Skip to content
Authrim

Update an OAuth/OIDC client.

PUT
/api/admin/clients/{id}
Code sample: Shell / cURL 
curl --request PUT \
  --url https://auth.example.com/api/admin/clients/example \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{ "client_name": "example", "description": "example", "redirect_uris": [ "https://example.com" ], "grant_types": [ "authorization_code" ], "response_types": [ "code" ], "scope": "example", "logo_uri": "https://example.com", "client_uri": "https://example.com", "policy_uri": "https://example.com", "tos_uri": "https://example.com", "contacts": [ "example" ], "token_endpoint_auth_method": "none", "subject_type": "public", "sector_identifier_uri": "https://example.com", "is_trusted": true, "skip_consent": true, "allow_claims_without_scope": true, "identity_mapping": { "fieldMappingSetId": "example", "fieldMappingVersionId": "example", "destinationNamespace": "example", "sourceProfileId": "example" }, "attribute_release_consent": { "enabled": true, "mode": "once" }, "allowed_redirect_origins": [ "example" ], "web_origin_registry": "example", "require_pkce": true, "minimum_ial": "IAL1", "application_type": "web", "trust_group": "example", "browser_public_client_mode": "disabled", "browser_refresh_token_policy": "disabled", "native_sso_enabled": true, "native_channel_allowed": true, "allowed_channels": [ "example" ], "token_exchange_allowed": true, "allowed_subject_token_clients": [ "example" ], "allowed_token_exchange_resources": [ "example" ], "delegation_mode": "none", "client_credentials_allowed": true, "allowed_scopes": [ "example" ], "requestable_scopes": [ "example" ], "default_scope": "example", "default_audience": "example", "default_resource": "example", "id_token_signed_response_alg": "RS256", "userinfo_signed_response_alg": "none", "initiate_login_uri": "https://example.com", "login_ui_url": "https://example.com" }'

Replace Client in the Clients area. The request body is JSON unless the detailed schema for this operation states otherwise. 404 also answers a client that does not exist. identity_mapping is the app’s own choice: a Mapping Set, or { “mode”: “none” } (the app takes no mapping, whatever the defaults say). Left null or absent, the app follows the tenant’s default Mapping Set, else the platform’s, else no mapping applies; an activation’s scope never binds an app to a set. When identity_mapping names a Mapping Set it is checked the way a default Mapping Set is: the set must be one the tenant owns (a platform-owned set is not accepted for an app yet, because a tenant backup cannot hold the reference; it answers as a set that does not exist, and the tenant’s or the platform’s default Mapping Set names it instead), active, with an active activation that applies and an active compiled snapshot (and, when fieldMappingVersionId is given, that version), and must release into exactly one active OIDC Destination Profile. 404 when the set does not exist or is not available to the tenant (another tenant’s set, and a platform-owned set, answer the same), 400 when it exists but cannot be used (not active, no active compiled snapshot, no single active OIDC Destination Profile), 503 when the Admin database cannot be read to check it. A change to identity_mapping records the level’s before and after choices in history. A concurrent client edit returns 409; a history preparation or confirmation failure returns 503. Other fields keep the ordinary client update validation.

Authorizations

Section titled “Authorizations ”

Parameters

Section titled “ Parameters ”

Path Parameters

Section titled “Path Parameters ”
id
required
string

Header Parameters

Section titled “Header Parameters ”
X-Tenant-Id
string

Tenant selector for multi-tenant admin requests.

Request Body required

Section titled “Request Body required ”
Media type application/json
object
client_name
string
>= 1 characters
description
string | null
redirect_uris
Array<string>
>= 1 items
grant_types
Array<string>
Allowed values: authorization_code refresh_token client_credentials urn:ietf:params:oauth:grant-type:device_code urn:openid:params:grant-type:ciba urn:ietf:params:oauth:grant-type:token-exchange
response_types
Array<string>
Allowed values: code id_token token
scope
string
logo_uri
string format: uri
client_uri
string format: uri
policy_uri
string format: uri
tos_uri
string format: uri
contacts
Array<string>
token_endpoint_auth_method
string
Allowed values: none client_secret_basic client_secret_post private_key_jwt
subject_type
string
Allowed values: public pairwise
sector_identifier_uri
string format: uri
is_trusted
boolean
skip_consent
boolean
allow_claims_without_scope
boolean
identity_mapping
One of:
One of:
object
fieldMappingSetId
required
string
fieldMappingVersionId
string
destinationNamespace
string
sourceProfileId
string
key
additional properties
attribute_release_consent
One of:
object
enabled
required
boolean
mode
required
string
Allowed values: once every_time until_attributes_change
key
additional properties
allowed_redirect_origins
Array<string>
web_origin_registry
object | null
require_pkce
boolean
minimum_ial

The lowest identity assurance level (NIST SP 800-63A) a person must have been proofed at to be authorized by, or issued tokens for, this client. Absent on update: unchanged. Null: removes it (the client sets no minimum of its own). An empty string is refused with 400 invalid_request, never read as null. A person below it is refused (authorization_code, refresh_token and the other user grants: access_denied at authorize, invalid_grant at the token endpoint; device and CIBA: access_denied). It applies whether or not tenant-wide assurance is on. Set here only; dynamic client registration does not accept it.

string | null
Allowed values: IAL1 IAL2 IAL3
application_type
string
Allowed values: web native service
trust_group
string | null
browser_public_client_mode
string | null
Allowed values: disabled enabled required
browser_refresh_token_policy
string | null
Allowed values: disabled rotation persistent
native_sso_enabled
boolean | null
native_channel_allowed
boolean | null
allowed_channels
Array<string> | null
token_exchange_allowed
boolean
allowed_subject_token_clients
Array<string> | null
allowed_token_exchange_resources
Array<string> | null
delegation_mode
string
Allowed values: none delegation impersonation
client_credentials_allowed
boolean
allowed_scopes
Array<string> | null
requestable_scopes

OAuth scope tokens this client may request. Agent Access connections require explicit agent scopes.

Array<string> | null
<= 100 items
default_scope
string | null
default_audience
string | null
default_resource
string | null
id_token_signed_response_alg

JWS algorithm for this app’s ID Tokens. Null or omitted means the tenant’s oauth.id_token_signing_alg (RS256 by default). Refused (400 invalid_request) when it differs from the tenant’s algorithm while oauth.id_token_signing_alg_client_override is false, and 503 temporarily_unavailable when that policy cannot be read.

string | null
Allowed values: RS256 ES256 PS256
userinfo_signed_response_alg

JWS algorithm used for signed UserInfo responses. JSON is returned when set to none or omitted.

string | null
default: none
Allowed values: none RS256 ES256 PS256
initiate_login_uri
string format: uri
login_ui_url
string format: uri

Responses

Section titled “ Responses ”

200

Section titled “200 ”

OAuth/OIDC client mutation response.

Media type application/json
object
success
required
boolean
client
object
client_name
required
string
>= 1 characters
description
string | null
redirect_uris
required
Array<string>
>= 1 items
grant_types
required
Array<string>
Allowed values: authorization_code refresh_token client_credentials urn:ietf:params:oauth:grant-type:device_code urn:openid:params:grant-type:ciba urn:ietf:params:oauth:grant-type:token-exchange
response_types
required
Array<string>
Allowed values: code id_token token
scope
string
logo_uri
string format: uri
client_uri
string format: uri
policy_uri
string format: uri
tos_uri
string format: uri
contacts
Array<string>
token_endpoint_auth_method
string
Allowed values: none client_secret_basic client_secret_post private_key_jwt
subject_type
string
Allowed values: public pairwise
sector_identifier_uri
string format: uri
is_trusted
boolean
skip_consent
boolean
allow_claims_without_scope
boolean
identity_mapping
One of:
One of:
object
fieldMappingSetId
required
string
fieldMappingVersionId
string
destinationNamespace
string
sourceProfileId
string
key
additional properties
attribute_release_consent
One of:
object
enabled
required
boolean
mode
required
string
Allowed values: once every_time until_attributes_change
key
additional properties
allowed_redirect_origins
Array<string>
web_origin_registry
object | null
require_pkce
boolean
minimum_ial

The lowest identity assurance level (NIST SP 800-63A) a person must have been proofed at to be authorized by, or issued tokens for, this client. Absent on update: unchanged. Null: removes it (the client sets no minimum of its own). An empty string is refused with 400 invalid_request, never read as null. A person below it is refused (authorization_code, refresh_token and the other user grants: access_denied at authorize, invalid_grant at the token endpoint; device and CIBA: access_denied). It applies whether or not tenant-wide assurance is on. Set here only; dynamic client registration does not accept it.

string | null
Allowed values: IAL1 IAL2 IAL3
application_type
string
Allowed values: web native service
trust_group
string | null
browser_public_client_mode
string | null
Allowed values: disabled enabled required
browser_refresh_token_policy
string | null
Allowed values: disabled rotation persistent
native_sso_enabled
boolean | null
native_channel_allowed
boolean | null
allowed_channels
Array<string> | null
token_exchange_allowed
boolean
allowed_subject_token_clients
Array<string> | null
allowed_token_exchange_resources
Array<string> | null
delegation_mode
string
Allowed values: none delegation impersonation
client_credentials_allowed
boolean
allowed_scopes
Array<string> | null
requestable_scopes

OAuth scope tokens this client may request. Agent Access connections require explicit agent scopes.

Array<string> | null
<= 100 items
default_scope
string | null
default_audience
string | null
default_resource
string | null
id_token_signed_response_alg

JWS algorithm for this app’s ID Tokens. Null or omitted means the tenant’s oauth.id_token_signing_alg (RS256 by default). Refused (400 invalid_request) when it differs from the tenant’s algorithm while oauth.id_token_signing_alg_client_override is false, and 503 temporarily_unavailable when that policy cannot be read.

string | null
Allowed values: RS256 ES256 PS256
userinfo_signed_response_alg

JWS algorithm used for signed UserInfo responses. JSON is returned when set to none or omitted.

string | null
default: none
Allowed values: none RS256 ES256 PS256
client_id
required
string
client_secret

Returned only on secret-issuing operations such as confidential client creation or regeneration. Public clients using token_endpoint_auth_method=none do not generate or return a secret.

string
tenant_id
string
created_at
One of:
integer
updated_at
One of:
integer
warnings

Returned by create and update when a saved client cannot work as asked until a tenant setting changes. The client is saved either way. Today: a client with token_exchange_allowed whose delegation_mode the tenant has not allowed (tokens.exchange_delegation_enabled, tokens.exchange_impersonation_enabled), which token exchange refuses with unauthorized_client.

Array<object>
object
code
required
string
Allowed values: token_exchange_not_allowed_by_tenant
setting
required

The tenant setting to turn on.

string
message
required
string
Example 
{
  "client": {
    "grant_types": [
      "authorization_code"
    ],
    "response_types": [
      "code"
    ],
    "token_endpoint_auth_method": "none",
    "subject_type": "public",
    "identity_mapping": {
      "mode": "none"
    },
    "attribute_release_consent": {
      "mode": "once"
    },
    "minimum_ial": "IAL1",
    "application_type": "web",
    "browser_public_client_mode": "disabled",
    "browser_refresh_token_policy": "disabled",
    "delegation_mode": "none",
    "id_token_signed_response_alg": "RS256",
    "userinfo_signed_response_alg": "none"
  },
  "warnings": [
    {
      "code": "token_exchange_not_allowed_by_tenant"
    }
  ]
}

400

Section titled “400 ”

Error response.

Media type application/json
object
error
string
message
string
error_description
string
key
additional properties
Example generated
{
  "error": "example",
  "message": "example",
  "error_description": "example"
}

404

Section titled “404 ”

Error response.

Media type application/json
object
error
string
message
string
error_description
string
key
additional properties
Example generated
{
  "error": "example",
  "message": "example",
  "error_description": "example"
}

409

Section titled “409 ”

A concurrent update prevented saving the Mapping Set choice (conflict).

Media type application/json
object
error
required
string
Allowed value: conflict
reason
required
string
Allowed values: version_conflict set_deleted set_inactive is_current client_deleted invalid_history
error_description
string
Example 
{
  "error": "conflict",
  "reason": "version_conflict"
}

503

Section titled “503 ”

Storage is unavailable or the change history could not be confirmed. operation_id, when present, identifies a choice update whose completion needs confirmation; read current state before retrying rather than assume the client stayed unchanged.

Media type application/json
object
error
string
error_description
string
operation_id
string
Example generated
{
  "error": "example",
  "error_description": "example",
  "operation_id": "example"
}