Get client information for a previously registered client.
Get client information for a previously registered client.
Query parameters
Client ID that identifies client.
Headers
Authorization header carrying "registration_access_token" issued before as a Bearer token
Response
OK
Redirection URI values used by the Client. One of these registered Redirection URI values must exactly match the redirect_uri parameter value used in each Authorization Request
Array of The Claims Redirect URIs to which the client wishes the authorization server to direct the requesting party's user agent after completing its interaction.
A list of the OAuth 2.0 response_type values that the Client is declaring that it will restrict itself to using. If omitted, the default is that the Client will use only the code Response Type. Allowed values are code, token, id_token.
A list of the OAuth 2.0 Grant Types that the Client is declaring that it will restrict itself to using.
e-mail addresses of people responsible for this Client.
authorization details types (RFC9396). Fine-graned access.
Name of the Client to be presented to the user.
URL that references a logo for the Client application
URL of the home page of the Client. The value of this field must point to a valid Web page.
URL that the Relying Party Client provides to the End-User to read about the how the profile data will be used.
URL that the Relying Party Client provides to the End-User to read about the Relying Party's terms of service.
URL for the Client's JSON Web Key Set (JWK) document containing key(s) that are used for signing requests to the OP. The JWK Set may also contain the Client's encryption keys(s) that are used by the OP to encrypt the responses to the Client. When both signing and encryption keys are made available, a use (Key Use) parameter value is required for all keys in the document to indicate each key's intended usage .
Client's JSON Web Key Set (JWK) document, passed by value. The semantics of the jwks parameter are the same as the jwks_uri parameter, other than that the JWK Set is passed by value, rather than by reference. This parameter is intended only to be used by Clients that, for some reason, are unable to use the jwks_uri parameter, for instance, by native applications that might not have a location to host the contents of the JWK Set. If a Client can use jwks_uri, it must not use jwks. One significant downside of jwks is that it does not enable key rotation. The jwks_uri and jwks parameters must not be used together.
URL using the https scheme to be used in calculating Pseudonymous Identifiers by the OP.
Subject type requested for the Client ID. Valid types include pairwise and public.
Specifies whether RPT should be return as signed JWT.
Specifies whether access token as signed JWT.
Specifies signing algorithm that has to be used during JWT signing. If it's not specified, then the default OP signing algorithm will be used .
JWS alg algorithm (JWA) required for signing the ID Token issued to this Client.
JWE alg algorithm (JWA) required for encrypting the ID Token issued to this Client.
JWE enc algorithm (JWA) required for encrypting the ID Token issued to this Client.
JWS alg algorithm (JWA) required for signing UserInfo Responses.
JWE alg algorithm (JWA) required for encrypting UserInfo Responses.
JWE enc algorithm (JWA) required for encrypting UserInfo Responses.
JWS alg algorithm (JWA) required for signing Introspection Responses.
JWE alg algorithm (JWA) required for encrypting Introspection Responses.
JWE enc algorithm (JWA) required for encrypting Introspection Responses.
JWS alg algorithm (JWA) required for signing Logout Status JWT.
JWS alg algorithm (JWA) required for signing Transaction Token Responses.
JWE alg algorithm (JWA) required for encrypting Transaction Token Responses.
JWE enc algorithm (JWA) required for encrypting Transaction Token Responses.
JWS alg algorithm (JWA) that must be used for signing Request Objects sent to the OP.
JWE alg algorithm (JWA) the RP is declaring that it may use for encrypting Request Objects sent to the OP.
JWE enc algorithm (JWA) the RP is declaring that it may use for encrypting Request Objects sent to the OP.
Requested Client Authentication method for the Token Endpoint.
Array of additional Client Authentication methods for the Token Endpoint
JWS alg algorithm (JWA) that must be used for signing the JWT used to authenticate the Client at the Token Endpoint for the private_key_jwt and client_secret_jwt authentication methods.
Specifies the Default Maximum Authentication Age.
Boolean value specifying whether the auth_time Claim in the ID Token is required. It is required when the value is true.
Array of default requested Authentication Context Class Reference values that the Authorization Server must use for processing requests from the Client.
Integer value which sets minimum acr level.
boolean value, if false and minimum_acr_level is higher then current acr_values then reject request. If true - resolve acr according to either client's minimum_acr_priority_list or AS auth_level_mapping
enables client to specify the acr order of preference, rather then just the next lowest integer value
Specifies the URI using the https scheme that the authorization server can call to initiate a login at the client.
Array of client's groups.
Provide the URLs supplied by the RP to request that the user be redirected to this location after a logout has been performed.
RP URL that will cause the RP to log itself out when rendered in an iframe by the OP.
Boolean value specifying whether the RP requires that a session ID query parameter be included to identify the RP session at the OP when the logout_uri is used. If omitted, the default value is false.
RP URL that will cause the RP to log itself out when sent a Logout Token by the OP.
Boolean value specifying whether the RP requires that a session ID Claim be included in the Logout Token to identify the RP session with the OP when the backchannel_logout_uri is used. If omitted, the default value is false.
Provide a list of request_uri values that are pre-registered by the Client for use at the Authorization Server.
This param will be removed in a future version because the correct is 'scope' not 'scopes', see (rfc7591).
String containing a space-separated list of claims that can be requested individually.
Specifies the JWT Confirmation Method member name (e.g. tbh) that the Relying Party expects when receiving Token Bound ID Tokens. The presence of this parameter indicates that the Relying Party supports Token Binding of ID Tokens. If omitted, the default is that the Relying Party does not support Token Binding of ID Tokens.
An string representation of the expected subject distinguished name of the certificate, which the OAuth client will use in mutual TLS authentication.
Specifies whether to allow spontaneous scopes for client. The default value is false.
List of spontaneous scopes
Boolean value with default value false. If true and access_token_as_jwt=true then run introspection script and transfer claims into JWT.
Boolean value indicating if the client authorization will not be removed afer expiration (expiration date is same as client's expiration that created it). The default value is false.
Provide list of scope which are used during authentication to authorize access to resource.
specifies authorized JavaScript origins.
Specifies the Client-specific access token expiration.
Specifies the Client-specific id_token expiration in seconds.
Specifies the Client-specific tx_token expiration in seconds.
Specifies the Client-specific PAR expiration in seconds.
Boolean parameter indicating whether the only means of initiating an authorization request the client is allowed to use is a pushed authorization request. If omitted, the default value is "false".
Specifies a unique identifier string (UUID) assigned by the client developer or software publisher used by registration endpoints to identify the client software to be dynamically registered.
Specifies a version identifier string for the client software identified by 'software_id'. The value of the 'software_version' should change on any update to the client software identified by the same 'software_id'.
specifies a software statement containing client metadata values about the client software as claims. This is a string value containing the entire signed JWT.
specifies how backchannel token will be deliveried.
Client Initiated Backchannel Authentication (CIBA) enables a Client to initiate the authentication of an end-user by means of out-of-band mechanisms. Upon receipt of the notification, the Client makes a request to the token endpoint to obtain the tokens.
The JWS algorithm alg value that the Client will use for signing authentication request, as described in Section 7.1.1. of OAuth 2.0 [RFC6749]. When omitted, the Client will not send signed authentication requests.
Boolean value specifying whether the Client supports the user_code parameter. If omitted, the default value is false.
Example response
{
"redirect_uris": [
"https://client.example.org/cb"
],
"jwks": "{\"key1\": \"value1\", \"key2\": \"value2\"}",
"default_max_age": 1000000,
"minimum_acr_level": 10,
"post_logout_redirect_uris": [
"https://client.example.org/logout/page1",
"https://client.example.org/logout/page2",
"https://client.example.org/logout/page3"
],
"scope": [
"openid"
],
"access_token_lifetime": 100,
"id_token_lifetime": 600,
"tx_token_lifetime": 600,
"par_lifetime": 600,
"software_id": "4NRB1-0XZABZI9E6-5SM3R",
"software_version": "2.1",
"backchannel_token_delivery_mode": "push, poll, ping"
}