Sign in

v1

latestOpenAPI 3.0.02026-07-24171968.3 KB
Dynamic Client Registration Endpoint

Use this endpoint to update dynamic client

Update a previously registered client's registration with the OIDC Provider. This request MUST include all client metadata fields as returned to the client from a previous registration, read, or update operation. The updated client metadata fields request MUST NOT include the "registration_access_token", "registration_client_uri", "client_secret_expires_at", or "client_id_issued_at" fields

put/register/{clientId}

Path parameters

clientIdstring required

Dynamic client identifier

Headers

x-client-certificatestring

MTLS Client Certificate

Request body

redirect_urisstring[] required
response_typesstring[]
grant_typesstring[]
application_type'native' | 'web'

Kind of the application.

contactsstring[]
client_namestring

Name of the Client to be presented to the End-User.

logo_uristring

URL that references a logo for the Client application.

client_uristring

URL of the home page of the Client.

policy_uristring

URL that the Relying Party Client provides to the End-User to read about the how the profile data will be used.

tos_uristring

URL that the Relying Party Client provides to the End-User to read about the Relying Party's terms of service.

jwks_uristring

URL for the Client's JSON Web Key Set document.

jwksobject

Client's JSON Web Key Set document, passed by value.

sector_identifier_uristring

URL using the https scheme to be used in calculating Pseudonymous Identifiers by the OIDC Provider. It is not supported by this implementation since it only support public subject_type.

subject_type'public'

subject_type requested for responses to this Client.

id_token_signed_response_alg'RS256' | 'RS384' | 'RS512' | 'ES256' | 'ES384' | 'ES512' | 'PS256' | 'PS384' | 'PS512'

JWS "alg" algorithm REQUIRED for signing the ID Token issued to this Client.

id_token_encrypted_response_alg'none' | 'RSA-OAEP' | 'RSA-OAEP-256'

JWE "alg" algorithm REQUIRED for encrypting the ID Token issued to this Client.

id_token_encrypted_response_enc'none' | 'A128GCM' | 'A192GCM' | 'A256GCM'

JWE "enc" algorithm REQUIRED for encrypting the ID Token issued to this Client.

userinfo_signed_response_alg'RS256' | 'RS384' | 'RS512' | 'ES256' | 'ES384' | 'ES512' | 'PS256' | 'PS384' | 'PS512'

JWS "alg" algorithm REQUIRED for signing UserInfo Responses

userinfo_encrypted_response_alg'none' | 'RSA-OAEP' | 'RSA-OAEP-256'

JWE "alg" algorithm REQUIRED for encrypting UserInfo Responses

userinfo_encrypted_response_enc'none' | 'A128GCM' | 'A192GCM' | 'A256GCM'

JWE "enc" algorithm REQUIRED for encrypting UserInfo Responses

request_object_signing_alg'RS256' | 'RS384' | 'RS512' | 'ES256' | 'ES384' | 'ES512' | 'PS256' | 'PS384' | 'PS512'

JWS "alg" algorithm that MUST be used for signing Request Objects sent to the OIDC Provider

request_object_encryption_alg'none' | 'RSA-OAEP' | 'RSA-OAEP-256'

JWE "alg" algorithm the Relying Party is declaring that it may use for encrypting Request Objects sent to the OIDC Provider

request_object_encryption_enc'none' | 'A128GCM' | 'A192GCM' | 'A256GCM'

JWE "enc" algorithm the Relying Party is declaring that it may use for encrypting Request Objects sent to the OIDC Provider

token_endpoint_auth_method'default' | 'client_secret_basic' | 'client_secret_post' | 'private_key_jwt' | 'tls_client_auth'

Requested Client Authentication method for the Token Endpoint

token_endpoint_auth_signing_alg'RS256' | 'RS384' | 'RS512' | 'ES256' | 'ES384' | 'ES512' | 'PS256' | 'PS384' | 'PS512'

JWS "alg" algorithm that MUST be used for signing the JWT used to authenticate the Client at the Token Endpoint for the private_key_jwt authentication method.

token_endpoint_auth_single_use_jtiboolean

Whether private_key_jwt client assertion can only be used once. This is done by checking the "jti" claim uniqueness.

default_max_agenumber

Default Maximum Authentication Age This implementation does not read this configuration.

require_auth_timeboolean

Whether the auth_time Claim in the ID Token is required. This implementation by default will output auth_time whether it is required or not.

default_acr_valuesstring[]
initiate_login_uristring

URI using the https scheme that a third party can use to initiate a login by the Relying Party

request_urisstring[]
scopestring

Space-delimited string containing list of scope values that the client can use when requesting access tokens.

tls_client_auth_subject_dnstring

Expected subject distinguished name of the certificate that the client will use in mutual-TLS authentication.

tls_client_auth_san_dnsstring

Expected DNS Name SAN entry in the certificate that the client will use in mutual-TLS authentication.

tls_client_auth_san_emailstring

Expected RFC822 Name SAN entry in the certificate that the client will use in mutual-TLS authentication.

tls_client_auth_san_ipstring

Expected IP Address SAN entry in the certificate that the client will use in mutual-TLS authentication.

tls_client_auth_san_uristring

Expected Uniform Resource Identifier (URI) SAN entry in the certificate that the client will use in mutual-TLS authentication

tls_client_certificate_bound_access_tokensboolean

Indicate the client's intention to use mutual-TLS client certificate-bound access tokens.

require_pushed_authorization_requestsboolean

Indicates whether the client is required to use Pushed Authorization Request to initiate authorization requests.

require_pkceboolean

Indicates whether the client is required to use Proof Key for Code Exchange (PKCE) in the authorization requests.

backchannel_token_delivery_mode'poll' | 'ping'

Method of delivering the tokens after a successful user authentication.

backchannel_client_notification_endpointstring

The endpoint to which the OIDC Provider will post a notification after a successful or failed end-user authentication. Required if the token delivery mode is set to "ping".

backchannel_user_code_parameterboolean

Indicates whether the client is sending user_code parameter

software_idstring

A unique identifier string assigned by the client developer or software publisher used by registration endpoints to identify the client software to be dynamically registered. The value of this field is not intended to be human readable and is usually opaque to the client and authorization server.

software_versionstring

A version identifier string for the client software identified by "software_id". The value of the "software_version" SHOULD change on any update to the client software identified by the same "software_id".

software_statementstring

A software statement is a JSON Web Token (JWT) that asserts metadata values about the client software as a bundle. All the properties above can be specified in a software statement. When presented to the authorization server as part of a client registration request, the software statement MUST be digitally signed and MUST contain an "iss" (issuer) claim denoting the party attesting to the claims in the software statement. Client metadata values conveyed in the software statement will take precedence over those conveyed using plain JSON elements. When using Dynamic Client Registration for FAPI specification, the software statement is generated by regulatory body and there are certain rules to follow.

Response

Metadata associated with the dynamic client.

client_idstring

OAuth 2.0 client identifier string.

client_secretstring

OAuth 2.0 client secret string.

client_id_issued_atnumber

Time at which the client identifier was issued. The time is represented as the number of seconds from 1970-01-01T00:00:00Z as measured in UTC until the date/time of issuance.

client_secret_expires_atnumber

Time at which the client secret will expire or 0 if it will not expire. The time is represented as the number of seconds from 1970-01-01T00:00:00Z as measured in UTC until the date/time of expiration.

registration_client_uristring

Fully qualified URL of the client configuration endpoint for this client

registration_access_tokenstring

Access token to be used at the client configuration endpoint to perform subsequent management operations upon the client registration.

redirect_urisstring[]
response_typesstring[]
grant_typesstring[]
application_type'native' | 'web'

Kind of the application.

contactsstring[]
client_namestring

Name of the Client to be presented to the End-User.

logo_uristring

URL that references a logo for the Client application.

client_uristring

URL of the home page of the Client.

policy_uristring

URL that the Relying Party Client provides to the End-User to read about the how the profile data will be used.

tos_uristring

URL that the Relying Party Client provides to the End-User to read about the Relying Party's terms of service.

jwks_uristring

URL for the Client's JSON Web Key Set document.

jwksobject

Client's JSON Web Key Set document, passed by value.

sector_identifier_uristring

URL using the https scheme to be used in calculating Pseudonymous Identifiers by the OIDC Provider. It is not supported by this implementation since it only support public subject_type.

subject_type'public'

subject_type requested for responses to this Client.

id_token_signed_response_alg'RS256' | 'RS384' | 'RS512' | 'ES256' | 'ES384' | 'ES512' | 'PS256' | 'PS384' | 'PS512'

JWS "alg" algorithm REQUIRED for signing the ID Token issued to this Client.

id_token_encrypted_response_alg'none' | 'RSA-OAEP' | 'RSA-OAEP-256'

JWE "alg" algorithm REQUIRED for encrypting the ID Token issued to this Client.

id_token_encrypted_response_enc'none' | 'A128GCM' | 'A192GCM' | 'A256GCM'

JWE "enc" algorithm REQUIRED for encrypting the ID Token issued to this Client.

userinfo_signed_response_alg'RS256' | 'RS384' | 'RS512' | 'ES256' | 'ES384' | 'ES512' | 'PS256' | 'PS384' | 'PS512'

JWS "alg" algorithm REQUIRED for signing UserInfo Responses

userinfo_encrypted_response_alg'none' | 'RSA-OAEP' | 'RSA-OAEP-256'

JWE "alg" algorithm REQUIRED for encrypting UserInfo Responses

userinfo_encrypted_response_enc'none' | 'A128GCM' | 'A192GCM' | 'A256GCM'

JWE "enc" algorithm REQUIRED for encrypting UserInfo Responses

request_object_signing_alg'RS256' | 'RS384' | 'RS512' | 'ES256' | 'ES384' | 'ES512' | 'PS256' | 'PS384' | 'PS512'

JWS "alg" algorithm that MUST be used for signing Request Objects sent to the OIDC Provider

request_object_encryption_alg'none' | 'RSA-OAEP' | 'RSA-OAEP-256'

JWE "alg" algorithm the Relying Party is declaring that it may use for encrypting Request Objects sent to the OIDC Provider

request_object_encryption_enc'none' | 'A128GCM' | 'A192GCM' | 'A256GCM'

JWE "enc" algorithm the Relying Party is declaring that it may use for encrypting Request Objects sent to the OIDC Provider

token_endpoint_auth_method'default' | 'client_secret_basic' | 'client_secret_post' | 'private_key_jwt' | 'tls_client_auth'

Requested Client Authentication method for the Token Endpoint

token_endpoint_auth_signing_alg'RS256' | 'RS384' | 'RS512' | 'ES256' | 'ES384' | 'ES512' | 'PS256' | 'PS384' | 'PS512'

JWS "alg" algorithm that MUST be used for signing the JWT used to authenticate the Client at the Token Endpoint for the private_key_jwt authentication method.

token_endpoint_auth_single_use_jtiboolean

Whether private_key_jwt client assertion can only be used once. This is done by checking the "jti" claim uniqueness.

default_max_agenumber

Default Maximum Authentication Age. This implementation does not read this configuration.

require_auth_timeboolean

Whether the auth_time Claim in the ID Token is required. This implementation by default will output auth_time whether it is required or not.

default_acr_valuesstring[]
initiate_login_uristring

URI using the https scheme that a third party can use to initiate a login by the Relying Party

request_urisstring[]
scopestring

Space-delimited string containing list of scope values that the client can use when requesting access tokens.

tls_client_auth_subject_dnstring

Expected subject distinguished name of the certificate that the client will use in mutual-TLS authentication.

tls_client_auth_san_dnsstring

Expected DNS Name SAN entry in the certificate that the client will use in mutual-TLS authentication.

tls_client_auth_san_emailstring

Expected RFC822 Name SAN entry in the certificate that the client will use in mutual-TLS authentication.

tls_client_auth_san_ipstring

Expected IP Address SAN entry in the certificate that the client will use in mutual-TLS authentication.

tls_client_auth_san_uristring

Expected Uniform Resource Identifier (URI) SAN entry in the certificate that the client will use in mutual-TLS authentication

tls_client_certificate_bound_access_tokensboolean

Indicate the client's intention to use mutual-TLS client certificate-bound access tokens.

require_pushed_authorization_requestsboolean

Indicates whether the client is required to use Pushed Authorization Request to initiate authorization requests.

require_pkceboolean

Indicates whether the client is required to use Proof Key for Code Exchange (PKCE) in the authorization requests.

backchannel_token_delivery_mode'poll' | 'ping'

Method of delivering the tokens after a successful user authentication.

backchannel_client_notification_endpointstring

The endpoint to which the OIDC Provider will post a notification after a successful or failed end-user authentication. Required if the token delivery mode is set to "ping".

backchannel_user_code_parameterboolean

Indicates whether the client is sending user_code parameter

software_idstring

A unique identifier string assigned by the client developer or software publisher used by registration endpoints to identify the client software to be dynamically registered. The value of this field is not intended to be human readable and is usually opaque to the client and authorization server.

software_versionstring

A version identifier string for the client software identified by "software_id". The value of the "software_version" SHOULD change on any update to the client software identified by the same "software_id".

software_statementstring

A software statement is a JSON Web Token (JWT) that asserts metadata values about the client software as a bundle. All the properties above can be specified in a software statement. When presented to the authorization server as part of a client registration request, the software statement MUST be digitally signed and MUST contain an "iss" (issuer) claim denoting the party attesting to the claims in the software statement. Client metadata values conveyed in the software statement will take precedence over those conveyed using plain JSON elements. When using Dynamic Client Registration for FAPI specification, the software statement is generated by regulatory body and there are certain rules to follow. All metadata inside the software statement will be returned as top level element in the response.