Get one OIDC client's registered configuration (admin)

Docs version v1 (main)Nauthera is pre-1.0, in a design-partner program

GET/v1/admin/orgs/{slug}/clients/{id}

Returns the registered configuration of one of slug's organization's OIDC clients, named by its registration id: its redirect and logout addresses, scopes, grant and response types, how it authenticates, its PKCE policy, token lifetimes and signing algorithms, how it came to be registered, and the labels the organization may see. A client of another organization is answered as 404, exactly like an id that does not exist.

No secret material. The response says whether the client holds a secret (has_secret) and nothing more. The server keeps only a one-way hash of a client secret, shown once when it is minted, so there is no secret to return; neither the hash nor the registration access token is ever included either.

Personal data. The registration contacts (RFC 7591 §2 contacts) are returned only to a caller holding users.pii.read; without it the field is absent.

A lifetime field is absent when the client registered none and so takes the server's default. Requires the nauthera.clients:read scope and the clients.read permission.

GET/v1/admin/orgs/{slug}/clients/{id}

curl -g 'https://auth.example.com/v1/admin/orgs/{slug}/clients/{id}' \
  -H "Authorization: Bearer $ACCESS_TOKEN"

Response

200 OK

{
  "id": "string",
  "client_id": "string",
  "display_name": "string",
  "display_name_markers": [
    "bidi"
  ],
  "type": "public",
  "token_endpoint_auth_method": "none",
  "grant_types": [
    "authorization_code"
  ],
  "source": "operator",
  "created_at": "2026-01-15T09:30:00Z",
  "updated_at": "2026-01-15T09:30:00Z",
  "issuer": "string",
  "redirect_uris": [
    "string"
  ],
  "post_logout_redirect_uris": [
    "string"
  ],
  "response_types": [
    "string"
  ],
  "scopes": [
    "string"
  ],
  "pkce_policy": "required_s256",
  "pkce_required": false,
  "allow_refresh": false,
  "require_signed_request_object": false,
  "authorization_details_types": [
    "string"
  ],
  "has_secret": false,
  "second_factor": {}
}

Authorization

Bearer tokenOAuth 2.0nauthera.clients:read

The access token must carry the scope shown.

Send it in the Authorization header:

The access token, as Bearer <token> (RFC 6750 §2.1) or, for a sender-constrained token, DPoP <token> (RFC 9449 §7.1). A token minted with a cnf.jkt confirmation is only accepted together with a DPoP proof signed by that key, whichever of the two schemes carries it.

The caller must also hold the permission clients.read: Read an organization's OIDC clients.

Path parameters

slugstringrequired
The organization slug. It names the TENANT OF RECORD for the operation: the rows it reads and writes, the policy its secrets are derived under, and the organization its audit record is filed against all come from this organization. A token is admitted only through its own slug, except a main-org token, which may be admitted through any — so cross-tenant administration is performed through the TARGET tenant's slug, never by naming its resources through another. A token reaching for a slug it may not be admitted through is refused identically whether that organization exists or not.
1–64 characters
idstringrequired
The client's registration id (UUID), as the clients listing returns it in id — not its client_id, which another registration in the same organization may also carry.
1–64 characters

Headers

DPoPstring
DPoP proof JWT (RFC 9449 §4). REQUIRED on a request presenting a DPoP-bound access token, and it must be signed by the key named in the token's cnf.jkt and cover this request's method and URI. The proof is read from the request itself rather than from this decoded parameter, so every protected operation is covered whether or not it declares it.

Responses

200 OKapplication/jsonThe client's registered configuration.
The client's registered configuration.
Headers
- Cache-Controlno-store
Body
One OIDC client's registered configuration as the admin API shows it: everything the list carries, plus the registered metadata an administrator needs to see why a relying party fails. It never carries a secret, a secret hash or a registration access token — only whether the client holds a secret.
- idstringrequired
  The registration id (UUID).
- client_idstringrequired
  The OAuth client identifier relying parties present.
- display_namestringrequired
  The name the client is shown under; empty when it registered none.
- display_name_markersarray of enumsrequired
  What about the display name is there to be misread, in a fixed order; empty for an ordinary name.
  Each item:
  What about a client's display name is there to be misread: a direction override, isolate or mark (bidi), a control character (control), invisible characters (invisible), surrounding or repeated whitespace (padded), a name longer than the sign-in pages show (overlong), or markup (markup).
  Possible values6 values
  bidi
  control
  invisible
  padded
  overlong
  markup
- typeenumrequired
  Whether a client authenticates at the token endpoint: a public client holds no credential, a confidential one holds a secret or a key.
  Possible values2 values
  public
  confidential
- token_endpoint_auth_methodenumrequired
  How a client authenticates at the token endpoint (RFC 7591 §2).
  Possible values4 values
  none
  client_secret_basic
  client_secret_post
  private_key_jwt
- grant_typesarray of enumsrequired
  The grant types the client is registered for.
  Each item:
  A grant type a client may use at the token endpoint (RFC 7591 §2).
  Possible values4 values
  authorization_code
  refresh_token
  client_credentials
  urn:ietf:params:oauth:grant-type:device_code
- sourceenumrequired
  How a client came to be registered: by an operator over the control plane, by dynamic registration (RFC 7591), or by the server itself, as an organization's admin console and machine client.
  Possible values3 values
  operator
  dynamic
  provisioner
- created_atstring · date-timerequired
- updated_atstring · date-timerequired
- issuerstringrequired
  The issuer the client is registered under: the iss of the tokens it receives, and the base of its discovery document ({issuer}/.well-known/openid-configuration).
- redirect_urisarray of stringsrequired
  The registered redirection URIs, exactly as registered.
- post_logout_redirect_urisarray of stringsrequired
  The registered post-logout redirection URIs.
- response_typesarray of stringsrequired
  The registered response types.
- scopesarray of stringsrequired
  The scopes the client may request.
- pkce_policyenumrequired
  Whether the client must present a PKCE (S256) challenge on the authorization code grant (RFC 7636): required_s256, optional or disabled. A public client is held to PKCE whatever its policy says; pkce_required reports the effective answer.
  Possible values3 values
  required_s256
  optional
  disabled
- pkce_requiredbooleanrequired
  Whether the client must present a PKCE S256 challenge, after the rule that a public client always must.
- allow_refreshbooleanrequired
  Whether the client may be issued refresh tokens.
- require_signed_request_objectbooleanrequired
  Whether every authorization request must be a signed request object.
- authorization_details_typesarray of stringsrequired
  The rich authorization request types (RFC 9396) the client may use.
- has_secretbooleanrequired
  Whether the client holds a client secret. The secret itself is never returned: only a one-way hash of it is stored, and the plaintext was shown once, when it was minted.
- second_factorobjectrequired
  Which second factors a sign-in may use, and when a user who holds one is spared the challenge. The deployment, the organization and the client each carry one, and a sign-in runs under the three narrowed together: a level can remove a method, add the requirement, keep passwordless sign-in closed or spare fewer sign-ins, and never the reverse. A write that states more than the levels above allow (a method they do not permit, passwordless sign-in they keep closed, a longer remember window, a zone they do not spare in) is refused with 400 naming the field and the bound. A write replaces the whole policy.
  Show child attributesHide child attributes
  methodsarray of enums
  The methods a user may enroll and answer with. Empty inherits the level above.
  Possible values3 values
  totp
  passkey
  email
  at most 3 items
  requiredboolean
  Sends a user who holds no permitted factor through enrollment before a session is issued.
  passwordlessboolean
  Opens sign-in with a discoverable passkey and no password. It is open only where the deployment, the organization and the client all open it.
  remember_for_secondsinteger · int64
  Spares a user who holds a permitted factor the challenge on a browser that passed a second factor for them within this many seconds, while their password and factors are the ones it passed under. Zero inherits the level above's window.
  at least 0
  spare_zonesarray of strings
  Spares such a user the challenge from these of the deployment's network zones. Empty inherits the level above's.
  at most 64 items · each item: at most 63 characters
  always_challengeboolean
  Spares no sign-in, on a remembered browser or in a zone.
  rulesarray of objects
  Narrow this level's policy for the sign-ins that meet them.
  Each item:
  Narrows its level's policy for a sign-in that meets every condition it sets. A rule only ever narrows its own level.
  at most 64 items
  Show item attributesHide item attributes
  namestringrequired
  Names the rule in the sign-in's audit record; unique on its level.
  at most 63 characters
  outside_zonesarray of strings
  Holds for an address in none of these network zones.
  at most 64 items · each item: at most 63 characters
  inside_zonesarray of strings
  Holds for an address in one of these network zones.
  at most 64 items · each item: at most 63 characters
  new_networkboolean
  Holds for a network the user has completed no sign-in from.
  new_browserboolean
  Holds for a browser that has not passed a second factor for the user under their current password and factors.
  methodsarray of enums
  Narrows the permitted methods to these.
  Possible values3 values
  totp
  passkey
  email
  at most 3 items
  requireboolean
  Requires a second factor, which no exemption spares.
  No other properties are accepted.
  No other properties are accepted.
- access_token_ttl_secondsinteger · int64
  The registered access-token lifetime in seconds; absent when the client takes the server's default.
- refresh_token_ttl_secondsinteger · int64
  The registered refresh-token lifetime in seconds; absent when the client takes the server's default.
- id_token_ttl_secondsinteger · int64
  The registered ID-token lifetime in seconds; absent when the client takes the server's default.
- id_token_signed_response_algstring
  The JWS algorithm the client's ID tokens are signed with; absent when it takes the server's default.
- token_endpoint_auth_signing_algstring
  The JWS algorithm a private_key_jwt client signs its assertions with; absent when unrestricted.
- jwks_uristring
  Where the server fetches the client's public keys from; absent when it registered none.
- backchannel_logout_uristring
  The client's back-channel logout URI; absent when it registered none.
- backchannel_logout_session_requiredboolean
  Whether back-channel logout tokens must carry a sid.
- frontchannel_logout_uristring
  The client's front-channel logout URI; absent when it registered none.
- frontchannel_logout_session_requiredboolean
  Whether front-channel logout requests must carry iss and sid.
- secret_locationobject
  Where an operator-managed client's secret is kept in the cluster that manages it, as the operator last reported it: a Secret and the key in it. Never the secret. Absent for a client the operator does not manage or that has no secret.
  Show child attributesHide child attributes
  namespacestringrequired
  The Secret's namespace, the client manifest's own.
  namestringrequired
  The Secret's name.
  keystringrequired
  The key in the Secret's data holding the client secret.
  originenumrequired
  Who chose an operator client's secret: the server, which minted it and the operator wrote it to the Secret (minted), or the team managing the client, whose Secret the operator reads it from (supplied).
  Possible values2 values
  minted
  supplied
  fingerprintstringrequired
  The fingerprint of the secret the server held when the operator reported the location, as the OIDCClient's status.secretFingerprint and the Secret's nauthera.io/secret-fingerprint annotation show it.
- labelsmap of strings
  The client's labels, except the server's reserved ones under nauthera.dev/, which carry its organization and machine roles; absent when it has none.
- contactsarray of strings
  The registration contacts (RFC 7591 §2). Personal data: present only for a caller holding users.pii.read, and only when the client registered some.
- client_uristring
  The client's home page, as it registered it (RFC 7591 §2).
- logo_uristring
  The client's logo, as it registered it (RFC 7591 §2).
- policy_uristring
  The client's privacy policy, as it registered it (RFC 7591 §2).
- tos_uristring
  The client's terms of service, as it registered it (RFC 7591 §2).
- software_idstring
  The self-asserted software id it registered (RFC 7591 §2).
- software_versionstring
  The self-asserted software version it registered (RFC 7591 §2).
401 Unauthorizedapplication/problem+jsonProblem details (RFC 9457) with an RFC 6750 / RFC 9449 challenge.
Problem details (RFC 9457) with an RFC 6750 / RFC 9449 challenge.
Headers
- Cache-Controlno-store
- WWW-Authenticatestring
- DPoP-Noncestring
Body
RFC 9457 (formerly RFC 7807) problem details (application/problem+json). code is a stable machine-readable slug for the problem kind (it mirrors the last path segment of type), so consumers can branch on it without parsing prose. type is https://nauthera.io/problems/<code>, which resolves to the code's runbook: why it happened, who is affected and what to do (RFC 9457 §3.1.1). A problem without a code has about:blank. errors is present on validation failures and lists every offending field.
- titlestringrequired
  Example"Request validation failed"
- statusintegerrequired
  Example400
- typestring · uri
  Example"https://nauthera.io/problems/validation_error"
- detailstring
  Example"One or more fields did not satisfy the API schema."
- codeenum
  The kind of problem, as a stable machine-readable slug a client branches on and translates rather than parsing title or detail, which are English prose for logs. A problem whose status says everything the server knows carries no code.
  Show moreShow less
  validation_error is the one code whose message is not a sentence about the code itself: the request failed the schema, and the specifics are the errors list — one entry per offending field — which a form renders on those fields. required and malformed are spelled like two of the per-field violation codes (FieldError.code) but mean something else; the two vocabularies are told apart by position, never by spelling.
  
  Compatibility: this is a CLOSED enum, with the same cost as AuditAction: a client generated against an older version of this document rejects a problem carrying a code added after it was built. Regenerate on upgrade, or decode the field as a plain string. It is enumerated anyway so that what a client must translate is knowable from the contract alone.
  Possible values43 values
  invalid_request
  invalid_credentials
  forbidden
  unauthorized
  insufficient_user_authentication
  protected_account
  password_held_by_directory
  last_role_administrator
  invalid_code
  too_many_requests
  too_many_attempts
  account_locked
  account_unavailable
  already_enrolled
  registration_disabled
  registration_conflict
  captcha_failed
  invalid_reset_link
  password_reused
  password_too_short
  password_too_long
  password_compromised
  invalid_verification_link
  invalid_invitation_link
  mail_relay_missing
  email_unverified
  not_found
  conflict
  unavailable
  busy
  window_too_large
  too_many_series
  internal_error
  rate_limited
  malformed
  body_too_large
  required
  validation_error
  unknown_org
  invalid_token
  invalid_dpop_proof
  use_dpop_nonce
  server_error
- instancestring
  Example"/introspect"
- request_idstring
  Example"8d94ed49-1caf-4ab3-9594-557142f2d023"
- trace_idstring
  Distributed-trace id (hex) for correlating this response with traces and logs. Present only when tracing is enabled and the request was recorded. Opaque and safe to log/share.
  Example"4bf92f3577b34da6a3ce929d0e0e4736"
- errorsarray of objects
  Field-level violations (present for validation errors).
  Each item:
  A single field-level validation violation.
  Show item attributesHide item attributes
  fieldstringrequired
  Offending field, dotted for nested bodies (e.g. child.id).
  Example"token_type_hint"
  codestringrequired
  Machine-readable violation code: required, too_short, too_long, pattern, invalid_format, not_allowed, minimum, maximum, multiple_of, too_few, too_many, not_unique, malformed.
  Example"not_allowed"
  messagestringrequired
  Example"field token_type_hint must be one of [access_token, refresh_token]"
403 Forbiddenapplication/problem+jsonProblem details (RFC 9457) with an RFC 6750 / RFC 9449 challenge.
Problem details (RFC 9457) with an RFC 6750 / RFC 9449 challenge.
Headers
- Cache-Controlno-store
- WWW-Authenticatestring
- DPoP-Noncestring
Body
RFC 9457 (formerly RFC 7807) problem details (application/problem+json). code is a stable machine-readable slug for the problem kind (it mirrors the last path segment of type), so consumers can branch on it without parsing prose. type is https://nauthera.io/problems/<code>, which resolves to the code's runbook: why it happened, who is affected and what to do (RFC 9457 §3.1.1). A problem without a code has about:blank. errors is present on validation failures and lists every offending field.
- titlestringrequired
  Example"Request validation failed"
- statusintegerrequired
  Example400
- typestring · uri
  Example"https://nauthera.io/problems/validation_error"
- detailstring
  Example"One or more fields did not satisfy the API schema."
- codeenum
  The kind of problem, as a stable machine-readable slug a client branches on and translates rather than parsing title or detail, which are English prose for logs. A problem whose status says everything the server knows carries no code.
  Show moreShow less
  validation_error is the one code whose message is not a sentence about the code itself: the request failed the schema, and the specifics are the errors list — one entry per offending field — which a form renders on those fields. required and malformed are spelled like two of the per-field violation codes (FieldError.code) but mean something else; the two vocabularies are told apart by position, never by spelling.
  
  Compatibility: this is a CLOSED enum, with the same cost as AuditAction: a client generated against an older version of this document rejects a problem carrying a code added after it was built. Regenerate on upgrade, or decode the field as a plain string. It is enumerated anyway so that what a client must translate is knowable from the contract alone.
  Possible values43 values
  invalid_request
  invalid_credentials
  forbidden
  unauthorized
  insufficient_user_authentication
  protected_account
  password_held_by_directory
  last_role_administrator
  invalid_code
  too_many_requests
  too_many_attempts
  account_locked
  account_unavailable
  already_enrolled
  registration_disabled
  registration_conflict
  captcha_failed
  invalid_reset_link
  password_reused
  password_too_short
  password_too_long
  password_compromised
  invalid_verification_link
  invalid_invitation_link
  mail_relay_missing
  email_unverified
  not_found
  conflict
  unavailable
  busy
  window_too_large
  too_many_series
  internal_error
  rate_limited
  malformed
  body_too_large
  required
  validation_error
  unknown_org
  invalid_token
  invalid_dpop_proof
  use_dpop_nonce
  server_error
- instancestring
  Example"/introspect"
- request_idstring
  Example"8d94ed49-1caf-4ab3-9594-557142f2d023"
- trace_idstring
  Distributed-trace id (hex) for correlating this response with traces and logs. Present only when tracing is enabled and the request was recorded. Opaque and safe to log/share.
  Example"4bf92f3577b34da6a3ce929d0e0e4736"
- errorsarray of objects
  Field-level violations (present for validation errors).
  Each item:
  A single field-level validation violation.
  Show item attributesHide item attributes
  fieldstringrequired
  Offending field, dotted for nested bodies (e.g. child.id).
  Example"token_type_hint"
  codestringrequired
  Machine-readable violation code: required, too_short, too_long, pattern, invalid_format, not_allowed, minimum, maximum, multiple_of, too_few, too_many, not_unique, malformed.
  Example"not_allowed"
  messagestringrequired
  Example"field token_type_hint must be one of [access_token, refresh_token]"
404 Not Foundapplication/problem+jsonProblem details (RFC 9457).
Problem details (RFC 9457).
Body
RFC 9457 (formerly RFC 7807) problem details (application/problem+json). code is a stable machine-readable slug for the problem kind (it mirrors the last path segment of type), so consumers can branch on it without parsing prose. type is https://nauthera.io/problems/<code>, which resolves to the code's runbook: why it happened, who is affected and what to do (RFC 9457 §3.1.1). A problem without a code has about:blank. errors is present on validation failures and lists every offending field.
- titlestringrequired
  Example"Request validation failed"
- statusintegerrequired
  Example400
- typestring · uri
  Example"https://nauthera.io/problems/validation_error"
- detailstring
  Example"One or more fields did not satisfy the API schema."
- codeenum
  The kind of problem, as a stable machine-readable slug a client branches on and translates rather than parsing title or detail, which are English prose for logs. A problem whose status says everything the server knows carries no code.
  Show moreShow less
  validation_error is the one code whose message is not a sentence about the code itself: the request failed the schema, and the specifics are the errors list — one entry per offending field — which a form renders on those fields. required and malformed are spelled like two of the per-field violation codes (FieldError.code) but mean something else; the two vocabularies are told apart by position, never by spelling.
  
  Compatibility: this is a CLOSED enum, with the same cost as AuditAction: a client generated against an older version of this document rejects a problem carrying a code added after it was built. Regenerate on upgrade, or decode the field as a plain string. It is enumerated anyway so that what a client must translate is knowable from the contract alone.
  Possible values43 values
  invalid_request
  invalid_credentials
  forbidden
  unauthorized
  insufficient_user_authentication
  protected_account
  password_held_by_directory
  last_role_administrator
  invalid_code
  too_many_requests
  too_many_attempts
  account_locked
  account_unavailable
  already_enrolled
  registration_disabled
  registration_conflict
  captcha_failed
  invalid_reset_link
  password_reused
  password_too_short
  password_too_long
  password_compromised
  invalid_verification_link
  invalid_invitation_link
  mail_relay_missing
  email_unverified
  not_found
  conflict
  unavailable
  busy
  window_too_large
  too_many_series
  internal_error
  rate_limited
  malformed
  body_too_large
  required
  validation_error
  unknown_org
  invalid_token
  invalid_dpop_proof
  use_dpop_nonce
  server_error
- instancestring
  Example"/introspect"
- request_idstring
  Example"8d94ed49-1caf-4ab3-9594-557142f2d023"
- trace_idstring
  Distributed-trace id (hex) for correlating this response with traces and logs. Present only when tracing is enabled and the request was recorded. Opaque and safe to log/share.
  Example"4bf92f3577b34da6a3ce929d0e0e4736"
- errorsarray of objects
  Field-level violations (present for validation errors).
  Each item:
  A single field-level validation violation.
  Show item attributesHide item attributes
  fieldstringrequired
  Offending field, dotted for nested bodies (e.g. child.id).
  Example"token_type_hint"
  codestringrequired
  Machine-readable violation code: required, too_short, too_long, pattern, invalid_format, not_allowed, minimum, maximum, multiple_of, too_few, too_many, not_unique, malformed.
  Example"not_allowed"
  messagestringrequired
  Example"field token_type_hint must be one of [access_token, refresh_token]"
429 Too Many Requestsapplication/problem+jsonToo many requests.
Too many requests.
Body
RFC 9457 (formerly RFC 7807) problem details (application/problem+json). code is a stable machine-readable slug for the problem kind (it mirrors the last path segment of type), so consumers can branch on it without parsing prose. type is https://nauthera.io/problems/<code>, which resolves to the code's runbook: why it happened, who is affected and what to do (RFC 9457 §3.1.1). A problem without a code has about:blank. errors is present on validation failures and lists every offending field.
- titlestringrequired
  Example"Request validation failed"
- statusintegerrequired
  Example400
- typestring · uri
  Example"https://nauthera.io/problems/validation_error"
- detailstring
  Example"One or more fields did not satisfy the API schema."
- codeenum
  The kind of problem, as a stable machine-readable slug a client branches on and translates rather than parsing title or detail, which are English prose for logs. A problem whose status says everything the server knows carries no code.
  Show moreShow less
  validation_error is the one code whose message is not a sentence about the code itself: the request failed the schema, and the specifics are the errors list — one entry per offending field — which a form renders on those fields. required and malformed are spelled like two of the per-field violation codes (FieldError.code) but mean something else; the two vocabularies are told apart by position, never by spelling.
  
  Compatibility: this is a CLOSED enum, with the same cost as AuditAction: a client generated against an older version of this document rejects a problem carrying a code added after it was built. Regenerate on upgrade, or decode the field as a plain string. It is enumerated anyway so that what a client must translate is knowable from the contract alone.
  Possible values43 values
  invalid_request
  invalid_credentials
  forbidden
  unauthorized
  insufficient_user_authentication
  protected_account
  password_held_by_directory
  last_role_administrator
  invalid_code
  too_many_requests
  too_many_attempts
  account_locked
  account_unavailable
  already_enrolled
  registration_disabled
  registration_conflict
  captcha_failed
  invalid_reset_link
  password_reused
  password_too_short
  password_too_long
  password_compromised
  invalid_verification_link
  invalid_invitation_link
  mail_relay_missing
  email_unverified
  not_found
  conflict
  unavailable
  busy
  window_too_large
  too_many_series
  internal_error
  rate_limited
  malformed
  body_too_large
  required
  validation_error
  unknown_org
  invalid_token
  invalid_dpop_proof
  use_dpop_nonce
  server_error
- instancestring
  Example"/introspect"
- request_idstring
  Example"8d94ed49-1caf-4ab3-9594-557142f2d023"
- trace_idstring
  Distributed-trace id (hex) for correlating this response with traces and logs. Present only when tracing is enabled and the request was recorded. Opaque and safe to log/share.
  Example"4bf92f3577b34da6a3ce929d0e0e4736"
- errorsarray of objects
  Field-level violations (present for validation errors).
  Each item:
  A single field-level validation violation.
  Show item attributesHide item attributes
  fieldstringrequired
  Offending field, dotted for nested bodies (e.g. child.id).
  Example"token_type_hint"
  codestringrequired
  Machine-readable violation code: required, too_short, too_long, pattern, invalid_format, not_allowed, minimum, maximum, multiple_of, too_few, too_many, not_unique, malformed.
  Example"not_allowed"
  messagestringrequired
  Example"field token_type_hint must be one of [access_token, refresh_token]"
Errorapplication/problem+jsonProblem details (RFC 9457) with an RFC 6750 / RFC 9449 challenge.
Problem details (RFC 9457) with an RFC 6750 / RFC 9449 challenge.
Headers
- Cache-Controlno-store
- WWW-Authenticatestring
- DPoP-Noncestring
Body
RFC 9457 (formerly RFC 7807) problem details (application/problem+json). code is a stable machine-readable slug for the problem kind (it mirrors the last path segment of type), so consumers can branch on it without parsing prose. type is https://nauthera.io/problems/<code>, which resolves to the code's runbook: why it happened, who is affected and what to do (RFC 9457 §3.1.1). A problem without a code has about:blank. errors is present on validation failures and lists every offending field.
- titlestringrequired
  Example"Request validation failed"
- statusintegerrequired
  Example400
- typestring · uri
  Example"https://nauthera.io/problems/validation_error"
- detailstring
  Example"One or more fields did not satisfy the API schema."
- codeenum
  The kind of problem, as a stable machine-readable slug a client branches on and translates rather than parsing title or detail, which are English prose for logs. A problem whose status says everything the server knows carries no code.
  Show moreShow less
  validation_error is the one code whose message is not a sentence about the code itself: the request failed the schema, and the specifics are the errors list — one entry per offending field — which a form renders on those fields. required and malformed are spelled like two of the per-field violation codes (FieldError.code) but mean something else; the two vocabularies are told apart by position, never by spelling.
  
  Compatibility: this is a CLOSED enum, with the same cost as AuditAction: a client generated against an older version of this document rejects a problem carrying a code added after it was built. Regenerate on upgrade, or decode the field as a plain string. It is enumerated anyway so that what a client must translate is knowable from the contract alone.
  Possible values43 values
  invalid_request
  invalid_credentials
  forbidden
  unauthorized
  insufficient_user_authentication
  protected_account
  password_held_by_directory
  last_role_administrator
  invalid_code
  too_many_requests
  too_many_attempts
  account_locked
  account_unavailable
  already_enrolled
  registration_disabled
  registration_conflict
  captcha_failed
  invalid_reset_link
  password_reused
  password_too_short
  password_too_long
  password_compromised
  invalid_verification_link
  invalid_invitation_link
  mail_relay_missing
  email_unverified
  not_found
  conflict
  unavailable
  busy
  window_too_large
  too_many_series
  internal_error
  rate_limited
  malformed
  body_too_large
  required
  validation_error
  unknown_org
  invalid_token
  invalid_dpop_proof
  use_dpop_nonce
  server_error
- instancestring
  Example"/introspect"
- request_idstring
  Example"8d94ed49-1caf-4ab3-9594-557142f2d023"
- trace_idstring
  Distributed-trace id (hex) for correlating this response with traces and logs. Present only when tracing is enabled and the request was recorded. Opaque and safe to log/share.
  Example"4bf92f3577b34da6a3ce929d0e0e4736"
- errorsarray of objects
  Field-level violations (present for validation errors).
  Each item:
  A single field-level validation violation.
  Show item attributesHide item attributes
  fieldstringrequired
  Offending field, dotted for nested bodies (e.g. child.id).
  Example"token_type_hint"
  codestringrequired
  Machine-readable violation code: required, too_short, too_long, pattern, invalid_format, not_allowed, minimum, maximum, multiple_of, too_few, too_many, not_unique, malformed.
  Example"not_allowed"
  messagestringrequired
  Example"field token_type_hint must be one of [access_token, refresh_token]"

PreviousList an organization's OIDC clients NextCount one OIDC client's daily, monthly and all-time users

Authorization

Path parameters

Headers

Responses

Headers

Body

Headers

Body

Headers

Body

Body

Body

Headers

Body