Use this endpoint to dynamically register a client

post

https://{pointofcontact}/oauth2/register

Dynamically register a client with the OIDC Provider. In the process,
client is able to present a set of metadata, such as a set of valid
redirection URIs. The metadata can either be communicated in a self-asserted
fashion or as a set of metadata called a software statement, which is digitally
signed; in the case of a software statement, the issuer is vouching for the
validity of the data about the client.

Recent Requests

Time	Status	User Agent
Retrieving recent requests…

Loading…

Body Params

redirect_uris

array of strings

required

redirect_uris*

response_types

array of strings

response_types

grant_types

array of strings

grant_types

application_type

string

enum

Kind of the application.

Allowed:

contacts

array of strings

contacts

client_name

string

Name of the Client to be presented to the End-User.

logo_uri

string

URL that references a logo for the Client application.

client_uri

string

URL of the home page of the Client.

policy_uri

string

URL that the Relying Party Client provides to the End-User to read
about the how the profile data will be used.

tos_uri

string

URL that the Relying Party Client provides to the End-User to read
about the Relying Party's terms of service.

jwks_uri

string

URL for the Client's JSON Web Key Set document.

jwks

object

Client's JSON Web Key Set document, passed by value.

sector_identifier_uri

string

URL using the https scheme to be used in calculating Pseudonymous
Identifiers by the OIDC Provider. It is not supported by this implementation
since it only support public subject_type.

subject_type

string

enum

subject_type requested for responses to this Client.

Allowed:

id_token_signed_response_alg

string

enum

JWS "alg" algorithm REQUIRED for signing the ID Token issued to this Client.

id_token_encrypted_response_alg

string

enum

JWE "alg" algorithm REQUIRED for encrypting the ID Token issued to this Client.

Allowed:

id_token_encrypted_response_enc

string

enum

JWE "enc" algorithm REQUIRED for encrypting the ID Token issued to this Client.

Allowed:

userinfo_signed_response_alg

string

enum

JWS "alg" algorithm REQUIRED for signing UserInfo Responses

userinfo_encrypted_response_alg

string

enum

JWE "alg" algorithm REQUIRED for encrypting UserInfo Responses

Allowed:

userinfo_encrypted_response_enc

string

enum

JWE "enc" algorithm REQUIRED for encrypting UserInfo Responses

Allowed:

request_object_signing_alg

string

enum

JWS "alg" algorithm that MUST be used for signing Request Objects
sent to the OIDC Provider

request_object_encryption_alg

string

enum

JWE "alg" algorithm the Relying Party is declaring that it may use
for encrypting Request Objects sent to the OIDC Provider

Allowed:

request_object_encryption_enc

string

enum

JWE "enc" algorithm the Relying Party is declaring that it may use
for encrypting Request Objects sent to the OIDC Provider

Allowed:

token_endpoint_auth_method

string

enum

Requested Client Authentication method for the Token Endpoint

Allowed:

token_endpoint_auth_signing_alg

string

enum

JWS "alg" algorithm that MUST be used for signing the JWT used to
authenticate the Client at the Token Endpoint for the private_key_jwt
authentication method.

token_endpoint_auth_single_use_jti

boolean

Whether private_key_jwt client assertion can only be used once. This is
done by checking the "jti" claim uniqueness.

default_max_age

number

Default Maximum Authentication Age
This implementation does not read this configuration.

require_auth_time

boolean

Whether the auth_time Claim in the ID Token is required.
This implementation by default will output auth_time whether it is
required or not.

default_acr_values

array of strings

default_acr_values

initiate_login_uri

string

URI using the https scheme that a third party can use to initiate
a login by the Relying Party

request_uris

array of strings

request_uris

scope

string

Space-delimited string containing list of scope values that the client
can use when requesting access tokens.

tls_client_auth_subject_dn

string

Expected subject distinguished name of the certificate that the
client will use in mutual-TLS authentication.

tls_client_auth_san_dns

string

Expected DNS Name SAN entry in the certificate that the client
will use in mutual-TLS authentication.

tls_client_auth_san_email

string

Expected RFC822 Name SAN entry in the certificate that the client
will use in mutual-TLS authentication.

tls_client_auth_san_ip

string

Expected IP Address SAN entry in the certificate that the client
will use in mutual-TLS authentication.

tls_client_auth_san_uri

string

Expected Uniform Resource Identifier (URI) SAN entry in the
certificate that the client will use in mutual-TLS authentication

tls_client_certificate_bound_access_tokens

boolean

Indicate the client's intention to use mutual-TLS client
certificate-bound access tokens.

require_pushed_authorization_requests

boolean

Indicates whether the client is required to use Pushed Authorization
Request to initiate authorization requests.

require_pkce

boolean

Indicates whether the client is required to use Proof Key for Code Exchange
(PKCE) in the authorization requests.

backchannel_token_delivery_mode

string

enum

Method of delivering the tokens after a successful user authentication.

Allowed:

backchannel_client_notification_endpoint

string

The endpoint to which the OIDC Provider will post a notification
after a successful or failed end-user authentication. Required if the
token delivery mode is set to "ping".

backchannel_user_code_parameter

boolean

Indicates whether the client is sending user_code parameter

software_id

string

A unique identifier string assigned by the client developer or software
publisher used by registration endpoints to identify the client software to
be dynamically registered. The value of this field is not intended to be
human readable and is usually opaque to the client and authorization server.

software_version

string

A version identifier string for the client software identified by
"software_id". The value of the "software_version" SHOULD change
on any update to the client software identified by the same "software_id".

software_statement

string

A software statement is a JSON Web Token (JWT) that asserts metadata values about
the client software as a bundle. All the properties above can be specified in
a software statement. When presented to the authorization server as part of a
client registration request, the software statement MUST be digitally signed
and MUST contain an "iss" (issuer) claim denoting the party attesting to the
claims in the software statement. Client metadata values conveyed in the
software statement will take precedence over those conveyed using plain JSON elements.
When using Dynamic Client Registration for FAPI specification, the software statement
is generated by regulatory body and there are certain rules to follow.

Headers

x-client-certificate

string

MTLS Client Certificate

content-type

string

enum

Defaults to application/json

Generated from available request content types

Allowed:

Responses

201Metadata associated with the dynamic client.

400OAuth JSON error response