# Get one OIDC client's registered configuration (admin)

`GET /v1/admin/orgs/{slug}/clients/{id}`

Returns the registered configuration of one of `slug`'s organization's
OIDC clients, named by its registration id: its redirect and logout
addresses, scopes, grant and response types, how it authenticates, its
PKCE policy, token lifetimes and signing algorithms, how it came to be
registered, and the labels the organization may see. A client of another
organization is answered as 404, exactly like an id that does not exist.

**No secret material.** The response says whether the client holds a
secret (`has_secret`) and nothing more. The server keeps only a one-way
hash of a client secret, shown once when it is minted, so there is no
secret to return; neither the hash nor the registration access token is
ever included either.

**Personal data.** The registration contacts (RFC 7591 §2 `contacts`)
are returned only to a caller holding `users.pii.read`; without it the
field is absent.

A lifetime field is absent when the client registered none and so takes
the server's default. Requires the `nauthera.clients:read` scope and the
`clients.read` permission.

## Authorization

- [Bearer token](https://www.nauthera.io/docs/v1/api#auth-bearerAuth) (`bearerAuth`) and [OAuth 2.0](https://www.nauthera.io/docs/v1/api#auth-oauth2) (`oauth2`) with scope `nauthera.clients:read`

Authorization header: The access token, as `Bearer <token>` (RFC 6750 §2.1) or, for a sender-constrained token, `DPoP <token>` (RFC 9449 §7.1). A token minted with a `cnf.jkt` confirmation is only accepted together with a `DPoP` proof signed by that key, whichever of the two schemes carries it.

Requires the permission [`clients.read`](https://www.nauthera.io/docs/v1/api#permission-clients.read): Read an organization's OIDC clients.

This endpoint is rate limited; it answers `429` when a limit is hit.

## Path parameters

- `slug` (string, required): The organization slug. It names the TENANT OF RECORD for the operation: the rows it reads and writes, the policy its secrets are derived under, and the organization its audit record is filed against all come from this organization. A token is admitted only through its own slug, except a main-org token, which may be admitted through any — so cross-tenant administration is performed through the TARGET tenant's slug, never by naming its resources through another. A token reaching for a slug it may not be admitted through is refused identically whether that organization exists or not. Constraints: 1–64 characters.
- `id` (string, required): The client's registration id (UUID), as the clients listing returns it in `id` — not its `client_id`, which another registration in the same organization may also carry. Constraints: 1–64 characters.

## Headers

- `DPoP` (string, optional): DPoP proof JWT (RFC 9449 §4). REQUIRED on a request presenting a DPoP-bound access token, and it must be signed by the key named in the token's `cnf.jkt` and cover this request's method and URI. The proof is read from the request itself rather than from this decoded parameter, so every protected operation is covered whether or not it declares it.

## Responses

### 200 OK

The client's registered configuration.

Content type: `application/json`

Headers:
- `Cache-Control` = `no-store`

One OIDC client's registered configuration as the admin API shows it:
everything the list carries, plus the registered metadata an
administrator needs to see why a relying party fails. It never carries
a secret, a secret hash or a registration access token — only whether
the client holds a secret.

- `id` (string, required): The registration id (UUID).
- `client_id` (string, required): The OAuth client identifier relying parties present.
- `display_name` (string, required): The name the client is shown under; empty when it registered none.
- `display_name_markers` (array of enums, required): What about the display name is there to be misread, in a fixed order; empty for an ordinary name. One of: `"bidi"`, `"control"`, `"invisible"`, `"padded"`, `"overlong"`, `"markup"`.

  Each item: What about a client's display name is there to be misread: a direction override, isolate or mark (`bidi`), a control character (`control`), invisible characters (`invisible`), surrounding or repeated whitespace (`padded`), a name longer than the sign-in pages show (`overlong`), or markup (`markup`).
- `type` (enum, required): Whether a client authenticates at the token endpoint: a public client holds no credential, a confidential one holds a secret or a key. One of: `"public"`, `"confidential"`.
- `token_endpoint_auth_method` (enum, required): How a client authenticates at the token endpoint (RFC 7591 §2). One of: `"none"`, `"client_secret_basic"`, `"client_secret_post"`, `"private_key_jwt"`.
- `grant_types` (array of enums, required): The grant types the client is registered for. One of: `"authorization_code"`, `"refresh_token"`, `"client_credentials"`, `"urn:ietf:params:oauth:grant-type:device_code"`.

  Each item: A grant type a client may use at the token endpoint (RFC 7591 §2).
- `source` (enum, required): How a client came to be registered: by an operator over the control plane, by dynamic registration (RFC 7591), or by the server itself, as an organization's admin console and machine client. One of: `"operator"`, `"dynamic"`, `"provisioner"`.
- `created_at` (string (date-time), required)
- `updated_at` (string (date-time), required)
- `issuer` (string, required): The issuer the client is registered under: the `iss` of the tokens it receives, and the base of its discovery document (`{issuer}/.well-known/openid-configuration`).
- `redirect_uris` (array of strings, required): The registered redirection URIs, exactly as registered.
- `post_logout_redirect_uris` (array of strings, required): The registered post-logout redirection URIs.
- `response_types` (array of strings, required): The registered response types.
- `scopes` (array of strings, required): The scopes the client may request.
- `pkce_policy` (enum, required): Whether the client must present a PKCE (S256) challenge on the authorization code grant (RFC 7636): `required_s256`, `optional` or `disabled`. A public client is held to PKCE whatever its policy says; `pkce_required` reports the effective answer. One of: `"required_s256"`, `"optional"`, `"disabled"`.
- `pkce_required` (boolean, required): Whether the client must present a PKCE S256 challenge, after the rule that a public client always must.
- `allow_refresh` (boolean, required): Whether the client may be issued refresh tokens.
- `require_signed_request_object` (boolean, required): Whether every authorization request must be a signed request object.
- `authorization_details_types` (array of strings, required): The rich authorization request types (RFC 9396) the client may use.
- `has_secret` (boolean, required): Whether the client holds a client secret. The secret itself is never returned: only a one-way hash of it is stored, and the plaintext was shown once, when it was minted.
- `second_factor` (object, required): Which second factors a sign-in may use, and when a user who holds one is spared the challenge. The deployment, the organization and the client each carry one, and a sign-in runs under the three narrowed together: a level can remove a method, add the requirement, keep passwordless sign-in closed or spare fewer sign-ins, and never the reverse. A write that states more than the levels above allow (a method they do not permit, passwordless sign-in they keep closed, a longer remember window, a zone they do not spare in) is refused with 400 naming the field and the bound. A write replaces the whole policy. No other properties are accepted.
  - `methods` (array of enums, optional): The methods a user may enroll and answer with. Empty inherits the level above. One of: `"totp"`, `"passkey"`, `"email"`. Constraints: at most 3 items.
  - `required` (boolean, optional): Sends a user who holds no permitted factor through enrollment before a session is issued.
  - `passwordless` (boolean, optional): Opens sign-in with a discoverable passkey and no password. It is open only where the deployment, the organization and the client all open it.
  - `remember_for_seconds` (integer (int64), optional): Spares a user who holds a permitted factor the challenge on a browser that passed a second factor for them within this many seconds, while their password and factors are the ones it passed under. Zero inherits the level above's window. Constraints: at least 0.
  - `spare_zones` (array of strings, optional): Spares such a user the challenge from these of the deployment's network zones. Empty inherits the level above's. Constraints: at most 64 items; each item: at most 63 characters.
  - `always_challenge` (boolean, optional): Spares no sign-in, on a remembered browser or in a zone.
  - `rules` (array of objects, optional): Narrow this level's policy for the sign-ins that meet them. Constraints: at most 64 items. No other properties are accepted.

    Each item: Narrows its level's policy for a sign-in that meets every condition it sets. A rule only ever narrows its own level.
    - `name` (string, required): Names the rule in the sign-in's audit record; unique on its level. Constraints: at most 63 characters.
    - `outside_zones` (array of strings, optional): Holds for an address in none of these network zones. Constraints: at most 64 items; each item: at most 63 characters.
    - `inside_zones` (array of strings, optional): Holds for an address in one of these network zones. Constraints: at most 64 items; each item: at most 63 characters.
    - `new_network` (boolean, optional): Holds for a network the user has completed no sign-in from.
    - `new_browser` (boolean, optional): Holds for a browser that has not passed a second factor for the user under their current password and factors.
    - `methods` (array of enums, optional): Narrows the permitted methods to these. One of: `"totp"`, `"passkey"`, `"email"`. Constraints: at most 3 items.
    - `require` (boolean, optional): Requires a second factor, which no exemption spares.
- `access_token_ttl_seconds` (integer (int64), optional): The registered access-token lifetime in seconds; absent when the client takes the server's default.
- `refresh_token_ttl_seconds` (integer (int64), optional): The registered refresh-token lifetime in seconds; absent when the client takes the server's default.
- `id_token_ttl_seconds` (integer (int64), optional): The registered ID-token lifetime in seconds; absent when the client takes the server's default.
- `id_token_signed_response_alg` (string, optional): The JWS algorithm the client's ID tokens are signed with; absent when it takes the server's default.
- `token_endpoint_auth_signing_alg` (string, optional): The JWS algorithm a `private_key_jwt` client signs its assertions with; absent when unrestricted.
- `jwks_uri` (string, optional): Where the server fetches the client's public keys from; absent when it registered none.
- `backchannel_logout_uri` (string, optional): The client's back-channel logout URI; absent when it registered none.
- `backchannel_logout_session_required` (boolean, optional): Whether back-channel logout tokens must carry a `sid`.
- `frontchannel_logout_uri` (string, optional): The client's front-channel logout URI; absent when it registered none.
- `frontchannel_logout_session_required` (boolean, optional): Whether front-channel logout requests must carry `iss` and `sid`.
- `secret_location` (object, optional): Where an operator-managed client's secret is kept in the cluster that manages it, as the operator last reported it: a Secret and the key in it. Never the secret. Absent for a client the operator does not manage or that has no secret.
  - `namespace` (string, required): The Secret's namespace, the client manifest's own.
  - `name` (string, required): The Secret's name.
  - `key` (string, required): The key in the Secret's data holding the client secret.
  - `origin` (enum, required): Who chose an operator client's secret: the server, which minted it and the operator wrote it to the Secret (`minted`), or the team managing the client, whose Secret the operator reads it from (`supplied`). One of: `"minted"`, `"supplied"`.
  - `fingerprint` (string, required): The fingerprint of the secret the server held when the operator reported the location, as the OIDCClient's `status.secretFingerprint` and the Secret's `nauthera.io/secret-fingerprint` annotation show it.
- `labels` (map of strings, optional): The client's labels, except the server's reserved ones under `nauthera.dev/`, which carry its organization and machine roles; absent when it has none.
- `contacts` (array of strings, optional): The registration contacts (RFC 7591 §2). Personal data: present only for a caller holding `users.pii.read`, and only when the client registered some.
- `client_uri` (string, optional): The client's home page, as it registered it (RFC 7591 §2).
- `logo_uri` (string, optional): The client's logo, as it registered it (RFC 7591 §2).
- `policy_uri` (string, optional): The client's privacy policy, as it registered it (RFC 7591 §2).
- `tos_uri` (string, optional): The client's terms of service, as it registered it (RFC 7591 §2).
- `software_id` (string, optional): The self-asserted software id it registered (RFC 7591 §2).
- `software_version` (string, optional): The self-asserted software version it registered (RFC 7591 §2).

### 401 Unauthorized

Problem details (RFC 9457) with an RFC 6750 / RFC 9449 challenge.

Content type: `application/problem+json`

Headers:
- `Cache-Control` = `no-store`
- `WWW-Authenticate` (string)
- `DPoP-Nonce` (string)

RFC 9457 (formerly RFC 7807) problem details (application/problem+json). `code` is a stable machine-readable slug for the problem kind (it mirrors the last path segment of `type`), so consumers can branch on it without parsing prose. `type` is `https://nauthera.io/problems/<code>`, which resolves to the code's runbook: why it happened, who is affected and what to do (RFC 9457 §3.1.1). A problem without a code has `about:blank`. `errors` is present on validation failures and lists every offending field.

- `title` (string, required): Example: `"Request validation failed"`.
- `status` (integer, required): Example: `400`.
- `type` (string (uri), optional): Example: `"https://nauthera.io/problems/validation_error"`.
- `detail` (string, optional): Example: `"One or more fields did not satisfy the API schema."`.
- `code` (enum, optional): The kind of problem, as a stable machine-readable slug a client branches on and translates rather than parsing `title` or `detail`, which are English prose for logs. A problem whose status says everything the server knows carries no `code`. One of: `"invalid_request"`, `"invalid_credentials"`, `"forbidden"`, `"unauthorized"`, `"insufficient_user_authentication"`, `"protected_account"`, `"password_held_by_directory"`, `"last_role_administrator"`, `"invalid_code"`, `"too_many_requests"`, `"too_many_attempts"`, `"account_locked"`, `"account_unavailable"`, `"already_enrolled"`, `"registration_disabled"`, `"registration_conflict"`, `"captcha_failed"`, `"invalid_reset_link"`, `"password_reused"`, `"password_too_short"`, `"password_too_long"`, `"password_compromised"`, `"invalid_verification_link"`, `"invalid_invitation_link"`, `"mail_relay_missing"`, `"email_unverified"`, `"not_found"`, `"conflict"`, `"unavailable"`, `"busy"`, `"window_too_large"`, `"too_many_series"`, `"internal_error"`, `"rate_limited"`, `"malformed"`, `"body_too_large"`, `"required"`, `"validation_error"`, `"unknown_org"`, `"invalid_token"`, `"invalid_dpop_proof"`, `"use_dpop_nonce"`, `"server_error"`.

  `validation_error` is the one code whose message is not a sentence about
  the code itself: the request failed the schema, and the specifics are
  the `errors` list — one entry per offending field — which a form renders
  on those fields. `required` and `malformed` are spelled like two of the
  per-field violation codes (`FieldError.code`) but mean something else;
  the two vocabularies are told apart by position, never by spelling.

  **Compatibility:** this is a CLOSED enum, with the same cost as
  `AuditAction`: a client generated against an older version of this
  document rejects a problem carrying a code added after it was built.
  Regenerate on upgrade, or decode the field as a plain string. It is
  enumerated anyway so that what a client must translate is knowable
  from the contract alone.
- `instance` (string, optional): Example: `"/introspect"`.
- `request_id` (string, optional): Example: `"8d94ed49-1caf-4ab3-9594-557142f2d023"`.
- `trace_id` (string, optional): Distributed-trace id (hex) for correlating this response with traces and logs. Present only when tracing is enabled and the request was recorded. Opaque and safe to log/share. Example: `"4bf92f3577b34da6a3ce929d0e0e4736"`.
- `errors` (array of objects, optional): Field-level violations (present for validation errors).

  Each item: A single field-level validation violation.
  - `field` (string, required): Offending field, dotted for nested bodies (e.g. child.id). Example: `"token_type_hint"`.
  - `code` (string, required): Machine-readable violation code: required, too_short, too_long, pattern, invalid_format, not_allowed, minimum, maximum, multiple_of, too_few, too_many, not_unique, malformed. Example: `"not_allowed"`.
  - `message` (string, required): Example: `"field token_type_hint must be one of [access_token, refresh_token]"`.

### 403 Forbidden

Problem details (RFC 9457) with an RFC 6750 / RFC 9449 challenge.

Content type: `application/problem+json`

Headers:
- `Cache-Control` = `no-store`
- `WWW-Authenticate` (string)
- `DPoP-Nonce` (string)

RFC 9457 (formerly RFC 7807) problem details (application/problem+json). `code` is a stable machine-readable slug for the problem kind (it mirrors the last path segment of `type`), so consumers can branch on it without parsing prose. `type` is `https://nauthera.io/problems/<code>`, which resolves to the code's runbook: why it happened, who is affected and what to do (RFC 9457 §3.1.1). A problem without a code has `about:blank`. `errors` is present on validation failures and lists every offending field.

- `title` (string, required): Example: `"Request validation failed"`.
- `status` (integer, required): Example: `400`.
- `type` (string (uri), optional): Example: `"https://nauthera.io/problems/validation_error"`.
- `detail` (string, optional): Example: `"One or more fields did not satisfy the API schema."`.
- `code` (enum, optional): The kind of problem, as a stable machine-readable slug a client branches on and translates rather than parsing `title` or `detail`, which are English prose for logs. A problem whose status says everything the server knows carries no `code`. One of: `"invalid_request"`, `"invalid_credentials"`, `"forbidden"`, `"unauthorized"`, `"insufficient_user_authentication"`, `"protected_account"`, `"password_held_by_directory"`, `"last_role_administrator"`, `"invalid_code"`, `"too_many_requests"`, `"too_many_attempts"`, `"account_locked"`, `"account_unavailable"`, `"already_enrolled"`, `"registration_disabled"`, `"registration_conflict"`, `"captcha_failed"`, `"invalid_reset_link"`, `"password_reused"`, `"password_too_short"`, `"password_too_long"`, `"password_compromised"`, `"invalid_verification_link"`, `"invalid_invitation_link"`, `"mail_relay_missing"`, `"email_unverified"`, `"not_found"`, `"conflict"`, `"unavailable"`, `"busy"`, `"window_too_large"`, `"too_many_series"`, `"internal_error"`, `"rate_limited"`, `"malformed"`, `"body_too_large"`, `"required"`, `"validation_error"`, `"unknown_org"`, `"invalid_token"`, `"invalid_dpop_proof"`, `"use_dpop_nonce"`, `"server_error"`.

  `validation_error` is the one code whose message is not a sentence about
  the code itself: the request failed the schema, and the specifics are
  the `errors` list — one entry per offending field — which a form renders
  on those fields. `required` and `malformed` are spelled like two of the
  per-field violation codes (`FieldError.code`) but mean something else;
  the two vocabularies are told apart by position, never by spelling.

  **Compatibility:** this is a CLOSED enum, with the same cost as
  `AuditAction`: a client generated against an older version of this
  document rejects a problem carrying a code added after it was built.
  Regenerate on upgrade, or decode the field as a plain string. It is
  enumerated anyway so that what a client must translate is knowable
  from the contract alone.
- `instance` (string, optional): Example: `"/introspect"`.
- `request_id` (string, optional): Example: `"8d94ed49-1caf-4ab3-9594-557142f2d023"`.
- `trace_id` (string, optional): Distributed-trace id (hex) for correlating this response with traces and logs. Present only when tracing is enabled and the request was recorded. Opaque and safe to log/share. Example: `"4bf92f3577b34da6a3ce929d0e0e4736"`.
- `errors` (array of objects, optional): Field-level violations (present for validation errors).

  Each item: A single field-level validation violation.
  - `field` (string, required): Offending field, dotted for nested bodies (e.g. child.id). Example: `"token_type_hint"`.
  - `code` (string, required): Machine-readable violation code: required, too_short, too_long, pattern, invalid_format, not_allowed, minimum, maximum, multiple_of, too_few, too_many, not_unique, malformed. Example: `"not_allowed"`.
  - `message` (string, required): Example: `"field token_type_hint must be one of [access_token, refresh_token]"`.

### 404 Not Found

Problem details (RFC 9457).

Content type: `application/problem+json`

RFC 9457 (formerly RFC 7807) problem details (application/problem+json). `code` is a stable machine-readable slug for the problem kind (it mirrors the last path segment of `type`), so consumers can branch on it without parsing prose. `type` is `https://nauthera.io/problems/<code>`, which resolves to the code's runbook: why it happened, who is affected and what to do (RFC 9457 §3.1.1). A problem without a code has `about:blank`. `errors` is present on validation failures and lists every offending field.

- `title` (string, required): Example: `"Request validation failed"`.
- `status` (integer, required): Example: `400`.
- `type` (string (uri), optional): Example: `"https://nauthera.io/problems/validation_error"`.
- `detail` (string, optional): Example: `"One or more fields did not satisfy the API schema."`.
- `code` (enum, optional): The kind of problem, as a stable machine-readable slug a client branches on and translates rather than parsing `title` or `detail`, which are English prose for logs. A problem whose status says everything the server knows carries no `code`. One of: `"invalid_request"`, `"invalid_credentials"`, `"forbidden"`, `"unauthorized"`, `"insufficient_user_authentication"`, `"protected_account"`, `"password_held_by_directory"`, `"last_role_administrator"`, `"invalid_code"`, `"too_many_requests"`, `"too_many_attempts"`, `"account_locked"`, `"account_unavailable"`, `"already_enrolled"`, `"registration_disabled"`, `"registration_conflict"`, `"captcha_failed"`, `"invalid_reset_link"`, `"password_reused"`, `"password_too_short"`, `"password_too_long"`, `"password_compromised"`, `"invalid_verification_link"`, `"invalid_invitation_link"`, `"mail_relay_missing"`, `"email_unverified"`, `"not_found"`, `"conflict"`, `"unavailable"`, `"busy"`, `"window_too_large"`, `"too_many_series"`, `"internal_error"`, `"rate_limited"`, `"malformed"`, `"body_too_large"`, `"required"`, `"validation_error"`, `"unknown_org"`, `"invalid_token"`, `"invalid_dpop_proof"`, `"use_dpop_nonce"`, `"server_error"`.

  `validation_error` is the one code whose message is not a sentence about
  the code itself: the request failed the schema, and the specifics are
  the `errors` list — one entry per offending field — which a form renders
  on those fields. `required` and `malformed` are spelled like two of the
  per-field violation codes (`FieldError.code`) but mean something else;
  the two vocabularies are told apart by position, never by spelling.

  **Compatibility:** this is a CLOSED enum, with the same cost as
  `AuditAction`: a client generated against an older version of this
  document rejects a problem carrying a code added after it was built.
  Regenerate on upgrade, or decode the field as a plain string. It is
  enumerated anyway so that what a client must translate is knowable
  from the contract alone.
- `instance` (string, optional): Example: `"/introspect"`.
- `request_id` (string, optional): Example: `"8d94ed49-1caf-4ab3-9594-557142f2d023"`.
- `trace_id` (string, optional): Distributed-trace id (hex) for correlating this response with traces and logs. Present only when tracing is enabled and the request was recorded. Opaque and safe to log/share. Example: `"4bf92f3577b34da6a3ce929d0e0e4736"`.
- `errors` (array of objects, optional): Field-level violations (present for validation errors).

  Each item: A single field-level validation violation.
  - `field` (string, required): Offending field, dotted for nested bodies (e.g. child.id). Example: `"token_type_hint"`.
  - `code` (string, required): Machine-readable violation code: required, too_short, too_long, pattern, invalid_format, not_allowed, minimum, maximum, multiple_of, too_few, too_many, not_unique, malformed. Example: `"not_allowed"`.
  - `message` (string, required): Example: `"field token_type_hint must be one of [access_token, refresh_token]"`.

### 429 Too Many Requests

Too many requests.

Content type: `application/problem+json`

RFC 9457 (formerly RFC 7807) problem details (application/problem+json). `code` is a stable machine-readable slug for the problem kind (it mirrors the last path segment of `type`), so consumers can branch on it without parsing prose. `type` is `https://nauthera.io/problems/<code>`, which resolves to the code's runbook: why it happened, who is affected and what to do (RFC 9457 §3.1.1). A problem without a code has `about:blank`. `errors` is present on validation failures and lists every offending field.

- `title` (string, required): Example: `"Request validation failed"`.
- `status` (integer, required): Example: `400`.
- `type` (string (uri), optional): Example: `"https://nauthera.io/problems/validation_error"`.
- `detail` (string, optional): Example: `"One or more fields did not satisfy the API schema."`.
- `code` (enum, optional): The kind of problem, as a stable machine-readable slug a client branches on and translates rather than parsing `title` or `detail`, which are English prose for logs. A problem whose status says everything the server knows carries no `code`. One of: `"invalid_request"`, `"invalid_credentials"`, `"forbidden"`, `"unauthorized"`, `"insufficient_user_authentication"`, `"protected_account"`, `"password_held_by_directory"`, `"last_role_administrator"`, `"invalid_code"`, `"too_many_requests"`, `"too_many_attempts"`, `"account_locked"`, `"account_unavailable"`, `"already_enrolled"`, `"registration_disabled"`, `"registration_conflict"`, `"captcha_failed"`, `"invalid_reset_link"`, `"password_reused"`, `"password_too_short"`, `"password_too_long"`, `"password_compromised"`, `"invalid_verification_link"`, `"invalid_invitation_link"`, `"mail_relay_missing"`, `"email_unverified"`, `"not_found"`, `"conflict"`, `"unavailable"`, `"busy"`, `"window_too_large"`, `"too_many_series"`, `"internal_error"`, `"rate_limited"`, `"malformed"`, `"body_too_large"`, `"required"`, `"validation_error"`, `"unknown_org"`, `"invalid_token"`, `"invalid_dpop_proof"`, `"use_dpop_nonce"`, `"server_error"`.

  `validation_error` is the one code whose message is not a sentence about
  the code itself: the request failed the schema, and the specifics are
  the `errors` list — one entry per offending field — which a form renders
  on those fields. `required` and `malformed` are spelled like two of the
  per-field violation codes (`FieldError.code`) but mean something else;
  the two vocabularies are told apart by position, never by spelling.

  **Compatibility:** this is a CLOSED enum, with the same cost as
  `AuditAction`: a client generated against an older version of this
  document rejects a problem carrying a code added after it was built.
  Regenerate on upgrade, or decode the field as a plain string. It is
  enumerated anyway so that what a client must translate is knowable
  from the contract alone.
- `instance` (string, optional): Example: `"/introspect"`.
- `request_id` (string, optional): Example: `"8d94ed49-1caf-4ab3-9594-557142f2d023"`.
- `trace_id` (string, optional): Distributed-trace id (hex) for correlating this response with traces and logs. Present only when tracing is enabled and the request was recorded. Opaque and safe to log/share. Example: `"4bf92f3577b34da6a3ce929d0e0e4736"`.
- `errors` (array of objects, optional): Field-level violations (present for validation errors).

  Each item: A single field-level validation violation.
  - `field` (string, required): Offending field, dotted for nested bodies (e.g. child.id). Example: `"token_type_hint"`.
  - `code` (string, required): Machine-readable violation code: required, too_short, too_long, pattern, invalid_format, not_allowed, minimum, maximum, multiple_of, too_few, too_many, not_unique, malformed. Example: `"not_allowed"`.
  - `message` (string, required): Example: `"field token_type_hint must be one of [access_token, refresh_token]"`.

### Error

Problem details (RFC 9457) with an RFC 6750 / RFC 9449 challenge.

Content type: `application/problem+json`

Headers:
- `Cache-Control` = `no-store`
- `WWW-Authenticate` (string)
- `DPoP-Nonce` (string)

RFC 9457 (formerly RFC 7807) problem details (application/problem+json). `code` is a stable machine-readable slug for the problem kind (it mirrors the last path segment of `type`), so consumers can branch on it without parsing prose. `type` is `https://nauthera.io/problems/<code>`, which resolves to the code's runbook: why it happened, who is affected and what to do (RFC 9457 §3.1.1). A problem without a code has `about:blank`. `errors` is present on validation failures and lists every offending field.

- `title` (string, required): Example: `"Request validation failed"`.
- `status` (integer, required): Example: `400`.
- `type` (string (uri), optional): Example: `"https://nauthera.io/problems/validation_error"`.
- `detail` (string, optional): Example: `"One or more fields did not satisfy the API schema."`.
- `code` (enum, optional): The kind of problem, as a stable machine-readable slug a client branches on and translates rather than parsing `title` or `detail`, which are English prose for logs. A problem whose status says everything the server knows carries no `code`. One of: `"invalid_request"`, `"invalid_credentials"`, `"forbidden"`, `"unauthorized"`, `"insufficient_user_authentication"`, `"protected_account"`, `"password_held_by_directory"`, `"last_role_administrator"`, `"invalid_code"`, `"too_many_requests"`, `"too_many_attempts"`, `"account_locked"`, `"account_unavailable"`, `"already_enrolled"`, `"registration_disabled"`, `"registration_conflict"`, `"captcha_failed"`, `"invalid_reset_link"`, `"password_reused"`, `"password_too_short"`, `"password_too_long"`, `"password_compromised"`, `"invalid_verification_link"`, `"invalid_invitation_link"`, `"mail_relay_missing"`, `"email_unverified"`, `"not_found"`, `"conflict"`, `"unavailable"`, `"busy"`, `"window_too_large"`, `"too_many_series"`, `"internal_error"`, `"rate_limited"`, `"malformed"`, `"body_too_large"`, `"required"`, `"validation_error"`, `"unknown_org"`, `"invalid_token"`, `"invalid_dpop_proof"`, `"use_dpop_nonce"`, `"server_error"`.

  `validation_error` is the one code whose message is not a sentence about
  the code itself: the request failed the schema, and the specifics are
  the `errors` list — one entry per offending field — which a form renders
  on those fields. `required` and `malformed` are spelled like two of the
  per-field violation codes (`FieldError.code`) but mean something else;
  the two vocabularies are told apart by position, never by spelling.

  **Compatibility:** this is a CLOSED enum, with the same cost as
  `AuditAction`: a client generated against an older version of this
  document rejects a problem carrying a code added after it was built.
  Regenerate on upgrade, or decode the field as a plain string. It is
  enumerated anyway so that what a client must translate is knowable
  from the contract alone.
- `instance` (string, optional): Example: `"/introspect"`.
- `request_id` (string, optional): Example: `"8d94ed49-1caf-4ab3-9594-557142f2d023"`.
- `trace_id` (string, optional): Distributed-trace id (hex) for correlating this response with traces and logs. Present only when tracing is enabled and the request was recorded. Opaque and safe to log/share. Example: `"4bf92f3577b34da6a3ce929d0e0e4736"`.
- `errors` (array of objects, optional): Field-level violations (present for validation errors).

  Each item: A single field-level validation violation.
  - `field` (string, required): Offending field, dotted for nested bodies (e.g. child.id). Example: `"token_type_hint"`.
  - `code` (string, required): Machine-readable violation code: required, too_short, too_long, pattern, invalid_format, not_allowed, minimum, maximum, multiple_of, too_few, too_many, not_unique, malformed. Example: `"not_allowed"`.
  - `message` (string, required): Example: `"field token_type_hint must be one of [access_token, refresh_token]"`.

## Example request

```bash
curl -g 'https://auth.example.com/v1/admin/orgs/{slug}/clients/{id}' \
  -H "Authorization: Bearer $ACCESS_TOKEN"
```

## Example response (200)

```json
{
  "id": "string",
  "client_id": "string",
  "display_name": "string",
  "display_name_markers": [
    "bidi"
  ],
  "type": "public",
  "token_endpoint_auth_method": "none",
  "grant_types": [
    "authorization_code"
  ],
  "source": "operator",
  "created_at": "2026-01-15T09:30:00Z",
  "updated_at": "2026-01-15T09:30:00Z",
  "issuer": "string",
  "redirect_uris": [
    "string"
  ],
  "post_logout_redirect_uris": [
    "string"
  ],
  "response_types": [
    "string"
  ],
  "scopes": [
    "string"
  ],
  "pkce_policy": "required_s256",
  "pkce_required": false,
  "allow_refresh": false,
  "require_signed_request_object": false,
  "authorization_details_types": [
    "string"
  ],
  "has_secret": false,
  "second_factor": {}
}
```