Skip to content
Authrim

Get an OAuth/OIDC client.

GET
/api/admin/clients/{id}
Code sample: Shell / cURL 
curl --request GET \
  --url https://auth.example.com/api/admin/clients/example \
  --header 'Authorization: Bearer <token>'

Get Client in the Clients area. Use this operation to retrieve client data without mutating tenant state.

Authorizations

Section titled “Authorizations ”

Parameters

Section titled “ Parameters ”

Path Parameters

Section titled “Path Parameters ”
id
required
string

Header Parameters

Section titled “Header Parameters ”
X-Tenant-Id
string

Tenant selector for multi-tenant admin requests.

Responses

Section titled “ Responses ”

200

Section titled “200 ”

OAuth/OIDC client response.

Media type application/json
object
client
required
object
client_name
required
string
>= 1 characters
description
string | null
redirect_uris
required
Array<string>
>= 1 items
grant_types
required
Array<string>
Allowed values: authorization_code refresh_token client_credentials urn:ietf:params:oauth:grant-type:device_code urn:openid:params:grant-type:ciba urn:ietf:params:oauth:grant-type:token-exchange
response_types
required
Array<string>
Allowed values: code id_token token
scope
string
logo_uri
string format: uri
client_uri
string format: uri
policy_uri
string format: uri
tos_uri
string format: uri
contacts
Array<string>
token_endpoint_auth_method
string
Allowed values: none client_secret_basic client_secret_post private_key_jwt
subject_type
string
Allowed values: public pairwise
sector_identifier_uri
string format: uri
is_trusted
boolean
skip_consent
boolean
allow_claims_without_scope
boolean
identity_mapping
One of:
One of:
object
fieldMappingSetId
required
string
fieldMappingVersionId
string
destinationNamespace
string
sourceProfileId
string
key
additional properties
attribute_release_consent
One of:
object
enabled
required
boolean
mode
required
string
Allowed values: once every_time until_attributes_change
key
additional properties
allowed_redirect_origins
Array<string>
web_origin_registry
object | null
require_pkce
boolean
minimum_ial

The lowest identity assurance level (NIST SP 800-63A) a person must have been proofed at to be authorized by, or issued tokens for, this client. Absent on update: unchanged. Null: removes it (the client sets no minimum of its own). An empty string is refused with 400 invalid_request, never read as null. A person below it is refused (authorization_code, refresh_token and the other user grants: access_denied at authorize, invalid_grant at the token endpoint; device and CIBA: access_denied). It applies whether or not tenant-wide assurance is on. Set here only; dynamic client registration does not accept it.

string | null
Allowed values: IAL1 IAL2 IAL3
application_type
string
Allowed values: web native service
trust_group
string | null
browser_public_client_mode
string | null
Allowed values: disabled enabled required
browser_refresh_token_policy
string | null
Allowed values: disabled rotation persistent
native_sso_enabled
boolean | null
native_channel_allowed
boolean | null
allowed_channels
Array<string> | null
token_exchange_allowed
boolean
allowed_subject_token_clients
Array<string> | null
allowed_token_exchange_resources
Array<string> | null
delegation_mode
string
Allowed values: none delegation impersonation
client_credentials_allowed
boolean
allowed_scopes
Array<string> | null
requestable_scopes

OAuth scope tokens this client may request. Agent Access connections require explicit agent scopes.

Array<string> | null
<= 100 items
default_scope
string | null
default_audience
string | null
default_resource
string | null
id_token_signed_response_alg

JWS algorithm for this app’s ID Tokens. Null or omitted means the tenant’s oauth.id_token_signing_alg (RS256 by default). Refused (400 invalid_request) when it differs from the tenant’s algorithm while oauth.id_token_signing_alg_client_override is false, and 503 temporarily_unavailable when that policy cannot be read.

string | null
Allowed values: RS256 ES256 PS256
userinfo_signed_response_alg

JWS algorithm used for signed UserInfo responses. JSON is returned when set to none or omitted.

string | null
default: none
Allowed values: none RS256 ES256 PS256
client_id
required
string
client_secret

Returned only on secret-issuing operations such as confidential client creation or regeneration. Public clients using token_endpoint_auth_method=none do not generate or return a secret.

string
tenant_id
string
created_at
One of:
integer
updated_at
One of:
integer
warnings

Returned by create and update when a saved client cannot work as asked until a tenant setting changes. The client is saved either way. Today: a client with token_exchange_allowed whose delegation_mode the tenant has not allowed (tokens.exchange_delegation_enabled, tokens.exchange_impersonation_enabled), which token exchange refuses with unauthorized_client.

Array<object>
object
code
required
string
Allowed values: token_exchange_not_allowed_by_tenant
setting
required

The tenant setting to turn on.

string
message
required
string
Example 
{
  "client": {
    "grant_types": [
      "authorization_code"
    ],
    "response_types": [
      "code"
    ],
    "token_endpoint_auth_method": "none",
    "subject_type": "public",
    "identity_mapping": {
      "mode": "none"
    },
    "attribute_release_consent": {
      "mode": "once"
    },
    "minimum_ial": "IAL1",
    "application_type": "web",
    "browser_public_client_mode": "disabled",
    "browser_refresh_token_policy": "disabled",
    "delegation_mode": "none",
    "id_token_signed_response_alg": "RS256",
    "userinfo_signed_response_alg": "none"
  },
  "warnings": [
    {
      "code": "token_exchange_not_allowed_by_tenant"
    }
  ]
}

404

Section titled “404 ”

Error response.

Media type application/json
object
error
string
message
string
error_description
string
key
additional properties
Example generated
{
  "error": "example",
  "message": "example",
  "error_description": "example"
}