openapi: 3.0.3
info:
  title: Clients
  description: >-
    Allows an application to manage its clients, including updating existing
    clients and creating additional clients. To authorize API calls, use an
    access token for the relevant application. To manage apps and their clients
    as a tenant admin, see [Application APIs](/openapi/user/apps.openapi.json).
  version: ''
servers:
  - url: https://api.sbx.transmitsecurity.io/cis
    description: Sandbox environment
  - url: https://api.transmitsecurity.io/cis
    description: Production environment (US)
  - url: https://api.eu.transmitsecurity.io/cis
    description: Production environment (EU)
  - url: https://api.ca.transmitsecurity.io/cis
    description: Production environment (CA)
  - url: https://api.au.transmitsecurity.io/cis
    description: Production environment (AU)
security: []
paths:
  /v1/clients:
    post:
      operationId: createClient
      summary: Create client
      description: >-
        Creates an additional client for the app. To authorize a request, use an
        access token for the relevant application. <br><br>**Required
        permissions**: `apps:create`, `[appId]:create`, `apps:edit`,
        `[appId]:edit`.
      parameters: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              anyOf:
                - $ref: '#/components/schemas/ApiCreateOidcClientInput'
                - $ref: '#/components/schemas/ApiCreateSamlClientInput'
      responses:
        '201':
          description: ''
          content:
            application/json:
              schema:
                anyOf:
                  - $ref: '#/components/schemas/ApiOidcClient'
                  - $ref: '#/components/schemas/ApiSamlClient'
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestHttpError'
        '409':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IdentifierIsTakenHttpError'
      security:
        - ClientAccessToken: []
    get:
      operationId: getAll
      summary: Get all clients
      description: >-
        Retrieves a list of clients for the app. To authorize a request, use an
        access token for the relevant application. <br><br>**Required
        permissions**: `apps:read`, `[appId]:read`.
      parameters: []
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                items:
                  anyOf:
                    - $ref: '#/components/schemas/ApiOidcClient'
                    - $ref: '#/components/schemas/ApiSamlClient'
                type: array
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestHttpError'
      security:
        - ClientAccessToken: []
    delete:
      operationId: deleteClients
      summary: Delete all clients
      description: >-
        Deletes all clients associated with the app. To authorize a request, use
        an access token for the relevant application. Note that the application
        cannot be used without clients. <br><br>**Required permissions**:
        `apps:create`, `[appId]:create`, `apps:edit`, `[appId]:edit`,
        `apps:delete`, `[appId]:delete`.
      parameters: []
      responses:
        '204':
          description: ''
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestHttpError'
        '404':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotFoundHttpError'
      security:
        - ClientAccessToken: []
  /v1/clients/{clientId}:
    get:
      operationId: getClientById
      summary: Get client by ID
      description: >-
        Retrieves a client by client ID. To authorize a request, use an access
        token for the relevant application. <br><br>**Required permissions**:
        `apps:read`, `[appId]:read`.
      parameters:
        - name: clientId
          required: true
          in: path
          description: ID of the client to retrieve
          schema:
            type: string
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                anyOf:
                  - $ref: '#/components/schemas/ApiOidcClient'
                  - $ref: '#/components/schemas/ApiSamlClient'
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestHttpError'
        '404':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotFoundHttpError'
      security:
        - ClientAccessToken: []
    put:
      operationId: updateClient
      summary: Update client
      description: >-
        Update a client by its ID. To authorize a request, use an access token
        for the relevant application. Note: Fields that are objects cannot be
        partially updated, since the new value you set will just replace the
        current one. <br><br>**Required permissions**: `apps:create`,
        `[appId]:create`, `apps:edit`, `[appId]:edit`.
      parameters:
        - name: clientId
          required: true
          in: path
          description: ID of the client to update
          schema:
            type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              anyOf:
                - $ref: '#/components/schemas/ApiUpdateOidcClientInput'
                - $ref: '#/components/schemas/ApiUpdateSamlClientInput'
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                anyOf:
                  - $ref: '#/components/schemas/ApiOidcClient'
                  - $ref: '#/components/schemas/ApiSamlClient'
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestHttpError'
        '404':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotFoundHttpError'
      security:
        - ClientAccessToken: []
    delete:
      operationId: deleteClient
      summary: Delete client
      description: >-
        Deletes a client. To authorize a request, use an access token for the
        relevant application. <br><br>**Required permissions**: `apps:create`,
        `[appId]:create`, `apps:edit`, `[appId]:edit`, `apps:delete`,
        `[appId]:delete`.
      parameters:
        - name: clientId
          required: true
          in: path
          description: ID of the client to delete
          schema:
            type: string
      responses:
        '204':
          description: ''
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestHttpError'
        '404':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotFoundHttpError'
      security:
        - ClientAccessToken: []
  /v1/clients/{clientId}/resources:
    put:
      operationId: updateResourcesOfClient
      summary: Update client resources
      description: >-
        Updates the list of resources that a client is allowed to explicitly
        request access to. To authorize a request, use an access token for the
        relevant application. <br><br>**Required permissions**: `apps:create`,
        `[appId]:create`, `apps:edit`, `[appId]:edit`.
      parameters:
        - name: clientId
          required: true
          in: path
          schema:
            type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ApiUpdateResourceInAppInput'
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                anyOf:
                  - $ref: '#/components/schemas/ApiOidcClient'
                  - $ref: '#/components/schemas/ApiSamlClient'
      security:
        - ClientAccessToken: []
components:
  schemas:
    BadRequestHttpError:
      type: object
      properties:
        message:
          example: Bad request
          type: array
          items:
            type: string
        error_code:
          type: number
          example: 400
      required:
        - message
        - error_code
    ApiOidcClient:
      type: object
      properties:
        app_id:
          type: string
          description: Application ID
        tenant_id:
          type: string
          description: Tenant ID
        client_id:
          type: string
          description: Client ID used for API requests
        client_secret:
          type: string
          description: Client secret used to obtain tokens for API authorization
        name:
          type: string
          description: Client name displayed in the Admin Portal
        description:
          type: string
          description: Short description of your client, displayed in the Admin Portal
        resources:
          description: >-
            List of resources this client is allowed to explicitly request
            access to
          type: array
          items:
            type: string
        created_at:
          format: date-time
          type: string
          description: Date the client was created
        updated_at:
          format: date-time
          type: string
          description: Date the client was last updated
        authentication_protocol:
          type: string
          description: Authentication protocol used by the client
          enum:
            - oidc
            - saml
        client_group_id:
          type: string
          description: Id of client group where client is assigned
        default_custom_claims:
          type: array
          description: List of all the custom claims the client wants to receive by default
          items:
            type: string
            enum:
              - tid
              - fname
              - lname
              - mname
              - email
              - email_verified
              - phone_number
              - phone_number_verified
              - groups
              - new_user
              - birthday
              - language
              - city
              - address
              - country
              - street_address
              - address_type
              - webauthn
              - roles
              - ts_roles
              - role_values
              - ts_permissions
              - permissions
              - approval_data
              - custom_group_data
              - username
              - secondary_phone_numbers
              - secondary_emails
              - picture
              - created_at
              - last_auth
              - auth_time
              - external_account_id
              - external_user_id
              - app_name
              - custom_data
              - custom_app_data
        short_cookies_samesite_type:
          type: string
          enum:
            - lax
            - none
          description: >-
            Short cookies samesite type. Possible values: "none", "lax",
            "strict". Default: "lax"
          default: lax
        redirect_uris:
          description: List of URIs approved for redirects for your client
          type: array
          items:
            type: string
        client_type:
          type: string
          enum:
            - web
            - native
          description: Type of client
          default: web
        response_types:
          type: array
          default:
            - code
            - id_token
            - none
          example:
            - code
          items:
            type: string
            enum:
              - code
              - id_token
        token_endpoint_auth_method:
          type: string
          enum:
            - client_secret_basic
            - self_signed_tls_client_auth
            - tls_client_auth
            - none
            - private_key_jwt
          description: This field is deprecated- to configure pkce use "pkce" field instead
          deprecated: true
        pkce:
          type: string
          enum:
            - enforcePkceInsteadOfClientCredentials
            - enforcePkceAlongsideClientCredentials
            - allowPkceAlongsideClientCredentials
          description: PKCE configuration
        device_authorization:
          description: >-
            Configuration for an [OAuth Device Authorization
            Flow](https://www.rfc-editor.org/rfc/rfc8628)
          allOf:
            - $ref: '#/components/schemas/ApiDeviceAuthConfiguration'
        ciba_authorization:
          description: CIBA authorization flow configuration
          allOf:
            - $ref: '#/components/schemas/ApiCibaAuthConfiguration'
        supported_prompts:
          type: array
          description: Supported prompts for oidc authentication flow
          items:
            type: string
            enum:
              - login
              - consent
              - none
        authentication_configuration:
          description: JWKS configuration for mTLS authentication
          allOf:
            - $ref: '#/components/schemas/ApiClientAuthenticationConfiguration'
        token_expiration:
          description: Token expiration configuration
          allOf:
            - $ref: '#/components/schemas/ApiTokenExpirationConfiguration'
        session_expiration:
          type: number
          description: Session expiration time (seconds)
        enforce_par:
          type: boolean
          description: Enforce PAR (Pushed Authorization Request) for this client
        fapi_version_compliancy:
          type: boolean
          description: FAPI compliance
      required:
        - app_id
        - tenant_id
        - client_id
        - client_secret
        - name
        - description
        - resources
        - created_at
        - updated_at
        - authentication_protocol
        - client_group_id
        - default_custom_claims
        - redirect_uris
        - device_authorization
        - ciba_authorization
        - supported_prompts
        - token_expiration
        - session_expiration
        - enforce_par
        - fapi_version_compliancy
    ApiSamlClient:
      type: object
      properties:
        app_id:
          type: string
          description: Application ID
        tenant_id:
          type: string
          description: Tenant ID
        client_id:
          type: string
          description: Client ID used for API requests
        client_secret:
          type: string
          description: Client secret used to obtain tokens for API authorization
        name:
          type: string
          description: Client name displayed in the Admin Portal
        description:
          type: string
          description: Short description of your client, displayed in the Admin Portal
        resources:
          description: >-
            List of resources this client is allowed to explicitly request
            access to
          type: array
          items:
            type: string
        created_at:
          format: date-time
          type: string
          description: Date the client was created
        updated_at:
          format: date-time
          type: string
          description: Date the client was last updated
        authentication_protocol:
          type: string
          description: Authentication protocol used by the client
          enum:
            - oidc
            - saml
        client_group_id:
          type: string
          description: Id of client group where client is assigned
        default_custom_claims:
          type: array
          description: List of all the custom claims the client wants to receive by default
          items:
            type: string
            enum:
              - tid
              - fname
              - lname
              - mname
              - email
              - email_verified
              - phone_number
              - phone_number_verified
              - groups
              - new_user
              - birthday
              - language
              - city
              - address
              - country
              - street_address
              - address_type
              - webauthn
              - roles
              - ts_roles
              - role_values
              - ts_permissions
              - permissions
              - approval_data
              - custom_group_data
              - username
              - secondary_phone_numbers
              - secondary_emails
              - picture
              - created_at
              - last_auth
              - auth_time
              - external_account_id
              - external_user_id
              - app_name
              - custom_data
              - custom_app_data
        short_cookies_samesite_type:
          type: string
          enum:
            - lax
            - none
          description: >-
            Short cookies samesite type. Possible values: "none", "lax",
            "strict". Default: "lax"
          default: lax
        optional_acs_url:
          type: boolean
          description: Allow the ACS URL to be optional
        sp_acs_url:
          type: string
          description: SAML ACS URL
        sp_entity_id:
          type: string
          description: SP SAML entity ID
        metadata_url:
          type: string
          description: SAML IDP metadata URL
        sso_url:
          type: string
          description: SAML SSO URL
        entity_id:
          type: string
          description: SAML Entity ID
        x509_certificate:
          type: string
          description: X.509 certificate
        sp_name_id_type:
          type: string
          description: SAML NameID Type
          enum:
            - email
            - secondaryEmail
            - username
            - phoneNumber
            - externalUserId
        sign_assertion:
          type: boolean
          description: Sign SAML assertion
      required:
        - app_id
        - tenant_id
        - client_id
        - client_secret
        - name
        - description
        - resources
        - created_at
        - updated_at
        - authentication_protocol
        - client_group_id
        - default_custom_claims
        - optional_acs_url
        - sp_acs_url
        - sp_entity_id
        - metadata_url
        - sso_url
        - entity_id
        - x509_certificate
        - sp_name_id_type
        - sign_assertion
    ApiCreateOidcClientInput:
      type: object
      properties:
        name:
          type: string
          description: Name of the client
          example: My Client
        description:
          type: string
          description: Short description of the client
        resources:
          description: List of resources IDs associated with this client
          type: array
          items:
            type: string
        authentication_protocol:
          type: string
          enum:
            - oidc
            - saml
          description: Authentication protocol used by the client
          default: oidc
        client_group_id:
          type: string
          description: Id of client group to associate with
        default_custom_claims:
          type: array
          description: List of client default custom claims
          items:
            type: string
            enum:
              - tid
              - fname
              - lname
              - mname
              - email
              - email_verified
              - phone_number
              - phone_number_verified
              - groups
              - new_user
              - birthday
              - language
              - city
              - address
              - country
              - street_address
              - address_type
              - webauthn
              - roles
              - ts_roles
              - role_values
              - ts_permissions
              - permissions
              - approval_data
              - custom_group_data
              - username
              - secondary_phone_numbers
              - secondary_emails
              - picture
              - created_at
              - last_auth
              - auth_time
              - external_account_id
              - external_user_id
              - app_name
              - custom_data
              - custom_app_data
        short_cookies_samesite_type:
          type: string
          enum:
            - lax
            - none
          description: >-
            Short cookies samesite type. Possible values: "none", "lax",
            "strict". Default: "lax"
          default: lax
        redirect_uris:
          description: List of URIs approved for redirects for your client
          example:
            - https://www.example.com/login
          type: array
          items:
            type: string
        client_type:
          type: string
          enum:
            - web
            - native
          description: Client type
          default: web
        device_authorization:
          description: >-
            Configuration for an [OAuth Device Authorization
            Flow](https://www.rfc-editor.org/rfc/rfc8628)
          allOf:
            - $ref: '#/components/schemas/ApiDeviceAuthConfiguration'
        ciba_authorization:
          description: CIBA authorization flow configuration
          allOf:
            - $ref: '#/components/schemas/ApiCibaAuthConfiguration'
        is_third_party:
          type: boolean
          description: Is third party client
        allowed_scopes:
          description: Allowed scopes
          type: array
          items:
            type: string
        consent_uri:
          type: string
          description: Consent URI
        consent_validity_period:
          type: number
          description: Consent validity period
        pkce:
          type: string
          enum:
            - enforcePkceInsteadOfClientCredentials
            - enforcePkceAlongsideClientCredentials
            - allowPkceAlongsideClientCredentials
          description: PKCE configuration
        supported_prompts:
          type: array
          example:
            - login
            - consent
            - none
          description: Supported prompts for the OIDC authentication flow
          items:
            type: string
            enum:
              - login
              - consent
              - none
        token_expiration:
          description: Token expiration settings
          allOf:
            - $ref: '#/components/schemas/ApiTokenExpirationConfiguration'
        session_expiration:
          type: number
          description: Session expiration time (seconds)
        enforce_par:
          type: boolean
          description: enforce PAR (Pushed Authorization Request) for this client
        role_ids:
          description: Role IDs
          type: array
          items:
            type: string
        fapi_version_compliancy:
          type: boolean
          description: FAPI 2.0 compliancy configuration
        token_endpoint_auth_method:
          type: string
          enum:
            - client_secret_basic
            - self_signed_tls_client_auth
            - tls_client_auth
            - none
            - private_key_jwt
          description: This field is deprecated- to configure pkce use "pkce" field instead
          default: client_secret_basic
          deprecated: true
        response_types:
          type: array
          default:
            - code
            - id_token
          example:
            - code
          items:
            type: string
            enum:
              - code
              - id_token
        authentication_configuration:
          description: Client authentication configuration
          allOf:
            - $ref: '#/components/schemas/ApiClientAuthenticationConfiguration'
      required:
        - name
        - redirect_uris
    ApiCreateSamlClientInput:
      type: object
      properties:
        name:
          type: string
          description: Name of the client
          example: My Client
        description:
          type: string
          description: Short description of the client
        resources:
          description: List of resources IDs associated with this client
          type: array
          items:
            type: string
        authentication_protocol:
          type: string
          enum:
            - oidc
            - saml
          description: Authentication protocol used by the client
          default: oidc
        client_group_id:
          type: string
          description: Id of client group to associate with
        default_custom_claims:
          type: array
          description: List of client default custom claims
          items:
            type: string
            enum:
              - tid
              - fname
              - lname
              - mname
              - email
              - email_verified
              - phone_number
              - phone_number_verified
              - groups
              - new_user
              - birthday
              - language
              - city
              - address
              - country
              - street_address
              - address_type
              - webauthn
              - roles
              - ts_roles
              - role_values
              - ts_permissions
              - permissions
              - approval_data
              - custom_group_data
              - username
              - secondary_phone_numbers
              - secondary_emails
              - picture
              - created_at
              - last_auth
              - auth_time
              - external_account_id
              - external_user_id
              - app_name
              - custom_data
              - custom_app_data
        short_cookies_samesite_type:
          type: string
          enum:
            - lax
            - none
          description: >-
            Short cookies samesite type. Possible values: "none", "lax",
            "strict". Default: "lax"
          default: lax
        sp_acs_url:
          type: string
          description: SAML ACS URL
        sp_entity_id:
          type: string
          description: SAML Service provider entity ID
        sp_name_id_type:
          type: string
          enum:
            - email
            - secondaryEmail
            - username
            - phoneNumber
            - externalUserId
          description: SAML Name ID Type
        supported_prompts:
          type: array
          example:
            - login
            - consent
            - none
          description: Supported prompts for the OIDC authentication flow
          items:
            type: string
            enum:
              - login
              - consent
              - none
        sign_assertion:
          type: boolean
          description: Sign SAML assertion
        optional_acs_url:
          type: boolean
          description: Allow ACS URL to be optional
      required:
        - name
        - sp_entity_id
    IdentifierIsTakenHttpError:
      type: object
      properties:
        message:
          type: string
        error_code:
          type: number
      required:
        - message
        - error_code
    NotFoundHttpError:
      type: object
      properties:
        message:
          type: string
        error_code:
          type: number
          example: 404
      required:
        - message
        - error_code
    ApiUpdateOidcClientInput:
      type: object
      properties:
        name:
          type: string
          description: Name of the client
          example: My Client
        description:
          type: string
          description: Short description of the client
        resources:
          description: List of resources IDs associated with this client
          type: array
          items:
            type: string
        client_group_id:
          type: string
          description: Id of client group to associate with
        default_custom_claims:
          type: array
          description: List of client default custom claims
          items:
            type: string
            enum:
              - tid
              - fname
              - lname
              - mname
              - email
              - email_verified
              - phone_number
              - phone_number_verified
              - groups
              - new_user
              - birthday
              - language
              - city
              - address
              - country
              - street_address
              - address_type
              - webauthn
              - roles
              - ts_roles
              - role_values
              - ts_permissions
              - permissions
              - approval_data
              - custom_group_data
              - username
              - secondary_phone_numbers
              - secondary_emails
              - picture
              - created_at
              - last_auth
              - auth_time
              - external_account_id
              - external_user_id
              - app_name
              - custom_data
              - custom_app_data
        short_cookies_samesite_type:
          type: string
          enum:
            - lax
            - none
          description: >-
            Short cookies samesite type. Possible values: "none", "lax",
            "strict". Default: "lax"
          default: lax
        redirect_uris:
          description: List of URIs approved for redirects for your client
          example:
            - https://www.example.com/login
          type: array
          items:
            type: string
        client_type:
          type: string
          enum:
            - web
            - native
          description: Client type
          default: web
        device_authorization:
          description: >-
            Configuration for an [OAuth Device Authorization
            Flow](https://www.rfc-editor.org/rfc/rfc8628)
          allOf:
            - $ref: '#/components/schemas/ApiDeviceAuthConfiguration'
        ciba_authorization:
          description: CIBA authorization flow configuration
          allOf:
            - $ref: '#/components/schemas/ApiCibaAuthConfiguration'
        is_third_party:
          type: boolean
          description: Is third party client
        allowed_scopes:
          description: Allowed scopes
          type: array
          items:
            type: string
        consent_uri:
          type: string
          description: Consent URI
        consent_validity_period:
          type: number
          description: Consent validity period
        pkce:
          type: string
          enum:
            - enforcePkceInsteadOfClientCredentials
            - enforcePkceAlongsideClientCredentials
            - allowPkceAlongsideClientCredentials
          description: PKCE configuration
        supported_prompts:
          type: array
          example:
            - login
            - consent
            - none
          description: Supported prompts for the OIDC authentication flow
          items:
            type: string
            enum:
              - login
              - consent
              - none
        token_expiration:
          description: Token expiration settings
          allOf:
            - $ref: '#/components/schemas/ApiTokenExpirationConfiguration'
        session_expiration:
          type: number
          description: Session expiration time (seconds)
        enforce_par:
          type: boolean
          description: enforce PAR (Pushed Authorization Request) for this client
        role_ids:
          description: Role IDs
          type: array
          items:
            type: string
        fapi_version_compliancy:
          type: boolean
          description: FAPI 2.0 compliancy configuration
        token_endpoint_auth_method:
          type: string
          enum:
            - client_secret_basic
            - self_signed_tls_client_auth
            - tls_client_auth
            - none
            - private_key_jwt
          description: This field is deprecated- to configure pkce use "pkce" field instead
          default: client_secret_basic
          deprecated: true
        response_types:
          type: array
          default:
            - code
            - id_token
          example:
            - code
          items:
            type: string
            enum:
              - code
              - id_token
        authentication_configuration:
          description: Client authentication configuration
          allOf:
            - $ref: '#/components/schemas/ApiClientAuthenticationConfiguration'
    ApiUpdateSamlClientInput:
      type: object
      properties:
        name:
          type: string
          description: Name of the client
          example: My Client
        description:
          type: string
          description: Short description of the client
        resources:
          description: List of resources IDs associated with this client
          type: array
          items:
            type: string
        client_group_id:
          type: string
          description: Id of client group to associate with
        default_custom_claims:
          type: array
          description: List of client default custom claims
          items:
            type: string
            enum:
              - tid
              - fname
              - lname
              - mname
              - email
              - email_verified
              - phone_number
              - phone_number_verified
              - groups
              - new_user
              - birthday
              - language
              - city
              - address
              - country
              - street_address
              - address_type
              - webauthn
              - roles
              - ts_roles
              - role_values
              - ts_permissions
              - permissions
              - approval_data
              - custom_group_data
              - username
              - secondary_phone_numbers
              - secondary_emails
              - picture
              - created_at
              - last_auth
              - auth_time
              - external_account_id
              - external_user_id
              - app_name
              - custom_data
              - custom_app_data
        short_cookies_samesite_type:
          type: string
          enum:
            - lax
            - none
          description: >-
            Short cookies samesite type. Possible values: "none", "lax",
            "strict". Default: "lax"
          default: lax
        sp_acs_url:
          type: string
          description: SAML ACS URL
        sp_entity_id:
          type: string
          description: SAML Service provider entity ID
        sp_name_id_type:
          type: string
          enum:
            - email
            - secondaryEmail
            - username
            - phoneNumber
            - externalUserId
          description: SAML Name ID Type
        supported_prompts:
          type: array
          example:
            - login
            - consent
            - none
          description: Supported prompts for the OIDC authentication flow
          items:
            type: string
            enum:
              - login
              - consent
              - none
        sign_assertion:
          type: boolean
          description: Sign SAML assertion
        optional_acs_url:
          type: boolean
          description: Allow ACS URL to be optional
    ApiUpdateResourceInAppInput:
      type: object
      properties:
        resource_ids:
          type: array
          items:
            type: string
          description: >-
            List of resources this application is allowed to explicitly request
            access to
      required:
        - resource_ids
    ApiDeviceAuthConfiguration:
      type: object
      properties:
        enabled:
          type: boolean
          description: >-
            Determines if the client is allowed to use the OAuth device
            authorization flow
          default: false
        approval_uri:
          type: string
          description: >-
            The URI of the page that allows the user to approve the access
            request
          example: https://www.example.com/device/approval
        success_uri:
          type: string
          description: >-
            Callback URI that receives an indication of whether the end-user
            authentication was completed successfully.
          example: https://www.example.com/device/complete
        input_uri:
          type: string
          description: The URI of the page that allows the user to enter the code
          example: https://www.example.com/device/start
      required:
        - enabled
        - approval_uri
        - success_uri
        - input_uri
    ApiCibaAuthConfiguration:
      type: object
      properties:
        enabled:
          type: boolean
          description: >-
            Determines if the client is allowed to use the OAuth CIBA
            authorization flow
          default: false
        login_uri:
          type: string
          description: >-
            The URI of the page that allows the user to log-in and verify the
            access request
          example: https://www.example.com/ciba/login
      required:
        - enabled
    ApiClientAuthenticationConfiguration:
      type: object
      properties:
        method:
          type: string
          enum:
            - client_secret_basic
            - self_signed_tls_client_auth
            - tls_client_auth
            - private_key_jwt
          description: Client authentication method
          default: client_secret_basic
        tls_client_auth:
          description: TLS client authentication configuration for mTLS
          allOf:
            - $ref: '#/components/schemas/TlsClientAuth'
        isMtlsCertTokenBound:
          type: boolean
          description: >-
            States whether to bind the access token to the client certificate
            when mTLS is enabled
        jwks:
          type: object
          description: >-
            A set of JWK keys containing the public keys for the Client to use
            for authentication
      required:
        - method
    ApiTokenExpirationConfiguration:
      type: object
      properties:
        access_token_ttl:
          type: number
          description: Access token time-to-live
        refresh_token_ttl:
          type: number
          description: Refresh token time-to-live
        max_refresh_rotate:
          type: number
          description: Maximum time the refresh token can be rotated
    TlsClientAuth:
      type: object
      properties:
        certificate_chain:
          type: string
          description: >-
            Certificate chain including intermediate CA certificates used for
            client certificate validation
        distinguished_name:
          type: number
          description: The length of the generated OTP code. Must be between 4 and 8.
          example: 6
        ocsp_on:
          type: boolean
          description: Enables OCSP (Online Certificate Status Protocol) verification
        ocsp_responder_uri:
          type: string
          description: OCSP responder URI
        ocsp_responder_certificate:
          type: string
          description: OCSP responder certificate used for signature verification
        ocsp_fail_open:
          type: boolean
          description: OCSP fail-open
  securitySchemes:
    bearer:
      scheme: bearer
      bearerFormat: JWT
      type: http
    UserAccessToken:
      type: http
      description: >-
        A token returned upon end-user authentication, which provides access to
        resources and data for the user and app for which it was generated
      scheme: bearer
      bearerFormat: JWT
    AdminAccessToken:
      type: oauth2
      flows:
        clientCredentials:
          tokenUrl: /oidc/token
          scopes: {}
      description: >-
        A token generated by a management application using the [token
        endpoint](/openapi/token.openapi/other/getaccesstoken). It provides
        access to all resources for the tenant and its apps
    ClientAccessToken:
      type: oauth2
      flows:
        clientCredentials:
          tokenUrl: /oidc/token
          scopes: {}
      description: >-
        A token generated by an end-user application using the [token
        endpoint](/openapi/token.openapi/other/getaccesstoken). It provides
        access to resources and data on the tenant level or associated with the
        specific application (but not other apps in the tenant)
    OrgAdminAccessToken:
      type: oauth2
      flows:
        clientCredentials:
          tokenUrl: /oidc/token
          scopes: {}
      description: >-
        A token returned upon B2B authentication for a user that has the
        organizationAdmin or organizationCreator role.
