# Update client resources

Update the list of resources that a client is allowed to explicitly request access to

Endpoint: PUT /v1/applications/{appId}/clients/{clientId}/resources
Security: ClientAccessToken, AdminAccessToken

## Path parameters:

  - `clientId` (string, required)

  - `appId` (string, required)

## Request fields (application/json):

  - `resource_ids` (array, required)
    List of resources this application is allowed to explicitly request access to

## Response 200 fields (application/json):

  - `app_id` (string, required)
    Application ID

  - `tenant_id` (string, required)
    Tenant ID

  - `client_id` (string, required)
    Client ID used for API requests

  - `client_secret` (string, required)
    Client secret used to obtain tokens for API authorization

  - `name` (string, required)
    Client name displayed in the Admin Portal

  - `description` (string, required)
    Short description of your client, displayed in the Admin Portal

  - `resources` (array, required)
    List of resources this client is allowed to explicitly request access to

  - `created_at` (string, required)
    Date the client was created

  - `updated_at` (string, required)
    Date the client was last updated

  - `authentication_protocol` (string, required)
    Authentication protocol used by the client
    Enum: "oidc", "saml"

  - `client_group_id` (string, required)
    Id of client group where client is assigned

  - `default_custom_claims` (array, required)
    List of all the custom claims the client wants to receive by default

  - `default_user_info_claims` (array)
    List of client default custom claims returned by the UserInfo endpoint

  - `sync_id_token_claims_to_userinfo` (boolean)
    When true, UserInfo custom claims are kept in sync with default_custom_claims

  - `short_cookies_samesite_type` (string)
    Short cookies samesite type. Possible values: "none", "lax", "strict". Default: "lax"
    Enum: "lax", "none"

  - `redirect_uris` (array, required)
    List of URIs approved for redirects for your client

  - `client_type` (string)
    Type of client
    Enum: "web", "native"

  - `response_types` (array)
    Example: ["code"]

  - `token_endpoint_auth_method` (string)
    This field is deprecated- to configure pkce use "pkce" field instead
    Enum: "client_secret_basic", "self_signed_tls_client_auth", "tls_client_auth", "none", "private_key_jwt"

  - `pkce` (string)
    PKCE configuration
    Enum: "enforcePkceInsteadOfClientCredentials", "enforcePkceAlongsideClientCredentials", "allowPkceAlongsideClientCredentials"

  - `device_authorization` (object, required)
    Configuration for an [OAuth Device Authorization Flow](https://www.rfc-editor.org/rfc/rfc8628)

  - `device_authorization.enabled` (boolean, required)
    Determines if the client is allowed to use the OAuth device authorization flow

  - `device_authorization.approval_uri` (string, required)
    The URI of the page that allows the user to approve the access request
    Example: https://www.example.com/device/approval

  - `device_authorization.success_uri` (string, required)
    Callback URI that receives an indication of whether the end-user authentication was completed successfully.
    Example: https://www.example.com/device/complete

  - `device_authorization.input_uri` (string, required)
    The URI of the page that allows the user to enter the code
    Example: https://www.example.com/device/start

  - `ciba_authorization` (object, required)
    CIBA authorization flow configuration

  - `ciba_authorization.enabled` (boolean, required)
    Determines if the client is allowed to use the OAuth CIBA authorization flow

  - `ciba_authorization.login_uri` (string)
    The URI of the page that allows the user to log-in and verify the access request
    Example: https://www.example.com/ciba/login

  - `supported_prompts` (array, required)
    Supported prompts for oidc authentication flow

  - `authentication_configuration` (object)
    JWKS configuration for mTLS authentication

  - `authentication_configuration.method` (string, required)
    Client authentication method
    Enum: "client_secret_basic", "self_signed_tls_client_auth", "tls_client_auth", "private_key_jwt"

  - `authentication_configuration.tls_client_auth` (object)
    TLS client authentication configuration for mTLS

  - `authentication_configuration.tls_client_auth.certificate_chain` (string)
    Certificate chain including intermediate CA certificates used for client certificate validation

  - `authentication_configuration.tls_client_auth.distinguished_name` (number)
    The length of the generated OTP code. Must be between 4 and 8.
    Example: 6

  - `authentication_configuration.tls_client_auth.ocsp_on` (boolean)
    Enables OCSP (Online Certificate Status Protocol) verification

  - `authentication_configuration.tls_client_auth.ocsp_responder_uri` (string)
    OCSP responder URI

  - `authentication_configuration.tls_client_auth.ocsp_responder_certificate` (string)
    OCSP responder certificate used for signature verification

  - `authentication_configuration.tls_client_auth.ocsp_fail_open` (boolean)
    OCSP fail-open

  - `authentication_configuration.isMtlsCertTokenBound` (boolean)
    States whether to bind the access token to the client certificate when mTLS is enabled

  - `authentication_configuration.jwks` (object)
    A set of JWK keys containing the public keys for the Client to use for authentication

  - `token_expiration` (object, required)
    Token expiration configuration

  - `token_expiration.access_token_ttl` (number)
    Access token time-to-live

  - `token_expiration.refresh_token_ttl` (number)
    Refresh token time-to-live

  - `token_expiration.max_refresh_rotate` (number)
    Maximum time the refresh token can be rotated

  - `session_expiration` (number, required)
    Session expiration time (seconds)

  - `enforce_par` (boolean, required)
    Enforce PAR (Pushed Authorization Request) for this client

  - `fapi_version_compliancy` (boolean, required)
    FAPI compliance

  - `id_token_encryption` (object)
    ID Token encryption configuration

  - `id_token_encryption.enabled` (boolean, required)
    Determines if ID token encryption is enabled for the client

  - `id_token_encryption.jwks` (object)
    A set of JWK keys containing the public keys for the client to use for ID token encryption

  - `optional_acs_url` (boolean, required)
    Allow the ACS URL to be optional

  - `sp_acs_url` (string, required)
    SAML ACS URL

  - `sp_entity_id` (string, required)
    SP SAML entity ID

  - `metadata_url` (string, required)
    SAML IDP metadata URL

  - `sso_url` (string, required)
    SAML SSO URL

  - `entity_id` (string, required)
    SAML Entity ID

  - `x509_certificate` (string, required)
    X.509 certificate

  - `sp_name_id_type` (string, required)
    SAML NameID Type
    Enum: "email", "secondaryEmail", "username", "phoneNumber", "externalUserId"

  - `sign_assertion` (boolean, required)
    Sign SAML assertion

  - `use_centralized_login` (boolean)
    When enabled, SAML SP-initiated SSO redirects to the tenant centralized hub application instead of hosted login