Admin API: Clients

Operations on clients in the Odudu admin API, one section each. Every request carries a bearer token; the index says which audience it needs and how a refusal is shaped.

GET /admin/tenants/{tenant}/clients

Requires the "manage-clients" capability.

service_account_admin_reach is what the client’s service account holds of the admin capabilities, which every write on the client is judged against; derived on every read and outside the ETag, empty for a client with no service account. client_id_exact finds the one client whose client_id is exactly that, through the unique index.

Path parameters

Name	Type	Required	Details
tenant	string	yes	The tenant being administered, addressed by name.

Query parameters

Name	Type	Required	Details
cursor	string	no	The next value of the previous page, to continue after it.
limit	integer	no	How many items to return. A value over 200 is treated as 200; the default is 50. Constraints: at least 1.
client_id	string	no	Only clients whose client_id starts with this. Constraints: at least 1 character.
client_id_exact	string	no	The one client with exactly this client_id. Constraints: at least 1 character.
name	string	no	Only clients whose name starts with this. Constraints: at least 1 character.
type	string	no	Only clients of this type. Constraints: one of public, confidential.
enabled	string	no	true for enabled clients only. Constraints: one of true, false.

Responses

200 OK

Body: application/json

Field	Type	Required	Details
items	array of object	yes	The entries of this answer.
items[]	object	yes
items[].id	string	yes	The client's internal identifier, a UUID. It names the client in admin API paths such as /clients/{id}; it is not the OAuth client_id.
items[].client_id	string	yes	The client_id the application sends to the authorization and token endpoints. Chosen when the client is created and unique within the tenant.
items[].name	string	yes	A display name for people, shown for example on the consent screen.
items[].description	string or null	yes	Free text for administrators, or null when none was set.
items[].type	string	yes	public for an application that cannot keep a secret (a single-page or native app), which must use PKCE; confidential for one that authenticates at the token endpoint. Constraints: one of public, confidential.
items[].enabled	boolean	yes	A disabled client cannot start a sign-in or obtain tokens, and tokens already issued to it stop being accepted.
items[].full_scope_allowed	boolean	yes	When true the client's tokens carry every role the user holds. When false, a role reaches a token only through a scope the client is assigned.
items[].registration_origin	string	yes	How the client came to exist: seeded by odudu seed or odudu init, anonymous or token through dynamic registration, or operator through the admin API. Constraints: one of seeded, anonymous, token, operator.
items[].created_at	string	yes	When the client was created, as an ISO 8601 date and time.
items[].redirect_uris	array of string	yes	The addresses the authorization server may send the user back to after sign-in. A request naming any other address is refused.
items[].grant_types	array of string	yes	The grants the client may use at the token endpoint, such as authorization_code, refresh_token, client_credentials.
items[].token_endpoint_auth_method	string	yes	How a confidential client authenticates at the token endpoint, for example client_secret_basic, client_secret_post or private_key_jwt.
items[].audiences	array of string	yes	The audiences (aud) added to the access tokens issued to this client, besides the issuer.
items[].access_token_ttl_seconds	integer or null	yes	How long this client's access tokens live, in seconds. Null uses the tenant's setting of the same name.
items[].id_token_ttl_seconds	integer or null	yes	How long this client's ID tokens live, in seconds. Null uses the tenant's setting of the same name.
items[].refresh_token_ttl_seconds	integer or null	yes	How long this client's refresh tokens live, in seconds. Null uses the tenant's setting of the same name.
items[].client_credentials_scopes	array of string	yes	The scopes the client may request with the client_credentials grant, where it acts as itself.
items[].web_origins	array of string	yes	The browser origins allowed to call the token and UserInfo endpoints from JavaScript (CORS).
items[].post_logout_redirect_uris	array of string	yes	The addresses the user may be sent to after a logout the client started.
items[].jwks	any or null	yes	The public keys the client authenticates with when its method is private_key_jwt, as a JWK Set. Null when it uses jwks_uri or a secret.
items[].jwks_uri	string or null	yes	The address the server fetches the client public keys from, instead of holding them in jwks.
items[].frontchannel_logout_uri	string or null	yes	The client page the user agent loads to tell the client the user signed out (front-channel logout).
items[].backchannel_logout_uri	string or null	yes	The client endpoint the server posts a logout token to when a session ends (back-channel logout).
items[].frontchannel_logout_session_required	boolean	yes	Whether the front-channel logout request carries the session id (sid) and issuer.
items[].backchannel_logout_session_required	boolean	yes	Whether the back-channel logout token carries the session id (sid).
items[].consent_required	boolean	yes	Whether the user must approve what the client asks for on a consent screen before tokens are issued.
items[].token_exchange_impersonation_allowed	boolean	yes	Whether the client may use token exchange (RFC 8693) to act as a user rather than on behalf of one.
items[].userinfo_signed_response_alg	string or null	yes	The algorithm that signs this client’s UserInfo responses. Null returns plain JSON.
items[].userinfo_encrypted_response_alg	string or null	yes	The key-management algorithm that encrypts this client’s UserInfo responses, or null.
items[].userinfo_encrypted_response_enc	string or null	yes	The content-encryption algorithm for encrypted UserInfo responses, or null.
items[].tls_client_auth_subject_dn	string or null	yes	The certificate subject a client using tls_client_auth must present, or null.
items[].client_uri	string or null	yes	A web page about the client application, shown to users.
items[].policy_uri	string or null	yes	The client privacy policy page, shown to users.
items[].tos_uri	string or null	yes	The client terms of service page, shown to users.
items[].id_token_signed_response_alg	string or null	yes	The algorithm that signs this client’s ID tokens. Null uses the tenant’s default.
items[].default_max_age	integer or null	yes	The longest age in seconds a sign-in may have before the user must sign in again, when the request does not say. Null sets none.
items[].require_auth_time	boolean	yes	Whether ID tokens always carry the auth_time claim.
items[].previous_secret_expires_at	string or null	yes	When the secret that a rotation replaced stops authenticating, or null when no rotation kept one. The secret itself is never shown.
items[].builtin_admin	boolean	yes	True for the tenant’s built-in admin console client, which cannot be deleted and is limited in what can be amended.
items[].service_subject_id	string or null	yes	The service account a confidential client authenticates as, or null when it has none. Constraints: a UUID.
items[].scopes	array of object	yes	The scopes assigned to the client and whether each is default (always requested) or optional (only when asked for).
items[].scopes[]	object	yes
items[].scopes[].id	string	yes	The scope’s identifier.
items[].scopes[].name	string	yes	The scope name.
items[].scopes[].assignment	string	yes	default is requested for the client without being asked for, optional only when the request names it. Constraints: one of default, optional.
items[].service_account_admin_reach	array of string	yes
next	string	no	An opaque cursor for the next page; absent on the last page.

401 RFC 9457 problem details

Body: application/problem+json, an RFC 9457 problem document described under problem details.

403 RFC 9457 problem details

Body: application/problem+json, an RFC 9457 problem document described under problem details.

POST /admin/tenants/{tenant}/clients

Requires the "manage-clients" capability.

A list on the client (redirect_uris, web_origins, post_logout_redirect_uris, audiences, client_credentials_scopes) holds at most 200 entries, refused with 400 naming the field, how many it held and how many it may. A write refuses only a list it changes: a client stored over the limit is amended in its other fields as it is.

Path parameters

Name	Type	Required	Details
tenant	string	yes	The tenant being administered, addressed by name.

Request body

Body: application/json

Field	Type	Required	Details
client_id	string	yes	Constraints: no bidirectional control characters, at least 1 character.

{
  "client_id": "web-app",
  "name": "Web app",
  "redirect_uris": [
    "https://app.example.com/callback"
  ],
  "grant_types": [
    "authorization_code",
    "refresh_token"
  ],
  "token_endpoint_auth_method": "none"
}

Responses

201 Created

Body: application/json

Field	Type	Required	Details
id	string	yes	The client's internal identifier, a UUID. It names the client in admin API paths such as /clients/{id}; it is not the OAuth client_id.
client_id	string	yes	The client_id the application sends to the authorization and token endpoints. Chosen when the client is created and unique within the tenant.
name	string	yes	A display name for people, shown for example on the consent screen.
description	string or null	yes	Free text for administrators, or null when none was set.
type	string	yes	public for an application that cannot keep a secret (a single-page or native app), which must use PKCE; confidential for one that authenticates at the token endpoint. Constraints: one of public, confidential.
enabled	boolean	yes	A disabled client cannot start a sign-in or obtain tokens, and tokens already issued to it stop being accepted.
full_scope_allowed	boolean	yes	When true the client's tokens carry every role the user holds. When false, a role reaches a token only through a scope the client is assigned.
registration_origin	string	yes	How the client came to exist: seeded by odudu seed or odudu init, anonymous or token through dynamic registration, or operator through the admin API. Constraints: one of seeded, anonymous, token, operator.
created_at	string	yes	When the client was created, as an ISO 8601 date and time.
redirect_uris	array of string	yes	The addresses the authorization server may send the user back to after sign-in. A request naming any other address is refused.
grant_types	array of string	yes	The grants the client may use at the token endpoint, such as authorization_code, refresh_token, client_credentials.
token_endpoint_auth_method	string	yes	How a confidential client authenticates at the token endpoint, for example client_secret_basic, client_secret_post or private_key_jwt.
audiences	array of string	yes	The audiences (aud) added to the access tokens issued to this client, besides the issuer.
access_token_ttl_seconds	integer or null	yes	How long this client's access tokens live, in seconds. Null uses the tenant's setting of the same name.
id_token_ttl_seconds	integer or null	yes	How long this client's ID tokens live, in seconds. Null uses the tenant's setting of the same name.
refresh_token_ttl_seconds	integer or null	yes	How long this client's refresh tokens live, in seconds. Null uses the tenant's setting of the same name.
client_credentials_scopes	array of string	yes	The scopes the client may request with the client_credentials grant, where it acts as itself.
web_origins	array of string	yes	The browser origins allowed to call the token and UserInfo endpoints from JavaScript (CORS).
post_logout_redirect_uris	array of string	yes	The addresses the user may be sent to after a logout the client started.
jwks	any or null	yes	The public keys the client authenticates with when its method is private_key_jwt, as a JWK Set. Null when it uses jwks_uri or a secret.
jwks_uri	string or null	yes	The address the server fetches the client public keys from, instead of holding them in jwks.
frontchannel_logout_uri	string or null	yes	The client page the user agent loads to tell the client the user signed out (front-channel logout).
backchannel_logout_uri	string or null	yes	The client endpoint the server posts a logout token to when a session ends (back-channel logout).
frontchannel_logout_session_required	boolean	yes	Whether the front-channel logout request carries the session id (sid) and issuer.
backchannel_logout_session_required	boolean	yes	Whether the back-channel logout token carries the session id (sid).
consent_required	boolean	yes	Whether the user must approve what the client asks for on a consent screen before tokens are issued.
token_exchange_impersonation_allowed	boolean	yes	Whether the client may use token exchange (RFC 8693) to act as a user rather than on behalf of one.
userinfo_signed_response_alg	string or null	yes	The algorithm that signs this client’s UserInfo responses. Null returns plain JSON.
userinfo_encrypted_response_alg	string or null	yes	The key-management algorithm that encrypts this client’s UserInfo responses, or null.
userinfo_encrypted_response_enc	string or null	yes	The content-encryption algorithm for encrypted UserInfo responses, or null.
tls_client_auth_subject_dn	string or null	yes	The certificate subject a client using tls_client_auth must present, or null.
client_uri	string or null	yes	A web page about the client application, shown to users.
policy_uri	string or null	yes	The client privacy policy page, shown to users.
tos_uri	string or null	yes	The client terms of service page, shown to users.
id_token_signed_response_alg	string or null	yes	The algorithm that signs this client’s ID tokens. Null uses the tenant’s default.
default_max_age	integer or null	yes	The longest age in seconds a sign-in may have before the user must sign in again, when the request does not say. Null sets none.
require_auth_time	boolean	yes	Whether ID tokens always carry the auth_time claim.
previous_secret_expires_at	string or null	yes	When the secret that a rotation replaced stops authenticating, or null when no rotation kept one. The secret itself is never shown.
builtin_admin	boolean	yes	True for the tenant’s built-in admin console client, which cannot be deleted and is limited in what can be amended.
service_subject_id	string or null	yes	The service account a confidential client authenticates as, or null when it has none. Constraints: a UUID.
scopes	array of object	yes	The scopes assigned to the client and whether each is default (always requested) or optional (only when asked for).
scopes[]	object	yes
scopes[].id	string	yes	The scope’s identifier.
scopes[].name	string	yes	The scope name.
scopes[].assignment	string	yes	default is requested for the client without being asked for, optional only when the request names it. Constraints: one of default, optional.
service_account_admin_reach	array of string	yes
client_secret	string	no	The new secret. Shown only in this response.

401 RFC 9457 problem details

Body: application/problem+json, an RFC 9457 problem document described under problem details.

403 RFC 9457 problem details

Body: application/problem+json, an RFC 9457 problem document described under problem details.

GET /admin/tenants/{tenant}/clients/count

Requires the "manage-clients" capability.

Path parameters

Name	Type	Required	Details
tenant	string	yes	The tenant being administered, addressed by name.

Query parameters

Name	Type	Required	Details
client_id	string	no	Only clients whose client_id starts with this. Constraints: at least 1 character.
client_id_exact	string	no	The one client with exactly this client_id. Constraints: at least 1 character.
name	string	no	Only clients whose name starts with this. Constraints: at least 1 character.
type	string	no	Only clients of this type. Constraints: one of public, confidential.
enabled	string	no	true for enabled clients only. Constraints: one of true, false.

Responses

200 OK

Body: application/json

Field	Type	Required	Details
count	integer	yes	How many items match, up to a cap.
capped	boolean	yes	True when more match than count says, because counting stops at the cap.

401 RFC 9457 problem details

Body: application/problem+json, an RFC 9457 problem document described under problem details.

403 RFC 9457 problem details

Body: application/problem+json, an RFC 9457 problem document described under problem details.

GET /admin/tenants/{tenant}/clients/{id}

Requires the "manage-clients" capability.

service_account_admin_reach is what the client’s service account holds of the admin capabilities, which every write on the client is judged against; derived on every read and outside the ETag, empty for a client with no service account.

Path parameters

Name	Type	Required	Details
tenant	string	yes	The tenant being administered, addressed by name.
id	string	yes	A row id. Constraints: a UUID.

Responses

200 OK

Body: application/json

Field	Type	Required	Details
id	string	yes	The client's internal identifier, a UUID. It names the client in admin API paths such as /clients/{id}; it is not the OAuth client_id.
client_id	string	yes	The client_id the application sends to the authorization and token endpoints. Chosen when the client is created and unique within the tenant.
name	string	yes	A display name for people, shown for example on the consent screen.
description	string or null	yes	Free text for administrators, or null when none was set.
type	string	yes	public for an application that cannot keep a secret (a single-page or native app), which must use PKCE; confidential for one that authenticates at the token endpoint. Constraints: one of public, confidential.
enabled	boolean	yes	A disabled client cannot start a sign-in or obtain tokens, and tokens already issued to it stop being accepted.
full_scope_allowed	boolean	yes	When true the client's tokens carry every role the user holds. When false, a role reaches a token only through a scope the client is assigned.
registration_origin	string	yes	How the client came to exist: seeded by odudu seed or odudu init, anonymous or token through dynamic registration, or operator through the admin API. Constraints: one of seeded, anonymous, token, operator.
created_at	string	yes	When the client was created, as an ISO 8601 date and time.
redirect_uris	array of string	yes	The addresses the authorization server may send the user back to after sign-in. A request naming any other address is refused.
grant_types	array of string	yes	The grants the client may use at the token endpoint, such as authorization_code, refresh_token, client_credentials.
token_endpoint_auth_method	string	yes	How a confidential client authenticates at the token endpoint, for example client_secret_basic, client_secret_post or private_key_jwt.
audiences	array of string	yes	The audiences (aud) added to the access tokens issued to this client, besides the issuer.
access_token_ttl_seconds	integer or null	yes	How long this client's access tokens live, in seconds. Null uses the tenant's setting of the same name.
id_token_ttl_seconds	integer or null	yes	How long this client's ID tokens live, in seconds. Null uses the tenant's setting of the same name.
refresh_token_ttl_seconds	integer or null	yes	How long this client's refresh tokens live, in seconds. Null uses the tenant's setting of the same name.
client_credentials_scopes	array of string	yes	The scopes the client may request with the client_credentials grant, where it acts as itself.
web_origins	array of string	yes	The browser origins allowed to call the token and UserInfo endpoints from JavaScript (CORS).
post_logout_redirect_uris	array of string	yes	The addresses the user may be sent to after a logout the client started.
jwks	any or null	yes	The public keys the client authenticates with when its method is private_key_jwt, as a JWK Set. Null when it uses jwks_uri or a secret.
jwks_uri	string or null	yes	The address the server fetches the client public keys from, instead of holding them in jwks.
frontchannel_logout_uri	string or null	yes	The client page the user agent loads to tell the client the user signed out (front-channel logout).
backchannel_logout_uri	string or null	yes	The client endpoint the server posts a logout token to when a session ends (back-channel logout).
frontchannel_logout_session_required	boolean	yes	Whether the front-channel logout request carries the session id (sid) and issuer.
backchannel_logout_session_required	boolean	yes	Whether the back-channel logout token carries the session id (sid).
consent_required	boolean	yes	Whether the user must approve what the client asks for on a consent screen before tokens are issued.
token_exchange_impersonation_allowed	boolean	yes	Whether the client may use token exchange (RFC 8693) to act as a user rather than on behalf of one.
userinfo_signed_response_alg	string or null	yes	The algorithm that signs this client’s UserInfo responses. Null returns plain JSON.
userinfo_encrypted_response_alg	string or null	yes	The key-management algorithm that encrypts this client’s UserInfo responses, or null.
userinfo_encrypted_response_enc	string or null	yes	The content-encryption algorithm for encrypted UserInfo responses, or null.
tls_client_auth_subject_dn	string or null	yes	The certificate subject a client using tls_client_auth must present, or null.
client_uri	string or null	yes	A web page about the client application, shown to users.
policy_uri	string or null	yes	The client privacy policy page, shown to users.
tos_uri	string or null	yes	The client terms of service page, shown to users.
id_token_signed_response_alg	string or null	yes	The algorithm that signs this client’s ID tokens. Null uses the tenant’s default.
default_max_age	integer or null	yes	The longest age in seconds a sign-in may have before the user must sign in again, when the request does not say. Null sets none.
require_auth_time	boolean	yes	Whether ID tokens always carry the auth_time claim.
previous_secret_expires_at	string or null	yes	When the secret that a rotation replaced stops authenticating, or null when no rotation kept one. The secret itself is never shown.
builtin_admin	boolean	yes	True for the tenant’s built-in admin console client, which cannot be deleted and is limited in what can be amended.
service_subject_id	string or null	yes	The service account a confidential client authenticates as, or null when it has none. Constraints: a UUID.
scopes	array of object	yes	The scopes assigned to the client and whether each is default (always requested) or optional (only when asked for).
scopes[]	object	yes
scopes[].id	string	yes	The scope’s identifier.
scopes[].name	string	yes	The scope name.
scopes[].assignment	string	yes	default is requested for the client without being asked for, optional only when the request names it. Constraints: one of default, optional.
service_account_admin_reach	array of string	yes

401 RFC 9457 problem details

Body: application/problem+json, an RFC 9457 problem document described under problem details.

403 RFC 9457 problem details

Body: application/problem+json, an RFC 9457 problem document described under problem details.

PATCH /admin/tenants/{tenant}/clients/{id}

Requires the "manage-clients" capability.

Refused with 403 when the client’s service account holds an admin capability the caller does not (the target ceiling). A list on the client (redirect_uris, web_origins, post_logout_redirect_uris, audiences, client_credentials_scopes) holds at most 200 entries, refused with 400 naming the field, how many it held and how many it may. A write refuses only a list it changes: a client stored over the limit is amended in its other fields as it is.

Path parameters

Name	Type	Required	Details
tenant	string	yes	The tenant being administered, addressed by name.
id	string	yes	A row id. Constraints: a UUID.

Request body

Body: application/json

Field	Type	Required	Details
(body)	object	yes	Constraints: other fields accepted.

Responses

200 OK

Body: application/json

Field	Type	Required	Details
id	string	yes	The client's internal identifier, a UUID. It names the client in admin API paths such as /clients/{id}; it is not the OAuth client_id.
client_id	string	yes	The client_id the application sends to the authorization and token endpoints. Chosen when the client is created and unique within the tenant.
name	string	yes	A display name for people, shown for example on the consent screen.
description	string or null	yes	Free text for administrators, or null when none was set.
type	string	yes	public for an application that cannot keep a secret (a single-page or native app), which must use PKCE; confidential for one that authenticates at the token endpoint. Constraints: one of public, confidential.
enabled	boolean	yes	A disabled client cannot start a sign-in or obtain tokens, and tokens already issued to it stop being accepted.
full_scope_allowed	boolean	yes	When true the client's tokens carry every role the user holds. When false, a role reaches a token only through a scope the client is assigned.
registration_origin	string	yes	How the client came to exist: seeded by odudu seed or odudu init, anonymous or token through dynamic registration, or operator through the admin API. Constraints: one of seeded, anonymous, token, operator.
created_at	string	yes	When the client was created, as an ISO 8601 date and time.
redirect_uris	array of string	yes	The addresses the authorization server may send the user back to after sign-in. A request naming any other address is refused.
grant_types	array of string	yes	The grants the client may use at the token endpoint, such as authorization_code, refresh_token, client_credentials.
token_endpoint_auth_method	string	yes	How a confidential client authenticates at the token endpoint, for example client_secret_basic, client_secret_post or private_key_jwt.
audiences	array of string	yes	The audiences (aud) added to the access tokens issued to this client, besides the issuer.
access_token_ttl_seconds	integer or null	yes	How long this client's access tokens live, in seconds. Null uses the tenant's setting of the same name.
id_token_ttl_seconds	integer or null	yes	How long this client's ID tokens live, in seconds. Null uses the tenant's setting of the same name.
refresh_token_ttl_seconds	integer or null	yes	How long this client's refresh tokens live, in seconds. Null uses the tenant's setting of the same name.
client_credentials_scopes	array of string	yes	The scopes the client may request with the client_credentials grant, where it acts as itself.
web_origins	array of string	yes	The browser origins allowed to call the token and UserInfo endpoints from JavaScript (CORS).
post_logout_redirect_uris	array of string	yes	The addresses the user may be sent to after a logout the client started.
jwks	any or null	yes	The public keys the client authenticates with when its method is private_key_jwt, as a JWK Set. Null when it uses jwks_uri or a secret.
jwks_uri	string or null	yes	The address the server fetches the client public keys from, instead of holding them in jwks.
frontchannel_logout_uri	string or null	yes	The client page the user agent loads to tell the client the user signed out (front-channel logout).
backchannel_logout_uri	string or null	yes	The client endpoint the server posts a logout token to when a session ends (back-channel logout).
frontchannel_logout_session_required	boolean	yes	Whether the front-channel logout request carries the session id (sid) and issuer.
backchannel_logout_session_required	boolean	yes	Whether the back-channel logout token carries the session id (sid).
consent_required	boolean	yes	Whether the user must approve what the client asks for on a consent screen before tokens are issued.
token_exchange_impersonation_allowed	boolean	yes	Whether the client may use token exchange (RFC 8693) to act as a user rather than on behalf of one.
userinfo_signed_response_alg	string or null	yes	The algorithm that signs this client’s UserInfo responses. Null returns plain JSON.
userinfo_encrypted_response_alg	string or null	yes	The key-management algorithm that encrypts this client’s UserInfo responses, or null.
userinfo_encrypted_response_enc	string or null	yes	The content-encryption algorithm for encrypted UserInfo responses, or null.
tls_client_auth_subject_dn	string or null	yes	The certificate subject a client using tls_client_auth must present, or null.
client_uri	string or null	yes	A web page about the client application, shown to users.
policy_uri	string or null	yes	The client privacy policy page, shown to users.
tos_uri	string or null	yes	The client terms of service page, shown to users.
id_token_signed_response_alg	string or null	yes	The algorithm that signs this client’s ID tokens. Null uses the tenant’s default.
default_max_age	integer or null	yes	The longest age in seconds a sign-in may have before the user must sign in again, when the request does not say. Null sets none.
require_auth_time	boolean	yes	Whether ID tokens always carry the auth_time claim.
previous_secret_expires_at	string or null	yes	When the secret that a rotation replaced stops authenticating, or null when no rotation kept one. The secret itself is never shown.
builtin_admin	boolean	yes	True for the tenant’s built-in admin console client, which cannot be deleted and is limited in what can be amended.
service_subject_id	string or null	yes	The service account a confidential client authenticates as, or null when it has none. Constraints: a UUID.
scopes	array of object	yes	The scopes assigned to the client and whether each is default (always requested) or optional (only when asked for).
scopes[]	object	yes
scopes[].id	string	yes	The scope’s identifier.
scopes[].name	string	yes	The scope name.
scopes[].assignment	string	yes	default is requested for the client without being asked for, optional only when the request names it. Constraints: one of default, optional.
service_account_admin_reach	array of string	yes

401 RFC 9457 problem details

Body: application/problem+json, an RFC 9457 problem document described under problem details.

403 RFC 9457 problem details

Body: application/problem+json, an RFC 9457 problem document described under problem details.

DELETE /admin/tenants/{tenant}/clients/{id}

Requires the "manage-clients" capability.

Refused with 403 when the client’s service account holds an admin capability the caller does not (the target ceiling). Deletes every role scoped to the client with it, and is refused with 403 too when what those roles reach includes an admin capability the caller does not hold. Refused with 409 (about:blank#last-administrator) when it would leave no enabled subject holding tenant-admin — manage-tenants in the system tenant.

Path parameters

Name	Type	Required	Details
tenant	string	yes	The tenant being administered, addressed by name.
id	string	yes	A row id. Constraints: a UUID.

Responses

204 OK

Body: application/json

Field	Type	Required	Details
(body)	any	yes

401 RFC 9457 problem details

Body: application/problem+json, an RFC 9457 problem document described under problem details.

403 RFC 9457 problem details

Body: application/problem+json, an RFC 9457 problem document described under problem details.

POST /admin/tenants/{tenant}/clients/{id}/secret

Requires the "manage-clients" capability.

Answers the new secret once. grace_seconds (0 to 604800, default 0) keeps the secret it replaces authenticating that long beside it, and the response states when it stops in previous_secret_expires_at. Refused with 403 when the client’s service account holds an admin capability the caller does not (the target ceiling).

Path parameters

Name	Type	Required	Details
tenant	string	yes	The tenant being administered, addressed by name.
id	string	yes	A row id. Constraints: a UUID.

Query parameters

Name	Type	Required	Details
grace_seconds	integer	no	Constraints: at least 0, at most 604800.

Responses

200 OK

Body: application/json

Field	Type	Required	Details
id	string	yes	The client's internal identifier, a UUID. It names the client in admin API paths such as /clients/{id}; it is not the OAuth client_id.
client_id	string	yes	The client_id the application sends to the authorization and token endpoints. Chosen when the client is created and unique within the tenant.
name	string	yes	A display name for people, shown for example on the consent screen.
description	string or null	yes	Free text for administrators, or null when none was set.
type	string	yes	public for an application that cannot keep a secret (a single-page or native app), which must use PKCE; confidential for one that authenticates at the token endpoint. Constraints: one of public, confidential.
enabled	boolean	yes	A disabled client cannot start a sign-in or obtain tokens, and tokens already issued to it stop being accepted.
full_scope_allowed	boolean	yes	When true the client's tokens carry every role the user holds. When false, a role reaches a token only through a scope the client is assigned.
registration_origin	string	yes	How the client came to exist: seeded by odudu seed or odudu init, anonymous or token through dynamic registration, or operator through the admin API. Constraints: one of seeded, anonymous, token, operator.
created_at	string	yes	When the client was created, as an ISO 8601 date and time.
redirect_uris	array of string	yes	The addresses the authorization server may send the user back to after sign-in. A request naming any other address is refused.
grant_types	array of string	yes	The grants the client may use at the token endpoint, such as authorization_code, refresh_token, client_credentials.
token_endpoint_auth_method	string	yes	How a confidential client authenticates at the token endpoint, for example client_secret_basic, client_secret_post or private_key_jwt.
audiences	array of string	yes	The audiences (aud) added to the access tokens issued to this client, besides the issuer.
access_token_ttl_seconds	integer or null	yes	How long this client's access tokens live, in seconds. Null uses the tenant's setting of the same name.
id_token_ttl_seconds	integer or null	yes	How long this client's ID tokens live, in seconds. Null uses the tenant's setting of the same name.
refresh_token_ttl_seconds	integer or null	yes	How long this client's refresh tokens live, in seconds. Null uses the tenant's setting of the same name.
client_credentials_scopes	array of string	yes	The scopes the client may request with the client_credentials grant, where it acts as itself.
web_origins	array of string	yes	The browser origins allowed to call the token and UserInfo endpoints from JavaScript (CORS).
post_logout_redirect_uris	array of string	yes	The addresses the user may be sent to after a logout the client started.
jwks	any or null	yes	The public keys the client authenticates with when its method is private_key_jwt, as a JWK Set. Null when it uses jwks_uri or a secret.
jwks_uri	string or null	yes	The address the server fetches the client public keys from, instead of holding them in jwks.
frontchannel_logout_uri	string or null	yes	The client page the user agent loads to tell the client the user signed out (front-channel logout).
backchannel_logout_uri	string or null	yes	The client endpoint the server posts a logout token to when a session ends (back-channel logout).
frontchannel_logout_session_required	boolean	yes	Whether the front-channel logout request carries the session id (sid) and issuer.
backchannel_logout_session_required	boolean	yes	Whether the back-channel logout token carries the session id (sid).
consent_required	boolean	yes	Whether the user must approve what the client asks for on a consent screen before tokens are issued.
token_exchange_impersonation_allowed	boolean	yes	Whether the client may use token exchange (RFC 8693) to act as a user rather than on behalf of one.
userinfo_signed_response_alg	string or null	yes	The algorithm that signs this client’s UserInfo responses. Null returns plain JSON.
userinfo_encrypted_response_alg	string or null	yes	The key-management algorithm that encrypts this client’s UserInfo responses, or null.
userinfo_encrypted_response_enc	string or null	yes	The content-encryption algorithm for encrypted UserInfo responses, or null.
tls_client_auth_subject_dn	string or null	yes	The certificate subject a client using tls_client_auth must present, or null.
client_uri	string or null	yes	A web page about the client application, shown to users.
policy_uri	string or null	yes	The client privacy policy page, shown to users.
tos_uri	string or null	yes	The client terms of service page, shown to users.
id_token_signed_response_alg	string or null	yes	The algorithm that signs this client’s ID tokens. Null uses the tenant’s default.
default_max_age	integer or null	yes	The longest age in seconds a sign-in may have before the user must sign in again, when the request does not say. Null sets none.
require_auth_time	boolean	yes	Whether ID tokens always carry the auth_time claim.
previous_secret_expires_at	string or null	yes	When the secret that a rotation replaced stops authenticating, or null when no rotation kept one. The secret itself is never shown.
builtin_admin	boolean	yes	True for the tenant’s built-in admin console client, which cannot be deleted and is limited in what can be amended.
service_subject_id	string or null	yes	The service account a confidential client authenticates as, or null when it has none. Constraints: a UUID.
scopes	array of object	yes	The scopes assigned to the client and whether each is default (always requested) or optional (only when asked for).
scopes[]	object	yes
scopes[].id	string	yes	The scope’s identifier.
scopes[].name	string	yes	The scope name.
scopes[].assignment	string	yes	default is requested for the client without being asked for, optional only when the request names it. Constraints: one of default, optional.
service_account_admin_reach	array of string	yes
client_secret	string	yes	The new secret. Shown only in this response.

401 RFC 9457 problem details

Body: application/problem+json, an RFC 9457 problem document described under problem details.

403 RFC 9457 problem details

Body: application/problem+json, an RFC 9457 problem document described under problem details.

GET /admin/tenants/{tenant}/clients/{id}/logout-deliveries

Requires the "manage-clients" capability.

The Back-Channel Logout Tokens queued for the client, most recent first: pending, delivered, or failed once every attempt is spent, with the last error. Never the token itself.

Path parameters

Name	Type	Required	Details
tenant	string	yes	The tenant being administered, addressed by name.
id	string	yes	A row id. Constraints: a UUID.

Query parameters

Name	Type	Required	Details
cursor	string	no	The next value of the previous page, to continue after it.
limit	integer	no	How many items to return. A value over 200 is treated as 200; the default is 50. Constraints: at least 1.
status	string	no	Constraints: one of pending, delivered, failed.

Responses

200 OK

Body: application/json

Field	Type	Required	Details
items	array of object	yes	The entries of this answer.
items[]	object	yes
items[].id	string	yes	The delivery’s identifier.
items[].session_id	string	yes	The session whose end the token reports.
items[].endpoint	string	yes	The client address the token is posted to.
items[].status	string	yes	pending until delivered, delivered once the client answered, failed after the attempts ran out. Constraints: one of pending, delivered, failed.
items[].attempts	integer	yes	How many times delivery was tried. Constraints: at least 0.
items[].last_error	string or null	yes	Why the last attempt failed, or null.
items[].created_at	string	yes	When the delivery was queued.
items[].next_attempt_at	string	yes	When the next attempt is due.
items[].delivered_at	string or null	yes	When the client accepted it, or null.
next	string	no	An opaque cursor for the next page; absent on the last page.

401 RFC 9457 problem details

Body: application/problem+json, an RFC 9457 problem document described under problem details.

403 RFC 9457 problem details

Body: application/problem+json, an RFC 9457 problem document described under problem details.

GET /admin/tenants/{tenant}/clients/{id}/evaluate

Requires the "manage-clients" capability.

The claims an authorization-code exchange for this client and subject would put in the ID token, the access token and the UserInfo response, computed by the functions issuance calls, with none of the envelope a signer adds. scope is resolved against the client’s assignments, as issuance resolves it; absent, the client’s default scopes. It assumes consent is granted: for a consent_required client a real code carries only the scopes consented to. Signs nothing. Additionally requires view-users, refused with 403 otherwise, since the claims are the subject’s. Audited as client.evaluate.

Path parameters

Name	Type	Required	Details
tenant	string	yes	The tenant being administered, addressed by name.
id	string	yes	A row id. Constraints: a UUID.

Query parameters

Name	Type	Required	Details
subject	string	yes	Constraints: a UUID.
scope	string	no	Constraints: at most 2048 characters.

Responses

200 OK

Body: application/json

Field	Type	Required	Details
scope	string	yes	The scopes the evaluation used, space-separated.
id_token	object or null	yes	The claims the ID token would carry, or null when the scope has no openid. Constraints: other fields accepted.
access_token	object	yes	The claims the access token would carry. Constraints: other fields accepted.
userinfo	object	yes	The claims the UserInfo endpoint would return. Constraints: other fields accepted.

401 RFC 9457 problem details

Body: application/problem+json, an RFC 9457 problem document described under problem details.

403 RFC 9457 problem details

Body: application/problem+json, an RFC 9457 problem document described under problem details.

GET /admin/tenants/{tenant}/clients/{id}/installation

Requires the "manage-clients" capability.

What a relying party is configured with: the issuer and its discovery URL, as this request’s host names them, and the client’s own identifier, type, authentication method, URIs, grant types and default scopes. Never the secret.

Path parameters

Name	Type	Required	Details
tenant	string	yes	The tenant being administered, addressed by name.
id	string	yes	A row id. Constraints: a UUID.

Responses

200 OK

Body: application/json

Field	Type	Required	Details
issuer	string	yes	The issuer identifier the application must trust.
discovery_url	string	yes	The discovery document address; most client libraries need only this.
client_id	string	yes	The client_id to configure in the application.
client_type	string	yes	public or confidential. Constraints: one of public, confidential.
token_endpoint_auth_method	string	yes	How the application authenticates at the token endpoint.
redirect_uris	array of string	yes	The redirect addresses registered for the client.
post_logout_redirect_uris	array of string	yes	The post-logout addresses registered for the client.
grant_types	array of string	yes	The grants the client may use.
default_scope	string	yes	The scopes requested when the application asks for none, space-separated.

401 RFC 9457 problem details

Body: application/problem+json, an RFC 9457 problem document described under problem details.

403 RFC 9457 problem details

Body: application/problem+json, an RFC 9457 problem document described under problem details.

GET /admin/tenants/{tenant}/clients/{id}/sessions

Requires the "manage-sessions" capability.

The live sessions holding a grant through the client: GET …/sessions?client={id}, answering 404 for a client that does not exist.

Path parameters

Name	Type	Required	Details
tenant	string	yes	The tenant being administered, addressed by name.
id	string	yes	A row id. Constraints: a UUID.

Query parameters

Name	Type	Required	Details
cursor	string	no	The next value of the previous page, to continue after it.
limit	integer	no	How many items to return. A value over 200 is treated as 200; the default is 50. Constraints: at least 1.

Responses

200 OK

Body: application/json

Field	Type	Required	Details
items	array of object	yes	The entries of this answer.
items[]	object	yes
items[].id	string	yes	The session’s identifier.
items[].created_at	string	yes	When the user signed in.
items[].last_active_at	string	yes	When the session last did anything.
items[].remembered	boolean	yes	Whether the user chose to stay signed in, which gives the session the longer remember-me lifetimes.
items[].client_ids	array of string	yes	The clients the session has signed the user in to.
items[].subject_id	string	yes	The user the session belongs to.
items[].username	string or null	yes	That user’s username, or null.
next	string	no	An opaque cursor for the next page; absent on the last page.

401 RFC 9457 problem details

Body: application/problem+json, an RFC 9457 problem document described under problem details.

403 RFC 9457 problem details

Body: application/problem+json, an RFC 9457 problem document described under problem details.

DELETE /admin/tenants/{tenant}/clients/{id}/grants

Requires the "manage-sessions" capability.

Revokes up to 10,000 of the grants issued through the client that nothing has revoked, whoever holds them, so no refresh token the client holds is honoured again; remaining says how many more are left (counted to 10,000), so a caller repeats the call until it is 0 — one call is not every grant. Ends no session. A grant whose subject holds an admin capability the caller does not is left alone and counted under beyond_ceiling.

Path parameters

Name	Type	Required	Details
tenant	string	yes	The tenant being administered, addressed by name.
id	string	yes	A row id. Constraints: a UUID.

Responses

200 OK

Body: application/json

Field	Type	Required	Details
revoked	integer	yes	Constraints: at least 0.
beyond_ceiling	integer	yes	How many belong to users holding an admin capability the caller does not, which are left alone. Constraints: at least 0.
remaining	integer	yes	How many are left; repeat the call until it is 0. Constraints: at least 0.

401 RFC 9457 problem details

Body: application/problem+json, an RFC 9457 problem document described under problem details.

403 RFC 9457 problem details

Body: application/problem+json, an RFC 9457 problem document described under problem details.

Documentation coverage: 277 of 288 fields described (96%).