--- title: "Process Authorization Request" method: POST path: "/api/{serviceId}/auth/authorization" tags: ["Authorization Endpoint"] --- # Process Authorization Request `POST /api/{serviceId}/auth/authorization` This API parses request parameters of an authorization request and returns necessary data for the authorization server implementation to process the authorization request further. ## Path parameters - `serviceId` string, required ## Request body - AuthorizationRequest - `parameters` string, required — OAuth 2.0 authorization request parameters which are the request parameters that the OAuth 2.0 authorization endpoint of the authorization server implementation received from the client application. The value of parameters is either (1) the entire query string when the HTTP method of the request from the client application is `GET` or (2) the entire entity body (which is formatted in `application/x-www-form-urlencoded`) when the HTTP method of the request from the client application is `POST`. - `context` string — The arbitrary text to be attached to the ticket that will be issued from the `/auth/authorization` API. The text can be retrieved later by the `/auth/authorization/ticket/info` API and can be updated by the `/auth/authorization/ticket/update` API. The text will be compressed and encrypted when it is saved in the Authlete database. - `cimdOptions` CimdOptions — Options for [OAuth Client ID Metadata Document](https://datatracker.ietf.org/doc/draft-ietf-oauth-client-id-metadata-document/) (CIMD). These options allow per-request control over CIMD behavior, taking precedence over service-level configuration when provided. - `alwaysRetrieved` boolean — Whether to always retrieve client metadata in the CIMD context regardless of the cache's validity. Under normal circumstances, client metadata retrieved from the location referenced by the client ID is stored in the database with an expiration time calculated using HTTP caching mechanisms (see [RFC 9111 HTTP Caching](https://www.rfc-editor.org/rfc/rfc9111.html)). Until that expiration time is reached, Authlete does not attempt to retrieve the client metadata again. When this flag is set to `true`, Authlete retrieves the client metadata regardless of the cache's validity. If this flag is included in an Authlete API call and its value is `true`, it takes precedence over the corresponding service configuration (see `Service.cimdAlwaysRetrieved`). This flag is effective only when the service supports CIMD (see `Service.clientIdMetadataDocumentSupported`) and CIMD is actually used to resolve client metadata. For example, if the client ID in a request does not appear to be a valid URI, CIMD will not be used even if the service is configured to support it. In such cases, this flag has no effect. Client metadata retrieval is performed only in the initiating request of an authorization flow, and not in any subsequent requests. For example, in the authorization code flow, metadata may be retrieved during the authorization request, but not during the subsequent token request. In contrast, in the client credentials flow, metadata retrieval may occur because the token request itself is the initiating request in the flow. - `httpPermitted` boolean — Whether to allow the `http` scheme in client IDs in the CIMD context. The specification requires the `https` scheme, but if this flag is set to `true`, Authlete also allows the `http` scheme. The main purpose of this option is to make development easier for developers who run CIMD-enabled servers and a web server publishing client metadata on their local machines without TLS. Given this purpose, it is not recommended to enable this option in production environments unless an allowlist is used (see `Service.cimdAllowlistEnabled`). If this flag is included in an Authlete API call and its value is `true`, it takes precedence over the corresponding service configuration (see `Service.cimdHttpPermitted`). - `queryPermitted` boolean — Whether to allow a query component in client IDs in the CIMD context. Although the specification states that a client ID "SHOULD NOT include a query string component," it does technically allow it. However, query components are prone to misuse. Therefore, Authlete does not allow them by default. Setting this flag to `true` relaxes that restriction. If this flag is included in an Authlete API call and its value is `true`, it takes precedence over the corresponding service configuration (see `Service.cimdQueryPermitted`). ## Response `200` Authorization request processed successfully - AuthorizationResponse - `resultCode` string — The code which represents the result of the API call. - `resultMessage` string — A short message which explains the result of the API call. - `action` 'INTERNAL_SERVER_ERROR' | 'BAD_REQUEST' | 'LOCATION' | 'FORM' | 'NO_INTERACTION' | 'INTERACTION' — The next action that the authorization server implementation should take. - `client` ClientLimitedAuthorization - `number` integer — The sequential number of the client. The value of this property is assigned by Authlete. - `clientName` string — The name of the client application. This property corresponds to `client_name` in [OpenID Connect Dynamic Client Registration 1.0, 2. Client Metadata](https://openid.net/specs/openid-connect-registration-1_0.html#ClientMetadata). - `clientNames` TaggedValue[] — Client names with language tags. If the client application has different names for different languages, this property can be used to register the names. - `tag` string — The language tag part. - `value` string — The value part. - `description` string — The description about the client application. - `descriptions` TaggedValue[] — Descriptions about the client application with language tags. If the client application has different descriptions for different languages, this property can be used to register the descriptions. - `tag` string — The language tag part. - `value` string — The value part. - `clientId` integer — The client identifier used in Authlete API calls. The value of this property is assigned by Authlete. - `clientIdAlias` string — The value of the client's `client_id` property used in OAuth and OpenID Connect calls. By default, this is a string version of the `clientId` property. - `clientIdAliasEnabled` boolean — Deprecated. Always set to `true`. - `clientType` 'PUBLIC' | 'CONFIDENTIAL' — The client type, either `CONFIDENTIAL` or `PUBLIC`. See [RFC 6749, 2.1. Client Types](https://datatracker.ietf.org/doc/html/rfc6749#section-2.1) for details. - `logoUri` string — The URL pointing to the logo image of the client application. This property corresponds to `logo_uri` in [OpenID Connect Dynamic Client Registration 1.0, 2. Client Metadata](https://openid.net/specs/openid-connect-registration-1_0.html#ClientMetadata). - `logoUris` TaggedValue[] — Logo image URLs with language tags. If the client application has different logo images for different languages, this property can be used to register URLs of the images. - `tag` string — The language tag part. - `value` string — The value part. - `tosUri` string — The URL pointing to the "Terms Of Service" page. This property corresponds to `tos_uri` in [OpenID Connect Dynamic Client Registration 1.0, 2. Client Metadata](https://openid.net/specs/openid-connect-registration-1_0.html#ClientMetadata). - `tosUris` TaggedValue[] — URLs of "Terms Of Service" pages with language tags. If the client application has different "Terms Of Service" pages for different languages, this property can be used to register the URLs. - `tag` string — The language tag part. - `value` string — The value part. - `policyUri` string — The URL pointing to the page which describes the policy as to how end-user's profile data is used. This property corresponds to `policy_uri` in [OpenID Connect Dynamic Client Registration 1.0, 2. Client Metadata](https://openid.net/specs/openid-connect-registration-1_0.html#ClientMetadata). - `policyUris` TaggedValue[] — URLs of policy pages with language tags. If the client application has different policy pages for different languages, this property can be used to register the URLs. - `tag` string — The language tag part. - `value` string — The value part. - `serviceNumber` integer — The sequential number of the service of the client application. The value of this property is assigned by Authlete. - `defaultMaxAge` integer — The default maximum authentication age in seconds. This value is used when an authorization request from the client application does not have `max_age` request parameter. This property corresponds to `default_max_age` in [OpenID Connect Dynamic Client Registration 1.0, 2. Client Metadata](https://openid.net/specs/openid-connect-registration-1_0.html#ClientMetadata). - `authTimeRequired` boolean — The flag to indicate whether this client requires `auth_time` claim to be embedded in the ID token. This property corresponds to `require_auth_time` in [OpenID Connect Dynamic Client Registration 1.0, 2. Client Metadata](https://openid.net/specs/openid-connect-registration-1_0.html#ClientMetadata). - `createdAt` integer — The time at which this client was created. The value is represented as milliseconds since the UNIX epoch (1970-01-01). - `modifiedAt` integer — The time at which this client was last modified. The value is represented as milliseconds since the UNIX epoch (1970-01-01). - `tlsClientCertificateBoundAccessTokens` boolean — The flag to indicate whether this client use TLS client certificate bound access tokens. - `bcUserCodeRequired` boolean — The boolean flag to indicate whether a user code is required when this client makes a backchannel authentication request. This property corresponds to the `backchannel_user_code_parameter` metadata. - `backchannelLogoutSessionRequired` boolean — The flag indicating whether the client requires that a `sid` (session ID) claim be included in the logout token sent to `backchannelLogoutUri`. - `dynamicallyRegistered` boolean — The flag to indicate whether this client has been registered dynamically. For more details, see [RFC 7591](https://datatracker.ietf.org/doc/html/rfc7591). - `parRequired` boolean — The flag to indicate whether this client is required to use the pushed authorization request endpoint. This property corresponds to the `require_pushed_authorization_requests` client metadata defined in "OAuth 2.0 Pushed Authorization Requests". - `requestObjectRequired` boolean — The flag to indicate whether authorization requests from this client are always required to utilize a request object by using either `request` or `request_uri` request parameter. If this flag is set to `true` and the service's `traditionalRequestObjectProcessingApplied` is set to `false`, authorization requests from this client are processed as if `require_signed_request_object` client metadata of this client is `true`. The metadata is defined in "JAR (JWT Secured Authorization Request)". - `frontChannelRequestObjectEncryptionRequired` boolean — The flag indicating whether encryption of request object is required when the request object is passed through the front channel. - `requestObjectEncryptionAlgMatchRequired` boolean — The flag indicating whether the JWE alg of encrypted request object must match the `request_object_encryption_alg` client metadata. - `requestObjectEncryptionEncMatchRequired` boolean — The flag indicating whether the JWE enc of encrypted request object must match the `request_object_encryption_enc` client metadata. - `singleAccessTokenPerSubject` boolean — If `Enabled` is selected, an attempt to issue a new access token invalidates existing access tokens that are associated with the same combination of subject and client. Note that, however, attempts by Client Credentials Flow do not invalidate existing access tokens because access tokens issued by Client Credentials Flow are not associated with any end-user's subject. Even if `Disabled` is selected here, single access token per subject is effective if `singleAccessTokenPerSubject` of the `Service` this client belongs to is Enabled. - `pkceRequired` boolean — The flag to indicate whether the use of Proof Key for Code Exchange (PKCE) is always required for authorization requests by Authorization Code Flow. If `true`, `code_challenge` request parameter is always required for authorization requests using Authorization Code Flow. See [RFC 7636](https://tools.ietf.org/html/rfc7636) (Proof Key for Code Exchange by OAuth Public Clients) for details about `code_challenge` request parameter. - `pkceS256Required` boolean — The flag to indicate whether `S256` is always required as the code challenge method whenever [PKCE (RFC 7636)](https://tools.ietf.org/html/rfc7636) is used. If this flag is set to `true`, `code_challenge_method=S256` must be included in the authorization request whenever it includes the `code_challenge` request parameter. Neither omission of the `code_challenge_method` request parameter nor use of plain (`code_challenge_method=plain`) is allowed. - `rsRequestSigned` boolean — The flag indicating whether this service signs responses from the resource server. - `dpopRequired` boolean — If the DPoP is required for this client - `locked` boolean — The flag which indicates whether this client is locked. - `mtlsEndpointAliasesUsed` boolean — The flag indicating whether the client intends to prefer mutual TLS endpoints over non-MTLS endpoints. This property corresponds to the `use_mtls_endpoint_aliases` client metadata that is defined in [FAPI 2.0 Security Profile, 8.1.1. use_mtls_endpoint_aliases](https://openid.bitbucket.io/fapi/fapi-2_0-security-profile.html#section-8.1.1). - `inScopeForTokenMigration` boolean — The flag indicating whether this client is in scope for token migration operations. - `trustChainExpiresAt` integer — the expiration time of the trust chain that was used when this client was registered or updated by the mechanism defined in OpenID Connect Federation 1.0. The value is represented as milliseconds elapsed since the Unix epoch (1970-01-01). - `trustChainUpdatedAt` integer — the time at which the trust chain was updated by the mechanism defined in OpenID Connect Federation 1.0 - `automaticallyRegistered` boolean — The flag indicating whether this client was registered by the "automatic" client registration of OIDC Federation. - `explicitlyRegistered` boolean — The flag indicating whether this client was registered by the "explicit" client registration of OIDC Federation. - `credentialResponseEncryptionRequired` boolean — True if credential responses to this client must be always encrypted. - `metadataDocumentLocation` string, uri — Location of the Client ID Metadata Document that was used for this client. This property is set when client metadata was retrieved via the OAuth Client ID Metadata Document (CIMD) mechanism. - `metadataDocumentExpiresAt` integer — Expiration time of the metadata document (UNIX time in milliseconds). - `metadataDocumentUpdatedAt` integer — Last-updated time of the metadata document (UNIX time in milliseconds). - `discoveredByMetadataDocument` boolean — Indicates whether this client was discovered via a Client ID Metadata Document. - `clientSource` 'DYNAMIC_REGISTRATION' | 'AUTOMATIC_REGISTRATION' | 'EXPLICIT_REGISTRATION' | 'METADATA_DOCUMENT' | 'STATIC_REGISTRATION' — Source of this client record. - `entityId` string — the entity ID of this client. - `display` 'PAGE' | 'POPUP' | 'TOUCH' | 'WAP' — The display mode which the client application requests by `display` request parameter. When the authorization request does not have `display` request parameter, `PAGE` is set as the default value. It is ensured that the value of `display` is one of the supported display modes which are specified by `supportedDisplays` configuration parameter of the service. If the display mode specified by the authorization request is not supported, an error is raised. Values for this property correspond to the values listed in "[OpenID Connect Core 1.0, 3.1.2.1. Authentication Request](https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest), display". - `maxAge` integer — The maximum authentication age. This value comes from `max_age` request parameter, or `defaultMaxAge` configuration parameter of the client application when the authorization request does not contain `max_age` request parameter. See "[OpenID Connect Core 1.0, 3.1.2.1. Authentication Request](https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest), max_age" for `max_age` request parameter, and see "[OpenID Connect Dynamic Client Registration 1.0, 2. Client Metadata](https://openid.net/specs/openid-connect-registration-1_0.html#ClientMetadata), default_max_age" for `defaultMaxAge` configuration parameter. - `service` Service - `number` integer — The sequential number of the service. The value of this property is assigned by Authlete. - `serviceName` string — The name of this service. - `issuer` string — The issuer identifier of the service. A URL that starts with https:// and has no query or fragment component. The value of this property is used as `iss` claim in an [ID token](https://openid.net/specs/openid-connect-core-1_0.html#IDToken) and `issuer` property in the [OpenID Provider Metadata](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata). - `description` string — The description about the service. - `apiKey` integer — The service ID used in Authlete API calls. The value of this property is assigned by Authlete. - `apiSecret` string — The API secret of this service. This value is assigned by Authlete and is used for service authentication in API calls. - `tokenBatchNotificationEndpoint` string, uri — The endpoint for batch token notifications. This endpoint is called when multiple tokens are issued or revoked in a batch operation. - `clientAssertionAudRestrictedToIssuer` boolean — The flag indicating whether the audience of client assertion JWTs must match the issuer identifier of this service. - `serviceOwnerNumber` integer — The number of the organization that owns this service. This value is assigned by Authlete. - `clientsPerDeveloper` integer — The maximum number of client applications that a developer can have. - `developerAuthenticationCallbackEndpoint` string, uri — The endpoint for developer authentication callbacks. This is used when developers log into the developer portal. - `developerAuthenticationCallbackApiKey` string — The API key for basic authentication at the developer authentication callback endpoint. - `developerAuthenticationCallbackApiSecret` string — The API secret for basic authentication at the developer authentication callback endpoint. - `supportedSnses` string[] — Social login services (SNS) that this service supports for end-user authentication. - `snsCredentials` SnsCredentials[] — The credentials for social login services (SNS) that are used for end-user authentication. - `sns` string — SNS. - `apiKey` string — API key. - `apiSecret` string — API secret. - `clientIdAliasEnabled` boolean — Deprecated. Always `true`. - `metadata` Pair[] — The `metadata` of the service. The content of the returned array depends on contexts. The predefined service metadata is listed in the following table. | Key | Description | | --- | --- | | `clientCount` | The number of client applications which belong to this service. | - `key` string — The key part. - `value` string — The value part. - `createdAt` integer — The time at which this service was created. The value is represented as milliseconds since the UNIX epoch (`1970-01-01`). - `modifiedAt` integer — The time at which this service was last modified. The value is represented as milliseconds since the UNIX epoch (1970-01-01). - `authenticationCallbackEndpoint` string, uri — A Web API endpoint for user authentication which is to be prepared on the service side. The endpoint must be implemented if you do not implement the UI at the authorization endpoint but use the one provided by Authlete. The user authentication at the authorization endpoint provided by Authlete is performed by making a `POST` request to this endpoint. - `authenticationCallbackApiKey` string — API key for basic authentication at the authentication callback endpoint. If the value is not empty, Authlete generates Authorization header for Basic authentication when making a request to the authentication callback endpoint. - `authenticationCallbackApiSecret` string — API secret for `basic` authentication at the authentication callback endpoint. - `supportedAcrs` string[] — Values of acrs (authentication context class references) that the service supports. The value of this property is used as `acr_values_supported` property in the [OpenID Provider Metadata](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata). - `supportedGrantTypes` GrantType[] — Values of `grant_type` request parameter that the service supports. The value of this property is used as `grant_types_supported property` in the [OpenID Provider Metadata](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata). - `supportedResponseTypes` ResponseType[] — Values of `response_type` request parameter that the service supports. Valid values are listed in Response Type. The value of this property is used as `response_types_supported` property in the [OpenID Provider Metadata](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata). - `supportedAuthorizationDetailsTypes` string[] — The supported data types that can be used as values of the type field in `authorization_details`. This property corresponds to the `authorization_details_types_supported` metadata. See "OAuth 2.0 Rich Authorization Requests" (RAR) for details. - `supportedServiceProfiles` ServiceProfile[] — The profiles that this service supports. - `errorDescriptionOmitted` boolean — The flag to indicate whether the `error_description` response parameter is omitted. According to [RFC 6749](https://tools.ietf.org/html/rfc6749), an authorization server may include the `error_description` response parameter in error responses. If `true`, Authlete does not embed the `error_description` response parameter in error responses. - `errorUriOmitted` boolean — The flag to indicate whether the `error_uri` response parameter is omitted. According to [RFC 6749](https://tools.ietf.org/html/rfc6749), an authorization server may include the `error_uri` response parameter in error responses. If `true`, Authlete does not embed the `error_uri` response parameter in error responses. - `authorizationEndpoint` string, uri — The authorization endpoint of the service. A URL that starts with `https://` and has no fragment component. For example, `https://example.com/auth/authorization`. The value of this property is used as `authorization_endpoint` property in the [OpenID Provider Metadata](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata). - `directAuthorizationEndpointEnabled` boolean — The flag to indicate whether the direct authorization endpoint is enabled or not. The path of the endpoint is `/api/auth/authorization/direct/service-api-key`. - `supportedUiLocales` string[] — UI locales that the service supports. Each element is a language tag defined in [RFC 5646](https://tools.ietf.org/html/rfc5646). For example, `en-US` and `ja-JP`. The value of this property is used as `ui_locales_supported` property in the [OpenID Provider Metadata](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata). - `supportedDisplays` Display[] — Values of `display` request parameter that service supports. The value of this property is used as `display_values_supported` property in the Provider Metadata](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata). - `pkceRequired` boolean — The flag to indicate whether the use of Proof Key for Code Exchange (PKCE) is always required for authorization requests by Authorization Code Flow. If `true`, `code_challenge` request parameter is always required for authorization requests using Authorization Code Flow. See [RFC 7636](https://tools.ietf.org/html/rfc7636) (Proof Key for Code Exchange by OAuth Public Clients) for details about `code_challenge` request parameter. - `pkceS256Required` boolean — The flag to indicate whether `S256` is always required as the code challenge method whenever [PKCE (RFC 7636)](https://tools.ietf.org/html/rfc7636) is used. If this flag is set to `true`, `code_challenge_method=S256` must be included in the authorization request whenever it includes the `code_challenge` request parameter. Neither omission of the `code_challenge_method` request parameter nor use of plain (`code_challenge_method=plain`) is allowed. - `authorizationResponseDuration` integer — The duration of authorization response JWTs in seconds. [Financial-grade API: JWT Secured Authorization Response Mode for OAuth 2.0 (JARM)](https://openid.net/specs/openid-financial-api-jarm.html) defines new values for the `response_mode` request parameter. They are `query.jwt`, `fragment.jwt`, `form_post.jwt` and `jwt`. If one of them is specified as the response mode, response parameters from the authorization endpoint will be packed into a JWT. This property is used to compute the value of the `exp` claim of the JWT. - `authorizationCodeDuration` integer — The duration of authorization codes in seconds. - `tokenEndpoint` string, uri — The [token endpoint](https://tools.ietf.org/html/rfc6749#section-3.2) of the service. A URL that starts with `https://` and has not fragment component. For example, `https://example.com/auth/token`. The value of this property is used as `token_endpoint` property in the [OpenID Provider Metadata](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata). - `directTokenEndpointEnabled` boolean — The flag to indicate whether the direct token endpoint is enabled or not. The path of the endpoint is `/api/auth/token/direct/service-api-key`. - `supportedTokenAuthMethods` ClientAuthMethod[] — Client authentication methods supported by the token endpoint of the service. The value of this property is used as `token_endpoint_auth_methods_supports` property in the [OpenID Provider Metadata](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata). - `missingClientIdAllowed` boolean — The flag to indicate token requests from public clients without the `client_id` request parameter are allowed when the client can be guessed from `authorization_code` or `refresh_token`. This flag should not be set unless you have special reasons. - `revocationEndpoint` string, uri — The [revocation endpoint](https://tools.ietf.org/html/rfc7009) of the service. A URL that starts with `https://`. For example, `https://example.com/auth/revocation`. - `directRevocationEndpointEnabled` boolean — The flag to indicate whether the direct revocation endpoint is enabled or not. The URL of the endpoint is `/api/auth/revocation/direct/service-api-key`. - `supportedRevocationAuthMethods` ClientAuthMethod[] — Client authentication methods supported at the revocation endpoint. - `introspectionEndpoint` string, uri — The URI of the introspection endpoint. - `directIntrospectionEndpointEnabled` boolean — The flag to indicate whether the direct userinfo endpoint is enabled or not. The path of the endpoint is `/api/auth/userinfo/direct/{serviceApiKey}`. - `supportedIntrospectionAuthMethods` ClientAuthMethod[] — Client authentication methods supported at the introspection endpoint. - `pushedAuthReqEndpoint` string, uri — The URI of the pushed authorization request endpoint. This property corresponds to the `pushed_authorization_request_endpoint` metadata defined in "[5. Authorization Server Metadata](https://tools.ietf.org/html/draft-lodderstedt-oauth-par#section-5)" of OAuth 2.0 Pushed Authorization Requests. - `pushedAuthReqDuration` integer — The duration of pushed authorization requests in seconds. - `parRequired` boolean — The flag to indicate whether this service requires that clients use the pushed authorization request endpoint. This property corresponds to the `require_pushed_authorization_requests` server metadata defined in [OAuth 2.0 Pushed Authorization Requests](https://tools.ietf.org/html/draft-lodderstedt-oauth-par). - `requestObjectRequired` boolean — The flag to indicate whether this service requires that authorization requests always utilize a request object by using either request or `request_uri` request parameter. If this flag is set to `true` and the value of `traditionalRequestObjectProcessingApplied` is `false`, the value of `require_signed_request_object` server metadata of this service is reported as `true` in the discovery document. The metadata is defined in JAR (JWT Secured Authorization Request). That `require_signed_request_object` is `true` means that authorization requests which don't conform to the JAR specification are rejected. - `traditionalRequestObjectProcessingApplied` boolean — The flag to indicate whether a request object is processed based on rules defined in [OpenID Connect Core 1.0](https://openid.net/specs/openid-connect-core-1_0.html) or JAR (JWT Secured Authorization Request). - `mutualTlsValidatePkiCertChain` boolean — The flag to indicate whether this service validates certificate chains during PKI-based client mutual TLS authentication. - `trustedRootCertificates` string[] — The list of root certificates trusted by this service for PKI-based client mutual TLS authentication. - `mtlsEndpointAliases` NamedUri[] — The MTLS endpoint aliases. - `name` string - `uri` string, uri - `accessTokenType` string — The access token type. This value is used as the value of `token_type` property in access token responses. If this service complies with [RFC 6750](https://tools.ietf.org/html/rfc6750), the value of this property should be `Bearer`. See [RFC 6749 (OAuth 2.0), 7.1. Access Token Types](https://tools.ietf.org/html/rfc6749#section-7.1) for details. - `tlsClientCertificateBoundAccessTokens` boolean — The flag to indicate whether this service supports issuing TLS client certificate bound access tokens. - `accessTokenDuration` integer — The duration of access tokens in seconds. This value is used as the value of `expires_in` property in access token responses. `expires_in` is defined [RFC 6749, 5.1. Successful Response](https://tools.ietf.org/html/rfc6749#section-5.1). - `singleAccessTokenPerSubject` boolean — The flag to indicate whether the number of access tokens per subject (and per client) is at most one or can be more. If `true`, an attempt to issue a new access token invalidates existing access tokens that are associated with the same subject and the same client. Note that, however, attempts by [Client Credentials Flow](https://tools.ietf.org/html/rfc6749#section-4.4) do not invalidate existing access tokens because access tokens issued by Client Credentials Flow are not associated with any end-user's subject. Also note that an attempt by [Refresh Token Flow](https://tools.ietf.org/html/rfc6749#section-6) invalidates the coupled access token only and this invalidation is always performed regardless of whether the value of this setting item is `true` or `false`. - `accessTokenSignAlg` 'NONE' | 'HS256' | 'HS384' | 'HS512' | 'RS256' | 'RS384' | 'RS512' | 'ES256' | 'ES384' | 'ES512' | 'PS256' | 'PS384' | 'PS512' | 'ES256K' | 'EdDSA', nullable — The signature algorithm for JWT. This value is represented on 'alg' attribute of the header of JWT. it's semantics depends upon where is this defined, for instance: - as service accessTokenSignAlg value, it defines that access token are JWT and the algorithm used to sign it. Check your [KB article](https://kb.authlete.com/en/s/oauth-and-openid-connect/a/jwt-based-access-token). - as client authorizationSignAlg value, it represents the signature algorithm used when [creating a JARM response](https://kb.authlete.com/en/s/oauth-and-openid-connect/a/enabling-jarm). - or as client requestSignAlg value, it specifies which is the expected signature used by [client on a Request Object](https://kb.authlete.com/en/s/oauth-and-openid-connect/a/request-objects). - `accessTokenSignatureKeyId` string — The key ID to identify a JWK used for signing access tokens. A JWK Set can be registered as a property of a service. A JWK Set can contain 0 or more JWKs. Authlete Server has to pick up one JWK for signing from the JWK Set when it generates a JWT-based access token. Authlete Server searches the registered JWK Set for a JWK which satisfies conditions for access token signature. If the number of JWK candidates which satisfy the conditions is 1, there is no problem. On the other hand, if there exist multiple candidates, a Key ID is needed to be specified so that Authlete Server can pick up one JWK from among the JWK candidates. - `refreshTokenDuration` integer — The duration of refresh tokens in seconds. The related specifications have no requirements on refresh token duration, but Authlete sets expiration for refresh tokens. - `refreshTokenDurationKept` boolean — The flag to indicate whether the remaining duration of the used refresh token is taken over to the newly issued refresh token. - `refreshTokenDurationReset` boolean — The flag which indicates whether duration of refresh tokens are reset when they are used even if the `refreshTokenKept` property of this service set to is `true` (= even if "Refresh Token Continuous Use" is "Kept"). This flag has no effect when the `refreshTokenKept` property is set to `false`. In other words, if this service issues a new refresh token on every refresh token request, the refresh token will have fresh duration (unless `refreshTokenDurationKept` is set to `true`) and this `refreshTokenDurationReset` property is not referenced. - `refreshTokenKept` boolean — The flag to indicate whether a refresh token remains unchanged or gets renewed after its use. If `true`, a refresh token used to get a new access token remains valid after its use. Otherwise, if `false`, a refresh token is invalidated after its use and a new refresh token is issued. See [RFC 6749 6. Refreshing an Access Token](https://tools.ietf.org/html/rfc6749#section-6), as to how to get a new access token using a refresh token. - `supportedScopes` Scope[] — Scopes supported by the service. - `name` string — The name of the scope. - `defaultEntry` boolean — `true` to mark the scope as default. Scopes marked as default are regarded as requested when an authorization request from a client application does not contain scope request parameter. - `description` string — The description about the scope. - `descriptions` TaggedValue[] — The descriptions about this scope in multiple languages. - `tag` string — The language tag part. - `value` string — The value part. - `attributes` Pair[] — The attributes of the scope. - `key` string — The key part. - `value` string — The value part. - `scopeRequired` boolean — The flag to indicate whether requests that request no scope are rejected or not. - `idTokenDuration` integer — 'The duration of [ID token](https://openid.net/specs/openid-connect-core-1_0.html#IDToken)s in seconds. This value is used to calculate the value of `exp` claim in an ID token.' - `allowableClockSkew` integer — The allowable clock skew between the server and clients in seconds. The clock skew is taken into consideration when time-related claims in a JWT (e.g. `exp`, `iat`, `nbf`) are verified. - `supportedClaimTypes` ClaimType[] — Claim types supported by the service. Valid values are listed in Claim Type. Note that Authlete currently doesn't provide any API to help implementations for `AGGREGATED` and `DISTRIBUTED`. The value of this property is used as `claim_types_supported` property in the [OpenID Provider Metadata](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata). - `supportedClaimLocales` string[] — Claim locales that the service supports. Each element is a language tag defined in [RFC 5646](https://tools.ietf.org/html/rfc5646). For example, `en-US` and `ja-JP`. See [OpenID Connect Core 1.0, 5.2. Languages and Scripts](https://openid.net/specs/openid-connect-core-1_0.html#ClaimsLanguagesAndScripts) for details. The value of this property is used as `claims_locales_supported` property in the [OpenID Provider Metadata](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata). - `supportedClaims` string[] — Claim names that the service supports. The standard claim names listed in [OpenID Connect Core 1.0, 5.1. Standard Claim](https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims) should be supported. The following is the list of standard claims. - `claimShortcutRestrictive` boolean — The flag indicating whether claims specified by shortcut scopes (e.g. `profile`) are included in the issued ID token only when no access token is issued. - `jwksUri` string, uri — The URL of the service's [JSON Web Key Set](https://tools.ietf.org/html/rfc7517) document. For example, `http://example.com/auth/jwks`. Client applications accesses this URL (1) to get the public key of the service to validate the signature of an ID token issued by the service and (2) to get the public key of the service to encrypt an request object of the client application. See [OpenID Connect Core 1.0, 10. Signatures and Encryption](https://openid.net/specs/openid-connect-core-1_0.html#SigEnc) for details. The value of this property is used as `jwks_uri` property in the [OpenID Provider Metadata](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata). - `directJwksEndpointEnabled` boolean — 'The flag to indicate whether the direct jwks endpoint is enabled or not. The path of the endpoint is `/api/service/jwks/get/direct/service-api-key`. ' - `jwks` string — The content of the service's [JSON Web Key Set](https://tools.ietf.org/html/rfc7517) document. If this property is not `null` in a `/service/create` request or a `/service/update` request, Authlete hosts the content in the database. This property must not be `null` and must contain pairs of public/private keys if the service wants to support asymmetric signatures for ID tokens and asymmetric encryption for request objects. See [OpenID Connect Core 1.0, 10. Signatures and Encryption](https://openid.net/specs/openid-connect-core-1_0.html#SigEnc) for details. - `idTokenSignatureKeyId` string — The key ID to identify a JWK used for ID token signature using an asymmetric key. - `userInfoSignatureKeyId` string — The key ID to identify a JWK used for user info signature using an asymmetric key. - `authorizationSignatureKeyId` string — The key ID to identify a JWK used for signing authorization responses using an asymmetric key. - `userInfoEndpoint` string, uri — The [user info endpoint](http://openid.net/specs/openid-connect-core-1_0.html#UserInfo) of the service. A URL that starts with `https://`. For example, `https://example.com/auth/userinfo`. The value of this property is used as `userinfo_endpoint` property in the [OpenID Provider Metadata](http://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata). - `directUserInfoEndpointEnabled` boolean — The flag to indicate whether the direct userinfo endpoint is enabled or not. The path of the endpoint is `/api/auth/userinfo/direct/service-api-key`. - `dynamicRegistrationSupported` boolean — The boolean flag which indicates whether the [OAuth 2.0 Dynamic Client Registration Protocol](https://tools.ietf.org/html/rfc7591) is supported. - `registrationEndpoint` string, uri — The [registration endpoint](http://openid.net/specs/openid-connect-registration-1_0.html#ClientRegistration) of the service. A URL that starts with `https://`. For example, `https://example.com/auth/registration`. The value of this property is used as `registration_endpoint` property in the [OpenID Provider Metadata](http://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata). - `registrationManagementEndpoint` string, uri — The URI of the registration management endpoint. If dynamic client registration is supported, and this is set, this URI will be used as the basis of the client's management endpoint by appending `/clientid}/` to it as a path element. If this is unset, the value of `registrationEndpoint` will be used as the URI base instead. - `policyUri` string, uri — The URL of the "Policy" of the service. The value of this property is used as `op_policy_uri` property in the [OpenID Provider Metadata](http://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata). - `tosUri` string, uri — The URL of the "Terms Of Service" of the service. The value of this property is used as `op_tos_uri` property in the [OpenID Provider Metadata](http://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata). - `serviceDocumentation` string, uri — The URL of a page where documents for developers can be found. The value of this property is used as `service_documentation` property in the [OpenID Provider Metadata](http://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata). - `backchannelAuthenticationEndpoint` string, uri — The URI of backchannel authentication endpoint, which is defined in the specification of [CIBA (Client Initiated Backchannel Authentication)](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html). - `supportedBackchannelTokenDeliveryModes` DeliveryMode[] — The supported backchannel token delivery modes. This property corresponds to the `backchannel_token_delivery_modes_supported` metadata. Backchannel token delivery modes are defined in the specification of [CIBA (Client Initiated Backchannel Authentication)](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html). - `backchannelAuthReqIdDuration` integer — The duration of backchannel authentication request IDs issued from the backchannel authentication endpoint in seconds. This is used as the value of the `expires_in` property in responses from the backchannel authentication endpoint. - `backchannelPollingInterval` integer — The minimum interval between polling requests to the token endpoint from client applications in seconds. This is used as the value of the `interval` property in responses from the backchannel authentication endpoint. - `backchannelUserCodeParameterSupported` boolean — The boolean flag which indicates whether the `user_code` request parameter is supported at the backchannel authentication endpoint. This property corresponds to the `backchannel_user_code_parameter_supported` metadata. - `backchannelBindingMessageRequiredInFapi` boolean — The flag to indicate whether the `binding_message` request parameter is always required whenever a backchannel authentication request is judged as a request for Financial-grade API. - `deviceAuthorizationEndpoint` string, uri — The URI of the device authorization endpoint. Device authorization endpoint is defined in the specification of OAuth 2.0 Device Authorization Grant. - `deviceVerificationUri` string, uri — The verification URI for the device flow. This URI is used as the value of the `verification_uri` parameter in responses from the device authorization endpoint. - `deviceVerificationUriComplete` string, uri — The verification URI for the device flow with a placeholder for a user code. This URI is used to build the value of the `verification_uri_complete` parameter in responses from the device authorization endpoint. - `deviceFlowCodeDuration` integer — The duration of device verification codes and end-user verification codes issued from the device authorization endpoint in seconds. This is used as the value of the `expires_in` property in responses from the device authorization endpoint. - `deviceFlowPollingInterval` integer — The minimum interval between polling requests to the token endpoint from client applications in seconds in device flow. This is used as the value of the `interval` property in responses from the device authorization endpoint. - `userCodeCharset` 'BASE20' | 'NUMERIC' — The character set for end-user verification codes (`user_code`) for Device Flow. - `userCodeLength` integer — The length of end-user verification codes (`user_code`) for Device Flow. - `supportedTrustFrameworks` string[] — Trust frameworks supported by this service. This corresponds to the `trust_frameworks_supported` [metadata](https://openid.net/specs/openid-connect-4-identity-assurance-1_0.html#rfc.section.7). - `supportedEvidence` string[] — Evidence supported by this service. This corresponds to the `evidence_supported` [metadata](https://openid.net/specs/openid-connect-4-identity-assurance-1_0.html#rfc.section.7). - `supportedIdentityDocuments` string[] — Identity documents supported by this service. This corresponds to the `id_documents_supported` [metadata](https://openid.net/specs/openid-connect-4-identity-assurance-1_0.html#rfc.section.7). - `supportedVerificationMethods` string[] — Verification methods supported by this service. This corresponds to the `id_documents_verification_methods_supported` [metadata](https://openid.net/specs/openid-connect-4-identity-assurance-1_0.html#rfc.section.7). - `supportedVerifiedClaims` string[] — Verified claims supported by this service. This corresponds to the `claims_in_verified_claims_supported` [metadata](https://openid.net/specs/openid-connect-4-identity-assurance-1_0.html#rfc.section.7). - `verifiedClaimsValidationSchemaSet` 'standard' | 'standard+id_document' — The verified claims validation schema set. - `attributes` Pair[] — The attributes of this service. - `key` string — The key part. - `value` string — The value part. - `nbfOptional` boolean — The flag indicating whether the nbf claim in the request object is optional even when the authorization request is regarded as a FAPI-Part2 request. - `issSuppressed` boolean — The flag indicating whether generation of the iss response parameter is suppressed. - `supportedCustomClientMetadata` string[] — custom client metadata supported by this service. - `tokenExpirationLinked` boolean — The flag indicating whether the expiration date of an access token never exceeds that of the corresponding refresh token. - `frontChannelRequestObjectEncryptionRequired` boolean — The flag indicating whether encryption of request object is required when the request object is passed through the front channel. - `requestObjectEncryptionAlgMatchRequired` boolean — The flag indicating whether the JWE alg of encrypted request object must match the `request_object_encryption_alg` client metadata of the client that has sent the request object. - `requestObjectEncryptionEncMatchRequired` boolean — The flag indicating whether the JWE `enc` of encrypted request object must match the `request_object_encryption_enc` client metadata of the client that has sent the request object. - `hsmEnabled` boolean — The flag indicating whether HSM (Hardware Security Module) support is enabled for this service. When this flag is `false`, keys managed in HSMs are not used even if they exist. In addition, `/api/hsk/*` APIs reject all requests. Even if this flag is `true`, HSM-related features do not work if the configuration of the Authlete server you are using does not support HSM. - `hsks` Hsk[] — The information about keys managed on HSMs (Hardware Security Modules). This `hsks` property is output only, meaning that `hsks` in requests to `/api/service/create` API and `/api/service/update` API do not have any effect. The contents of this property is controlled only by `/api/hsk/*` APIs. - `kty` string — The key type (EC or RSA) - `use` string — Get the use of the key on the HSM. When the key use is "sig" (signature), the private key on the HSM is used to sign data and the corresponding public key is used to verify the signature. When the key use is "enc" (encryption), the private key on the HSM is used to decrypt encrypted data which have been encrypted with the corresponding public key - `kid` string — Key ID for the key on the HSM. - `hsmName` string — The name of the HSM. The identifier for the HSM that sits behind the Authlete server. For example, "google". - `handle` string — The handle for the key on the HSM. A handle is a base64url-encoded 256-bit random value (43 letters) which is assigned by Authlete on the call of the /api/hsk/create API - `publicKey` string — The public key that corresponds to the key on the HSM. - `alg` string — The algorithm of the key on the HSM. When the key use is `"sig"`, the algorithm represents a signing algorithm such as `"ES256"`. When the key use is `"enc"`, the algorithm represents an encryption algorithm such as `"RSA-OAEP-256"`. - `grantManagementEndpoint` string — The URL of the grant management endpoint. - `grantManagementActionRequired` boolean — The flag indicating whether every authorization request (and any request serving as an authorization request such as CIBA backchannel authentication request and device authorization request) must include the `grant_management_action` request parameter. - `unauthorizedOnClientConfigSupported` boolean — The flag indicating whether Authlete's `/api/client/registration` API uses `UNAUTHORIZED` as a value of the `action` response parameter when appropriate. - `dcrScopeUsedAsRequestable` boolean — The flag indicating whether the `scope` request parameter in dynamic client registration and update requests (RFC 7591 and RFC 7592) is used as scopes that the client can request. Limiting the range of scopes that a client can request is achieved by listing scopes in the `client.extension.requestableScopes` property and setting the `client.extension.requestableScopesEnabled` property to `true`. This feature is called "requestable scopes". This property affects behaviors of `/api/client/registration` and other family APIs. - `endSessionEndpoint` string, uri — The endpoint for clients ending the sessions. A URL that starts with `https://` and has no fragment component. For example, `https://example.com/auth/endSession`. The value of this property is used as `end_session_endpoint` property in the [OpenID Provider Metadata](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata). - `loopbackRedirectionUriVariable` boolean — The flag indicating whether the port number component of redirection URIs can be variable when the host component indicates loopback. - `requestObjectAudienceChecked` boolean — The flag indicating whether Authlete checks whether the `aud` claim of request objects matches the issuer identifier of this service. - `accessTokenForExternalAttachmentEmbedded` boolean — The flag indicating whether Authlete generates access tokens for external attachments and embeds them in ID tokens and userinfo responses. - `authorityHints` string[] — Identifiers of entities that can issue entity statements for this service. This property corresponds to the `authority_hints` property that appears in a self-signed entity statement that is defined in OpenID Connect Federation 1.0. - `federationEnabled` boolean — flag indicating whether this service supports OpenID Connect Federation 1 - `federationJwks` string — JWK Set document containing keys that are used to sign (1) self-signed entity statement of this service and (2) the response from `signed_jwks_uri`. - `federationSignatureKeyId` string — A key ID to identify a JWK used to sign the entity configuration and the signed JWK Set. - `federationConfigurationDuration` integer — The duration of the entity configuration in seconds. - `federationRegistrationEndpoint` string — The URI of the federation registration endpoint. This property corresponds to the `federation_registration_endpoint` server metadata that is defined in OpenID Connect Federation 1.0. - `organizationName` string — The human-readable name representing the organization that operates this service. This property corresponds to the `organization_name` server metadata that is defined in OpenID Connect Federation 1.0. - `predefinedTransformedClaims` string — The transformed claims predefined by this service in JSON format. This property corresponds to the `transformed_claims_predefined` server metadata. - `refreshTokenIdempotent` boolean — flag indicating whether refresh token requests with the same refresh token can be made multiple times in quick succession and they can obtain the same renewed refresh token within the short period. - `signedJwksUri` string — The URI of the endpoint that returns this service's JWK Set document in the JWT format. This property corresponds to the `signed_jwks_uri` server metadata defined in OpenID Connect Federation 1.0. - `supportedAttachments` AttachmentType[] — Supported attachment types. This property corresponds to the {@code attachments_supported} server metadata which was added by the third implementer's draft of OpenID Connect for Identity Assurance 1.0. - `supportedDigestAlgorithms` string[] — Supported algorithms used to compute digest values of external attachments. This property corresponds to the `digest_algorithms_supported` server metadata which was added by the third implementer's draft of OpenID Connect for Identity Assurance 1.0. - `supportedDocuments` string[] — Document types supported by this service. This property corresponds to the `documents_supported` server metadata. - `supportedDocumentsMethods` string[] — validation and verification processes supported by this service. This property corresponds to the `documents_methods_supported` server metadata. The third implementer's draft of [OpenID Connect for Identity Assurance 1.0](https://openid.net/specs/openid-connect-4-identity-assurance-1_0.html) renamed the `id_documents_verification_methods_supported` server metadata to `documents_methods_supported`. - `supportedDocumentsValidationMethods` string[] — Document validation methods supported by this service. This property corresponds to the `documents_validation_methods_supported` server metadata which was added by the third implementer's draft of - `supportedDocumentsVerificationMethods` string[] — Document verification methods supported by this service. This property corresponds to the `documents_verification_methods_supported` server metadata which was added by the third implementer's draft of [OpenID Connect for Identity Assurance 1.0](https://openid.net/specs/openid-connect-4-identity-assurance-1_0.html) - `supportedElectronicRecords` string[] — Electronic record types supported by this service. This property corresponds to the `electronic_records_supported` server metadata which was added by the third implementer's draft of [OpenID Connect for Identity Assurance 1.0](https://openid.net/specs/openid-connect-4-identity-assurance-1_0.html) - `supportedClientRegistrationTypes` ClientRegistrationType[] - `tokenExchangeByIdentifiableClientsOnly` boolean — The flag indicating whether to prohibit unidentifiable clients from making token exchange requests. - `tokenExchangeByConfidentialClientsOnly` boolean — The flag indicating whether to prohibit public clients from making token exchange requests. - `tokenExchangeByPermittedClientsOnly` boolean — The flag indicating whether to prohibit clients that have no explicit permission from making token exchange requests. - `tokenExchangeEncryptedJwtRejected` boolean — The flag indicating whether to reject token exchange requests which use encrypted JWTs as input tokens. - `tokenExchangeUnsignedJwtRejected` boolean — The flag indicating whether to reject token exchange requests which use unsigned JWTs as input tokens. - `jwtGrantByIdentifiableClientsOnly` boolean — The flag indicating whether to prohibit unidentifiable clients from using the grant type "urn:ietf:params:oauth:grant-type:jwt-bearer". - `jwtGrantEncryptedJwtRejected` boolean — The flag indicating whether to reject token requests that use an encrypted JWT as an authorization grant with the grant type "urn:ietf:params:oauth:grant-type:jwt-bearer". - `jwtGrantUnsignedJwtRejected` boolean — The flag indicating whether to reject token requests that use an unsigned JWT as an authorization grant with the grant type "urn:ietf:params:oauth:grant-type:jwt-bearer". - `dcrDuplicateSoftwareIdBlocked` boolean — The flag indicating whether to block DCR (Dynamic Client Registration) requests whose "software_id" has already been used previously. - `trustAnchors` TrustAnchor[] — The trust anchors that are referenced when this service resolves trust chains of relying parties. If this property is empty, client registration fails regardless of whether its type is `automatic` or `explicit`. It means that OpenID Connect Federation 1.0 does not work. - `entityId` string — the entity ID of the trust anchor - `jwks` string — the JWK Set document containing public keys of the trust anchor - `openidDroppedOnRefreshWithoutOfflineAccess` boolean — The flag indicating whether the openid scope should be dropped from scopes list assigned to access token issued when a refresh token grant is used. - `supportedDocumentsCheckMethods` string[] — Supported document check methods. This property corresponds to the `documents_check_methods_supported` server metadata which was added by the fourth implementer's draft of OpenID Connect for Identity Assurance 1.0. - `rsResponseSigned` boolean — The flag indicating whether this service signs responses from the resource server. - `cnonceDuration` integer — The duration of `c_nonce`. - `dpopNonceRequired` boolean — Whether to require DPoP proof JWTs to include the `nonce` claim whenever they are presented. - `verifiableCredentialsEnabled` boolean — Get the flag indicating whether the feature of Verifiable Credentials for this service is enabled or not. - `credentialJwksUri` string — The URL at which the JWK Set document of the credential issuer is exposed. - `credentialOfferDuration` integer — The default duration of credential offers in seconds. - `dpopNonceDuration` integer — The duration of nonce values for DPoP proof JWTs in seconds. - `preAuthorizedGrantAnonymousAccessSupported` boolean — The flag indicating whether token requests using the pre-authorized code grant flow by unidentifiable clients are allowed. - `credentialTransactionDuration` integer — The duration of transaction ID in seconds that may be issued as a result of a credential request or a batch credential request. - `introspectionSignatureKeyId` string — The key ID of the key for signing introspection responses. - `resourceSignatureKeyId` string — The key ID of the key for signing introspection responses. - `userPinLength` integer — The default length of user PINs. - `supportedPromptValues` Prompt[] — The supported `prompt` values. - `idTokenReissuable` boolean — The flag indicating whether to enable the feature of ID token reissuance in the refresh token flow. - `credentialJwks` string — The JWK Set document containing private keys that are used to sign verifiable credentials. - `fapiModes` FapiMode[] — FAPI modes for this service. When the value of this property is not `null`, Authlete always processes requests to this service based on the specified FAPI modes if the FAPI feature is enabled in Authlete and the FAPI profile is supported by this service. For instance, when this property is set to an array containing `FAPI1_ADVANCED` only, Authlete always processes requests to this service based on "Financial-grade API Security Profile 1.0 - Part 2: Advanced" if the FAPI feature is enabled in Authlete and the FAPI profile is supported by this service. - `credentialDuration` integer — The default duration of verifiable credentials in seconds. - `credentialIssuerMetadata` CredentialIssuerMetadata - `authorizationServers` string[] — The identifiers of the authorization servers that the credential issuer relies on for authorization. This property corresponds to the authorization_servers metadata. When the credential issuer works as an authorization server for itself, this property should be omitted. - `credentialIssuer` string — The identifier of a credential request. - `credentialEndpoint` string, uri — The URL of the credential endpoint of the credential issuer. - `batchCredentialEndpoint` string, uri — The URL of the batch credential endpoint of the credential issuer. - `deferredCredentialEndpoint` string — The URL of the deferred credential endpoint of the credential issuer. - `credentialsSupported` string — A JSON object describing supported credential configurations. This property corresponds to the credential_configurations_supported metadata. Note: Due to a breaking change in December 2023, this was changed from a JSON array to a JSON object. - `credentialResponseEncryptionAlgValuesSupported` string[] — The supported JWE `alg` algorithms for credential response encryption. This property corresponds to the `credential_response_encryption.alg_values_supported` metadata. - `credentialResponseEncryptionEncValuesSupported` string[] — The supported JWE `enc` algorithms for credential response encryption. This property corresponds to the `credential_response_encryption.enc_values_supported` metadata. - `requireCredentialResponseEncryption` boolean — The boolean flag indicating whether credential response encryption is required. This property corresponds to the `credential_response_encryption.encryption_required metadata`. If this flag is `true`, every credential request to the credential issuer must include the `credential_response_encryption` property. - `requireCredentialRequestEncryption` boolean — The boolean flag indicating whether credential request encryption is required. This property corresponds to the `credential_request_encryption.encryption_required` metadata. If this flag is `true`, every credential request to the credential issuer must be encrypted. - `credentialResponseEncryptionZipValuesSupported` string[] — The supported JWE `zip` (compression) algorithms for credential response encryption. This property corresponds to the `credential_response_encryption.zip_values_supported` metadata. - `batchSize` integer — The maximum array size for the `proofs` parameter in a credential request. This property corresponds to the `batch_credential_issuance.batch_size` metadata. If the value of this property is 2 or greater, the `batch_credential_issuance` parameter will appear in the response from the credential issuer metadata endpoint. - `idTokenAudType` string — The type of the `aud` claim in ID tokens. - `nativeSsoSupported` boolean — Flag that enables the [OpenID Connect Native SSO for Mobile Apps 1.0](https://openid.net/specs/openid-connect-native-sso-1_0.html) specification (“Native SSO”). When this property is **not** `true`, Native SSO specific parameters are ignored or treated as errors. For example: * The `device_sso` scope has no special meaning (Authlete does not embed the `sid` claim in ID tokens). * The `urn:openid:params:token-type:device-secret` token type is treated as unknown and results in an error. When set to `true`, the server metadata advertises `"native_sso_supported": true`. See [OpenID Connect Discovery 1.0](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata) and [RFC 8414 §2](https://www.rfc-editor.org/rfc/rfc8414.html#section-2) for background. Native SSO is available in Authlete 3.0 and later. - `oid4vciVersion` string — Version of the [OpenID for Verifiable Credential Issuance](https://www.authlete.com/developers/oid4vci/) (OID4VCI) specification to support. Accepted values are: * `null` or `"1.0-ID1"` → Implementer’s Draft 1. * `"1.0"` or `"1.0-Final"` → Final 1.0 specification. Choose the value that matches the OID4VCI behaviour your service should expose. See the OID4VCI documentation for details. - `cimdMetadataPolicyEnabled` boolean — Flag that controls whether the CIMD metadata policy is applied to client metadata obtained through the Client ID Metadata Document (CIMD) mechanism. - `clientIdMetadataDocumentSupported` boolean — Indicates whether the Client ID Metadata Document (CIMD) mechanism is supported. When `true`, the service will attempt to retrieve client metadata via CIMD where applicable. - `cimdAllowlistEnabled` boolean — Enables the allowlist for CIMD. When `true`, only CIMD endpoints that are on the allowlist are used. - `cimdAllowlist` string[] — The allowlist of CIMD endpoints (hosts/URIs) that may be used when retrieving client metadata via Client ID Metadata Documents. - `cimdAlwaysRetrieved` boolean — If `true`, CIMD retrieval is always attempted for clients, regardless of other conditions. - `cimdHttpPermitted` boolean — Allows CIMD retrieval over plain HTTP. When `false`, only HTTPS CIMD endpoints are allowed. - `cimdQueryPermitted` boolean — Allows the use of query parameters when retrieving CIMD metadata. When `false`, query parameters are disallowed for CIMD requests. - `cimdMetadataPolicy` string — The metadata policy applied to client metadata obtained through the CIMD mechanism. The value must follow the metadata policy grammar defined in [OpenID Federation 1.0 §6.1 Metadata Policy](https://openid.net/specs/openid-federation-1_0.html#name-metadata-policy). - `httpAliasProhibited` boolean — When `true`, client ID aliases starting with `https://` or `http://` are prohibited. - `attestationChallengeTimeWindow` integer — The time window of attestation challenges in seconds. This is used for OAuth 2.0 Attestation-Based Client Authentication. - `clientAttesterRootsEnabled` boolean — The flag indicating whether the attester roots for Client Attestation JWT x5c chain validation are enabled. - `clientAttesterRootsOnly` boolean — The flag indicating whether only client authentication validated via attester roots is accepted. - `keyAttesterRootsEnabled` boolean — The flag indicating whether the attester roots for Key Attestation JWT x5c chain validation are enabled. - `keyAttesterRootsOnly` boolean — The flag indicating whether only key attestation validated via attester roots is accepted. - `clientAttesterRoots` string[] — The trusted root certificates (PEM-encoded X.509) for validating the x5c chain in Client Attestation JWTs. - `keyAttesterRoots` string[] — The trusted root certificates (PEM-encoded X.509) for validating the x5c chain in Key Attestation JWTs. - `backchannelLogoutSupported` boolean — The flag indicating whether this service supports OpenID Connect Back-Channel Logout 1.0. - `backchannelLogoutSessionSupported` boolean — The flag indicating whether this service includes a `sid` (session ID) claim in ID tokens, supporting per-session backchannel logout. - `scopes` Scope[] — The scopes that the client application requests. This value comes from `scope` request parameter. If the request does not contain `scope` parameter, this parameter is a list of scopes which are registered as default. If the authorization request does not have `scope` request parameter and the service has not registered any default scope, the value of this parameter is `null`. It is ensured that scopes listed by this parameters are contained in the list of supported scopes which are specified by `supportedScopes` configuration parameter of the service. Unsupported scopes in the authorization request do not cause an error and are just ignored. OpenID Connect defines some scope names which need to be treated specially. The table below lists the special scope names. | Name | Description | | --- | --- | | `openid` | This scope must be contained in `scope` request parameter to promote an OAuth 2.0 authorization request to an OpenID Connect request. It is described in "[OpenID Connect Core 1.0, 3.1.2.1. Authentication Request](https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest), scope". | | `profile` | This scope is used to request some claims to be embedded in the ID token. The claims are `name`, `family_name`, `given_name`, `middle_name`, `nickname`, `preferred_username`, `profile`, `picture`, `website`, `gender`, `birthdate`, `zoneinfo`, `locale`, and `updated_at`. It is described in [OpenID Connect Core 1.0, 5.4. Requesting Claims using Scope Values](https://openid.net/specs/openid-connect-core-1_0.html#ScopeClaims). | | `email` | This scope is used to request some claims to be embedded in the ID token. The claims are `email` and `email_verified`. It is described in [OpenID Connect Core 1.0, 5.4. Requesting Claims using Scope Values](https://openid.net/specs/openid-connect-core-1_0.html#ScopeClaims). | | `address` | This scope is used to request `address` claim to be embedded in the ID token. It is described in [OpenID Connect Core 1.0, 5.4. Requesting Claims using Scope Values](https://openid.net/specs/openid-connect-core-1_0.html#ScopeClaims). The format of `address` claim is not a simple string. It is described in [OpenID Connect Core 1.0, 5.1.1. Address Claim](https://openid.net/specs/openid-connect-core-1_0.html#AddressClaim). | | `phone` | This scope is used to request some claims to be embedded in the ID token. The claims are `phone_number` and `phone_number_verified`. It is described in [OpenID Connect Core 1.0, 5.4. Requesting Claims using Scope Values](https://openid.net/specs/openid-connect-core-1_0.html#ScopeClaims). | | `offline_access` | The following is an excerpt about this scope from [OpenID Connect Core 1.0, 11. Offline Access](https://openid.net/specs/openid-connect-core-1_0.html#OfflineAccess). > This scope value requests that an OAuth 2.0 Refresh Token be issued that can be used to obtain an Access Token that grants access to the end-user's userinfo endpoint even when the end-user is not present (not logged in). | Note that, if `response_type` request parameter does not contain code, `offline_acccess` scope is removed from this list even when scope request parameter contains `offline_access`. This behavior is a requirement written in [OpenID Connect Core 1.0, 11. Offline Access](https://openid.net/specs/openid-connect-core-1_0.html#OfflineAccess). - `name` string — The name of the scope. - `defaultEntry` boolean — `true` to mark the scope as default. Scopes marked as default are regarded as requested when an authorization request from a client application does not contain scope request parameter. - `description` string — The description about the scope. - `descriptions` TaggedValue[] — The descriptions about this scope in multiple languages. - `tag` string — The language tag part. - `value` string — The value part. - `attributes` Pair[] — The attributes of the scope. - `key` string — The key part. - `value` string — The value part. - `uiLocales` string[] — The locales that the client application presented as candidates to be used for UI. This value comes from `ui_locales` request parameter. The format of `ui_locales` is a space-separated list of language tag values defined in [RFC5646](https://datatracker.ietf.org/doc/html/rfc5646). See "[OpenID Connect Core 1.0, 3.1.2.1. Authentication Request](https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest), ui_locales" for details. It is ensured that locales listed by this parameters are contained in the list of supported UI locales which are specified by `supportedUiLocales` configuration parameter of the service. Unsupported UI locales in the authorization request do not cause an error and are just ignored. - `claimsLocales` string[] — End-user's preferred languages and scripts for claims. This value comes from `claims_locales` request parameter. The format of `claims_locales` is a space-separated list of language tag values defined in [RFC5646](https://datatracker.ietf.org/doc/html/rfc5646). See "[OpenID Connect Core 1.0, 5.2. Claims Languages and Scripts](https://openid.net/specs/openid-connect-core-1_0.html#ClaimsLanguagesAndScripts)" for details. It is ensured that locales listed by this parameters are contained in the list of supported claim locales which are specified by `supportedClaimsLocales` configuration parameter of the service. Unsupported claim locales in the authorization request do not cause an error and are just ignored. - `claims` string[] — The list of claims that the client application requests to be embedded in the ID token. The value comes from (1) `id_token` in `claims` request parameter [1] and/or (2) special scopes (`profile`, `email`, `address` and `phone`) which are expanded to claims. See [OpenID Connect Core 1.0, 5.5. Requesting Claims using the "claims" Request Parameter](https://openid.net/specs/openid-connect-core-1_0.html#ClaimsParameter) for `claims` request parameter, and see [OpenID Connect Core 1.0, 5.4. Requesting Claims using Scope Values](https://openid.net/specs/openid-connect-core-1_0.html#ScopeClaims) for the special scopes. - `acrEssential` boolean — This boolean value indicates whether the authentication of the end-user must be one of the ACRs (Authentication Context Class References) listed in `acrs` parameter. This parameter becomes `true` only when (1) the authorization request contains `claims` request parameter and (2) `acr` claim is in it, and (3) `essential` property of the `acr` claim is `true`. See [OpenID Connect Core 1.0, 5.5.1.1. Requesting the "acr" Claim](https://openid.net/specs/openid-connect-core-1_0.html#acrSemantics) for details. - `clientIdAliasUsed` boolean — `true` if the value of the `client_id` request parameter included in the authorization request is the client ID alias. `false` if the value is the original numeric client ID. - `acrs` string[] — The list of ACRs (Authentication Context Class References) one of which the client application requests to be satisfied for the authentication of the end-user. This value comes from `acr_values` request parameter or `defaultAcrs` configuration parameter of the client application. See "[OpenID Connect Core 1.0, 3.1.2.1. Authentication Request](https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest), acr_values" for `acr_values` request parameter, and see "[OpenID Connect Dynamic Client Registration 1.0, 2. Client Metadata](https://openid.net/specs/openid-connect-registration-1_0.html#ClientMetadata), default_acr_values" for `defaultAcrs` configuration parameter. - `subject` string — The subject (= unique user ID managed by the authorization server implementation) that the client application expects to grant authorization. The value comes from `sub` claim in `claims` request parameter. - `loginHint` string — A hint about the login identifier of the end-user. The value comes from `login_hint` request parameter. - `prompts` Prompt[] — The list of values of prompt request parameter. See "[OpenID Connect Core 1.0, 3.1.2.1. Authentication Request](https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest), prompt" for prompt request parameter. - `lowestPrompt` 'NONE' | 'LOGIN' | 'CONSENT' | 'SELECT_ACCOUNT' | 'CREATE' — The prompt that the UI displayed to the end-user must satisfy as the minimum level. This value comes from `prompt` request parameter. When the authorization request does not contain `prompt` request parameter, `CONSENT` is used as the default value. See "[OpenID Connect Core 1.0, 3.1.2.1. Authentication Request](https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest), prompt" for `prompt` request parameter. - `requestObjectPayload` string — The payload part of the request object. The value of this proprty is `null` if the authorization request does not include a request object. - `idTokenClaims` string — The value of the `id_token` property in the claims request parameter or in the claims property in a request object. - `userInfoClaims` string — The value of the `userinfo` property in the `claims` request parameter or in the `claims` property in a request object. - `resources` string[] — The resources specified by the `resource` request parameters or by the `resource` property in the request object. If both are given, the values in the request object should be set. See "Resource Indicators for OAuth 2.0" for details. - `authorizationDetails` AuthzDetails — The authorization details. This represents the value of the `authorization_details` request parameter in the preceding device authorization request which is defined in "OAuth 2.0 Rich Authorization Requests". - `elements` AuthorizationDetailsElement[] — Elements of this authorization details. - `type` string, required — The type of this element. From _"OAuth 2.0 Rich Authorization Requests"_: _"The type of authorization data as a string. This field MAY define which other elements are allowed in the request. This element is REQUIRED."_ This property is always NOT `null`. - `locations` string[] — The resources and/or resource servers. This property may be `null`. From _"OAuth 2.0 Rich Authorization Requests"_: _"An array of strings representing the location of the resource or resource server. This is typically composed of URIs."_ This property may be `null`. - `actions` string[] — The actions. From _"OAuth 2.0 Rich Authorization Requests"_: _"An array of strings representing the kinds of actions to be taken at the resource. The values of the strings are determined by the API being protected."_ This property may be `null`. - `dataTypes` string[] — From _"OAuth 2.0 Rich Authorization Requests"_: _"An array of strings representing the kinds of data being requested from the resource."_ This property may be `null`. - `identifier` string — The identifier of a specific resource. From _"OAuth 2.0 Rich Authorization Requests"_: _"A string identifier indicating a specific resource available at the API."_ This property may be `null`. - `privileges` string[] — The types or levels of privilege. From "OAuth 2.0 Rich Authorization Requests": _"An array of strings representing the types or levels of privilege being requested at the resource."_ This property may be `null`. - `otherFields` string — The RAR request in the JSON format excluding the pre-defined attributes such as `type` and `locations`. The content and semantics are specific to the deployment and the use case implemented. - `purpose` string — The `purpose` request parameter is defined in [9. Transaction-specific Purpose](https://openid.net/specs/openid-connect-4-identity-assurance-1_0.html#name-transaction-specific-purpos) of [OpenID Connect for Identity Assurance 1.0](https://openid.net/specs/openid-connect-4-identity-assurance-1_0.html) as follows: > purpose: OPTIONAL. String describing the purpose for obtaining certain user data from the OP. The purpose MUST NOT be shorter than 3 characters and MUST NOT be longer than 300 characters. If these rules are violated, the authentication request MUST fail and the OP returns an error invalid_request to the RP. - `responseContent` string — The content that the authorization server implementation is to return to the client application. Its format varies depending on the value of `action` parameter. - `ticket` string — A ticket issued by Authlete to the service implementation. This is needed when the service implementation calls either `/auth/authorization/fail` API or `/auth/authorization/issue` API. - `dynamicScopes` DynamicScope[] — The dynamic scopes which the client application requested by the scope request parameter. - `name` string — The scope name. - `value` string — The scope value. - `gmAction` 'CREATE' | 'QUERY' | 'REPLACE' | 'REVOKE' | 'MERGE' — The grant management action of the device authorization request. The `grant_management_action` request parameter is defined in [Grant Management for OAuth 2.0](https://openid.net/specs/fapi-grant-management.html). - `grantId` string — the value of the `grant_id` request parameter of the device authorization request. The `grant_id` request parameter is defined in [Grant Management for OAuth 2.0](https://openid.net/specs/fapi-grant-management.html) , which is supported by Authlete 2.3 and newer versions. - `grant` Grant - `scopes` GrantScope[] - `scope` string — Space-delimited scopes. - `resource` string[] — List of resource indicators. - `claims` string[] — The claims associated with the Grant. - `authorizationDetails` AuthzDetails — The authorization details. This represents the value of the `authorization_details` request parameter in the preceding device authorization request which is defined in "OAuth 2.0 Rich Authorization Requests". - `elements` AuthorizationDetailsElement[] — Elements of this authorization details. - `type` string, required — The type of this element. From _"OAuth 2.0 Rich Authorization Requests"_: _"The type of authorization data as a string. This field MAY define which other elements are allowed in the request. This element is REQUIRED."_ This property is always NOT `null`. - `locations` string[] — The resources and/or resource servers. This property may be `null`. From _"OAuth 2.0 Rich Authorization Requests"_: _"An array of strings representing the location of the resource or resource server. This is typically composed of URIs."_ This property may be `null`. - `actions` string[] — The actions. From _"OAuth 2.0 Rich Authorization Requests"_: _"An array of strings representing the kinds of actions to be taken at the resource. The values of the strings are determined by the API being protected."_ This property may be `null`. - `dataTypes` string[] — From _"OAuth 2.0 Rich Authorization Requests"_: _"An array of strings representing the kinds of data being requested from the resource."_ This property may be `null`. - `identifier` string — The identifier of a specific resource. From _"OAuth 2.0 Rich Authorization Requests"_: _"A string identifier indicating a specific resource available at the API."_ This property may be `null`. - `privileges` string[] — The types or levels of privilege. From "OAuth 2.0 Rich Authorization Requests": _"An array of strings representing the types or levels of privilege being requested at the resource."_ This property may be `null`. - `otherFields` string — The RAR request in the JSON format excluding the pre-defined attributes such as `type` and `locations`. The content and semantics are specific to the deployment and the use case implemented. - `grantSubject` string — The subject identifying the user who has given the grant identified by the `grant_id` request parameter of the device authorization request. Authlete 2.3 and newer versions support [Grant Management for OAuth 2.0](https://openid.net/specs/fapi-grant-management.html). An authorization request may contain a `grant_id` request parameter which is defined in the specification. If the value of the request parameter is valid, {@link #getGrantSubject()} will return the subject of the user who has given the grant to the client application. Authorization server implementations may use the value returned from {@link #getGrantSubject()} in order to determine the user to authenticate. The user your system will authenticate during the authorization process (or has already authenticated) may be different from the user of the grant. The first implementer's draft of "Grant Management for OAuth 2.0" does not mention anything about the case, so the behavior in the case is left to implementations. Authlete will not perform the grant management action when the `subject` passed to Authlete does not match the user of the grant. - `requestedClaimsForTx` string[] — Names of claims that are requested indirectly by *"transformed claims"*. A client application can request *"transformed claims"* by adding names of transformed claims in the `claims` request parameter. The following is an example of the `claims` request parameter that requests a predefined transformed claim named `18_or_over` and a transformed claim named `nationality_usa` to be embedded in the response from the userinfo endpoint. ```json { "transformed_claims": { "nationality_usa": { "claim": "nationalities", "fn": [ [ "eq", "USA" ], "any" ] } }, "userinfo": { "::18_or_over": null, ":nationality_usa": null } } ``` The example above assumes that a transformed claim named `18_or_over` is predefined by the authorization server like below. ```json { "18_or_over": { "claim": "birthdate", "fn": [ "years_ago", [ "gte", 18 ] ] } } ``` In the example, the `nationalities` claim is requested indirectly by the `nationality_usa` transformed claim. Likewise, the `birthdate` claim is requested indirectly by the `18_or_over` transformed claim. When the `claims` request parameter of an authorization request is like the example above, this `requestedClaimsForTx` property will hold the following value. ```json [ "birthdate", "nationalities" ] ``` It is expected that the authorization server implementation prepares values of the listed claims and passes them as the value of the `claimsForTx` request parameter when it calls the `/api/auth/userinfo/issue` API. The following is an example of the value of the `claimsForTx` request parameter. ```json { "birthdate": "1970-01-23", "nationalities": [ "DEU", "USA" ] } ``` - `requestedVerifiedClaimsForTx` array[] — Names of verified claims that will be referenced when transformed claims are computed. - string[] - `transformedClaims` string — the value of the `transformed_claims` property in the `claims` request parameter of an authorization request or in the `claims` property in a request object. - `clientEntityIdUsed` boolean — Flag which indicates whether the entity ID of the client was used when the request for the access token was made. - `claimsAtUserInfo` string[] — The list of claims that the client application requests to be embedded in userinfo responses. The value comes from the `"scope"` and `"claims"` request parameters of the original authorization request. - `credentialOfferInfo` CredentialOfferInfo - `identifier` string — The identifier of the credential offer. - `credentialOffer` string — The credential offer in the JSON format. - `credentialIssuer` string — The identifier of the credential issuer. - `authorizationCodeGrantIncluded` boolean — The flag indicating whether the `authorization_code` object is included in the `grants` object. - `issuerStateIncluded` boolean — The flag indicating whether the `issuer_state` property is included in the `authorization_code` object in the `grants` object. - `issuerState` string — The value of the `issuer_state` property in the `authorization_code` object in the `grants` object. - `preAuthorizedCodeGrantIncluded` boolean — The flag indicating whether the `urn:ietf:params:oauth:grant-type:pre-authorized_code` object is included in the `grants` object. - `preAuthorizedCode` string — The value of the `pre-authorized_code` property in the `urn:ietf:params:oauth:grant-type:pre-authorized_code` object in the `grants` object. - `subject` string — The subject associated with the credential offer. - `expiresAt` integer — The time at which the credential offer will expire. - `context` string — The general-purpose arbitrary string. - `properties` Property[] — Extra properties to associate with the credential offer. - `key` string — The key part. - `value` string — The value part. - `hidden` boolean — The flag to indicate whether this property hidden from or visible to client applications. If `true`, this property is hidden from client applications. Otherwise, this property is visible to client applications. - `jwtAtClaims` string — Additional claims that are added to the payload part of the JWT access token. - `authTime` integer — The time at which the user authentication was performed during the course of issuing the credential offer. - `acr` string — The Authentication Context Class Reference of the user authentication performed during the course of issuing the credential offer. - `credentialConfigurationIds` string[] — The value of the `credential_configuration_ids` property of the credential offer. - `txCode` string — The transaction code. - `txCodeInputMode` string — The input mode of the transaction code. - `txCodeDescription` string — The description of the transaction code. - `issuableCredentials` string — The information about the **issuable credentials** that can be obtained by presenting the access token that will be issued as a result of the authorization request. - `nativeSsoRequested` boolean — Flag which indicates whether [Native SSO](https://openid.net/specs/openid-connect-native-sso-1_0.html) is requested. This property should be set to `true` when all the following conditions are satisfied: - `metadataDocumentUsed` boolean — Flag indicating whether a metadata document was used to resolve client metadata for this request. When `true`, the client metadata was retrieved via the CIMD mechanism rather than from the Authlete database. ## Other responses - `400` - `401` - `403` - `429` — The request exceeded the request rate permitted for the endpoint. - `500` --- [API](https://skmtc.net/authlete/apis/authlete-api.md) · [All operations](https://skmtc.net/authlete/apis/authlete-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/authlete/authlete-api/versions/7ad74ab64749/schema)