Create SSO group client

Request

Creates a new client in the SSO clients group.

Required permissions: sso-service:edit.

Security

ClientAccessToken

Path

groupIdstringrequired

ID of the group to retrieve

Bodyapplication/jsonrequired

Any of:

namestringrequired

Name of the client

Example:"My Client"

descriptionstring

Short description of the client

resourcesArray of strings

List of resources IDs associated with this client

authentication_protocolstring

Authentication protocol used by the client

Default:"oidc"

Enum:"oidc""saml"

client_group_idstring

Id of client group to associate with

default_custom_claimsArray of strings

List of client default custom claims

Items Enum:"tid""fname""lname""mname""email""email_verified""phone_number""phone_number_verified""groups""new_user"

default_user_info_claimsArray of strings

List of client default custom claims returned by the UserInfo endpoint. Mutually exclusive with sync_id_token_claims_to_userinfo=true in the same request.

Items Enum:"tid""fname""lname""mname""email""email_verified""phone_number""phone_number_verified""groups""new_user"

sync_id_token_claims_to_userinfoboolean

When true, UserInfo custom claims are kept in sync with default_custom_claims (the ID Token list). Mutually exclusive with explicit default_user_info_claims in the same request.

Default:false

short_cookies_samesite_typestring

Short cookies samesite type. Possible values: "none", "lax", "strict". Default: "lax"

Default:"lax"

Enum:"lax""none"

redirect_urisArray of strings

List of URIs approved for redirects for your client

Example:

[
  "https://www.example.com/login"
]

client_typestring

Client type

Default:"web"

Enum:"web""native"

device_authorizationobject

Configuration for an OAuth Device Authorization Flow

ciba_authorizationobject

CIBA authorization flow configuration

is_third_partyboolean

Is third party client

allowed_scopesArray of strings

Allowed scopes

consent_uristring

Consent URI

consent_validity_periodnumber

Consent validity period

pkcestring

PKCE configuration

Enum:"enforcePkceInsteadOfClientCredentials""enforcePkceAlongsideClientCredentials""allowPkceAlongsideClientCredentials"

supported_promptsArray of strings

Supported prompts for the OIDC authentication flow

Items Enum:"login""consent""none"

Example:

[
  "login",
  "consent",
  "none"
]

token_expirationobject

Token expiration settings

session_expirationnumber

Session expiration time (seconds)

enforce_parboolean

enforce PAR (Pushed Authorization Request) for this client

role_idsArray of strings

Role IDs

fapi_version_compliancyboolean

FAPI 2.0 compliancy configuration

response_typesArray of strings

Default:["code","id_token"]

Items Enum:"code""id_token"

Example:

[
  "code"
]

authentication_configurationobject

Client authentication configuration

id_token_encryptionobject

ID Token encryption configuration

token_endpoint_auth_methodstringdeprecated

This field is deprecated- to configure pkce use "pkce" field instead

Default:"client_secret_basic"

Enum:"client_secret_basic""self_signed_tls_client_auth""tls_client_auth""none""private_key_jwt"

curl -i -X POST \
  'https://api.sbx.transmitsecurity.io/cis/v1/sso-service/sso-group/{groupId}/clients' \
  -H 'Authorization: Bearer <YOUR_TOKEN_HERE>' \
  -H 'Content-Type: application/json' \
  -d '{
    "name": "My Client",
    "description": "string",
    "resources": [
      "string"
    ],
    "authentication_protocol": "oidc",
    "client_group_id": "string",
    "default_custom_claims": [
      "tid"
    ],
    "default_user_info_claims": [
      "tid"
    ],
    "sync_id_token_claims_to_userinfo": false,
    "short_cookies_samesite_type": "lax",
    "redirect_uris": [
      "https://www.example.com/login"
    ],
    "client_type": "web",
    "device_authorization": {
      "enabled": false,
      "approval_uri": "https://www.example.com/device/approval",
      "success_uri": "https://www.example.com/device/complete",
      "input_uri": "https://www.example.com/device/start"
    },
    "ciba_authorization": {
      "enabled": false,
      "login_uri": "https://www.example.com/ciba/login"
    },
    "is_third_party": true,
    "allowed_scopes": [
      "string"
    ],
    "consent_uri": "string",
    "consent_validity_period": 0,
    "pkce": "enforcePkceInsteadOfClientCredentials",
    "supported_prompts": [
      "login",
      "consent",
      "none"
    ],
    "token_expiration": {
      "access_token_ttl": 0,
      "refresh_token_ttl": 0,
      "max_refresh_rotate": 0
    },
    "session_expiration": 0,
    "enforce_par": true,
    "role_ids": [
      "string"
    ],
    "fapi_version_compliancy": true,
    "token_endpoint_auth_method": "client_secret_basic",
    "response_types": [
      "code"
    ],
    "authentication_configuration": {
      "method": "client_secret_basic",
      "tls_client_auth": {
        "certificate_chain": "string",
        "distinguished_name": 6,
        "ocsp_on": true,
        "ocsp_responder_uri": "string",
        "ocsp_responder_certificate": "string",
        "ocsp_fail_open": true
      },
      "isMtlsCertTokenBound": true,
      "jwks": {}
    },
    "id_token_encryption": {
      "enabled": false,
      "jwks": {}
    }
  }'

Responses

Bodyapplication/json

resultobjectrequired

Response

{
  "result": {
    "client_id": "string",
    "client_secret": "string",
    "client_type": "web",
    "name": "string",
    "pkce": "enforcePkceInsteadOfClientCredentials",
    "description": "string",
    "resources": [ … ],
    "created_at": "2019-08-24T14:15:22Z",
    "updated_at": "2019-08-24T14:15:22Z",
    "redirect_uris": [ … ],
    "authentication_protocol": "oidc",
    "is_third_party": true,
    "optional_acs_url": true,
    "sp_acs_url": "string",
    "sp_entity_id": "string",
    "metadata_url": "string",
    "sso_url": "string",
    "entity_id": "string",
    "x509_certificate": "string",
    "default_custom_claims": [ … ]
  }
}