Use this endpoint to dynamically register a client

post https://{pointofcontact}/oauth2/register

Dynamically register a client with the OIDC Provider. In the process,
client is able to present a set of metadata, such as a set of valid
redirection URIs. The metadata can either be communicated in a self-asserted
fashion or as a set of metadata called a software statement, which is digitally
signed; in the case of a software statement, the issuer is vouching for the
validity of the data about the client.

Body Params

redirect_uris

array of strings

required

redirect_uris*

response_types

array of strings

response_types

grant_types

array of strings

grant_types

application_type

string

Kind of the application.

contacts

array of strings

contacts

client_name

string

Name of the Client to be presented to the End-User.

logo_uri

string

URL that references a logo for the Client application.

client_uri

string

URL of the home page of the Client.

policy_uri

string

URL that the Relying Party Client provides to the End-User to read
about the how the profile data will be used.

tos_uri

string

URL that the Relying Party Client provides to the End-User to read
about the Relying Party's terms of service.

jwks_uri

string

URL for the Client's JSON Web Key Set document.

jwks

object

Client's JSON Web Key Set document, passed by value.

sector_identifier_uri

string

URL using the https scheme to be used in calculating Pseudonymous
Identifiers by the OIDC Provider. It is not supported by this implementation
since it only support public subject_type.

subject_type

string

subject_type requested for responses to this Client.

id_token_signed_response_alg

string

JWS "alg" algorithm REQUIRED for signing the ID Token issued to this Client.

id_token_encrypted_response_alg

string

JWE "alg" algorithm REQUIRED for encrypting the ID Token issued to this Client.

id_token_encrypted_response_enc

string

JWE "enc" algorithm REQUIRED for encrypting the ID Token issued to this Client.

userinfo_signed_response_alg

string

JWS "alg" algorithm REQUIRED for signing UserInfo Responses

userinfo_encrypted_response_alg

string

JWE "alg" algorithm REQUIRED for encrypting UserInfo Responses

userinfo_encrypted_response_enc

string

JWE "enc" algorithm REQUIRED for encrypting UserInfo Responses

request_object_signing_alg

string

JWS "alg" algorithm that MUST be used for signing Request Objects
sent to the OIDC Provider

request_object_encryption_alg

string

JWE "alg" algorithm the Relying Party is declaring that it may use
for encrypting Request Objects sent to the OIDC Provider

request_object_encryption_enc

string

JWE "enc" algorithm the Relying Party is declaring that it may use
for encrypting Request Objects sent to the OIDC Provider

token_endpoint_auth_method

string

Requested Client Authentication method for the Token Endpoint

token_endpoint_auth_signing_alg

string

JWS "alg" algorithm that MUST be used for signing the JWT used to
authenticate the Client at the Token Endpoint for the private_key_jwt
authentication method.

token_endpoint_auth_single_use_jti

boolean

Whether private_key_jwt client assertion can only be used once. This is
done by checking the "jti" claim uniqueness.

default_max_age

number

Default Maximum Authentication Age
This implementation does not read this configuration.

require_auth_time

boolean

Whether the auth_time Claim in the ID Token is required.
This implementation by default will output auth_time whether it is
required or not.

default_acr_values

array of strings

default_acr_values

initiate_login_uri

string

URI using the https scheme that a third party can use to initiate
a login by the Relying Party

request_uris

array of strings

request_uris

scope

string

Space-delimited string containing list of scope values that the client
can use when requesting access tokens.

tls_client_auth_subject_dn

string

Expected subject distinguished name of the certificate that the
client will use in mutual-TLS authentication.

tls_client_auth_san_dns

string

Expected DNS Name SAN entry in the certificate that the client
will use in mutual-TLS authentication.

tls_client_auth_san_email

string

Expected RFC822 Name SAN entry in the certificate that the client
will use in mutual-TLS authentication.

tls_client_auth_san_ip

string

Expected IP Address SAN entry in the certificate that the client
will use in mutual-TLS authentication.

tls_client_auth_san_uri

string

Expected Uniform Resource Identifier (URI) SAN entry in the
certificate that the client will use in mutual-TLS authentication

tls_client_certificate_bound_access_tokens

boolean

Indicate the client's intention to use mutual-TLS client
certificate-bound access tokens.

require_pushed_authorization_requests

boolean

Indicates whether the client is required to use Pushed Authorization
Request to initiate authorization requests.

require_pkce

boolean

Indicates whether the client is required to use Proof Key for Code Exchange
(PKCE) in the authorization requests.

backchannel_token_delivery_mode

string

Method of delivering the tokens after a successful user authentication.

backchannel_client_notification_endpoint

string

The endpoint to which the OIDC Provider will post a notification
after a successful or failed end-user authentication. Required if the
token delivery mode is set to "ping".

backchannel_user_code_parameter

boolean

Indicates whether the client is sending user_code parameter

software_id

string

A unique identifier string assigned by the client developer or software
publisher used by registration endpoints to identify the client software to
be dynamically registered. The value of this field is not intended to be
human readable and is usually opaque to the client and authorization server.

software_version

string

A version identifier string for the client software identified by
"software_id". The value of the "software_version" SHOULD change
on any update to the client software identified by the same "software_id".

software_statement

string

A software statement is a JSON Web Token (JWT) that asserts metadata values about
the client software as a bundle. All the properties above can be specified in
a software statement. When presented to the authorization server as part of a
client registration request, the software statement MUST be digitally signed
and MUST contain an "iss" (issuer) claim denoting the party attesting to the
claims in the software statement. Client metadata values conveyed in the
software statement will take precedence over those conveyed using plain JSON elements.
When using Dynamic Client Registration for FAPI specification, the software statement
is generated by regulatory body and there are certain rules to follow.

Headers

x-client-certificate

string

MTLS Client Certificate

Responses

Response body

object

client_id

string

OAuth 2.0 client identifier string.

client_secret

string

OAuth 2.0 client secret string.

client_id_issued_at

number

Time at which the client identifier was issued. The time is represented as the
number of seconds from 1970-01-01T00:00:00Z as measured in UTC until the
date/time of issuance.

client_secret_expires_at

number

Time at which the client secret will expire or 0 if it will not expire.
The time is represented as the number of seconds from 1970-01-01T00:00:00Z as
measured in UTC until the date/time of expiration.

registration_client_uri

string

Fully qualified URL of the client configuration endpoint for this client

registration_access_token

string

Access token to be used at the client configuration endpoint to perform
subsequent management operations upon the client registration.

redirect_uris

array of strings

redirect_uris

response_types

array of strings

response_types

grant_types

array of strings

grant_types

application_type

string

Kind of the application.

native web

contacts

array of strings

contacts

client_name

string

Name of the Client to be presented to the End-User.

logo_uri

string

URL that references a logo for the Client application.

client_uri

string

URL of the home page of the Client.

policy_uri

string

URL that the Relying Party Client provides to the End-User to read
about the how the profile data will be used.

tos_uri

string

URL that the Relying Party Client provides to the End-User to read
about the Relying Party's terms of service.

jwks_uri

string

URL for the Client's JSON Web Key Set document.

jwks

object

Client's JSON Web Key Set document, passed by value.

Has additional fields

sector_identifier_uri

string

URL using the https scheme to be used in calculating Pseudonymous
Identifiers by the OIDC Provider. It is not supported by this implementation
since it only support public subject_type.

subject_type

string

subject_type requested for responses to this Client.

public

id_token_signed_response_alg

string

JWS "alg" algorithm REQUIRED for signing the ID Token issued to this Client.

RS256 RS384 RS512 ES256 ES384 ES512 PS256 PS384 PS512

id_token_encrypted_response_alg

string

JWE "alg" algorithm REQUIRED for encrypting the ID Token issued to this Client.

none RSA-OAEP RSA-OAEP-256

id_token_encrypted_response_enc

string

JWE "enc" algorithm REQUIRED for encrypting the ID Token issued to this Client.

none A128GCM A192GCM A256GCM

userinfo_signed_response_alg

string

JWS "alg" algorithm REQUIRED for signing UserInfo Responses

RS256 RS384 RS512 ES256 ES384 ES512 PS256 PS384 PS512

userinfo_encrypted_response_alg

string

JWE "alg" algorithm REQUIRED for encrypting UserInfo Responses

none RSA-OAEP RSA-OAEP-256

userinfo_encrypted_response_enc

string

JWE "enc" algorithm REQUIRED for encrypting UserInfo Responses

none A128GCM A192GCM A256GCM

request_object_signing_alg

string

JWS "alg" algorithm that MUST be used for signing Request Objects
sent to the OIDC Provider

RS256 RS384 RS512 ES256 ES384 ES512 PS256 PS384 PS512

request_object_encryption_alg

string

JWE "alg" algorithm the Relying Party is declaring that it may use
for encrypting Request Objects sent to the OIDC Provider

none RSA-OAEP RSA-OAEP-256

request_object_encryption_enc

string

JWE "enc" algorithm the Relying Party is declaring that it may use
for encrypting Request Objects sent to the OIDC Provider

none A128GCM A192GCM A256GCM

token_endpoint_auth_method

string

Requested Client Authentication method for the Token Endpoint

default client_secret_basic client_secret_post private_key_jwt tls_client_auth

token_endpoint_auth_signing_alg

string

JWS "alg" algorithm that MUST be used for signing the JWT used to
authenticate the Client at the Token Endpoint for the private_key_jwt
authentication method.

RS256 RS384 RS512 ES256 ES384 ES512 PS256 PS384 PS512

token_endpoint_auth_single_use_jti

boolean

Whether private_key_jwt client assertion can only be used once. This is
done by checking the "jti" claim uniqueness.

default_max_age

number

Default Maximum Authentication Age.
This implementation does not read this configuration.

require_auth_time

boolean

Whether the auth_time Claim in the ID Token is required.
This implementation by default will output auth_time whether it is
required or not.

default_acr_values

array of strings

default_acr_values

initiate_login_uri

string

URI using the https scheme that a third party can use to initiate
a login by the Relying Party

request_uris

array of strings

request_uris

scope

string

Space-delimited string containing list of scope values that the client
can use when requesting access tokens.

tls_client_auth_subject_dn

string

Expected subject distinguished name of the certificate that the
client will use in mutual-TLS authentication.

tls_client_auth_san_dns

string

Expected DNS Name SAN entry in the certificate that the client
will use in mutual-TLS authentication.

tls_client_auth_san_email

string

Expected RFC822 Name SAN entry in the certificate that the client
will use in mutual-TLS authentication.

tls_client_auth_san_ip

string

Expected IP Address SAN entry in the certificate that the client
will use in mutual-TLS authentication.

tls_client_auth_san_uri

string

Expected Uniform Resource Identifier (URI) SAN entry in the
certificate that the client will use in mutual-TLS authentication

tls_client_certificate_bound_access_tokens

boolean

Indicate the client's intention to use mutual-TLS client
certificate-bound access tokens.

require_pushed_authorization_requests

boolean

Indicates whether the client is required to use Pushed Authorization
Request to initiate authorization requests.

require_pkce

boolean

Indicates whether the client is required to use Proof Key for Code Exchange
(PKCE) in the authorization requests.

backchannel_token_delivery_mode

string

Method of delivering the tokens after a successful user authentication.

poll ping

backchannel_client_notification_endpoint

string

The endpoint to which the OIDC Provider will post a notification
after a successful or failed end-user authentication. Required if the
token delivery mode is set to "ping".

backchannel_user_code_parameter

boolean

Indicates whether the client is sending user_code parameter

software_id

string

software_version

string

software_statement

string

201Metadata associated with the dynamic client.

400OAuth JSON error response