Skip to content

SSO Clients Groups

Configure Mosaic SSO Service to streamline login for users. Create and manage SSO clients group to control your SSO login experience.

Download OpenAPI description
sso-clients-groups.openapi.json
sso-clients-groups.openapi.yaml
Languages
Servers
Sandbox environment
https://api.sbx.transmitsecurity.io/cis/
Production environment (US)
https://api.transmitsecurity.io/cis/
Production environment (EU)
https://api.eu.transmitsecurity.io/cis/
Production environment (CA)
https://api.ca.transmitsecurity.io/cis/
Production environment (AU)
https://api.au.transmitsecurity.io/cis/

Create clients group

Request

Creates a new SSO clients group.

Required permissions: sso-service:edit.

Security
ClientAccessToken
Bodyapplication/jsonrequired
namestringrequired

Name of the clients group

Example: "My Clients Group"
descriptionstring

Short description of the clients group

configurationobjectrequired

Configuration of the clients group

configuration.​journeystringrequired

The journey ID associated with the SSO clients group

configuration.​allowSilentLoginboolean

Whether silent login is allowed.

configuration.​sessionTimeoutnumber

Session timeout in seconds/minutes/hours/days/weeks (depending on value in session_timeout_granularity).

configuration.​sessionTimeoutGranularitystring

Session timeout granularity

Enum"seconds""minutes""hours""days""weeks"
curl -i -X POST \
  https://api.sbx.transmitsecurity.io/cis/v1/sso-service/sso-group \
  -H 'Authorization: Bearer <YOUR_TOKEN_HERE>' \
  -H 'Content-Type: application/json' \
  -d '{
    "name": "My Clients Group",
    "description": "string",
    "configuration": {
      "journey": "string",
      "allowSilentLogin": true,
      "sessionTimeout": 0,
      "sessionTimeoutGranularity": "seconds"
    }
  }'

Responses

Bodyapplication/json
resultobjectrequired
result.​app_idstringrequired

Application ID

result.​tenant_idstringrequired

Tenant ID

result.​app_namestringrequired

Application name displayed in the Admin Portal

result.​app_descriptionstringrequired

Short description of your application, displayed in the Admin Portal

result.​logostringrequired

URI of your application's logo, such as for email templates

result.​login_preferencesobjectrequired
result.​login_preferences.​auth_methodsobjectrequired

Login preferences

result.​login_preferences.​auth_methods.​googleobject

Google login configuration

result.​login_preferences.​auth_methods.​facebookobject

Facebook login configuration

result.​login_preferences.​auth_methods.​emailobject

Email magic link login configuration

result.​login_preferences.​auth_methods.​email_otpobject

Email one time password login configuration

result.​login_preferences.​auth_methods.​appleobject

Apple login configuration

result.​login_preferences.​auth_methods.​smsobject

SMS one time password login configuration

result.​login_preferences.​auth_methods.​webauthn_apiobject

WebAuthn API configuration

result.​login_preferences.​auth_methods.​lineobject

Line login configuration

result.​login_preferences.​auth_methods.​passwordobject

Password login configuration

result.​login_preferences.​auth_methods.​totpobject

TOTP login configuration

result.​login_preferences.​auth_methods.​pushobject

Push configuration

result.​login_preferences.​auth_methods.​tiktokobject

TikTok login configuration

result.​login_preferences.​auth_methods.​pin_authenticatorobject

PIN authenticator configuration

result.​login_preferences.​auth_methods.​faceobject

Face authenticator configuration

result.​created_atstring(date-time)required

Date the application was created

result.​created_bystringrequired

The user that created the application

result.​updated_atstring(date-time)required

Date the application was last updated

result.​service_providersArray of stringsrequired

List of service providers this application is allowed to explicitly redirect to

result.​authenticator_preferencesobjectrequired

Configures the application as the Authentication Hub of this tenant, allowing other apps to use it to perform a centralized login.

result.​authenticator_preferences.​is_centralizedbooleanrequired

Indicates whether to set the application as the Authentication Hub for this tenant

Default false
result.​authenticator_preferences.​login_uristringrequired

URI of the application that will initiate an authentication flow when centralized login is requested

Example: "https://www.example.com/login"
result.​allow_public_signupbooleanrequired

Determines if the application is allowed to request to create new users via login flows

result.​pkcestring

PKCE configuration

Enum"enforcePkceInsteadOfClientCredentials""enforcePkceAlongsideClientCredentials""allowPkceAlongsideClientCredentials"
result.​password_sharing_group_idstring

If the app has opted in to password sharing, this identifies the group of apps that it shares passwords with.

result.​login_uristring

URI used to redirect the user to the login page of the application (when needed)

Example: "https://www.example.com/login"
result.​invite_member_uristring

URI used to redirect the member to the login page of the application (when needed)

Example: "https://www.example.com/login"
result.​invite_client_idstring

Client used for the email magic link invitation flow

result.​subdomainstring

Subdomain of Org admin portal that can be offered for organizations to manage their users (when needed)

Example: "myapp"
result.​invite_member_email_expiration_minutesnumber

Member invite email link expiration in minutes

Default 2880
result.​custom_domainobject

Custom domain of the application that can be offered for the application to be accessed from

result.​external_communicationobject

External communication configuration for the application

result.​signing_key_enabledboolean

Determines if application specific signing key is enabled

result.​refresh_token_invalidation_trigger_configurationobject

Refresh token invalidation trigger configuration

result.​client_typestringDeprecated

Type of the default client

Default "web"
Enum"web""native"
result.​client_idstringDeprecated

Client ID of the default client used for API requests

result.​client_display_namestringDeprecated

Client name of the default client to display when needed

result.​client_descriptionstringDeprecated

Short description of the default client

result.​client_secretstringDeprecated

Client secret of the default client used to obtain tokens for API authorization

result.​redirect_urisArray of stringsDeprecated

List of URI approved for redirects for your default client

result.​resourcesArray of stringsDeprecated

List of resources the default client is allowed to explicitly request access to

result.​client_auth_methodstringDeprecated

This field is deprecated- to configure pkce use "pkce" field instead

Enum"client_secret_basic""self_signed_tls_client_auth""tls_client_auth""none""private_key_jwt"
result.​device_authorizationobjectDeprecated

Configuration for an OAuth Device Authorization Flow of the default client

result.​ciba_authorizationobjectDeprecated

CIBA authorization flow configuration of the default client

Response
application/json
{
  "result": {
    "app_id": "string",
    "tenant_id": "string",
    "app_name": "string",
    "app_description": "string",
    "client_type": "web",
    "logo": "string",
    "client_id": "string",
    "client_display_name": "string",
    "client_description": "string",
    "client_secret": "string",
    "redirect_uris": [ … ],
    "login_preferences": { … },
    "created_at": "2019-08-24T14:15:22Z",
    "created_by": "string",
    "updated_at": "2019-08-24T14:15:22Z",
    "resources": [ … ],
    "service_providers": [ … ],
    "authenticator_preferences": { … },
    "allow_public_signup": true,
    "client_auth_method": "client_secret_basic",
    "pkce": "enforcePkceInsteadOfClientCredentials",
    "device_authorization": { … },
    "ciba_authorization": { … },
    "password_sharing_group_id": "string",
    "login_uri": "https://www.example.com/login",
    "invite_member_uri": "https://www.example.com/login",
    "invite_client_id": "string",
    "subdomain": "myapp",
    "invite_member_email_expiration_minutes": 2880,
    "custom_domain": { … },
    "external_communication": { … },
    "signing_key_enabled": true,
    "refresh_token_invalidation_trigger_configuration": { … }
  }
}

Get all clients groups

Request

Retrieves a list of all clients groups.

Required permissions: sso-service:read.

Security
ClientAccessToken
curl -i -X GET \
  https://api.sbx.transmitsecurity.io/cis/v1/sso-service/sso-group \
  -H 'Authorization: Bearer <YOUR_TOKEN_HERE>'

Responses

Bodyapplication/json
resultArray of objectsrequired
result[].​idstringrequired

ID of the SSO group

result[].​namestringrequired

Name of the SSO group

result[].​descriptionstringrequired

Short description of the SSO group

result[].​configurationobjectrequired

Configuration for the SSO group

result[].​configuration.​journeystringrequired

Name of the journey to run within the SSO group.

result[].​configuration.​sessionTimeoutnumberrequired

The time in seconds/minutes/hours/days/weeks after which the session will expire. Default in seconds.

result[].​configuration.​allowSilentLoginbooleanrequired

Whether silent login is allowed.

result[].​configuration.​sessionTimeoutGranularitystringrequired

Session timeout granularity

Enum"seconds""minutes""hours""days""weeks"
result[].​clientsArray of objectsrequired

List of clients in the SSO group

result[].​clients[].​client_idstringrequired

Client ID used for API requests

result[].​clients[].​client_secretstringrequired

Client secret used to obtain tokens for API authorization

result[].​clients[].​client_typestring

Client type

Enum"web""native"
result[].​clients[].​namestringrequired

Client name displayed in the Admin Portal

result[].​clients[].​pkcestring

PKCE configuration for client

Enum"enforcePkceInsteadOfClientCredentials""enforcePkceAlongsideClientCredentials""allowPkceAlongsideClientCredentials"
result[].​clients[].​descriptionstringrequired

Short description of your client, displayed in the Admin Portal

result[].​clients[].​resourcesArray of stringsrequired

List of resources this client is allowed to explicitly request access to

result[].​clients[].​created_atstring(date-time)required

Date the client was created

result[].​clients[].​updated_atstring(date-time)required

Date the client was last updated

result[].​clients[].​redirect_urisArray of strings

List of URIs approved for redirects for your client

result[].​clients[].​authentication_protocolstring

Authentication protocol used by the client

Enum"oidc""saml"
result[].​clients[].​is_third_partyboolean

Whether the client is a third-party client

result[].​clients[].​optional_acs_urlboolean

ACS URL for the SAML client

result[].​clients[].​sp_acs_urlstring

ACS URL for the SAML client

result[].​clients[].​sp_entity_idstring

Entity ID for the SAML client

result[].​clients[].​metadata_urlstring

SAML IDP metadata URL

result[].​clients[].​sso_urlstring

SAML SSO URL

result[].​clients[].​entity_idstring

SAML Entity ID

result[].​clients[].​x509_certificatestring

X.509 certificate

result[].​clients[].​default_custom_claimsArray of strings

List of all the custom claims the client wants to receive by default

Items Enum"tid""fname""lname""mname""email""email_verified""phone_number""phone_number_verified""groups""new_user"
Response
application/json
{
  "result": [
    { … }
  ]
}

Get clients group by ID

Request

Retrieves a clients group by its ID. The clients group ID is a unique identifier for a clients group.

Required permissions: sso-service:read.

Security
ClientAccessToken
Path
groupIdstringrequired

ID of the group to retrieve

curl -i -X GET \
  'https://api.sbx.transmitsecurity.io/cis/v1/sso-service/sso-group/{groupId}' \
  -H 'Authorization: Bearer <YOUR_TOKEN_HERE>'

Responses

Bodyapplication/json
resultobjectrequired
result.​idstringrequired

ID of the SSO group

result.​namestringrequired

Name of the SSO group

result.​descriptionstringrequired

Short description of the SSO group

result.​configurationobjectrequired

Configuration for the SSO group

result.​configuration.​journeystringrequired

Name of the journey to run within the SSO group.

result.​configuration.​sessionTimeoutnumberrequired

The time in seconds/minutes/hours/days/weeks after which the session will expire. Default in seconds.

result.​configuration.​allowSilentLoginbooleanrequired

Whether silent login is allowed.

result.​configuration.​sessionTimeoutGranularitystringrequired

Session timeout granularity

Enum"seconds""minutes""hours""days""weeks"
result.​clientsArray of objectsrequired

List of clients in the SSO group

result.​clients[].​client_idstringrequired

Client ID used for API requests

result.​clients[].​client_secretstringrequired

Client secret used to obtain tokens for API authorization

result.​clients[].​client_typestring

Client type

Enum"web""native"
result.​clients[].​namestringrequired

Client name displayed in the Admin Portal

result.​clients[].​pkcestring

PKCE configuration for client

Enum"enforcePkceInsteadOfClientCredentials""enforcePkceAlongsideClientCredentials""allowPkceAlongsideClientCredentials"
result.​clients[].​descriptionstringrequired

Short description of your client, displayed in the Admin Portal

result.​clients[].​resourcesArray of stringsrequired

List of resources this client is allowed to explicitly request access to

result.​clients[].​created_atstring(date-time)required

Date the client was created

result.​clients[].​updated_atstring(date-time)required

Date the client was last updated

result.​clients[].​redirect_urisArray of strings

List of URIs approved for redirects for your client

result.​clients[].​authentication_protocolstring

Authentication protocol used by the client

Enum"oidc""saml"
result.​clients[].​is_third_partyboolean

Whether the client is a third-party client

result.​clients[].​optional_acs_urlboolean

ACS URL for the SAML client

result.​clients[].​sp_acs_urlstring

ACS URL for the SAML client

result.​clients[].​sp_entity_idstring

Entity ID for the SAML client

result.​clients[].​metadata_urlstring

SAML IDP metadata URL

result.​clients[].​sso_urlstring

SAML SSO URL

result.​clients[].​entity_idstring

SAML Entity ID

result.​clients[].​x509_certificatestring

X.509 certificate

result.​clients[].​default_custom_claimsArray of strings

List of all the custom claims the client wants to receive by default

Items Enum"tid""fname""lname""mname""email""email_verified""phone_number""phone_number_verified""groups""new_user"
Response
application/json
{
  "result": {
    "id": "string",
    "name": "string",
    "description": "string",
    "configuration": { … },
    "clients": [ … ]
  }
}

Update clients group

Request

Updates an existing clients group. The clients group ID is a unique identifier for a clients group.

Required permissions: sso-service:edit.

Security
ClientAccessToken
Path
groupIdstringrequired

ID of the group to retrieve

Bodyapplication/jsonrequired
namestringrequired

Name of the clients group

Example: "My Clients Group"
descriptionstring

Short description of the clients group

configurationobjectrequired

Configuration of the clients group

configuration.​journeystringrequired

The journey ID associated with the SSO clients group

configuration.​allowSilentLoginboolean

Whether silent login is allowed.

configuration.​sessionTimeoutnumber

Session timeout in seconds/minutes/hours/days/weeks (depending on value in session_timeout_granularity).

configuration.​sessionTimeoutGranularitystring

Session timeout granularity

Enum"seconds""minutes""hours""days""weeks"
curl -i -X PUT \
  'https://api.sbx.transmitsecurity.io/cis/v1/sso-service/sso-group/{groupId}' \
  -H 'Authorization: Bearer <YOUR_TOKEN_HERE>' \
  -H 'Content-Type: application/json' \
  -d '{
    "name": "My Clients Group",
    "description": "string",
    "configuration": {
      "journey": "string",
      "allowSilentLogin": true,
      "sessionTimeout": 0,
      "sessionTimeoutGranularity": "seconds"
    }
  }'

Responses

Bodyapplication/json
object
Response
application/json
{}

Delete clients group

Request

Deletes a clients group.

Required permissions: sso-service:edit, sso-service:delete.

Security
ClientAccessToken
Path
groupIdstringrequired

ID of the group to retrieve

curl -i -X DELETE \
  'https://api.sbx.transmitsecurity.io/cis/v1/sso-service/sso-group/{groupId}' \
  -H 'Authorization: Bearer <YOUR_TOKEN_HERE>'

Responses

Clients group deleted

Create SSO group client

Request

Creates a new client in the SSO clients group.

Required permissions: sso-service:edit.

Security
ClientAccessToken
Path
groupIdstringrequired

ID of the group to retrieve

Bodyapplication/jsonrequired
Any of:
namestringrequired

Name of the client

Example: "My Client"
descriptionstring

Short description of the client

resourcesArray of strings

List of resources IDs associated with this client

authentication_protocolstring

Authentication protocol used by the client

Default "oidc"
Enum"oidc""saml"
client_group_idstring

Id of client group to associate with

default_custom_claimsArray of strings

List of client default custom claims

Items Enum"tid""fname""lname""mname""email""email_verified""phone_number""phone_number_verified""groups""new_user"
short_cookies_samesite_typestring

Short cookies samesite type. Possible values: "none", "lax", "strict". Default: "lax"

Default "lax"
Enum"lax""none"
redirect_urisArray of stringsrequired

List of URIs approved for redirects for your client

Example: ["https://www.example.com/login"]
client_typestring

Client type

Default "web"
Enum"web""native"
device_authorizationobject

Configuration for an OAuth Device Authorization Flow

ciba_authorizationobject

CIBA authorization flow configuration

is_third_partyboolean

Is third party client

allowed_scopesArray of strings

Allowed scopes

consent_uristring

Consent URI

consent_validity_periodnumber

Consent validity period

pkcestring

PKCE configuration

Enum"enforcePkceInsteadOfClientCredentials""enforcePkceAlongsideClientCredentials""allowPkceAlongsideClientCredentials"
supported_promptsArray of strings

Supported prompts for the OIDC authentication flow

Items Enum"login""consent""none"
Example: ["login","consent","none"]
token_expirationobject

Token expiration settings

session_expirationnumber

Session expiration time (seconds)

enforce_parboolean

enforce PAR (Pushed Authorization Request) for this client

role_idsArray of strings

Role IDs

fapi_version_compliancyboolean

FAPI 2.0 compliancy configuration

response_typesArray of strings
Default ["code","id_token"]
Items Enum"code""id_token"
Example: ["code"]
authentication_configurationobject

Client authentication configuration

token_endpoint_auth_methodstringDeprecated

This field is deprecated- to configure pkce use "pkce" field instead

Default "client_secret_basic"
Enum"client_secret_basic""self_signed_tls_client_auth""tls_client_auth""none""private_key_jwt"
curl -i -X POST \
  'https://api.sbx.transmitsecurity.io/cis/v1/sso-service/sso-group/{groupId}/clients' \
  -H 'Authorization: Bearer <YOUR_TOKEN_HERE>' \
  -H 'Content-Type: application/json' \
  -d '{
    "name": "My Client",
    "description": "string",
    "resources": [
      "string"
    ],
    "authentication_protocol": "oidc",
    "client_group_id": "string",
    "default_custom_claims": [
      "tid"
    ],
    "short_cookies_samesite_type": "lax",
    "redirect_uris": [
      "https://www.example.com/login"
    ],
    "client_type": "web",
    "device_authorization": {
      "enabled": false,
      "approval_uri": "https://www.example.com/device/approval",
      "success_uri": "https://www.example.com/device/complete",
      "input_uri": "https://www.example.com/device/start"
    },
    "ciba_authorization": {
      "enabled": false,
      "login_uri": "https://www.example.com/ciba/login"
    },
    "is_third_party": true,
    "allowed_scopes": [
      "string"
    ],
    "consent_uri": "string",
    "consent_validity_period": 0,
    "pkce": "enforcePkceInsteadOfClientCredentials",
    "supported_prompts": [
      "login",
      "consent",
      "none"
    ],
    "token_expiration": {
      "access_token_ttl": 0,
      "refresh_token_ttl": 0,
      "max_refresh_rotate": 0
    },
    "session_expiration": 0,
    "enforce_par": true,
    "role_ids": [
      "string"
    ],
    "fapi_version_compliancy": true,
    "token_endpoint_auth_method": "client_secret_basic",
    "response_types": [
      "code"
    ],
    "authentication_configuration": {
      "method": "client_secret_basic",
      "tls_client_auth": {
        "certificate_chain": "string",
        "distinguished_name": 6,
        "ocsp_on": true,
        "ocsp_responder_uri": "string",
        "ocsp_responder_certificate": "string",
        "ocsp_fail_open": true
      },
      "isMtlsCertTokenBound": true,
      "jwks": {}
    }
  }'

Responses

Bodyapplication/json
resultobjectrequired
result.​client_idstringrequired

Client ID used for API requests

result.​client_secretstringrequired

Client secret used to obtain tokens for API authorization

result.​client_typestring

Client type

Enum"web""native"
result.​namestringrequired

Client name displayed in the Admin Portal

result.​pkcestring

PKCE configuration for client

Enum"enforcePkceInsteadOfClientCredentials""enforcePkceAlongsideClientCredentials""allowPkceAlongsideClientCredentials"
result.​descriptionstringrequired

Short description of your client, displayed in the Admin Portal

result.​resourcesArray of stringsrequired

List of resources this client is allowed to explicitly request access to

result.​created_atstring(date-time)required

Date the client was created

result.​updated_atstring(date-time)required

Date the client was last updated

result.​redirect_urisArray of strings

List of URIs approved for redirects for your client

result.​authentication_protocolstring

Authentication protocol used by the client

Enum"oidc""saml"
result.​is_third_partyboolean

Whether the client is a third-party client

result.​optional_acs_urlboolean

ACS URL for the SAML client

result.​sp_acs_urlstring

ACS URL for the SAML client

result.​sp_entity_idstring

Entity ID for the SAML client

result.​metadata_urlstring

SAML IDP metadata URL

result.​sso_urlstring

SAML SSO URL

result.​entity_idstring

SAML Entity ID

result.​x509_certificatestring

X.509 certificate

result.​default_custom_claimsArray of strings

List of all the custom claims the client wants to receive by default

Items Enum"tid""fname""lname""mname""email""email_verified""phone_number""phone_number_verified""groups""new_user"
Response
application/json
{
  "result": {
    "client_id": "string",
    "client_secret": "string",
    "client_type": "web",
    "name": "string",
    "pkce": "enforcePkceInsteadOfClientCredentials",
    "description": "string",
    "resources": [ … ],
    "created_at": "2019-08-24T14:15:22Z",
    "updated_at": "2019-08-24T14:15:22Z",
    "redirect_uris": [ … ],
    "authentication_protocol": "oidc",
    "is_third_party": true,
    "optional_acs_url": true,
    "sp_acs_url": "string",
    "sp_entity_id": "string",
    "metadata_url": "string",
    "sso_url": "string",
    "entity_id": "string",
    "x509_certificate": "string",
    "default_custom_claims": [ … ]
  }
}

Update client

Request

Updates a client within the SSO clients group by specifying it by its ID. Note: Fields that are objects cannot be partially updated, since the new value you set will just replace the current one.

Required permissions: sso-service:edit.

Security
ClientAccessToken
Path
groupIdstringrequired

ID of the group to retrieve

clientIdstringrequired

ID of the client to retrieve

Bodyapplication/jsonrequired
Any of:
namestring

Name of the client

Example: "My Client"
descriptionstring

Short description of the client

resourcesArray of strings

List of resources IDs associated with this client

client_group_idstring

Id of client group to associate with

default_custom_claimsArray of strings

List of client default custom claims

Items Enum"tid""fname""lname""mname""email""email_verified""phone_number""phone_number_verified""groups""new_user"
short_cookies_samesite_typestring

Short cookies samesite type. Possible values: "none", "lax", "strict". Default: "lax"

Default "lax"
Enum"lax""none"
redirect_urisArray of strings

List of URIs approved for redirects for your client

Example: ["https://www.example.com/login"]
client_typestring

Client type

Default "web"
Enum"web""native"
device_authorizationobject

Configuration for an OAuth Device Authorization Flow

ciba_authorizationobject

CIBA authorization flow configuration

is_third_partyboolean

Is third party client

allowed_scopesArray of strings

Allowed scopes

consent_uristring

Consent URI

consent_validity_periodnumber

Consent validity period

pkcestring

PKCE configuration

Enum"enforcePkceInsteadOfClientCredentials""enforcePkceAlongsideClientCredentials""allowPkceAlongsideClientCredentials"
supported_promptsArray of strings

Supported prompts for the OIDC authentication flow

Items Enum"login""consent""none"
Example: ["login","consent","none"]
token_expirationobject

Token expiration settings

session_expirationnumber

Session expiration time (seconds)

enforce_parboolean

enforce PAR (Pushed Authorization Request) for this client

role_idsArray of strings

Role IDs

fapi_version_compliancyboolean

FAPI 2.0 compliancy configuration

response_typesArray of strings
Default ["code","id_token"]
Items Enum"code""id_token"
Example: ["code"]
authentication_configurationobject

Client authentication configuration

token_endpoint_auth_methodstringDeprecated

This field is deprecated- to configure pkce use "pkce" field instead

Default "client_secret_basic"
Enum"client_secret_basic""self_signed_tls_client_auth""tls_client_auth""none""private_key_jwt"
curl -i -X PUT \
  'https://api.sbx.transmitsecurity.io/cis/v1/sso-service/sso-group/{groupId}/clients/{clientId}' \
  -H 'Authorization: Bearer <YOUR_TOKEN_HERE>' \
  -H 'Content-Type: application/json' \
  -d '{
    "name": "My Client",
    "description": "string",
    "resources": [
      "string"
    ],
    "client_group_id": "string",
    "default_custom_claims": [
      "tid"
    ],
    "short_cookies_samesite_type": "lax",
    "redirect_uris": [
      "https://www.example.com/login"
    ],
    "client_type": "web",
    "device_authorization": {
      "enabled": false,
      "approval_uri": "https://www.example.com/device/approval",
      "success_uri": "https://www.example.com/device/complete",
      "input_uri": "https://www.example.com/device/start"
    },
    "ciba_authorization": {
      "enabled": false,
      "login_uri": "https://www.example.com/ciba/login"
    },
    "is_third_party": true,
    "allowed_scopes": [
      "string"
    ],
    "consent_uri": "string",
    "consent_validity_period": 0,
    "pkce": "enforcePkceInsteadOfClientCredentials",
    "supported_prompts": [
      "login",
      "consent",
      "none"
    ],
    "token_expiration": {
      "access_token_ttl": 0,
      "refresh_token_ttl": 0,
      "max_refresh_rotate": 0
    },
    "session_expiration": 0,
    "enforce_par": true,
    "role_ids": [
      "string"
    ],
    "fapi_version_compliancy": true,
    "token_endpoint_auth_method": "client_secret_basic",
    "response_types": [
      "code"
    ],
    "authentication_configuration": {
      "method": "client_secret_basic",
      "tls_client_auth": {
        "certificate_chain": "string",
        "distinguished_name": 6,
        "ocsp_on": true,
        "ocsp_responder_uri": "string",
        "ocsp_responder_certificate": "string",
        "ocsp_fail_open": true
      },
      "isMtlsCertTokenBound": true,
      "jwks": {}
    }
  }'

Responses

Bodyapplication/json
resultobjectrequired
result.​client_idstringrequired

Client ID used for API requests

result.​client_secretstringrequired

Client secret used to obtain tokens for API authorization

result.​client_typestring

Client type

Enum"web""native"
result.​namestringrequired

Client name displayed in the Admin Portal

result.​pkcestring

PKCE configuration for client

Enum"enforcePkceInsteadOfClientCredentials""enforcePkceAlongsideClientCredentials""allowPkceAlongsideClientCredentials"
result.​descriptionstringrequired

Short description of your client, displayed in the Admin Portal

result.​resourcesArray of stringsrequired

List of resources this client is allowed to explicitly request access to

result.​created_atstring(date-time)required

Date the client was created

result.​updated_atstring(date-time)required

Date the client was last updated

result.​redirect_urisArray of strings

List of URIs approved for redirects for your client

result.​authentication_protocolstring

Authentication protocol used by the client

Enum"oidc""saml"
result.​is_third_partyboolean

Whether the client is a third-party client

result.​optional_acs_urlboolean

ACS URL for the SAML client

result.​sp_acs_urlstring

ACS URL for the SAML client

result.​sp_entity_idstring

Entity ID for the SAML client

result.​metadata_urlstring

SAML IDP metadata URL

result.​sso_urlstring

SAML SSO URL

result.​entity_idstring

SAML Entity ID

result.​x509_certificatestring

X.509 certificate

result.​default_custom_claimsArray of strings

List of all the custom claims the client wants to receive by default

Items Enum"tid""fname""lname""mname""email""email_verified""phone_number""phone_number_verified""groups""new_user"
Response
application/json
{
  "result": {
    "client_id": "string",
    "client_secret": "string",
    "client_type": "web",
    "name": "string",
    "pkce": "enforcePkceInsteadOfClientCredentials",
    "description": "string",
    "resources": [ … ],
    "created_at": "2019-08-24T14:15:22Z",
    "updated_at": "2019-08-24T14:15:22Z",
    "redirect_uris": [ … ],
    "authentication_protocol": "oidc",
    "is_third_party": true,
    "optional_acs_url": true,
    "sp_acs_url": "string",
    "sp_entity_id": "string",
    "metadata_url": "string",
    "sso_url": "string",
    "entity_id": "string",
    "x509_certificate": "string",
    "default_custom_claims": [ … ]
  }
}

Delete client

Request

Deletes a client and removes it from the SSO client group.

Required permissions: sso-service:edit, sso-service:delete.

Security
ClientAccessToken
Path
groupIdstringrequired

ID of the group to retrieve

clientIdstringrequired

ID of the client to delete

curl -i -X DELETE \
  'https://api.sbx.transmitsecurity.io/cis/v1/sso-service/sso-group/{groupId}/clients/{clientId}' \
  -H 'Authorization: Bearer <YOUR_TOKEN_HERE>'

Responses

Response
No content