# Update client

Updates a client within the SSO clients group by specifying it by its ID. Note: Fields that are objects cannot be partially updated, since the new value you set will just replace the current one. <br><br>**Required permissions**: `sso-service:edit`.

Endpoint: PUT /v1/sso-service/sso-group/{groupId}/clients/{clientId}
Security: ClientAccessToken

## Path parameters:

  - `groupId` (string, required)
    ID of the group to retrieve

  - `clientId` (string, required)
    ID of the client to retrieve

## Request fields (application/json):

  - `name` (string)
    Name of the client
    Example: My Client

  - `description` (string)
    Short description of the client

  - `resources` (array)
    List of resources IDs associated with this client

  - `client_group_id` (string)
    Id of client group to associate with

  - `default_custom_claims` (array)
    List of client default custom claims

  - `default_user_info_claims` (array)
    List of client default custom claims returned by the UserInfo endpoint. Mutually exclusive with sync_id_token_claims_to_userinfo=true in the same request.

  - `sync_id_token_claims_to_userinfo` (boolean)
    When true, UserInfo custom claims are kept in sync with default_custom_claims (the ID Token list). Mutually exclusive with explicit default_user_info_claims in the same request.

  - `short_cookies_samesite_type` (string)
    Short cookies samesite type. Possible values: "none", "lax", "strict". Default: "lax"
    Enum: "lax", "none"

  - `redirect_uris` (array)
    List of URIs approved for redirects for your client
    Example: ["https://www.example.com/login"]

  - `client_type` (string)
    Client type
    Enum: "web", "native"

  - `device_authorization` (object)
    Configuration for an [OAuth Device Authorization Flow](https://www.rfc-editor.org/rfc/rfc8628)

  - `device_authorization.enabled` (boolean, required)
    Determines if the client is allowed to use the OAuth device authorization flow

  - `device_authorization.approval_uri` (string, required)
    The URI of the page that allows the user to approve the access request
    Example: https://www.example.com/device/approval

  - `device_authorization.success_uri` (string, required)
    Callback URI that receives an indication of whether the end-user authentication was completed successfully.
    Example: https://www.example.com/device/complete

  - `device_authorization.input_uri` (string, required)
    The URI of the page that allows the user to enter the code
    Example: https://www.example.com/device/start

  - `ciba_authorization` (object)
    CIBA authorization flow configuration

  - `ciba_authorization.enabled` (boolean, required)
    Determines if the client is allowed to use the OAuth CIBA authorization flow

  - `ciba_authorization.login_uri` (string)
    The URI of the page that allows the user to log-in and verify the access request
    Example: https://www.example.com/ciba/login

  - `is_third_party` (boolean)
    Is third party client

  - `allowed_scopes` (array)
    Allowed scopes

  - `consent_uri` (string)
    Consent URI

  - `consent_validity_period` (number)
    Consent validity period

  - `pkce` (string)
    PKCE configuration
    Enum: "enforcePkceInsteadOfClientCredentials", "enforcePkceAlongsideClientCredentials", "allowPkceAlongsideClientCredentials"

  - `supported_prompts` (array)
    Supported prompts for the OIDC authentication flow
    Example: ["login","consent","none"]

  - `token_expiration` (object)
    Token expiration settings

  - `token_expiration.access_token_ttl` (number)
    Access token time-to-live

  - `token_expiration.refresh_token_ttl` (number)
    Refresh token time-to-live

  - `token_expiration.max_refresh_rotate` (number)
    Maximum time the refresh token can be rotated

  - `session_expiration` (number)
    Session expiration time (seconds)

  - `enforce_par` (boolean)
    enforce PAR (Pushed Authorization Request) for this client

  - `role_ids` (array)
    Role IDs

  - `fapi_version_compliancy` (boolean)
    FAPI 2.0 compliancy configuration

  - `token_endpoint_auth_method` (string)
    This field is deprecated- to configure pkce use "pkce" field instead
    Enum: "client_secret_basic", "self_signed_tls_client_auth", "tls_client_auth", "none", "private_key_jwt"

  - `response_types` (array)
    Example: ["code"]

  - `authentication_configuration` (object)
    Client authentication configuration

  - `authentication_configuration.method` (string, required)
    Client authentication method
    Enum: "client_secret_basic", "self_signed_tls_client_auth", "tls_client_auth", "private_key_jwt"

  - `authentication_configuration.tls_client_auth` (object)
    TLS client authentication configuration for mTLS

  - `authentication_configuration.tls_client_auth.certificate_chain` (string)
    Certificate chain including intermediate CA certificates used for client certificate validation

  - `authentication_configuration.tls_client_auth.distinguished_name` (number)
    The length of the generated OTP code. Must be between 4 and 8.
    Example: 6

  - `authentication_configuration.tls_client_auth.ocsp_on` (boolean)
    Enables OCSP (Online Certificate Status Protocol) verification

  - `authentication_configuration.tls_client_auth.ocsp_responder_uri` (string)
    OCSP responder URI

  - `authentication_configuration.tls_client_auth.ocsp_responder_certificate` (string)
    OCSP responder certificate used for signature verification

  - `authentication_configuration.tls_client_auth.ocsp_fail_open` (boolean)
    OCSP fail-open

  - `authentication_configuration.isMtlsCertTokenBound` (boolean)
    States whether to bind the access token to the client certificate when mTLS is enabled

  - `authentication_configuration.jwks` (object)
    A set of JWK keys containing the public keys for the Client to use for authentication

  - `id_token_encryption` (object)
    ID Token encryption configuration

  - `id_token_encryption.enabled` (boolean, required)
    Determines if ID token encryption is enabled for the client

  - `id_token_encryption.jwks` (object)
    A set of JWK keys containing the public keys for the client to use for ID token encryption

  - `sp_acs_url` (string)
    SAML ACS URL

  - `sp_entity_id` (string)
    SAML Service provider entity ID

  - `sp_name_id_type` (string)
    SAML Name ID Type
    Enum: "email", "secondaryEmail", "username", "phoneNumber", "externalUserId"

  - `sign_assertion` (boolean)
    Sign SAML assertion

  - `optional_acs_url` (boolean)
    Allow ACS URL to be optional

  - `use_centralized_login` (boolean)
    When enabled, SAML SP-initiated SSO redirects to the tenant centralized hub application instead of hosted login

## Response 200 fields (application/json):

  - `result` (object, required)

  - `result.client_id` (string, required)
    Client ID used for API requests

  - `result.client_secret` (string, required)
    Client secret used to obtain tokens for API authorization

  - `result.client_type` (string)
    Client type
    Enum: "web", "native"

  - `result.name` (string, required)
    Client name displayed in the Admin Portal

  - `result.pkce` (string)
    PKCE configuration for client
    Enum: "enforcePkceInsteadOfClientCredentials", "enforcePkceAlongsideClientCredentials", "allowPkceAlongsideClientCredentials"

  - `result.description` (string)
    Short description of your client, displayed in the Admin Portal

  - `result.resources` (array, required)
    List of resources this client is allowed to explicitly request access to

  - `result.created_at` (string, required)
    Date the client was created

  - `result.updated_at` (string, required)
    Date the client was last updated

  - `result.redirect_uris` (array)
    List of URIs approved for redirects for your client

  - `result.authentication_protocol` (string)
    Authentication protocol used by the client
    Enum: "oidc", "saml"

  - `result.is_third_party` (boolean)
    Whether the client is a third-party client

  - `result.optional_acs_url` (boolean)
    ACS URL for the SAML client

  - `result.sp_acs_url` (string)
    ACS URL for the SAML client

  - `result.sp_entity_id` (string)
    Entity ID for the SAML client

  - `result.metadata_url` (string)
    SAML IDP metadata URL

  - `result.sso_url` (string)
    SAML SSO URL

  - `result.entity_id` (string)
    SAML Entity ID

  - `result.x509_certificate` (string)
    X.509 certificate

  - `result.default_custom_claims` (array)
    List of all the custom claims the client wants to receive by default

## Response 404 fields (application/json):

  - `message` (string, required)

  - `error_code` (number, required)
    Example: 404