---
title: "Register Site"
method: POST
path: "/register-site"
tags: ["developers"]
---

# Register Site

`POST /register-site`

Registers site at oxd-server

## Request body

- object
  - `redirect_uris` string[], required — Provide the list of redirection URIs. The first URL is where the user will be redirected after successful authorization at the OpenID Connect Provider (OP).
  - `op_configuration_endpoint` string — The openid configuration endpoint URL. If missing, then either it must be present in defaults or `op_host` must be defined.
  - `op_host` string — Deprecated in favor of `op_configuration_endpoint`. It will be removed in future version(s). Provide the URL of OpenID Provider (OP) in this field. If missing, then `op_configuration_endpoint` must be defined.
  - `op_discovery_path` string — Deprecated in favor of `op_configuration_endpoint`. It will be removed in future version(s). Provide path to the OpenID Connect Provider's discovery document in this field. For example, if it is 'https://example.com/.well-known/openid-configuration' then the path is blank. But if it is 'https://example.com/oxauth/.well-known/openid-configuration' then the path is '/oxauth'
  - `post_logout_redirect_uris` string[] — Provide the URLs supplied by the RP to request that the user be redirected to this location after a logout has been performed.
  - `response_types` string[] — Provide a list of the OAuth 2.0 response_type values that the Client is declaring that it will restrict itself to using. If omitted, the default is that the Client will use only the code response type.
  - `grant_types` string[] — Provide a list of the OAuth 2.0 grant types that the Client is declaring that it will restrict itself to using.
  - `scope` string[] — Provide list of scope which are used during authentication to authorize access to resource.
  - `acr_values` string[] — Provide Returns the Default requested Authentication Context Class Reference values.
  - `client_name` string — oxd will generate its own non-human readable name by default if client_name is not specified
  - `client_jwks_uri` string — Provide the URL for the Client's JSON Web Key Set (JWK) document containing key(s) that are used for signing requests to the OP. The JWK Set may also contain the Client's encryption keys(s) that are used by the OP to encrypt the responses to the Client. When both signing and encryption keys are made available, a use (Key Use) parameter value is required for all keys in the document to indicate each key's intended usage .
  - `client_token_endpoint_auth_method` string — Provide the requested authentication method for the Token Endpoint. Valid values are none, client_secret_basic, client_secret_post, client_secret_jwt, private_key_jwt, access_token, tls_client_auth, self_signed_tls_client_auth.
  - `client_token_endpoint_auth_signing_alg` string — Provide the Requested Client Authentication method for the Token Endpoint. Valid values are none, HS256, HS384, HS512, RS256, RS384, RS512, ES256, ES384, ES512, PS256, PS384, PS512.
  - `client_request_uris` string[] — Provide a list of request_uri values that are pre-registered by the Client for use at the Authorization Server.
  - `client_frontchannel_logout_uris` string[] — Provide frontchannel logout uris.
  - `client_sector_identifier_uri` string — Provide the URL using the https scheme to be used in calculating Pseudonymous Identifiers by the OP. The URL references a file with a single JSON array of redirect_uri values.
  - `contacts` string[] — Provide a list of e-mail addresses for people allowed to administer the information for this Client
  - `ui_locales` string[] — Provide ui_locales, which can be used to pass the localization from the client application to the server application in the authorize request.
  - `claims_locales` string[] — Provide claims_locales, which end-user's preferred languages and scripts for Claims being returned.
  - `claims_redirect_uri` string[]
  - `client_id` string — client id of existing client, ignores all other parameters and skips new client registration forcing to use existing client (client_secret is required if this parameter is set).
  - `client_secret` string — client secret of existing client, must be used together with client_id
  - `access_token_as_jwt` boolean — specifies whether access_token should be return as JWT or not. Default value is false.
  - `access_token_signing_alg` string — sets signing algorithm used for JWT signing. Valid values are none, HS256, HS384, HS512, RS256, RS384, RS512, ES256, ES384, ES512, PS256, PS384, PS512
  - `rpt_as_jwt` boolean — specifies whether RPT should be return as JWT or not. Default value is false.
  - `logo_uri` string — specifies an URL that references a logo for the Client application.
  - `client_uri` string — specifies an URL of the home page of the Client.
  - `policy_uri` string — specifies an URL that the Relying Party Client provides to the End-User to read about the how the profile data will be used.
  - `front_channel_logout_session_required` boolean — specifies if front channel logout session required.
  - `tos_uri` string — specifies an URL that the Relying Party Client provides to the End-User to read about the Relying Party's terms.
  - `jwks` string — Client's JSON Web Key Set (JWK) document, passed by value. The semantics of the jwks parameter are the same as the jwks_uri parameter, other than that the JWK Set is passed by value, rather than by reference. This parameter is intended only to be used by Clients that, for some reason, are unable to use the jwks_uri parameter, for instance, by native applications that might not have a location to host the contents of the JWK Set. If a Client can use jwks_uri, it must not use jwks. One significant downside of jwks is that it does not enable key rotation. The jwks_uri and jwks parameters must not be used together.
  - `id_token_binding_cnf` string
  - `tls_client_auth_subject_dn` string
  - `run_introspection_script_beforeaccess_token_as_jwt_creation_and_include_claims` boolean — choose to run introspection script before access_token_as_jwt creation and include claims.
  - `id_token_signed_response_alg` string — choose the JWS alg algorithm (JWA) required for the ID Token issued to this client_id. Valid values are none, HS256, HS384, HS512, RS256, RS384, RS512, ES256, ES384, ES512, PS256, PS384, PS512
  - `id_token_encrypted_response_alg` string — choose the JWE alg algorithm (JWA) required for encrypting the ID Token issued to this client_id. Valid values are RSA1_5, RSA-OAEP, A128KW, A256KW
  - `id_token_encrypted_response_enc` string — choose the JWE enc algorithm (JWA) required for symmetric encryption of the ID Token issued to this client_id. Valid values are A128CBC+HS256, A256CBC+HS512, A128GCM, A256GCM
  - `user_info_signed_response_alg` string — choose the JWS alg algorithm (JWA) required for UserInfo responses. Valid values are none, HS256, HS384, HS512, RS256, RS384, RS512, ES256, ES384, ES512, PS256, PS384, PS512
  - `user_info_encrypted_response_alg` string — choose the JWE alg algorithm (JWA) required for encrypting UserInfo responses. Valid values are RSA1_5, RSA_OAEP, A128KW, A256KW
  - `user_info_encrypted_response_enc` string — choose the JWE enc algorithm (JWA) required for symmetric encryption of UserInfo responses. Valid values are A128CBC+HS256, A256CBC+HS512, A128GCM, A256GCM
  - `request_object_signing_alg` string — choose the JWS alg algorithm (JWA) that must be required by the Authorization Server. Valid values are none, HS256, HS384, HS512, RS256, RS384, RS512, ES256, ES384, ES512, PS256, PS384, PS512
  - `request_object_encryption_alg` string — choose the JWE alg algorithm (JWA) the RP is declaring that it may use for encrypting Request Objects sent to the OP. Valid values are RSA1_5, RSA_OAEP, A128KW, A256KW
  - `request_object_encryption_enc` string — choose the JWE enc algorithm (JWA) the RP is declaring that it may use for encrypting Request Objects sent to the OP. Valid values are A128CBC+HS256, A256CBC+HS512, A128GCM, A256GCM
  - `default_max_age` integer — specifies the Default Maximum Authentication Age.
  - `require_auth_time` boolean — specifies the Boolean value specifying whether the auth_time claim in the id_token is required. It is required when the value is true. The auth_time claim request in the request object overrides this setting.
  - `initiate_login_uri` string — specifies the URI using the https scheme that the authorization server can call to initiate a login at the client.
  - `authorized_origins` string[] — specifies authorized JavaScript origins.
  - `access_token_lifetime` integer — specifies the Client-specific access token expiration.
  - `software_id` string — specifies a unique identifier string (UUID) assigned by the client developer or software publisher used by registration endpoints to identify the client software to be dynamically registered.
  - `software_version` string — specifies a version identifier string for the client software identified by 'software_id'. The value of the 'software_version' should change on any update to the client software identified by the same 'software_id'.
  - `software_statement` string — specifies a software statement containing client metadata values about the client software as claims. This is a string value containing the entire signed JWT.
  - `custom_attributes` object — specifies custom attribute map copy.
  - `sync_client_from_op` boolean — specifies whether to sync client from OP. Default value is false.
  - `sync_client_period_in_seconds` integer — specifies period after which client can sync again with OP. Default value is 86400 (in seconds).
  - `allow_spontaneous_scopes` boolean — specifies whether to allow spontaneous scopes for client. The default value is false
  - `spontaneous_scopes` string[] — list of spontaneous scopes (regexp against which validation is performed).

## Response `200`

OK

- object
  - `oxd_id` string, required
  - `op_host` string, required
  - `client_id` string
  - `client_name` string
  - `client_secret` string
  - `client_registration_access_token` string
  - `client_registration_client_uri` string
  - `client_id_issued_at` integer
  - `client_secret_expires_at` integer

## Other responses

- `400` — Invalid parameters are provided to endpoint.
- `403` — Forbidden. Invalid access token provided in Authorization header.
- `500` — Internal error occured. Please check oxd-server.log file for details (usually located in /var/log/oxd-server/oxd-server.log).

---

[API](https://skmtc.net/gluufederation/apis/oxd-server.md) · [All operations](https://skmtc.net/gluufederation/apis/oxd-server/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/gluufederation/oxd-server/versions/33ca9e18c54b/schema)