oauth

Replace an OAuth client's scope ceiling

Replaces the client's allowed scopes with exactly the list given. Every scope must be one this deployment advertises in its metadata document (scopes_supported) or a fine scope of the form enforcer:<tag>.<effect> with effect read, write or destructive; an unknown scope answers 400 and names it. Existing consents and already-issued tokens are unaffected (their scope was fixed at issue): the new ceiling applies to the next /authorize consent and the next token exchange or refresh. A disabled or unknown client answers 404. Platform admin only.

patch/oauth/clients/{client_id}

Request

  • Base URL: https://api.instruxi.dev/api/v1/enforcer
  • URL: https://api.instruxi.dev/api/v1/enforcer/oauth/clients/{client_id}
  • Auth: API key in header Authorization

Path parameters

client_idstring required

client_id whose ceiling to replace

Request body

scopesstring[]

Scopes REPLACES the ceiling: what is listed here is exactly what the client may hold afterwards, no more and no less.

Example request

{
  "scopes": [
    "enforcer:read",
    "enforcer:write"
  ]
}

Response

OK

messagestring

Message states what did NOT change. Existing grants and issued tokens keep the scope fixed at issue; the new ceiling applies from the next /authorize consent and the next token exchange.

successboolean

Example response

{
  "success": true
}

Changes

No recorded changes to this operation across all 1 revision of this API.