },
            "description": "List of allowed scopes for this client. For a full list of scopes see [qlik.dev/authenticate/oauth/scopes/](https://qlik.dev/authenticate/oauth/scopes/)."
          },
          "clientSecrets": {
            "type": "array",
            "items": {
              "type": "object",
              "required": [
                "hint"
              ],
              "properties": {
                "hint": {
                  "type": "string",
                  "maxLength": 5,
                  "description": "Hint of a client application secret"
                },
                "createdAt": {
                  "type": "string",
                  "format": "date-time",
                  "example": "2025-12-03T14:59:46.331Z",
                  "description": "The timestamp for when the client-secret record was created."
                },
                "createdBy": {
                  "type": "string",
                  "description": "The identifier for the user that created the client-secret record."
                }
              }
            },
            "readOnly": true,
            "description": "Hints of any client application secrets"
          },
          "createdByType": {
            "type": "string",
            "readOnly": true,
            "description": "The type of caller that created this client. Possible values are `user`, `service`, and `dcr` for Dynamic Client Registration."
          },
          "connectionConfig": {
            "type": "object",
            "properties": {
              "consentMethod": {
                "enum": [
                  "required",
                  "trusted"
                ],
                "type": "string",
                "example": "required",
                "description": "Specifies the consent method for the connection."
              }
            },
            "description": "Optional settings for configuring the client connection."
          },
          "allowedGrantTypes": {
            "type": "array",
            "items": {
              "enum": [
                "client_credentials",
                "urn:qlik:oauth:user-impersonation"
              ],
              "type": "string"
            },
            "description": "Allowed grant types, only for use with appType: 'web'"
          },
          "allowedAuthMethods": {
            "type": "array",
            "items": {
              "enum": [
                "client_secret",
                "private_key_jwt"
              ],
              "type": "string"
            },
            "description": "List of allowed authentication methods for the client"
          }
        },
        "description": "Base schema for OAuth client requests and responses"
      },
      "OAuthClientCreateRequest": {
        "type": "object",
        "required": [
          "appType",
          "clientName"
        ],
        "properties": {
          "appType": {
            "enum": [
              "web",
              "native",
              "spa",
              "anonymous-embed"
            ],
            "type": "string",
            "maxLength": 64,
            "description": "Application type"
          },
          "jwksUri": {
            "type": "string",
            "example": "https://example.com/.well-known/jwks.json",
            "maxLength": 2048,
            "description": "URI of the JSON Web Key Set (JWKS) for the client",
            "x-qlik-private": true
          },
          "logoUri": {
            "type": "string",
            "maxLength": 2048,
            "description": "URI for logo of client"
          },
          "clientUri": {
            "type": "string",
            "maxLength": 2048,
            "description": "URI for homepage of client"
          },
          "clientName": {
            "type": "string",
            "maxLength": 512,
            "description": "Client application name"
          },
          "publicKeys": {
            "type": "array",
            "items": {
              "$ref": "#/components/schemas/JWK"
            },
            "description": "List of public keys for JWT authentication (required when using private_key_jwt)"
          },
          "description": {
            "type": "string",
            "maxLength": 4096,
            "description": "Client description"
          },
          "redirectUris": {
            "type": "array",
            "items": {
              "type": "string",
              "maxItems": 5,
              "maxLength": 256,
              "uniqueItems": true
            },
            "description": "List of allowed redirect URIs for login"
          },
          "allowedScopes": {
            "type": "array",
            "items": {
              "type": "string",
              "maxLength": 256,
              "uniqueItems": true
            },
            "description": "List of allowed scopes for this client. For a full list of scopes see [qlik.dev/authenticate/oauth/scopes/](https://qlik.dev/authenticate/oauth/scopes/)."
          },
          "allowedOrigins": {
            "type": "array",
            "items": {
              "type": "string",
              "maxItems": 5,
              "maxLength": 256,
              "uniqueItems": true
            },
            "description": "List of allowed origins for this client, only available with SPA application type"
          },
          "connectionConfig": {
            "type": "object",
            "properties": {
              "consentMethod": {
                "enum": [
                  "trusted"
                ],
                "type": "string",
                "description": "Specifies the consent method for the connection. The only allowed value is \"trusted.\""
              }
            },
            "description": "Optional settings for configuring the client connection."
          },
          "allowedGrantTypes": {
            "type": "array",
            "items": {
              "enum": [
                "client_credentials",
                "urn:qlik:oauth:user-impersonation"
              ],
              "type": "string"
            },
            "description": "Allowed grant types, only for use with appType: 'web'"
          },
          "allowedAuthMethods": {
            "type": "array",
            "items": {
              "enum": [
                "client_secret",
                "private_key_jwt"
              ],
              "type": "string",
              "description": "An authentication method for the client"
            },
            "description": "List of allowed authentication methods for the client"
          }
        },
        "description": "Request schema for OAuth client creation"
      },
      "OAuthClientCreateResponse": {
        "type": "object",
        "allOf": [
          {
            "$ref": "#/components/schemas/OAuthClientBase"
          }
        ],
        "required": [
          "clientId",
          "clientSecret"
        ],
        "properties": {
          "clientId": {
            "type": "string",
            "readOnly": true,
            "maxLength": 512,
            "description": "Client application id"
          },
          "publicKeys": {
            "type": "array",
            "items": {
              "$ref": "#/components/schemas/JWK"
            },
            "description": "List of public keys for JWT authentication"
          },
          "clientSecret": {
            "type": "string",
            "readOnly": true,
            "maxLength": 64,
            "description": "Client application secret"
          },
          "redirectUris": {
            "type": "array",
            "items": {
              "type": "string",
              "maxItems": 5,
              "maxLength": 256,
              "uniqueItems": true
            },
            "description": "List of allowed redirect URIs for login"
          },
          "allowedOrigins": {
            "type": "array",
            "items": {
              "type": "string",
              "maxItems": 5,
              "maxLength": 256,
              "uniqueItems": true
            },
            "description": "List of allowed redirect URIs for login"
          },
          "allowedAuthMethods": {
            "type": "array",
            "items": {
              "enum": [
                "client_secret",
                "private_key_jwt"
              ],
              "type": "string"
            },
            "description": "List of allowed authentication methods for the client"
          }
        },
        "description": "Response schema for OAuth client creation"
      },
      "OAuthClientListResponse": {
        "type": "object",
        "required": [
          "data",
          "links"
        ],
        "properties": {
          "data": {
            "type": "array",
            "items": {
              "$ref": "#/components/schemas/OAuthClientReadResponse"
            }
          },
          "links": {
            "$ref": "#/components/schemas/Links"
          }
        },
        "description": "Response schema for listing OAuth clients"
      },
      "OAuthClientPatchResponse": {
        "type": "object",
        "required": [
          "clientSecret"
        ],
        "properties": {
          "clientSecret": {
            "type": "string",
            "readOnly": true,
            "description": "The generated client application secret"
          }
        },
        "description": "Response schema for PATCH /oauth-clients when a client secret is generated"
      },
      "OAuthClientPublishResponse": {
        "type": "object",
        "required": [
          "publishedAt"
        ],
        "properties": {
          "publishedAt": {
            "type": "string",
            "format": "date-time",
            "description": "The timestamp which is set, if the client is published."
          }
        },
        "description": "Response schema for successfully publishing an OAuth client"
      },
      "OAuthClientReadResponse": {
        "type": "object",
        "allOf": [
          {
            "$ref": "#/components/schemas/OAuthClientBase"
          }
        ],
        "required": [
          "clientId"
        ],
        "properties": {
          "clientId": {
            "type": "string",
            "readOnly": true,
            "maxLength": 512,
            "description": "Client application id"
          }
        },
        "description": "Response schema for reading an OAuth client"
      },
      "OAuthClientSecretResponse": {
        "type": "object",
        "required": [
          "clientId",
          "clientSecret",
          "hint"
        ],
        "properties": {
          "hint": {
            "type": "string",
            "readOnly": true,
            "description": "Client application hint"
          },
          "clientId": {
            "type": "string",
            "readOnly": true,
            "description": "Client application id"
          },
          "createdAt": {
            "type": "string",
            "format": "date-time",
            "description": "The timestamp for when the client-secret record was created."
          },
          "createdBy": {
            "type": "string",
            "description": "The identifier for the user that created the client-secret record."
          },
          "clientSecret": {
            "type": "string",
            "readOnly": true,
            "description": "Client application secret"
          }
        },
        "description": "Response schema for creating an OAuth client application secret"
      },
      "OAuthClientUpdate": {
        "type": "object",
        "required": [
          "op",
          "path"
        ],
        "properties": {
          "op": {
            "enum": [
              "add",
              "remove",
              "replace"
            ],
            "type": "string",
            "description": "The operation to be performed"
          },
          "path": {
            "enum": [
              "/allowedOrigins",
              "/clientName",
              "/clientUri",
              "/description",
              "/logoUri",
              "/redirectUris",
              "/allowedScopes",
              "/allowedGrantTypes",
              "/publicKeys",
              "/allowedAuthMethods",
              "/jwksUri"
            ],
            "type": "string",
            "description": "The path for the given resource field to patch"
          },
          "value": {
            "oneOf": [
              {
                "type": "string"
              },
              {
                "type": "array",
                "items": {
                  "type": "string"
                }
              }
            ],
            "description": "The value to be used for this operation."
          }
        },
        "description": "A JSON Patch document as defined in http://tools.ietf.org/html/rfc6902"
      },
      "OAuthConnectionConfigUpdate": {
        "type": "object",
        "required": [
          "op",
          "path",
          "value"
        ],
        "properties": {
          "op": {
            "enum": [
              "replace"
            ],
            "type": "string",
            "description": "The operation to be performed"
          },
          "path": {
            "enum": [
              "/consentMethod"
            ],
            "type": "string",
            "description": "The path for the given resource field to patch"
          },
          "value": {
            "enum": [
              "required",
              "trusted"
            ],
            "type": "string",
            "description": "The value to be used for this operation."
          }
        },
        "description": "A JSON Patch document as defined in http://tools.ietf.org/html/rfc6902"
      }
    }
  },
  "servers": [
    {
      "url": "https://{tenant}.{region}.qlikcloud.com",
      "variables": {
        "region": {
          "default": "us",
          "description": "The region the tenant is hosted in"
        },
        "tenant": {
          "default": "your-tenant",
          "description": "Name of the tenant that will be called"
        }
      }
    }
  ]
}