# Get client by ID

Retrieves a client by client ID. To authorize a request, use an access token for the relevant application. **Required permissions**: `apps:read`, `[appId]:read`.

Endpoint: GET /v1/clients/{clientId}
Security: ClientAccessToken

## Security:

  - `ClientAccessToken` (unknown)
    oauth2

## Path parameters:

  - `clientId` (string, required)
    ID of the client to retrieve

## Response 200 fields (application/json):

  - `result` (any, required)
    The client

  - `result.app_id` (string, required)
    Application ID

  - `result.tenant_id` (string, required)
    Tenant ID

  - `result.client_id` (string, required)
    Client ID used for API requests

  - `result.client_secret` (string, required)
    Client secret used to obtain tokens for API authorization

  - `result.name` (string, required)
    Client name displayed in the Admin Portal

  - `result.description` (string, required)
    Short description of your client, displayed in the Admin Portal

  - `result.resources` (array, required)
    List of resources this client is allowed to explicitly request access to

  - `result.created_at` (string, required)
    Date the client was created

  - `result.updated_at` (string, required)
    Date the client was last updated

  - `result.authentication_protocol` (string, required)
    Authentication protocol used by the client
    Enum: "oidc", "saml"

  - `result.client_group_id` (string, required)
    Id of client group where client is assigned

  - `result.default_custom_claims` (array, required)
    List of all the custom claims the client wants to receive by default

  - `result.default_user_info_claims` (array)
    List of client default custom claims returned by the UserInfo endpoint

  - `result.sync_id_token_claims_to_userinfo` (boolean)
    When true, UserInfo custom claims are kept in sync with default_custom_claims

  - `result.short_cookies_samesite_type` (string)
    Short cookies samesite type. Possible values: "none", "lax", "strict". Default: "lax"
    Enum: "lax", "none"

  - `result.redirect_uris` (array, required)
    List of URIs approved for redirects for your client

  - `result.client_type` (string)
    Type of client
    Enum: "web", "native"

  - `result.response_types` (array)
    Example: ["code"]

  - `result.token_endpoint_auth_method` (string)
    This field is deprecated- to configure pkce use "pkce" field instead
    Enum: "client_secret_basic", "self_signed_tls_client_auth", "tls_client_auth", "none", "private_key_jwt"

  - `result.pkce` (string)
    PKCE configuration
    Enum: "enforcePkceInsteadOfClientCredentials", "enforcePkceAlongsideClientCredentials", "allowPkceAlongsideClientCredentials"

  - `result.device_authorization` (object, required)
    Configuration for an [OAuth Device Authorization Flow](https://www.rfc-editor.org/rfc/rfc8628)

  - `result.device_authorization.enabled` (boolean, required)
    Determines if the client is allowed to use the OAuth device authorization flow

  - `result.device_authorization.approval_uri` (string, required)
    The URI of the page that allows the user to approve the access request
    Example: https://www.example.com/device/approval

  - `result.device_authorization.success_uri` (string, required)
    Callback URI that receives an indication of whether the end-user authentication was completed successfully.
    Example: https://www.example.com/device/complete

  - `result.device_authorization.input_uri` (string, required)
    The URI of the page that allows the user to enter the code
    Example: https://www.example.com/device/start

  - `result.ciba_authorization` (object, required)
    CIBA authorization flow configuration

  - `result.ciba_authorization.enabled` (boolean, required)
    Determines if the client is allowed to use the OAuth CIBA authorization flow

  - `result.ciba_authorization.login_uri` (string)
    The URI of the page that allows the user to log-in and verify the access request
    Example: https://www.example.com/ciba/login

  - `result.supported_prompts` (array, required)
    Supported prompts for oidc authentication flow

  - `result.authentication_configuration` (object)
    JWKS configuration for mTLS authentication

  - `result.authentication_configuration.method` (string, required)
    Client authentication method
    Enum: "client_secret_basic", "self_signed_tls_client_auth", "tls_client_auth", "private_key_jwt"

  - `result.authentication_configuration.tls_client_auth` (object)
    TLS client authentication configuration for mTLS

  - `result.authentication_configuration.tls_client_auth.certificate_chain` (string)
    Certificate chain including intermediate CA certificates used for client certificate validation

  - `result.authentication_configuration.tls_client_auth.distinguished_name` (number)
    The length of the generated OTP code. Must be between 4 and 8.
    Example: 6

  - `result.authentication_configuration.tls_client_auth.ocsp_on` (boolean)
    Enables OCSP (Online Certificate Status Protocol) verification

  - `result.authentication_configuration.tls_client_auth.ocsp_responder_uri` (string)
    OCSP responder URI

  - `result.authentication_configuration.tls_client_auth.ocsp_responder_certificate` (string)
    OCSP responder certificate used for signature verification

  - `result.authentication_configuration.tls_client_auth.ocsp_fail_open` (boolean)
    OCSP fail-open

  - `result.authentication_configuration.isMtlsCertTokenBound` (boolean)
    States whether to bind the access token to the client certificate when mTLS is enabled

  - `result.authentication_configuration.jwks` (object)
    A set of JWK keys containing the public keys for the Client to use for authentication

  - `result.token_expiration` (object, required)
    Token expiration configuration

  - `result.token_expiration.access_token_ttl` (number)
    Access token time-to-live

  - `result.token_expiration.refresh_token_ttl` (number)
    Refresh token time-to-live

  - `result.token_expiration.max_refresh_rotate` (number)
    Maximum time the refresh token can be rotated

  - `result.session_expiration` (number, required)
    Session expiration time (seconds)

  - `result.enforce_par` (boolean, required)
    Enforce PAR (Pushed Authorization Request) for this client

  - `result.fapi_version_compliancy` (boolean, required)
    FAPI compliance

  - `result.id_token_encryption` (object)
    ID Token encryption configuration

  - `result.id_token_encryption.enabled` (boolean, required)
    Determines if ID token encryption is enabled for the client

  - `result.id_token_encryption.jwks` (object)
    A set of JWK keys containing the public keys for the client to use for ID token encryption

  - `result.optional_acs_url` (boolean, required)
    Allow the ACS URL to be optional

  - `result.sp_acs_url` (string, required)
    SAML ACS URL

  - `result.sp_entity_id` (string, required)
    SP SAML entity ID

  - `result.metadata_url` (string, required)
    SAML IDP metadata URL

  - `result.sso_url` (string, required)
    SAML SSO URL

  - `result.entity_id` (string, required)
    SAML Entity ID

  - `result.x509_certificate` (string, required)
    X.509 certificate

  - `result.x509_certificates` (array)
    All live certificates of the client, signing certificate first. Present only when SAML certificate rotation is enabled.

  - `result.x509_certificates.id` (string, required)
    Unique identifier of the certificate

  - `result.x509_certificates.status` (string, required)
    Certificate status. `signing`: the active certificate used to sign SAML responses and, when configured, assertions. `standby`: a certificate available for rotation that is published in the IdP metadata but not used for signing. Each SAML client only has one certificate with `signing` status.
    Enum: "signing", "standby"

  - `result.x509_certificates.source` (string, required)
    Certificate source. `generated`: generated specifically for this client. `shared`: a legacy certificate shared by SAML clients created before per-client certificates were introduced. See `expires_at` for the certificate expiration date.
    Enum: "generated", "shared"

  - `result.x509_certificates.created_at` (string, required)
    Date the certificate was created

  - `result.x509_certificates.expires_at` (string, required)
    Date the certificate expires (X.509 notAfter)

  - `result.sp_name_id_type` (string, required)
    SAML NameID Type
    Enum: "email", "secondaryEmail", "username", "phoneNumber", "externalUserId"

  - `result.sign_assertion` (boolean, required)
    Sign SAML assertion

  - `result.use_centralized_login` (boolean)
    When enabled, SAML SP-initiated SSO redirects to the tenant centralized hub application instead of hosted login

## Response 400 fields (application/json):

  - `message` (array, required)
    Example: Bad request

  - `error_code` (number, required)
    Example: 400

## Response 404 fields (application/json):

  - `message` (string, required)

  - `error_code` (number, required)
    Example: 404