---
title: "Replace an OAuth client's scope ceiling"
method: PATCH
path: "/oauth/clients/{client_id}"
tags: ["oauth"]
---

# Replace an OAuth client's scope ceiling

`PATCH /oauth/clients/{client_id}`

## Request

- Base URL: `https://api.instruxi.dev/api/v1/enforcer`
- URL: `https://api.instruxi.dev/api/v1/enforcer/oauth/clients/{client_id}`
- Auth: API key in header `Authorization`

Replaces the client's allowed scopes with exactly the list given. Every scope must be one this deployment advertises in its metadata document (`scopes_supported`) or a fine scope of the form `enforcer:<tag>.<effect>` with effect `read`, `write` or `destructive`; an unknown scope answers 400 and names it. Existing consents and already-issued tokens are unaffected (their scope was fixed at issue): the new ceiling applies to the next /authorize consent and the next token exchange or refresh. A disabled or unknown client answers 404. Platform admin only.

## Path parameters

- `client_id` string, required

## Request body

- InternalDeliveryHttpHandlerOAuthClientScopesRequest
  - `scopes` string[]: Scopes REPLACES the ceiling: what is listed here is exactly what the client may hold afterwards, no more and no less.

## Response `200`

OK

- InternalDeliveryHttpHandlerOAuthClientScopesResponse
  - `data` InternalDeliveryHttpHandlerOAuthClientSummary
    - `client_id` string
    - `client_id_issued_at` string
    - `client_name` string
    - `confidential` boolean: Confidential separates the clients an admin minted, which can exchange tokens, from the ones that registered themselves and cannot.
    - `disabled` boolean
    - `disabled_at` string
    - `grant_types` string[]
    - `redirect_uris` string[]
    - `scope` string
    - `token_exchange_resource` string
  - `message` string: Message states what did NOT change. Existing grants and issued tokens keep the scope fixed at issue; the new ceiling applies from the next /authorize consent and the next token exchange.
  - `success` boolean

## Other responses

- `400`: Bad Request
- `401`: Unauthorized
- `403`: Forbidden
- `404`: Not Found

---

[API](https://skmtc.dev/instruxi/apis/enforcer-api.md) · [All operations](https://skmtc.dev/instruxi/apis/enforcer-api/llms.txt) · [OpenAPI document](https://skmtc.dev/instruxi/apis/enforcer-api/revisions/fa82bc1becc0?raw)