Get one OIDC client's registered configuration (admin)

GET/v1/admin/orgs/{slug}/clients/{id}

Returns the registered configuration of one of slug's organization's OIDC clients, named by its registration id: its redirect and logout addresses, scopes, grant and response types, how it authenticates, its PKCE policy, token lifetimes and signing algorithms, how it came to be registered, and the labels the organization may see. A client of another organization is answered as 404, exactly like an id that does not exist.

No secret material. The response says whether the client holds a secret (has_secret) and nothing more. The server keeps only a one-way hash of a client secret, shown once when it is minted, so there is no secret to return; neither the hash nor the registration access token is ever included either.

Personal data. The registration contacts (RFC 7591 §2 contacts) are returned only to a caller holding users.pii.read; without it the field is absent.

A lifetime field is absent when the client registered none and so takes the server's default. Requires the nauthera.clients:read scope and the clients.read permission.

GET/v1/admin/orgs/{slug}/clients/{id}

curl -g 'https://auth.example.com/v1/admin/orgs/{slug}/clients/{id}' \
  -H "Authorization: Bearer $ACCESS_TOKEN"

Response

200 OK

{
  "id": "string",
  "client_id": "string",
  "display_name": "string",
  "display_name_markers": [
    "bidi"
  ],
  "type": "public",
  "token_endpoint_auth_method": "none",
  "grant_types": [
    "authorization_code"
  ],
  "source": "operator",
  "created_at": "2026-01-15T09:30:00Z",
  "updated_at": "2026-01-15T09:30:00Z",
  "issuer": "string",
  "redirect_uris": [
    "string"
  ],
  "post_logout_redirect_uris": [
    "string"
  ],
  "response_types": [
    "string"
  ],
  "scopes": [
    "string"
  ],
  "pkce_policy": "required_s256",
  "pkce_required": false,
  "allow_refresh": false,
  "require_signed_request_object": false,
  "authorization_details_types": [
    "string"
  ],
  "has_secret": false
}

Authorization

Bearer tokenOAuth 2.0nauthera.clients:read

The access token must carry the scope shown.

Send it in the Authorization header:

The access token, as Bearer <token> (RFC 6750 §2.1) or, for a sender-constrained token, DPoP <token> (RFC 9449 §7.1). A token minted with a cnf.jkt confirmation is only accepted together with a DPoP proof signed by that key, whichever of the two schemes carries it.

The caller must also hold the permission clients.read: Read an organization's OIDC clients.

Path parameters

slugstringrequired
The organization slug. It names the TENANT OF RECORD for the operation: the rows it reads and writes, the policy its secrets are derived under, and the organization its audit record is filed against all come from this organization. A token is admitted only through its own slug, except a main-org token, which may be admitted through any — so cross-tenant administration is performed through the TARGET tenant's slug, never by naming its resources through another. A token reaching for a slug it may not be admitted through is refused identically whether that organization exists or not.
1–64 characters
idstringrequired
The client's registration id (UUID), as the clients listing returns it in id — not its client_id, which another registration in the same organization may also carry.
1–64 characters

Headers

DPoPstring
DPoP proof JWT (RFC 9449 §4). REQUIRED on a request presenting a DPoP-bound access token, and it must be signed by the key named in the token's cnf.jkt and cover this request's method and URI. The proof is read from the request itself rather than from this decoded parameter, so every protected operation is covered whether or not it declares it.

Responses

200 OKapplication/jsonThe client's registered configuration.
The client's registered configuration.
Headers
- Cache-Controlno-store
Body
One OIDC client's registered configuration as the admin API shows it: everything the list carries, plus the registered metadata an administrator needs to see why a relying party fails. It never carries a secret, a secret hash or a registration access token — only whether the client holds a secret.
- idstringrequired
  The registration id (UUID).
- client_idstringrequired
  The OAuth client identifier relying parties present.
- display_namestringrequired
  The name the client is shown under; empty when it registered none.
- display_name_markersarray of enumsrequired
  What about the display name is there to be misread, in a fixed order; empty for an ordinary name.
  Each item:
  What about a client's display name is there to be misread: a direction override, isolate or mark (bidi), a control character (control), invisible characters (invisible), surrounding or repeated whitespace (padded), a name longer than the sign-in pages show (overlong), or markup (markup).
  Possible values"bidi""control""invisible""padded""overlong""markup"
- typeenumrequired
  Whether a client authenticates at the token endpoint: a public client holds no credential, a confidential one holds a secret or a key.
  Possible values"public""confidential"
- token_endpoint_auth_methodenumrequired
  How a client authenticates at the token endpoint (RFC 7591 §2).
  Possible values"none""client_secret_basic""client_secret_post""private_key_jwt"
- grant_typesarray of enumsrequired
  The grant types the client is registered for.
  Each item:
  A grant type a client may use at the token endpoint (RFC 7591 §2).
  Possible values"authorization_code""refresh_token""client_credentials""urn:ietf:params:oauth:grant-type:device_code"
- sourceenumrequired
  How a client came to be registered: by an operator over the control plane, by dynamic registration (RFC 7591), or by the server itself, as an organization's admin console and machine client.
  Possible values"operator""dynamic""provisioner"
- created_atstring · date-timerequired
- updated_atstring · date-timerequired
- issuerstringrequired
  The issuer the client is registered under: the iss of the tokens it receives, and the base of its discovery document ({issuer}/.well-known/openid-configuration).
- redirect_urisarray of stringsrequired
  The registered redirection URIs, exactly as registered.
- post_logout_redirect_urisarray of stringsrequired
  The registered post-logout redirection URIs.
- response_typesarray of stringsrequired
  The registered response types.
- scopesarray of stringsrequired
  The scopes the client may request.
- pkce_policyenumrequired
  Whether the client must present a PKCE (S256) challenge on the authorization code grant (RFC 7636): required_s256, optional or disabled. A public client is held to PKCE whatever its policy says; pkce_required reports the effective answer.
  Possible values"required_s256""optional""disabled"
- pkce_requiredbooleanrequired
  Whether the client must present a PKCE S256 challenge, after the rule that a public client always must.
- allow_refreshbooleanrequired
  Whether the client may be issued refresh tokens.
- require_signed_request_objectbooleanrequired
  Whether every authorization request must be a signed request object.
- authorization_details_typesarray of stringsrequired
  The rich authorization request types (RFC 9396) the client may use.
- has_secretbooleanrequired
  Whether the client holds a client secret. The secret itself is never returned: only a one-way hash of it is stored, and the plaintext was shown once, when it was minted.
- access_token_ttl_secondsinteger · int64
  The registered access-token lifetime in seconds; absent when the client takes the server's default.
- refresh_token_ttl_secondsinteger · int64
  The registered refresh-token lifetime in seconds; absent when the client takes the server's default.
- id_token_ttl_secondsinteger · int64
  The registered ID-token lifetime in seconds; absent when the client takes the server's default.
- id_token_signed_response_algstring
  The JWS algorithm the client's ID tokens are signed with; absent when it takes the server's default.
- token_endpoint_auth_signing_algstring
  The JWS algorithm a private_key_jwt client signs its assertions with; absent when unrestricted.
- jwks_uristring
  Where the server fetches the client's public keys from; absent when it registered none.
- backchannel_logout_uristring
  The client's back-channel logout URI; absent when it registered none.
- backchannel_logout_session_requiredboolean
  Whether back-channel logout tokens must carry a sid.
- frontchannel_logout_uristring
  The client's front-channel logout URI; absent when it registered none.
- frontchannel_logout_session_requiredboolean
  Whether front-channel logout requests must carry iss and sid.
- labelsmap of strings
  The client's labels, except the server's reserved ones under nauthera.dev/, which carry its organization and machine roles; absent when it has none.
- contactsarray of strings
  The registration contacts (RFC 7591 §2). Personal data: present only for a caller holding users.pii.read, and only when the client registered some.
- client_uristring
  The client's home page, as it registered it (RFC 7591 §2).
- logo_uristring
  The client's logo, as it registered it (RFC 7591 §2).
- policy_uristring
  The client's privacy policy, as it registered it (RFC 7591 §2).
- tos_uristring
  The client's terms of service, as it registered it (RFC 7591 §2).
- software_idstring
  The self-asserted software id it registered (RFC 7591 §2).
- software_versionstring
  The self-asserted software version it registered (RFC 7591 §2).
401 Unauthorizedapplication/problem+jsonProblem details (RFC 9457) with an RFC 6750 / RFC 9449 challenge.
Problem details (RFC 9457) with an RFC 6750 / RFC 9449 challenge.
Headers
- Cache-Controlno-store
- WWW-Authenticatestring
- DPoP-Noncestring
Body
RFC 9457 (formerly RFC 7807) problem details (application/problem+json). code is a stable machine-readable slug for the problem kind (it mirrors the suffix of type), so consumers can branch on it without parsing prose. errors is present on validation failures and lists every offending field.
- titlestringrequired
  Example"Request validation failed"
- statusintegerrequired
  Example400
- typestring · uri
  Example"urn:problem-type:validation_error"
- detailstring
  Example"One or more fields did not satisfy the API schema."
- codeenum
  The kind of problem, as a stable machine-readable slug a client branches on and translates rather than parsing title or detail, which are English prose for logs. A problem whose status says everything the server knows carries no code.
  Show moreShow less
  validation_error is the one code whose message is not a sentence about the code itself: the request failed the schema, and the specifics are the errors list — one entry per offending field — which a form renders on those fields. required and malformed are spelled like two of the per-field violation codes (FieldError.code) but mean something else; the two vocabularies are told apart by position, never by spelling.
  
  Compatibility: this is a CLOSED enum, with the same cost as AuditAction: a client generated against an older version of this document rejects a problem carrying a code added after it was built. Regenerate on upgrade, or decode the field as a plain string. It is enumerated anyway so that what a client must translate is knowable from the contract alone.
  Possible values"invalid_request""invalid_credentials""forbidden""unauthorized""insufficient_user_authentication""protected_account""last_role_administrator""invalid_code""too_many_requests""too_many_attempts""account_locked""account_unavailable""already_enrolled""registration_disabled""registration_conflict""captcha_failed""invalid_reset_link""invalid_verification_link""invalid_invitation_link""mail_relay_missing""not_found""conflict""unavailable""busy""window_too_large""too_many_series""internal_error""rate_limited""malformed""body_too_large""required""validation_error""unknown_org""invalid_token""invalid_dpop_proof""use_dpop_nonce""server_error"
- instancestring
  Example"/introspect"
- request_idstring
  Example"8d94ed49-1caf-4ab3-9594-557142f2d023"
- trace_idstring
  Distributed-trace id (hex) for correlating this response with traces and logs. Present only when tracing is enabled and the request was recorded. Opaque and safe to log/share.
  Example"4bf92f3577b34da6a3ce929d0e0e4736"
- errorsarray of objects
  Field-level violations (present for validation errors).
  Each item:
  A single field-level validation violation.
  Show item attributesHide item attributes
  fieldstringrequired
  Offending field, dotted for nested bodies (e.g. child.id).
  Example"token_type_hint"
  codestringrequired
  Machine-readable violation code: required, too_short, too_long, pattern, invalid_format, not_allowed, minimum, maximum, multiple_of, too_few, too_many, not_unique, malformed.
  Example"not_allowed"
  messagestringrequired
  Example"field token_type_hint must be one of [access_token, refresh_token]"
403 Forbiddenapplication/problem+jsonProblem details (RFC 9457) with an RFC 6750 / RFC 9449 challenge.
Problem details (RFC 9457) with an RFC 6750 / RFC 9449 challenge.
Headers
- Cache-Controlno-store
- WWW-Authenticatestring
- DPoP-Noncestring
Body
RFC 9457 (formerly RFC 7807) problem details (application/problem+json). code is a stable machine-readable slug for the problem kind (it mirrors the suffix of type), so consumers can branch on it without parsing prose. errors is present on validation failures and lists every offending field.
- titlestringrequired
  Example"Request validation failed"
- statusintegerrequired
  Example400
- typestring · uri
  Example"urn:problem-type:validation_error"
- detailstring
  Example"One or more fields did not satisfy the API schema."
- codeenum
  The kind of problem, as a stable machine-readable slug a client branches on and translates rather than parsing title or detail, which are English prose for logs. A problem whose status says everything the server knows carries no code.
  Show moreShow less
  validation_error is the one code whose message is not a sentence about the code itself: the request failed the schema, and the specifics are the errors list — one entry per offending field — which a form renders on those fields. required and malformed are spelled like two of the per-field violation codes (FieldError.code) but mean something else; the two vocabularies are told apart by position, never by spelling.
  
  Compatibility: this is a CLOSED enum, with the same cost as AuditAction: a client generated against an older version of this document rejects a problem carrying a code added after it was built. Regenerate on upgrade, or decode the field as a plain string. It is enumerated anyway so that what a client must translate is knowable from the contract alone.
  Possible values"invalid_request""invalid_credentials""forbidden""unauthorized""insufficient_user_authentication""protected_account""last_role_administrator""invalid_code""too_many_requests""too_many_attempts""account_locked""account_unavailable""already_enrolled""registration_disabled""registration_conflict""captcha_failed""invalid_reset_link""invalid_verification_link""invalid_invitation_link""mail_relay_missing""not_found""conflict""unavailable""busy""window_too_large""too_many_series""internal_error""rate_limited""malformed""body_too_large""required""validation_error""unknown_org""invalid_token""invalid_dpop_proof""use_dpop_nonce""server_error"
- instancestring
  Example"/introspect"
- request_idstring
  Example"8d94ed49-1caf-4ab3-9594-557142f2d023"
- trace_idstring
  Distributed-trace id (hex) for correlating this response with traces and logs. Present only when tracing is enabled and the request was recorded. Opaque and safe to log/share.
  Example"4bf92f3577b34da6a3ce929d0e0e4736"
- errorsarray of objects
  Field-level violations (present for validation errors).
  Each item:
  A single field-level validation violation.
  Show item attributesHide item attributes
  fieldstringrequired
  Offending field, dotted for nested bodies (e.g. child.id).
  Example"token_type_hint"
  codestringrequired
  Machine-readable violation code: required, too_short, too_long, pattern, invalid_format, not_allowed, minimum, maximum, multiple_of, too_few, too_many, not_unique, malformed.
  Example"not_allowed"
  messagestringrequired
  Example"field token_type_hint must be one of [access_token, refresh_token]"
404 Not Foundapplication/problem+jsonProblem details (RFC 9457).
Problem details (RFC 9457).
Body
RFC 9457 (formerly RFC 7807) problem details (application/problem+json). code is a stable machine-readable slug for the problem kind (it mirrors the suffix of type), so consumers can branch on it without parsing prose. errors is present on validation failures and lists every offending field.
- titlestringrequired
  Example"Request validation failed"
- statusintegerrequired
  Example400
- typestring · uri
  Example"urn:problem-type:validation_error"
- detailstring
  Example"One or more fields did not satisfy the API schema."
- codeenum
  The kind of problem, as a stable machine-readable slug a client branches on and translates rather than parsing title or detail, which are English prose for logs. A problem whose status says everything the server knows carries no code.
  Show moreShow less
  validation_error is the one code whose message is not a sentence about the code itself: the request failed the schema, and the specifics are the errors list — one entry per offending field — which a form renders on those fields. required and malformed are spelled like two of the per-field violation codes (FieldError.code) but mean something else; the two vocabularies are told apart by position, never by spelling.
  
  Compatibility: this is a CLOSED enum, with the same cost as AuditAction: a client generated against an older version of this document rejects a problem carrying a code added after it was built. Regenerate on upgrade, or decode the field as a plain string. It is enumerated anyway so that what a client must translate is knowable from the contract alone.
  Possible values"invalid_request""invalid_credentials""forbidden""unauthorized""insufficient_user_authentication""protected_account""last_role_administrator""invalid_code""too_many_requests""too_many_attempts""account_locked""account_unavailable""already_enrolled""registration_disabled""registration_conflict""captcha_failed""invalid_reset_link""invalid_verification_link""invalid_invitation_link""mail_relay_missing""not_found""conflict""unavailable""busy""window_too_large""too_many_series""internal_error""rate_limited""malformed""body_too_large""required""validation_error""unknown_org""invalid_token""invalid_dpop_proof""use_dpop_nonce""server_error"
- instancestring
  Example"/introspect"
- request_idstring
  Example"8d94ed49-1caf-4ab3-9594-557142f2d023"
- trace_idstring
  Distributed-trace id (hex) for correlating this response with traces and logs. Present only when tracing is enabled and the request was recorded. Opaque and safe to log/share.
  Example"4bf92f3577b34da6a3ce929d0e0e4736"
- errorsarray of objects
  Field-level violations (present for validation errors).
  Each item:
  A single field-level validation violation.
  Show item attributesHide item attributes
  fieldstringrequired
  Offending field, dotted for nested bodies (e.g. child.id).
  Example"token_type_hint"
  codestringrequired
  Machine-readable violation code: required, too_short, too_long, pattern, invalid_format, not_allowed, minimum, maximum, multiple_of, too_few, too_many, not_unique, malformed.
  Example"not_allowed"
  messagestringrequired
  Example"field token_type_hint must be one of [access_token, refresh_token]"
429 Too Many Requestsapplication/problem+jsonToo many requests.
Too many requests.
Body
RFC 9457 (formerly RFC 7807) problem details (application/problem+json). code is a stable machine-readable slug for the problem kind (it mirrors the suffix of type), so consumers can branch on it without parsing prose. errors is present on validation failures and lists every offending field.
- titlestringrequired
  Example"Request validation failed"
- statusintegerrequired
  Example400
- typestring · uri
  Example"urn:problem-type:validation_error"
- detailstring
  Example"One or more fields did not satisfy the API schema."
- codeenum
  The kind of problem, as a stable machine-readable slug a client branches on and translates rather than parsing title or detail, which are English prose for logs. A problem whose status says everything the server knows carries no code.
  Show moreShow less
  validation_error is the one code whose message is not a sentence about the code itself: the request failed the schema, and the specifics are the errors list — one entry per offending field — which a form renders on those fields. required and malformed are spelled like two of the per-field violation codes (FieldError.code) but mean something else; the two vocabularies are told apart by position, never by spelling.
  
  Compatibility: this is a CLOSED enum, with the same cost as AuditAction: a client generated against an older version of this document rejects a problem carrying a code added after it was built. Regenerate on upgrade, or decode the field as a plain string. It is enumerated anyway so that what a client must translate is knowable from the contract alone.
  Possible values"invalid_request""invalid_credentials""forbidden""unauthorized""insufficient_user_authentication""protected_account""last_role_administrator""invalid_code""too_many_requests""too_many_attempts""account_locked""account_unavailable""already_enrolled""registration_disabled""registration_conflict""captcha_failed""invalid_reset_link""invalid_verification_link""invalid_invitation_link""mail_relay_missing""not_found""conflict""unavailable""busy""window_too_large""too_many_series""internal_error""rate_limited""malformed""body_too_large""required""validation_error""unknown_org""invalid_token""invalid_dpop_proof""use_dpop_nonce""server_error"
- instancestring
  Example"/introspect"
- request_idstring
  Example"8d94ed49-1caf-4ab3-9594-557142f2d023"
- trace_idstring
  Distributed-trace id (hex) for correlating this response with traces and logs. Present only when tracing is enabled and the request was recorded. Opaque and safe to log/share.
  Example"4bf92f3577b34da6a3ce929d0e0e4736"
- errorsarray of objects
  Field-level violations (present for validation errors).
  Each item:
  A single field-level validation violation.
  Show item attributesHide item attributes
  fieldstringrequired
  Offending field, dotted for nested bodies (e.g. child.id).
  Example"token_type_hint"
  codestringrequired
  Machine-readable violation code: required, too_short, too_long, pattern, invalid_format, not_allowed, minimum, maximum, multiple_of, too_few, too_many, not_unique, malformed.
  Example"not_allowed"
  messagestringrequired
  Example"field token_type_hint must be one of [access_token, refresh_token]"
Errorapplication/problem+jsonProblem details (RFC 9457) with an RFC 6750 / RFC 9449 challenge.
Problem details (RFC 9457) with an RFC 6750 / RFC 9449 challenge.
Headers
- Cache-Controlno-store
- WWW-Authenticatestring
- DPoP-Noncestring
Body
RFC 9457 (formerly RFC 7807) problem details (application/problem+json). code is a stable machine-readable slug for the problem kind (it mirrors the suffix of type), so consumers can branch on it without parsing prose. errors is present on validation failures and lists every offending field.
- titlestringrequired
  Example"Request validation failed"
- statusintegerrequired
  Example400
- typestring · uri
  Example"urn:problem-type:validation_error"
- detailstring
  Example"One or more fields did not satisfy the API schema."
- codeenum
  The kind of problem, as a stable machine-readable slug a client branches on and translates rather than parsing title or detail, which are English prose for logs. A problem whose status says everything the server knows carries no code.
  Show moreShow less
  validation_error is the one code whose message is not a sentence about the code itself: the request failed the schema, and the specifics are the errors list — one entry per offending field — which a form renders on those fields. required and malformed are spelled like two of the per-field violation codes (FieldError.code) but mean something else; the two vocabularies are told apart by position, never by spelling.
  
  Compatibility: this is a CLOSED enum, with the same cost as AuditAction: a client generated against an older version of this document rejects a problem carrying a code added after it was built. Regenerate on upgrade, or decode the field as a plain string. It is enumerated anyway so that what a client must translate is knowable from the contract alone.
  Possible values"invalid_request""invalid_credentials""forbidden""unauthorized""insufficient_user_authentication""protected_account""last_role_administrator""invalid_code""too_many_requests""too_many_attempts""account_locked""account_unavailable""already_enrolled""registration_disabled""registration_conflict""captcha_failed""invalid_reset_link""invalid_verification_link""invalid_invitation_link""mail_relay_missing""not_found""conflict""unavailable""busy""window_too_large""too_many_series""internal_error""rate_limited""malformed""body_too_large""required""validation_error""unknown_org""invalid_token""invalid_dpop_proof""use_dpop_nonce""server_error"
- instancestring
  Example"/introspect"
- request_idstring
  Example"8d94ed49-1caf-4ab3-9594-557142f2d023"
- trace_idstring
  Distributed-trace id (hex) for correlating this response with traces and logs. Present only when tracing is enabled and the request was recorded. Opaque and safe to log/share.
  Example"4bf92f3577b34da6a3ce929d0e0e4736"
- errorsarray of objects
  Field-level violations (present for validation errors).
  Each item:
  A single field-level validation violation.
  Show item attributesHide item attributes
  fieldstringrequired
  Offending field, dotted for nested bodies (e.g. child.id).
  Example"token_type_hint"
  codestringrequired
  Machine-readable violation code: required, too_short, too_long, pattern, invalid_format, not_allowed, minimum, maximum, multiple_of, too_few, too_many, not_unique, malformed.
  Example"not_allowed"
  messagestringrequired
  Example"field token_type_hint must be one of [access_token, refresh_token]"

PreviousList an organization's OIDC clients NextCount one OIDC client's daily, monthly and all-time users

Get one OIDC client's registered configuration (admin)

GET/v1/admin/orgs/{slug}/clients/{id}

Personal data. The registration contacts (RFC 7591 §2 contacts) are returned only to a caller holding users.pii.read; without it the field is absent.

A lifetime field is absent when the client registered none and so takes the server's default. Requires the nauthera.clients:read scope and the clients.read permission.

{ "id": "string", "client_id": "string", "display_name": "string", "display_name_markers": [ "bidi" ], "type": "public", "token_endpoint_auth_method": "none", "grant_types": [ "authorization_code" ], "source": "operator", "created_at": "2026-01-15T09:30:00Z", "updated_at": "2026-01-15T09:30:00Z", "issuer": "string", "redirect_uris": [ "string" ], "post_logout_redirect_uris": [ "string" ], "response_types": [ "string" ], "scopes": [ "string" ], "pkce_policy": "required_s256", "pkce_required": false, "allow_refresh": false, "require_signed_request_object": false, "authorization_details_types": [ "string" ], "has_secret": false }

Headers

Body

Headers

Body

Headers

Body

Body

Body

Headers

Body

Headers

Body

Headers

Body

Headers

Body

Body

Body

Headers

Body