Sign in

v1

latestOpenAPI 3.0.1License2026-07-17236107.1 KB
developers

Register Site

Registers site at oxd-server

post/register-site

Request body

redirect_urisstring[] required

Provide the list of redirection URIs. The first URL is where the user will be redirected after successful authorization at the OpenID Connect Provider (OP).

op_configuration_endpointstring

The openid configuration endpoint URL. If missing, then either it must be present in defaults or op_host must be defined.

op_hoststring

Deprecated in favor of op_configuration_endpoint. It will be removed in future version(s). Provide the URL of OpenID Provider (OP) in this field. If missing, then op_configuration_endpoint must be defined.

op_discovery_pathstring

Deprecated in favor of op_configuration_endpoint. It will be removed in future version(s). Provide path to the OpenID Connect Provider's discovery document in this field. For example, if it is 'https://example.com/.well-known/openid-configuration' then the path is blank. But if it is 'https://example.com/oxauth/.well-known/openid-configuration' then the path is '/oxauth'

post_logout_redirect_urisstring[]

Provide the URLs supplied by the RP to request that the user be redirected to this location after a logout has been performed.

response_typesstring[]

Provide a list of the OAuth 2.0 response_type values that the Client is declaring that it will restrict itself to using. If omitted, the default is that the Client will use only the code response type.

grant_typesstring[]

Provide a list of the OAuth 2.0 grant types that the Client is declaring that it will restrict itself to using.

scopestring[]

Provide list of scope which are used during authentication to authorize access to resource.

acr_valuesstring[]

Provide Returns the Default requested Authentication Context Class Reference values.

client_namestring

oxd will generate its own non-human readable name by default if client_name is not specified

client_jwks_uristring

Provide the URL for the Client's JSON Web Key Set (JWK) document containing key(s) that are used for signing requests to the OP. The JWK Set may also contain the Client's encryption keys(s) that are used by the OP to encrypt the responses to the Client. When both signing and encryption keys are made available, a use (Key Use) parameter value is required for all keys in the document to indicate each key's intended usage .

client_token_endpoint_auth_methodstring

Provide the requested authentication method for the Token Endpoint. Valid values are none, client_secret_basic, client_secret_post, client_secret_jwt, private_key_jwt, access_token, tls_client_auth, self_signed_tls_client_auth.

client_token_endpoint_auth_signing_algstring

Provide the Requested Client Authentication method for the Token Endpoint. Valid values are none, HS256, HS384, HS512, RS256, RS384, RS512, ES256, ES384, ES512, PS256, PS384, PS512.

client_request_urisstring[]

Provide a list of request_uri values that are pre-registered by the Client for use at the Authorization Server.

client_frontchannel_logout_urisstring[]

Provide frontchannel logout uris.

client_sector_identifier_uristring

Provide the URL using the https scheme to be used in calculating Pseudonymous Identifiers by the OP. The URL references a file with a single JSON array of redirect_uri values.

contactsstring[]

Provide a list of e-mail addresses for people allowed to administer the information for this Client

ui_localesstring[]

Provide ui_locales, which can be used to pass the localization from the client application to the server application in the authorize request.

claims_localesstring[]

Provide claims_locales, which end-user's preferred languages and scripts for Claims being returned.

claims_redirect_uristring[]
client_idstring

client id of existing client, ignores all other parameters and skips new client registration forcing to use existing client (client_secret is required if this parameter is set).

client_secretstring

client secret of existing client, must be used together with client_id

access_token_as_jwtboolean

specifies whether access_token should be return as JWT or not. Default value is false.

access_token_signing_algstring

sets signing algorithm used for JWT signing. Valid values are none, HS256, HS384, HS512, RS256, RS384, RS512, ES256, ES384, ES512, PS256, PS384, PS512

rpt_as_jwtboolean

specifies whether RPT should be return as JWT or not. Default value is false.

logo_uristring

specifies an URL that references a logo for the Client application.

client_uristring

specifies an URL of the home page of the Client.

policy_uristring

specifies an URL that the Relying Party Client provides to the End-User to read about the how the profile data will be used.

front_channel_logout_session_requiredboolean

specifies if front channel logout session required.

tos_uristring

specifies an URL that the Relying Party Client provides to the End-User to read about the Relying Party's terms.

jwksstring

Client's JSON Web Key Set (JWK) document, passed by value. The semantics of the jwks parameter are the same as the jwks_uri parameter, other than that the JWK Set is passed by value, rather than by reference. This parameter is intended only to be used by Clients that, for some reason, are unable to use the jwks_uri parameter, for instance, by native applications that might not have a location to host the contents of the JWK Set. If a Client can use jwks_uri, it must not use jwks. One significant downside of jwks is that it does not enable key rotation. The jwks_uri and jwks parameters must not be used together.

id_token_binding_cnfstring
tls_client_auth_subject_dnstring
run_introspection_script_beforeaccess_token_as_jwt_creation_and_include_claimsboolean

choose to run introspection script before access_token_as_jwt creation and include claims.

id_token_signed_response_algstring

choose the JWS alg algorithm (JWA) required for the ID Token issued to this client_id. Valid values are none, HS256, HS384, HS512, RS256, RS384, RS512, ES256, ES384, ES512, PS256, PS384, PS512

id_token_encrypted_response_algstring

choose the JWE alg algorithm (JWA) required for encrypting the ID Token issued to this client_id. Valid values are RSA1_5, RSA-OAEP, A128KW, A256KW

id_token_encrypted_response_encstring

choose the JWE enc algorithm (JWA) required for symmetric encryption of the ID Token issued to this client_id. Valid values are A128CBC+HS256, A256CBC+HS512, A128GCM, A256GCM

user_info_signed_response_algstring

choose the JWS alg algorithm (JWA) required for UserInfo responses. Valid values are none, HS256, HS384, HS512, RS256, RS384, RS512, ES256, ES384, ES512, PS256, PS384, PS512

user_info_encrypted_response_algstring

choose the JWE alg algorithm (JWA) required for encrypting UserInfo responses. Valid values are RSA1_5, RSA_OAEP, A128KW, A256KW

user_info_encrypted_response_encstring

choose the JWE enc algorithm (JWA) required for symmetric encryption of UserInfo responses. Valid values are A128CBC+HS256, A256CBC+HS512, A128GCM, A256GCM

request_object_signing_algstring

choose the JWS alg algorithm (JWA) that must be required by the Authorization Server. Valid values are none, HS256, HS384, HS512, RS256, RS384, RS512, ES256, ES384, ES512, PS256, PS384, PS512

request_object_encryption_algstring

choose the JWE alg algorithm (JWA) the RP is declaring that it may use for encrypting Request Objects sent to the OP. Valid values are RSA1_5, RSA_OAEP, A128KW, A256KW

request_object_encryption_encstring

choose the JWE enc algorithm (JWA) the RP is declaring that it may use for encrypting Request Objects sent to the OP. Valid values are A128CBC+HS256, A256CBC+HS512, A128GCM, A256GCM

default_max_ageinteger

specifies the Default Maximum Authentication Age.

require_auth_timeboolean

specifies the Boolean value specifying whether the auth_time claim in the id_token is required. It is required when the value is true. The auth_time claim request in the request object overrides this setting.

initiate_login_uristring

specifies the URI using the https scheme that the authorization server can call to initiate a login at the client.

authorized_originsstring[]

specifies authorized JavaScript origins.

access_token_lifetimeinteger

specifies the Client-specific access token expiration.

software_idstring

specifies a unique identifier string (UUID) assigned by the client developer or software publisher used by registration endpoints to identify the client software to be dynamically registered.

software_versionstring

specifies a version identifier string for the client software identified by 'software_id'. The value of the 'software_version' should change on any update to the client software identified by the same 'software_id'.

software_statementstring

specifies a software statement containing client metadata values about the client software as claims. This is a string value containing the entire signed JWT.

custom_attributesobject

specifies custom attribute map copy.

sync_client_from_opboolean

specifies whether to sync client from OP. Default value is false.

sync_client_period_in_secondsinteger

specifies period after which client can sync again with OP. Default value is 86400 (in seconds).

allow_spontaneous_scopesboolean

specifies whether to allow spontaneous scopes for client. The default value is false

spontaneous_scopesstring[]

list of spontaneous scopes (regexp against which validation is performed).

Example request

{
  "redirect_uris": [
    "https://client.example.org/cb"
  ],
  "op_configuration_endpoint": "https://op.example.com/acme/.well-known/openid-configuration",
  "op_host": "https://<ophostname>",
  "op_discovery_path": "/oxauth",
  "post_logout_redirect_uris": [
    "https://client.example.org/logout/page1",
    "https://client.example.org/logout/page2",
    "https://client.example.org/logout/page3"
  ],
  "response_types": [
    "code"
  ],
  "grant_types": [
    "authorization_code",
    "client_credentials"
  ],
  "scope": [
    "openid"
  ],
  "acr_values": [
    "basic"
  ],
  "contacts": [
    "foo_bar@spam.org"
  ],
  "logo_uri": "https://client.example.org/logo.png",
  "client_uri": "https://client.example.org/page",
  "policy_uri": "https://client.example.org/page",
  "front_channel_logout_session_required": true,
  "tos_uri": "https://client.example.org/page",
  "jwks": "{\"key1\": \"value1\", \"key2\": \"value2\"}",
  "id_token_binding_cnf": "4NRB1-0XZABZI9E6-5SM3R",
  "tls_client_auth_subject_dn": "www.test.com",
  "run_introspection_script_beforeaccess_token_as_jwt_creation_and_include_claims": true,
  "default_max_age": 1000000,
  "require_auth_time": true,
  "initiate_login_uri": "https://client.example.org/authorization/page",
  "access_token_lifetime": 100000000,
  "software_id": "4NRB1-0XZABZI9E6-5SM3R",
  "software_version": "2.1",
  "sync_client_period_in_seconds": 86400
}

Response

OK

oxd_idstring required
op_hoststring required
client_idstring
client_namestring
client_secretstring
client_registration_access_tokenstring
client_registration_client_uristring
client_id_issued_atinteger
client_secret_expires_atinteger

Example response

{
  "oxd_id": "bcad760f-91ba-46e1-a020-05e4281d91b6",
  "op_host": "https://<op-hostname>",
  "client_id": "@!1736.179E.AA60.16B2!0001!8F7C.B9AB!0008!A2BB.9AE6.5F14.B387",
  "client_name": "TestClientName",
  "client_secret": "f436b936-03fc-433f-9772-53c2bc9e1c74",
  "client_registration_access_token": "d836df94-44b0-445a-848a-d43189839b17",
  "client_registration_client_uri": "https://<op-hostname>/oxauth/restv1/register?client_id=@!1736.179E.AA60.16B2!0001!8F7C.B9AB!0008!A2BB.9AE6.5F14.B387",
  "client_id_issued_at": 1501854943,
  "client_secret_expires_at": 1501941343
}