Registers new client dynamically.
The Client Registration Endpoint is an OAuth 2.0 Protected Resource through which a new Client registration can be requested.
Request body
Redirection URI values used by the Client. One of these registered Redirection URI values must exactly match the redirect_uri parameter value used in each Authorization Request
Array of The Claims Redirect URIs to which the client wishes the authorization server to direct the requesting party's user agent after completing its interaction.
A list of the OAuth 2.0 response_type values that the Client is declaring that it will restrict itself to using. If omitted, the default is that the Client will use only the code Response Type. Allowed values are code, token, id_token.
A list of the OAuth 2.0 Grant Types that the Client is declaring that it will restrict itself to using.
e-mail addresses of people responsible for this Client.
Name of the Client to be presented to the user.
authorization details types (RFC9396). Fine-graned access.
URL that references a logo for the Client application
URL of the home page of the Client. The value of this field must point to a valid Web page.
URL that the Relying Party Client provides to the End-User to read about the how the profile data will be used.
URL that the Relying Party Client provides to the End-User to read about the Relying Party's terms of service.
URL for the Client's JSON Web Key Set (JWK) document containing key(s) that are used for signing requests to the OP. The JWK Set may also contain the Client's encryption keys(s) that are used by the OP to encrypt the responses to the Client. When both signing and encryption keys are made available, a use (Key Use) parameter value is required for all keys in the document to indicate each key's intended usage .
URL using the https scheme to be used in calculating Pseudonymous Identifiers by the OP.
Subject type requested for the Client ID. Valid types include pairwise and public.
Specifies whether RPT should be return as signed JWT.
Specifies whether access token as signed JWT.
Specifies signing algorithm that has to be used during JWT signing. If it's not specified, then the default OP signing algorithm will be used .
JWS alg algorithm (JWA) required for signing the ID Token issued to this Client.
JWE alg algorithm (JWA) required for encrypting the ID Token issued to this Client.
JWE enc algorithm (JWA) required for encrypting the ID Token issued to this Client.
JWS alg algorithm (JWA) required for signing UserInfo Responses.
JWE alg algorithm (JWA) required for encrypting UserInfo Responses.
JWE enc algorithm (JWA) required for encrypting UserInfo Responses.
JWS alg algorithm (JWA) required for signing Introspection Responses.
JWE alg algorithm (JWA) required for encrypting Introspection Responses.
JWE enc algorithm (JWA) required for encrypting Introspection Responses.
JWS alg algorithm (JWA) required for signing Logout Status JWT.
JWS alg algorithm (JWA) required for signing Transaction Token Responses.
JWE alg algorithm (JWA) required for encrypting Transaction Token Responses.
JWE enc algorithm (JWA) required for encrypting Transaction Token Responses.
JWS alg algorithm (JWA) that must be used for signing Request Objects sent to the OP.
JWE alg algorithm (JWA) the RP is declaring that it may use for encrypting Request Objects sent to the OP.
JWE enc algorithm (JWA) the RP is declaring that it may use for encrypting Request Objects sent to the OP.
Requested Client Authentication method for the Token Endpoint.
Array of additional Client Authentication methods for the Token Endpoint
JWS alg algorithm (JWA) that must be used for signing the JWT used to authenticate the Client at the Token Endpoint for the private_key_jwt and client_secret_jwt authentication methods.
Specifies the Default Maximum Authentication Age.
Boolean specifying whether PKCE is required by client. Defalut value is false.
Boolean value specifying whether the auth_time Claim in the ID Token is required. It is required when the value is true.
Array of default requested Authentication Context Class Reference values that the Authorization Server must use for processing requests from the Client.
Integer value which sets minimum acr level.
boolean value, if false and minimum_acr_level is higher then current acr_values then reject request. If true - resolve acr according to either client's minimum_acr_priority_list or AS auth_level_mapping
enables client to specify the acr order of preference, rather then just the next lowest integer value
Array of client's groups.
Specifies the URI using the https scheme that the authorization server can call to initiate a login at the client.
Provide the URLs supplied by the RP to request that the user be redirected to this location after a logout has been performed.
RP URL that will cause the RP to log itself out when rendered in an iframe by the OP.
Boolean value specifying whether the RP requires that a session ID query parameter be included to identify the RP session at the OP when the logout_uri is used. If omitted, the default value is false.
RP URL that will cause the RP to log itself out when sent a Logout Token by the OP.
Boolean value specifying whether the RP requires that a session ID Claim be included in the Logout Token to identify the RP session with the OP when the backchannel_logout_uri is used. If omitted, the default value is false.
Provide a list of request_uri values that are pre-registered by the Client for use at the Authorization Server.
This param will be removed in a future version because the correct is 'scope' not 'scopes', see (rfc7591).
String containing a space-separated list of claims that can be requested individually.
Specifies the JWT Confirmation Method member name (e.g. tbh) that the Relying Party expects when receiving Token Bound ID Tokens. The presence of this parameter indicates that the Relying Party supports Token Binding of ID Tokens. If omitted, the default is that the Relying Party does not support Token Binding of ID Tokens.
An string representation of the expected subject distinguished name of the certificate, which the OAuth client will use in mutual TLS authentication.
Specifies whether to allow spontaneous scopes for client. The default value is false.
List of spontaneous scopes
Boolean value with default value false. If true and access_token_as_jwt=true then run introspection script and transfer claims into JWT.
Boolean value indicating if the client authorization will not be removed afer expiration (expiration date is same as client's expiration that created it). The default value is false.
Provide list of scope which are used during authentication to authorize access to resource.
specifies authorized JavaScript origins.
Specifies the Client-specific access token expiration in seconds.
Specifies the Client-specific id_token expiration in seconds.
Specifies the Client-specific tx_token expiration in seconds.
Specifies the Client-specific PAR expiration in seconds.
Specifies the client expiration in seconds.
Evidence is a set of claims generated by an attester to be appraised by a verifier. Evidence may include configuration data, measurements, telemetry, or inferences. This is a string value containing the evidence, as produced by the selected attestation technology.
boolean value specifying whether the client always uses DPoP for token requests. If omitted, the default value is false
requested additional authentication methods for the Token Endpoint.
Boolean parameter indicating whether the only means of initiating an authorization request the client is allowed to use is a pushed authorization request. If omitted, the default value is "false".
Specifies a unique identifier string (UUID) assigned by the client developer or software publisher used by registration endpoints to identify the client software to be dynamically registered.
Specifies a version identifier string for the client software identified by 'software_id'. The value of the 'software_version' should change on any update to the client software identified by the same 'software_id'.
specifies a software statement containing client metadata values about the client software as claims. This is a string value containing the entire signed JWT.
specifies how backchannel token will be deliveried.
Client Initiated Backchannel Authentication (CIBA) enables a Client to initiate the authentication of an end-user by means of out-of-band mechanisms. Upon receipt of the notification, the Client makes a request to the token endpoint to obtain the tokens.
The JWS algorithm alg value that the Client will use for signing authentication request, as described in Section 7.1.1. of OAuth 2.0 [RFC6749]. When omitted, the Client will not send signed authentication requests.
Boolean value specifying whether the Client supports the user_code parameter. If omitted, the default value is false.
Additional audiences.
Spontaneous scope script dns
PAR script dns
Transaction Token script dns
Logout status jwt script dns
Update token script dns
Logout status jwt script dns
Post Authn script dns
Token Exchange script dns
Identity Assertion (ID-JAG) script dns
Consent Gathering script dns
Introspection script dns
RPT Claims script dns
ROPC script dns
Organization Id
Example request
{
"redirect_uris": [
"https://client.example.org/cb"
],
"default_max_age": 1000000,
"minimum_acr_level": 10,
"post_logout_redirect_uris": [
"https://client.example.org/logout/page1",
"https://client.example.org/logout/page2",
"https://client.example.org/logout/page3"
],
"scope": [
"openid"
],
"access_token_lifetime": 600,
"id_token_lifetime": 600,
"tx_token_lifetime": 600,
"par_lifetime": 600,
"lifetime": 600,
"software_id": "4NRB1-0XZABZI9E6-5SM3R",
"software_version": "2.1",
"backchannel_token_delivery_mode": "push, poll, ping"
}Response
OK
Unique Client Identifier. It MUST NOT be currently valid for any other registered Client.
This value is used by Confidential Clients to authenticate to the Token Endpoint
Registration Access Token that can be used at the Client Configuration Endpoint to perform subsequent operations upon the Client registration.
Location of the Client Configuration Endpoint where the Registration Access Token can be used to perform subsequent operations upon the resulting Client registration.
Time at which the Client Identifier was issued.
Time at which the client_secret will expire or 0 if it will not expire.
Organization Id. Present only when organization id is set.