---
title: "Dynamic client registration (RFC 7591)"
method: POST
path: "/oauth2/register"
tags: ["OAuth"]
---

# Dynamic client registration (RFC 7591)

`POST /oauth2/register`

## Request

- Base URL: `https://api.uptimemonitoring.com`
- URL: `https://api.uptimemonitoring.com/oauth2/register`
- Auth: none required

Register a new OAuth client. Returns a `client_id` (and `client_secret`
for confidential clients). Public clients (PKCE-only) set
`token_endpoint_auth_method: "none"` and receive no secret.

Anyone may register a client. Holding a `client_id` confers no
privilege without a successful authorize flow.

Rate limited per caller IP (10/hour), counting every JSON attempt
presented to it, not just successes, plus a 100/hour process-wide
backstop that counts only attempts the per-IP limiter admits — a
request the per-IP limiter rejects does not consume backstop
capacity. `Content-Type` must be `application/json` — checked before
either limiter is consulted, so a non-JSON request spends neither
limiter's capacity. Clients that never complete a token grant are
deleted after 30 days.

## Request body

- object: All string fields must be valid UTF-8 with no null bytes. URL fields (`client_uri`, `redirect_uris[]`) must additionally be free of ASCII control characters (U+0000..U+001F, U+007F). Violations return HTTP 400 with the RFC 7591 envelope `{"error":"invalid_client_metadata","error_description":"…"}`.
  - `client_name` string
  - `client_uri` string, uri
  - `redirect_uris` string[], required
  - `grant_types` string[]
  - `response_types` string[]
  - `token_endpoint_auth_method` 'none' | 'client_secret_post' | 'client_secret_basic'
  - `scope` string

## Response `201`

Client registered.

- object
  - `client_id` string
  - `client_secret` string: Returned only for confidential clients; shown once.
  - `client_id_issued_at` integer
  - `redirect_uris` string[]
  - `grant_types` string[]
  - `response_types` string[]
  - `token_endpoint_auth_method` string
  - `scope` string

## Other responses

- `400`: Invalid client metadata.
- `415`: The request `Content-Type` is not `application/json`. Write operations (POST, PUT, PATCH) require that header; a missing or non-JSON media type is rejected before the body is read. The `charset` parameter is accepted and ignored, so `application/json; charset=utf-8` is valid.
- `429`: Rate limit exceeded — either the per-IP cap (10/hour) or the process-wide backstop (100/hour), whichever rejected first (the backstop is checked before the per-IP limiter). `Retry-After` is the ceiling of the remaining window in seconds (never truncated, so a 2.8s wait renders as `3`, not `2` — unlike `/feed/{token}`'s handler, which truncates).

---

[API](https://skmtc.dev/uptimemonitoring/apis/uptimemonitoring-com-api.md) · [All operations](https://skmtc.dev/uptimemonitoring/apis/uptimemonitoring-com-api/llms.txt) · [OpenAPI document](https://skmtc.dev/uptimemonitoring/apis/uptimemonitoring-com-api/revisions/ddcb2a8bc70f?raw)