Skip to content
Authrim

List OAuth/OIDC clients.

GET
/api/admin/clients
Code sample: Shell / cURL 
curl --request GET \
  --url https://auth.example.com/api/admin/clients \
  --header 'Authorization: Bearer <token>'

List OAuth/OIDC clients in the current tenant with pagination and optional search.

Authorizations

Section titled “Authorizations ”

Parameters

Section titled “ Parameters ”

Header Parameters

Section titled “Header Parameters ”
X-Tenant-Id
string

Tenant selector for multi-tenant admin requests.

Query Parameters

Section titled “Query Parameters ”
page
integer
>= 1
limit
integer
>= 1 <= 500
search
string

Responses

Section titled “ Responses ”

200

Section titled “200 ”

OAuth/OIDC client list response.

Media type application/json
object
clients
required
Array
object
client_name
required
string
>= 1 characters
description
string | null
redirect_uris
required
Array<string>
>= 1 items
grant_types
required
Array<string>
Allowed values: authorization_code refresh_token client_credentials urn:ietf:params:oauth:grant-type:device_code urn:openid:params:grant-type:ciba urn:ietf:params:oauth:grant-type:token-exchange
response_types
required
Array<string>
Allowed values: code id_token token
scope
string
logo_uri
string format: uri
client_uri
string format: uri
policy_uri
string format: uri
tos_uri
string format: uri
contacts
Array<string>
token_endpoint_auth_method
string
Allowed values: none client_secret_basic client_secret_post private_key_jwt
subject_type
string
Allowed values: public pairwise
sector_identifier_uri
string format: uri
is_trusted
boolean
skip_consent
boolean
allow_claims_without_scope
boolean
identity_mapping
One of:
One of:
object
fieldMappingSetId
required
string
fieldMappingVersionId
string
destinationNamespace
string
sourceProfileId
string
key
additional properties
attribute_release_consent
One of:
object
enabled
required
boolean
mode
required
string
Allowed values: once every_time until_attributes_change
key
additional properties
allowed_redirect_origins
Array<string>
web_origin_registry
object | null
require_pkce
boolean
minimum_ial

The lowest identity assurance level (NIST SP 800-63A) a person must have been proofed at to be authorized by, or issued tokens for, this client. Absent on update: unchanged. Null: removes it (the client sets no minimum of its own). An empty string is refused with 400 invalid_request, never read as null. A person below it is refused (authorization_code, refresh_token and the other user grants: access_denied at authorize, invalid_grant at the token endpoint; device and CIBA: access_denied). It applies whether or not tenant-wide assurance is on. Set here only; dynamic client registration does not accept it.

string | null
Allowed values: IAL1 IAL2 IAL3
application_type
string
Allowed values: web native service
trust_group
string | null
browser_public_client_mode
string | null
Allowed values: disabled enabled required
browser_refresh_token_policy
string | null
Allowed values: disabled rotation persistent
native_sso_enabled
boolean | null
native_channel_allowed
boolean | null
allowed_channels
Array<string> | null
token_exchange_allowed
boolean
allowed_subject_token_clients
Array<string> | null
allowed_token_exchange_resources
Array<string> | null
delegation_mode
string
Allowed values: none delegation impersonation
client_credentials_allowed
boolean
allowed_scopes
Array<string> | null
requestable_scopes

OAuth scope tokens this client may request. Agent Access connections require explicit agent scopes.

Array<string> | null
<= 100 items
default_scope
string | null
default_audience
string | null
default_resource
string | null
id_token_signed_response_alg

JWS algorithm for this app’s ID Tokens. Null or omitted means the tenant’s oauth.id_token_signing_alg (RS256 by default). Refused (400 invalid_request) when it differs from the tenant’s algorithm while oauth.id_token_signing_alg_client_override is false, and 503 temporarily_unavailable when that policy cannot be read.

string | null
Allowed values: RS256 ES256 PS256
userinfo_signed_response_alg

JWS algorithm used for signed UserInfo responses. JSON is returned when set to none or omitted.

string | null
default: none
Allowed values: none RS256 ES256 PS256
client_id
required
string
client_secret

Returned only on secret-issuing operations such as confidential client creation or regeneration. Public clients using token_endpoint_auth_method=none do not generate or return a secret.

string
tenant_id
string
created_at
One of:
integer
updated_at
One of:
integer
pagination
required
object
page
required
integer
>= 1
limit
required
integer
>= 1
total
required
integer
totalPages
required
integer
hasNext
required
boolean
hasPrev
required
boolean
Example 
{
  "clients": [
    {
      "grant_types": [
        "authorization_code"
      ],
      "response_types": [
        "code"
      ],
      "token_endpoint_auth_method": "none",
      "subject_type": "public",
      "identity_mapping": {
        "mode": "none"
      },
      "attribute_release_consent": {
        "mode": "once"
      },
      "minimum_ial": "IAL1",
      "application_type": "web",
      "browser_public_client_mode": "disabled",
      "browser_refresh_token_policy": "disabled",
      "delegation_mode": "none",
      "id_token_signed_response_alg": "RS256",
      "userinfo_signed_response_alg": "none"
    }
  ]
}