Skip to content

SSO Clients Groups

Configure Mosaic SSO Service to streamline login for users. Create and manage SSO clients group to control your SSO login experience.

Download OpenAPI description
sso-clients-groups.openapi.json
sso-clients-groups.openapi.yaml
Languages
Servers
Sandbox environment
https://api.sbx.transmitsecurity.io/cis/
Production environment (US)
https://api.transmitsecurity.io/cis/
Production environment (EU)
https://api.eu.transmitsecurity.io/cis/
Production environment (CA)
https://api.ca.transmitsecurity.io/cis/
Production environment (AU)
https://api.au.transmitsecurity.io/cis/

Create clients group

Request

Creates a new SSO clients group.

Required permissions: sso-service:edit.

Security
ClientAccessToken
Bodyapplication/jsonrequired
namestringrequired

Name of the clients group

Example: "My Clients Group"
descriptionstring

Short description of the clients group

configurationobjectrequired
configuration.​journeystringrequired

The journey ID associated with the SSO clients group

configuration.​allowSilentLoginboolean

Whether silent login is allowed.

configuration.​sessionTimeoutnumber

Session timeout in seconds/minutes/hours/days/weeks (depending on value in session_timeout_granularity).

configuration.​sessionTimeoutGranularitystring

Session timeout granularity

Enum"seconds""minutes""hours""days""weeks"
curl -i -X POST \
  https://api.sbx.transmitsecurity.io/cis/v1/sso-service/sso-group \
  -H 'Authorization: Bearer <YOUR_TOKEN_HERE>' \
  -H 'Content-Type: application/json' \
  -d '{
    "name": "My Clients Group",
    "description": "string",
    "configuration": {
      "journey": "string",
      "allowSilentLogin": true,
      "sessionTimeout": 0,
      "sessionTimeoutGranularity": "seconds"
    }
  }'

Responses

Bodyapplication/json
resultobjectrequired
result.​app_idstringrequired

Application ID

result.​tenant_idstringrequired

Tenant ID

result.​app_namestringrequired

Application name displayed in the Admin Portal

result.​app_descriptionstringrequired

Short description of your application, displayed in the Admin Portal

result.​logostringrequired

URI of your application's logo, such as for email templates

result.​login_preferencesobjectrequired
result.​login_preferences.​auth_methodsobjectrequired
result.​login_preferences.​auth_methods.​googleobject
result.​login_preferences.​auth_methods.​facebookobject
result.​login_preferences.​auth_methods.​emailobject
result.​login_preferences.​auth_methods.​email_otpobject
result.​login_preferences.​auth_methods.​appleobject
result.​login_preferences.​auth_methods.​smsobject
result.​login_preferences.​auth_methods.​webauthn_apiobject
result.​login_preferences.​auth_methods.​lineobject
result.​login_preferences.​auth_methods.​passwordobject
result.​login_preferences.​auth_methods.​totpobject
result.​login_preferences.​auth_methods.​pushobject
result.​login_preferences.​auth_methods.​tiktokobject
result.​login_preferences.​auth_methods.​pin_authenticatorobject
result.​login_preferences.​auth_methods.​faceobject
result.​created_atstring(date-time)required

Date the application was created

result.​created_bystringrequired

The user that created the application

result.​updated_atstring(date-time)required

Date the application was last updated

result.​service_providersArray of stringsrequired

List of service providers this application is allowed to explicitly redirect to

result.​authenticator_preferencesobjectrequired
result.​authenticator_preferences.​is_centralizedbooleanrequired

Indicates whether to set the application as the Authentication Hub for this tenant

Default false
result.​authenticator_preferences.​login_uristringrequired

URI of the application that will initiate an authentication flow when centralized login is requested

Example: "https://www.example.com/login"
result.​allow_public_signupbooleanrequired

Determines if the application is allowed to request to create new users via login flows

result.​pkcestring

PKCE configuration

Enum"enforcePkceInsteadOfClientCredentials""enforcePkceAlongsideClientCredentials""allowPkceAlongsideClientCredentials"
result.​password_sharing_group_idstring

If the app has opted in to password sharing, this identifies the group of apps that it shares passwords with.

result.​login_uristring

URI used to redirect the user to the login page of the application (when needed)

Example: "https://www.example.com/login"
result.​invite_member_uristring

URI used to redirect the member to the login page of the application (when needed)

Example: "https://www.example.com/login"
result.​invite_client_idstring

Client used for the email magic link invitation flow

result.​subdomainstring

Subdomain of Org admin portal that can be offered for organizations to manage their users (when needed)

Example: "myapp"
result.​invite_member_email_expiration_minutesnumber

Member invite email link expiration in minutes

Default 2880
result.​custom_domainobject
result.​external_communicationobject
result.​signing_key_enabledboolean

Determines if application specific signing key is enabled

result.​refresh_token_invalidation_trigger_configurationobject
result.​client_typestringDeprecated

Type of the default client

Default "web"
Enum"web""native"
result.​client_idstringDeprecated

Client ID of the default client used for API requests

result.​client_display_namestringDeprecated

Client name of the default client to display when needed

result.​client_descriptionstringDeprecated

Short description of the default client

result.​client_secretstringDeprecated

Client secret of the default client used to obtain tokens for API authorization

result.​redirect_urisArray of stringsDeprecated

List of URI approved for redirects for your default client

result.​resourcesArray of stringsDeprecated

List of resources the default client is allowed to explicitly request access to

result.​client_auth_methodstringDeprecated

This field is deprecated- to configure pkce use "pkce" field instead

Enum"client_secret_basic""self_signed_tls_client_auth""tls_client_auth""none""private_key_jwt"
result.​device_authorizationobjectDeprecated
result.​ciba_authorizationobjectDeprecated
Response
application/json
{
  "result": {
    "app_id": "string",
    "tenant_id": "string",
    "app_name": "string",
    "app_description": "string",
    "client_type": "web",
    "logo": "string",
    "client_id": "string",
    "client_display_name": "string",
    "client_description": "string",
    "client_secret": "string",
    "redirect_uris": [ … ],
    "login_preferences": { … },
    "created_at": "2019-08-24T14:15:22Z",
    "created_by": "string",
    "updated_at": "2019-08-24T14:15:22Z",
    "resources": [ … ],
    "service_providers": [ … ],
    "authenticator_preferences": { … },
    "allow_public_signup": true,
    "client_auth_method": "client_secret_basic",
    "pkce": "enforcePkceInsteadOfClientCredentials",
    "device_authorization": { … },
    "ciba_authorization": { … },
    "password_sharing_group_id": "string",
    "login_uri": "https://www.example.com/login",
    "invite_member_uri": "https://www.example.com/login",
    "invite_client_id": "string",
    "subdomain": "myapp",
    "invite_member_email_expiration_minutes": 2880,
    "custom_domain": { … },
    "external_communication": { … },
    "signing_key_enabled": true,
    "refresh_token_invalidation_trigger_configuration": { … }
  }
}

Get all clients groups

Request

Retrieves a list of all clients groups.

Required permissions: sso-service:read.

Security
ClientAccessToken
curl -i -X GET \
  https://api.sbx.transmitsecurity.io/cis/v1/sso-service/sso-group \
  -H 'Authorization: Bearer <YOUR_TOKEN_HERE>'

Responses

Bodyapplication/json
resultArray of objectsrequired
result[].​idstringrequired

ID of the SSO group

result[].​namestringrequired

Name of the SSO group

result[].​descriptionstringrequired

Short description of the SSO group

result[].​configurationobjectrequired
result[].​configuration.​journeystringrequired

Name of the journey to run within the SSO group.

result[].​configuration.​sessionTimeoutnumberrequired

The time in seconds/minutes/hours/days/weeks after which the session will expire. Default in seconds.

result[].​configuration.​allowSilentLoginbooleanrequired

Whether silent login is allowed.

result[].​configuration.​sessionTimeoutGranularitystringrequired

Session timeout granularity

Enum"seconds""minutes""hours""days""weeks"
result[].​clientsArray of objectsrequired

List of clients in the SSO group

result[].​clients[].​client_idstringrequired

Client ID used for API requests

result[].​clients[].​client_secretstringrequired

Client secret used to obtain tokens for API authorization

result[].​clients[].​client_typestring

Client type

Enum"web""native"
result[].​clients[].​namestringrequired

Client name displayed in the Admin Portal

result[].​clients[].​pkcestring

PKCE configuration for client

Enum"enforcePkceInsteadOfClientCredentials""enforcePkceAlongsideClientCredentials""allowPkceAlongsideClientCredentials"
result[].​clients[].​descriptionstringrequired

Short description of your client, displayed in the Admin Portal

result[].​clients[].​resourcesArray of stringsrequired

List of resources this client is allowed to explicitly request access to

result[].​clients[].​created_atstring(date-time)required

Date the client was created

result[].​clients[].​updated_atstring(date-time)required

Date the client was last updated

result[].​clients[].​redirect_urisArray of strings

List of URIs approved for redirects for your client

result[].​clients[].​authentication_protocolstring

Authentication protocol used by the client

Enum"oidc""saml"
result[].​clients[].​is_third_partyboolean

Whether the client is a third-party client

result[].​clients[].​optional_acs_urlboolean

ACS URL for the SAML client

result[].​clients[].​sp_acs_urlstring

ACS URL for the SAML client

result[].​clients[].​sp_entity_idstring

Entity ID for the SAML client

result[].​clients[].​metadata_urlstring

SAML IDP metadata URL

result[].​clients[].​sso_urlstring

SAML SSO URL

result[].​clients[].​entity_idstring

SAML Entity ID

result[].​clients[].​x509_certificatestring

X.509 certificate

result[].​clients[].​default_custom_claimsArray of strings

List of all the custom claims the client wants to receive by default

Items Enum"tid""fname""lname""mname""email""email_verified""phone_number""phone_number_verified""groups""new_user"
Response
application/json
{
  "result": [
    { … }
  ]
}

Get clients group by ID

Request

Retrieves a clients group by its ID. The clients group ID is a unique identifier for a clients group.

Required permissions: sso-service:read.

Security
ClientAccessToken
Path
groupIdstringrequired

ID of the group to retrieve

curl -i -X GET \
  'https://api.sbx.transmitsecurity.io/cis/v1/sso-service/sso-group/{groupId}' \
  -H 'Authorization: Bearer <YOUR_TOKEN_HERE>'

Responses

Bodyapplication/json
resultobjectrequired
result.​idstringrequired

ID of the SSO group

result.​namestringrequired

Name of the SSO group

result.​descriptionstringrequired

Short description of the SSO group

result.​configurationobjectrequired
result.​configuration.​journeystringrequired

Name of the journey to run within the SSO group.

result.​configuration.​sessionTimeoutnumberrequired

The time in seconds/minutes/hours/days/weeks after which the session will expire. Default in seconds.

result.​configuration.​allowSilentLoginbooleanrequired

Whether silent login is allowed.

result.​configuration.​sessionTimeoutGranularitystringrequired

Session timeout granularity

Enum"seconds""minutes""hours""days""weeks"
result.​clientsArray of objectsrequired

List of clients in the SSO group

result.​clients[].​client_idstringrequired

Client ID used for API requests

result.​clients[].​client_secretstringrequired

Client secret used to obtain tokens for API authorization

result.​clients[].​client_typestring

Client type

Enum"web""native"
result.​clients[].​namestringrequired

Client name displayed in the Admin Portal

result.​clients[].​pkcestring

PKCE configuration for client

Enum"enforcePkceInsteadOfClientCredentials""enforcePkceAlongsideClientCredentials""allowPkceAlongsideClientCredentials"
result.​clients[].​descriptionstringrequired

Short description of your client, displayed in the Admin Portal

result.​clients[].​resourcesArray of stringsrequired

List of resources this client is allowed to explicitly request access to

result.​clients[].​created_atstring(date-time)required

Date the client was created

result.​clients[].​updated_atstring(date-time)required

Date the client was last updated

result.​clients[].​redirect_urisArray of strings

List of URIs approved for redirects for your client

result.​clients[].​authentication_protocolstring

Authentication protocol used by the client

Enum"oidc""saml"
result.​clients[].​is_third_partyboolean

Whether the client is a third-party client

result.​clients[].​optional_acs_urlboolean

ACS URL for the SAML client

result.​clients[].​sp_acs_urlstring

ACS URL for the SAML client

result.​clients[].​sp_entity_idstring

Entity ID for the SAML client

result.​clients[].​metadata_urlstring

SAML IDP metadata URL

result.​clients[].​sso_urlstring

SAML SSO URL

result.​clients[].​entity_idstring

SAML Entity ID

result.​clients[].​x509_certificatestring

X.509 certificate

result.​clients[].​default_custom_claimsArray of strings

List of all the custom claims the client wants to receive by default

Items Enum"tid""fname""lname""mname""email""email_verified""phone_number""phone_number_verified""groups""new_user"
Response
application/json
{
  "result": {
    "id": "string",
    "name": "string",
    "description": "string",
    "configuration": { … },
    "clients": [ … ]
  }
}

Update clients group

Request

Updates an existing clients group. The clients group ID is a unique identifier for a clients group.

Required permissions: sso-service:edit.

Security
ClientAccessToken
Path
groupIdstringrequired

ID of the group to retrieve

Bodyapplication/jsonrequired
namestringrequired

Name of the clients group

Example: "My Clients Group"
descriptionstring

Short description of the clients group

configurationobjectrequired
configuration.​journeystringrequired

The journey ID associated with the SSO clients group

configuration.​allowSilentLoginboolean

Whether silent login is allowed.

configuration.​sessionTimeoutnumber

Session timeout in seconds/minutes/hours/days/weeks (depending on value in session_timeout_granularity).

configuration.​sessionTimeoutGranularitystring

Session timeout granularity

Enum"seconds""minutes""hours""days""weeks"
curl -i -X PUT \
  'https://api.sbx.transmitsecurity.io/cis/v1/sso-service/sso-group/{groupId}' \
  -H 'Authorization: Bearer <YOUR_TOKEN_HERE>' \
  -H 'Content-Type: application/json' \
  -d '{
    "name": "My Clients Group",
    "description": "string",
    "configuration": {
      "journey": "string",
      "allowSilentLogin": true,
      "sessionTimeout": 0,
      "sessionTimeoutGranularity": "seconds"
    }
  }'

Responses

Bodyapplication/json
object
Response
application/json
{}

Delete clients group

Request

Deletes a clients group.

Required permissions: sso-service:edit, sso-service:delete.

Security
ClientAccessToken
Path
groupIdstringrequired

ID of the group to retrieve

curl -i -X DELETE \
  'https://api.sbx.transmitsecurity.io/cis/v1/sso-service/sso-group/{groupId}' \
  -H 'Authorization: Bearer <YOUR_TOKEN_HERE>'

Responses

Clients group deleted

Create SSO group client

Request

Creates a new client in the SSO clients group.

Required permissions: sso-service:edit.

Security
ClientAccessToken
Path
groupIdstringrequired

ID of the group to retrieve

Bodyapplication/jsonrequired
Any of:
namestringrequired

Name of the client

Example: "My Client"
descriptionstring

Short description of the client

resourcesArray of strings

List of resources IDs associated with this client

authentication_protocolstring

Authentication protocol used by the client

Default "oidc"
Enum"oidc""saml"
client_group_idstring

Id of client group to associate with

default_custom_claimsArray of strings

List of client default custom claims

Items Enum"tid""fname""lname""mname""email""email_verified""phone_number""phone_number_verified""groups""new_user"
short_cookies_samesite_typestring

Short cookies samesite type. Possible values: "none", "lax", "strict". Default: "lax"

Default "lax"
Enum"lax""none"
redirect_urisArray of stringsrequired

List of URIs approved for redirects for your client

Example: ["https://www.example.com/login"]
client_typestring

Client type

Default "web"
Enum"web""native"
device_authorizationobject
ciba_authorizationobject
is_third_partyboolean

Is third party client

allowed_scopesArray of strings

Allowed scopes

consent_uristring

Consent URI

consent_validity_periodnumber

Consent validity period

pkcestring

PKCE configuration

Enum"enforcePkceInsteadOfClientCredentials""enforcePkceAlongsideClientCredentials""allowPkceAlongsideClientCredentials"
supported_promptsArray of strings

Supported prompts for the OIDC authentication flow

Items Enum"login""consent""none"
Example: ["login","consent","none"]
token_expirationobject
session_expirationnumber

Session expiration time (seconds)

enforce_parboolean

enforce PAR (Pushed Authorization Request) for this client

role_idsArray of strings

Role IDs

fapi_version_compliancyboolean

FAPI 2.0 compliancy configuration

response_typesArray of strings
Default ["code","id_token"]
Items Enum"code""id_token"
Example: ["code"]
authentication_configurationobject
token_endpoint_auth_methodstringDeprecated

This field is deprecated- to configure pkce use "pkce" field instead

Default "client_secret_basic"
Enum"client_secret_basic""self_signed_tls_client_auth""tls_client_auth""none""private_key_jwt"
curl -i -X POST \
  'https://api.sbx.transmitsecurity.io/cis/v1/sso-service/sso-group/{groupId}/clients' \
  -H 'Authorization: Bearer <YOUR_TOKEN_HERE>' \
  -H 'Content-Type: application/json' \
  -d '{
    "name": "My Client",
    "description": "string",
    "resources": [
      "string"
    ],
    "authentication_protocol": "oidc",
    "client_group_id": "string",
    "default_custom_claims": [
      "tid"
    ],
    "short_cookies_samesite_type": "lax",
    "redirect_uris": [
      "https://www.example.com/login"
    ],
    "client_type": "web",
    "device_authorization": {
      "enabled": false,
      "approval_uri": "https://www.example.com/device/approval",
      "success_uri": "https://www.example.com/device/complete",
      "input_uri": "https://www.example.com/device/start"
    },
    "ciba_authorization": {
      "enabled": false,
      "login_uri": "https://www.example.com/ciba/login"
    },
    "is_third_party": true,
    "allowed_scopes": [
      "string"
    ],
    "consent_uri": "string",
    "consent_validity_period": 0,
    "pkce": "enforcePkceInsteadOfClientCredentials",
    "supported_prompts": [
      "login",
      "consent",
      "none"
    ],
    "token_expiration": {
      "access_token_ttl": 0,
      "refresh_token_ttl": 0,
      "max_refresh_rotate": 0
    },
    "session_expiration": 0,
    "enforce_par": true,
    "role_ids": [
      "string"
    ],
    "fapi_version_compliancy": true,
    "token_endpoint_auth_method": "client_secret_basic",
    "response_types": [
      "code"
    ],
    "authentication_configuration": {
      "method": "client_secret_basic",
      "tls_client_auth": {
        "certificate_chain": "string",
        "distinguished_name": 6,
        "ocsp_on": true,
        "ocsp_responder_uri": "string",
        "ocsp_responder_certificate": "string",
        "ocsp_fail_open": true
      },
      "isMtlsCertTokenBound": true,
      "jwks": {}
    }
  }'

Responses

Bodyapplication/json
resultobjectrequired
result.​client_idstringrequired

Client ID used for API requests

result.​client_secretstringrequired

Client secret used to obtain tokens for API authorization

result.​client_typestring

Client type

Enum"web""native"
result.​namestringrequired

Client name displayed in the Admin Portal

result.​pkcestring

PKCE configuration for client

Enum"enforcePkceInsteadOfClientCredentials""enforcePkceAlongsideClientCredentials""allowPkceAlongsideClientCredentials"
result.​descriptionstringrequired

Short description of your client, displayed in the Admin Portal

result.​resourcesArray of stringsrequired

List of resources this client is allowed to explicitly request access to

result.​created_atstring(date-time)required

Date the client was created

result.​updated_atstring(date-time)required

Date the client was last updated

result.​redirect_urisArray of strings

List of URIs approved for redirects for your client

result.​authentication_protocolstring

Authentication protocol used by the client

Enum"oidc""saml"
result.​is_third_partyboolean

Whether the client is a third-party client

result.​optional_acs_urlboolean

ACS URL for the SAML client

result.​sp_acs_urlstring

ACS URL for the SAML client

result.​sp_entity_idstring

Entity ID for the SAML client

result.​metadata_urlstring

SAML IDP metadata URL

result.​sso_urlstring

SAML SSO URL

result.​entity_idstring

SAML Entity ID

result.​x509_certificatestring

X.509 certificate

result.​default_custom_claimsArray of strings

List of all the custom claims the client wants to receive by default

Items Enum"tid""fname""lname""mname""email""email_verified""phone_number""phone_number_verified""groups""new_user"
Response
application/json
{
  "result": {
    "client_id": "string",
    "client_secret": "string",
    "client_type": "web",
    "name": "string",
    "pkce": "enforcePkceInsteadOfClientCredentials",
    "description": "string",
    "resources": [ … ],
    "created_at": "2019-08-24T14:15:22Z",
    "updated_at": "2019-08-24T14:15:22Z",
    "redirect_uris": [ … ],
    "authentication_protocol": "oidc",
    "is_third_party": true,
    "optional_acs_url": true,
    "sp_acs_url": "string",
    "sp_entity_id": "string",
    "metadata_url": "string",
    "sso_url": "string",
    "entity_id": "string",
    "x509_certificate": "string",
    "default_custom_claims": [ … ]
  }
}

Update client

Request

Updates a client within the SSO clients group by specifying it by its ID. Note: Fields that are objects cannot be partially updated, since the new value you set will just replace the current one.

Required permissions: sso-service:edit.

Security
ClientAccessToken
Path
groupIdstringrequired

ID of the group to retrieve

clientIdstringrequired

ID of the client to retrieve

Bodyapplication/jsonrequired
Any of:
namestring

Name of the client

Example: "My Client"
descriptionstring

Short description of the client

resourcesArray of strings

List of resources IDs associated with this client

client_group_idstring

Id of client group to associate with

default_custom_claimsArray of strings

List of client default custom claims

Items Enum"tid""fname""lname""mname""email""email_verified""phone_number""phone_number_verified""groups""new_user"
short_cookies_samesite_typestring

Short cookies samesite type. Possible values: "none", "lax", "strict". Default: "lax"

Default "lax"
Enum"lax""none"
redirect_urisArray of strings

List of URIs approved for redirects for your client

Example: ["https://www.example.com/login"]
client_typestring

Client type

Default "web"
Enum"web""native"
device_authorizationobject
ciba_authorizationobject
is_third_partyboolean

Is third party client

allowed_scopesArray of strings

Allowed scopes

consent_uristring

Consent URI

consent_validity_periodnumber

Consent validity period

pkcestring

PKCE configuration

Enum"enforcePkceInsteadOfClientCredentials""enforcePkceAlongsideClientCredentials""allowPkceAlongsideClientCredentials"
supported_promptsArray of strings

Supported prompts for the OIDC authentication flow

Items Enum"login""consent""none"
Example: ["login","consent","none"]
token_expirationobject
session_expirationnumber

Session expiration time (seconds)

enforce_parboolean

enforce PAR (Pushed Authorization Request) for this client

role_idsArray of strings

Role IDs

fapi_version_compliancyboolean

FAPI 2.0 compliancy configuration

response_typesArray of strings
Default ["code","id_token"]
Items Enum"code""id_token"
Example: ["code"]
authentication_configurationobject
token_endpoint_auth_methodstringDeprecated

This field is deprecated- to configure pkce use "pkce" field instead

Default "client_secret_basic"
Enum"client_secret_basic""self_signed_tls_client_auth""tls_client_auth""none""private_key_jwt"
curl -i -X PUT \
  'https://api.sbx.transmitsecurity.io/cis/v1/sso-service/sso-group/{groupId}/clients/{clientId}' \
  -H 'Authorization: Bearer <YOUR_TOKEN_HERE>' \
  -H 'Content-Type: application/json' \
  -d '{
    "name": "My Client",
    "description": "string",
    "resources": [
      "string"
    ],
    "client_group_id": "string",
    "default_custom_claims": [
      "tid"
    ],
    "short_cookies_samesite_type": "lax",
    "redirect_uris": [
      "https://www.example.com/login"
    ],
    "client_type": "web",
    "device_authorization": {
      "enabled": false,
      "approval_uri": "https://www.example.com/device/approval",
      "success_uri": "https://www.example.com/device/complete",
      "input_uri": "https://www.example.com/device/start"
    },
    "ciba_authorization": {
      "enabled": false,
      "login_uri": "https://www.example.com/ciba/login"
    },
    "is_third_party": true,
    "allowed_scopes": [
      "string"
    ],
    "consent_uri": "string",
    "consent_validity_period": 0,
    "pkce": "enforcePkceInsteadOfClientCredentials",
    "supported_prompts": [
      "login",
      "consent",
      "none"
    ],
    "token_expiration": {
      "access_token_ttl": 0,
      "refresh_token_ttl": 0,
      "max_refresh_rotate": 0
    },
    "session_expiration": 0,
    "enforce_par": true,
    "role_ids": [
      "string"
    ],
    "fapi_version_compliancy": true,
    "token_endpoint_auth_method": "client_secret_basic",
    "response_types": [
      "code"
    ],
    "authentication_configuration": {
      "method": "client_secret_basic",
      "tls_client_auth": {
        "certificate_chain": "string",
        "distinguished_name": 6,
        "ocsp_on": true,
        "ocsp_responder_uri": "string",
        "ocsp_responder_certificate": "string",
        "ocsp_fail_open": true
      },
      "isMtlsCertTokenBound": true,
      "jwks": {}
    }
  }'

Responses

Bodyapplication/json
resultobjectrequired
result.​client_idstringrequired

Client ID used for API requests

result.​client_secretstringrequired

Client secret used to obtain tokens for API authorization

result.​client_typestring

Client type

Enum"web""native"
result.​namestringrequired

Client name displayed in the Admin Portal

result.​pkcestring

PKCE configuration for client

Enum"enforcePkceInsteadOfClientCredentials""enforcePkceAlongsideClientCredentials""allowPkceAlongsideClientCredentials"
result.​descriptionstringrequired

Short description of your client, displayed in the Admin Portal

result.​resourcesArray of stringsrequired

List of resources this client is allowed to explicitly request access to

result.​created_atstring(date-time)required

Date the client was created

result.​updated_atstring(date-time)required

Date the client was last updated

result.​redirect_urisArray of strings

List of URIs approved for redirects for your client

result.​authentication_protocolstring

Authentication protocol used by the client

Enum"oidc""saml"
result.​is_third_partyboolean

Whether the client is a third-party client

result.​optional_acs_urlboolean

ACS URL for the SAML client

result.​sp_acs_urlstring

ACS URL for the SAML client

result.​sp_entity_idstring

Entity ID for the SAML client

result.​metadata_urlstring

SAML IDP metadata URL

result.​sso_urlstring

SAML SSO URL

result.​entity_idstring

SAML Entity ID

result.​x509_certificatestring

X.509 certificate

result.​default_custom_claimsArray of strings

List of all the custom claims the client wants to receive by default

Items Enum"tid""fname""lname""mname""email""email_verified""phone_number""phone_number_verified""groups""new_user"
Response
application/json
{
  "result": {
    "client_id": "string",
    "client_secret": "string",
    "client_type": "web",
    "name": "string",
    "pkce": "enforcePkceInsteadOfClientCredentials",
    "description": "string",
    "resources": [ … ],
    "created_at": "2019-08-24T14:15:22Z",
    "updated_at": "2019-08-24T14:15:22Z",
    "redirect_uris": [ … ],
    "authentication_protocol": "oidc",
    "is_third_party": true,
    "optional_acs_url": true,
    "sp_acs_url": "string",
    "sp_entity_id": "string",
    "metadata_url": "string",
    "sso_url": "string",
    "entity_id": "string",
    "x509_certificate": "string",
    "default_custom_claims": [ … ]
  }
}

Delete client

Request

Deletes a client and removes it from the SSO client group.

Required permissions: sso-service:edit, sso-service:delete.

Security
ClientAccessToken
Path
groupIdstringrequired

ID of the group to retrieve

clientIdstringrequired

ID of the client to delete

curl -i -X DELETE \
  'https://api.sbx.transmitsecurity.io/cis/v1/sso-service/sso-group/{groupId}/clients/{clientId}' \
  -H 'Authorization: Bearer <YOUR_TOKEN_HERE>'

Responses

Response
No content