developers

Update Site

Updates site at oxd-server. If something changes in a pre-registered client, you can use this API to update your client in the OP.

post/update-site

Headers

Authorizationstring

AuthorizationOxdIdstring

Request body

oxd_idstring required

redirect_urisstring[]

Provide the list of redirection URIs. The first URL is where the user will be redirected after successful authorization at the OpenID Connect Provider (OP).

post_logout_redirect_urisstring[]

response_typesstring[]

grant_typesstring[]

scopestring[]

acr_valuesstring[]

client_jwks_uristring

client_token_endpoint_auth_methodstring

client_request_urisstring[]

client_sector_identifier_uristring

contactsstring[]

ui_localesstring[]

claims_localesstring[]

access_token_as_jwtboolean

specifies whether access_token should be return as JWT or not. Default value is false.

access_token_signing_algstring

sets signing algorithm used for JWT signing. Valid values are none, HS256, HS384, HS512, RS256, RS384, RS512, ES256, ES384, ES512

rpt_as_jwtboolean

specifies whether RPT should be return as JWT or not. Default value is false.

claims_redirect_uristring[]

client_token_endpoint_auth_signing_algstring

Provide the Requested Client Authentication method for the Token Endpoint. Valid values are none, HS256, HS384, HS512, RS256, RS384, RS512, ES256, ES384, ES512, PS256, PS384, PS512.

client_namestring

oxd will generate its own non-human readable name by default if client_name is not specified

logo_uristring

specifies an URL that references a logo for the Client application.

client_uristring

specifies an URL of the home page of the Client.

policy_uristring

specifies an URL that the Relying Party Client provides to the End-User to read about the how the profile data will be used.

front_channel_logout_session_requiredboolean

specifies if front channel logout session required.

tos_uristring

specifies an URL that the Relying Party Client provides to the End-User to read about the Relying Party's terms.

jwksstring

Client's JSON Web Key Set (JWK) document, passed by value. The semantics of the jwks parameter are the same as the jwks_uri parameter, other than that the JWK Set is passed by value, rather than by reference. This parameter is intended only to be used by Clients that, for some reason, are unable to use the jwks_uri parameter, for instance, by native applications that might not have a location to host the contents of the JWK Set. If a Client can use jwks_uri, it must not use jwks. One significant downside of jwks is that it does not enable key rotation. The jwks_uri and jwks parameters must not be used together.

id_token_binding_cnfstring

tls_client_auth_subject_dnstring

run_introspection_script_beforeaccess_token_as_jwt_creation_and_include_claimsboolean

choose to run introspection script before access_token_as_jwt creation and include claims.

id_token_signed_response_algstring

choose the JWS alg algorithm (JWA) required for the ID Token issued to this client_id. Valid values are none, HS256, HS384, HS512, RS256, RS384, RS512, ES256, ES384, ES512, PS256, PS384, PS512

id_token_encrypted_response_algstring

choose the JWE alg algorithm (JWA) required for encrypting the ID Token issued to this client_id. Valid values are RSA1_5, RSA-OAEP, A128KW, A256KW

id_token_encrypted_response_encstring

choose the JWE enc algorithm (JWA) required for symmetric encryption of the ID Token issued to this client_id. Valid values are A128CBC+HS256, A256CBC+HS512, A128GCM, A256GCM

user_info_signed_response_algstring

choose the JWS alg algorithm (JWA) required for UserInfo responses. Valid values are none, HS256, HS384, HS512, RS256, RS384, RS512, ES256, ES384, ES512, PS256, PS384, PS512

user_info_encrypted_response_algstring

choose the JWE alg algorithm (JWA) required for encrypting UserInfo responses. Valid values are RSA1_5, RSA_OAEP, A128KW, A256KW

user_info_encrypted_response_encstring

choose the JWE enc algorithm (JWA) required for symmetric encryption of UserInfo responses. Valid values are A128CBC+HS256, A256CBC+HS512, A128GCM, A256GCM

request_object_signing_algstring

choose the JWS alg algorithm (JWA) that must be required by the Authorization Server. Valid values are none, HS256, HS384, HS512, RS256, RS384, RS512, ES256, ES384, ES512, PS256, PS384, PS512

request_object_encryption_algstring

choose the JWE alg algorithm (JWA) the RP is declaring that it may use for encrypting Request Objects sent to the OP. Valid values are RSA1_5, RSA_OAEP, A128KW, A256KW

request_object_encryption_encstring

choose the JWE enc algorithm (JWA) the RP is declaring that it may use for encrypting Request Objects sent to the OP. Valid values are A128CBC+HS256, A256CBC+HS512, A128GCM, A256GCM

default_max_ageinteger

specifies the Default Maximum Authentication Age.

require_auth_timeboolean

specifies the Boolean value specifying whether the auth_time claim in the id_token is required. It is required when the value is true. The auth_time claim request in the request object overrides this setting.

initiate_login_uristring

specifies the URI using the https scheme that the authorization server can call to initiate a login at the client.

authorized_originsstring[]

specifies authorized JavaScript origins.

access_token_lifetimeinteger

specifies the Client-specific access token expiration.

software_idstring

specifies a unique identifier string (UUID) assigned by the client developer or software publisher used by registration endpoints to identify the client software to be dynamically registered.

software_versionstring

specifies a version identifier string for the client software identified by 'software_id'. The value of the 'software_version' should change on any update to the client software identified by the same 'software_id'.

software_statementstring

specifies a software statement containing client metadata values about the client software as claims. This is a string value containing the entire signed JWT.

custom_attributesobject

specifies custom attribute map copy.

sync_client_from_opboolean

specifies whether to sync client from OP. Default value is false.

sync_client_period_in_secondsinteger

specifies period after which client can sync again with OP. Default value is 86400 (in seconds).

allow_spontaneous_scopesboolean

specifies whether to allow spontaneous scopes for client. The default value is false

spontaneous_scopesstring[]

list of spontaneous scopes (regexp against which validation is performed).

Example request

{
  "oxd_id": "6F9619FF-8B86-D011-B42D-00CF4FC964FF",
  "redirect_uris": [
    "https://client.example.org/cb"
  ],
  "post_logout_redirect_uris": [
    "https://client.example.org/logout/page1",
    "https://client.example.org/logout/page2",
    "https://client.example.org/logout/page3"
  ],
  "response_types": [
    "code"
  ],
  "grant_types": [
    "authorization_code",
    "client_credentials"
  ],
  "scope": [
    "openid"
  ],
  "acr_values": [
    "basic"
  ],
  "contacts": [
    "foo_bar@spam.org"
  ],
  "logo_uri": "https://client.example.org/logo.png",
  "client_uri": "https://client.example.org/page",
  "policy_uri": "https://client.example.org/page",
  "front_channel_logout_session_required": true,
  "tos_uri": "https://client.example.org/page",
  "jwks": "{\"key1\": \"value1\", \"key2\": \"value2\"}",
  "id_token_binding_cnf": "4NRB1-0XZABZI9E6-5SM3R",
  "tls_client_auth_subject_dn": "www.test.com",
  "run_introspection_script_beforeaccess_token_as_jwt_creation_and_include_claims": true,
  "default_max_age": 1000000,
  "require_auth_time": true,
  "initiate_login_uri": "https://client.example.org/authorization/page",
  "access_token_lifetime": 100000000,
  "software_id": "4NRB1-0XZABZI9E6-5SM3R",
  "software_version": "2.1",
  "sync_client_period_in_seconds": 86400
}

Response

oxd_idstring required

Example response

{
  "oxd_id": "bcad760f-91ba-46e1-a020-05e4281d91b6"
}

Changes

Changed in 3 of the 50 revisions of this API.516

Apr 22, 2020413442ee92801See the full diff
- ○
  added the new optional header request parameter AuthorizationOxdId
  new-optional-request-parameter
Feb 13, 20205ce3fb45d8065See the full diff
- ○
  added optional request body
  request-body-added-optional
- ○
  added the media type application/json for the response with the status 200
  response-media-type-added
- ○
  added the media type application/json for the response with the status 400
  response-media-type-added
- ○
  added the media type application/json for the response with the status 403
  response-media-type-added
- ○
  added the media type application/json for the response with the status 500
  response-media-type-added
Nov 30, 2018c28eaefdb28551See the full diff
- ▲
  removed the request body
  request-body-removed
- ▲
  removed the media type application/json for the response with the status 200
  response-media-type-removed
- ▲
  removed the media type application/json for the response with the status 400
  response-media-type-removed
- ▲
  removed the media type application/json for the response with the status 403
  response-media-type-removed
- ▲
  removed the media type application/json for the response with the status 500
  response-media-type-removed
- ●
  deleted the header request parameter AuthorizationOxdId
  request-parameter-removed
This revision also has 6 changes that name no endpoint, such as unreferenced schemas being removed. See the revision's changelog

Full history