Update OAuth2 client

Request

Replace the registration metadata of an OAuth2 client (RFC 7592 Section 2.2). Authenticate with the registration_access_token as a Bearer token.

This is a full replacement, not a merge: omitted metadata fields are reset to their registration defaults. The request must include client_id matching the client being updated (RFC 7592 Section 2.2). If client_secret is included it must match the current secret. Credentials cannot be rotated through this endpoint.

Security

RegistrationAccessToken

Path

clientIdstringrequired

The client identifier issued at registration.

Examples:

Client ID

client_1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d

Bodyapplication/jsonrequired

Any of:

Effective grant types include authorization_code — explicitly, or by default when grant_types is omitted. A non-empty redirect_uris is required. Other grant types (client_credentials, refresh_token) can be registered alongside.

client_idstringrequired

Required (RFC 7592 Section 2.2). Must match the client being updated. Credentials cannot be changed through this endpoint.

client_secretstring

Optional. If present, must match the client's current secret.

redirect_urisArray of strings, (uri), non-emptyrequired

Redirect URIs for the authorization_code grant. Compared with exact string matching at authorization time (RFC 6749 Section 3.1.2.3).

client_namestring

Human-readable client name, displayed on the authorization consent screen.

scopestring^(menu:read|menu:write|orders:read|orders:wri...

Space-separated list of scopes. Defaults to all available scopes.

Default:"menu:read menu:write orders:read orders:write revenue:read"

Example:"menu:read orders:read orders:write"

grant_typesArray of strings

Grant types the client may use. A refresh token is issued with authorization_code grant responses only when refresh_token is included here. The client_credentials grant never returns one (RFC 6749 Section 4.4.3).

Default:["authorization_code","client_credentials","refresh_token"]

Items Enum:"authorization_code""client_credentials""refresh_token"

token_endpoint_auth_methodstring

Requested client authentication method for the token endpoint, registered as client metadata and echoed in registration responses. Defaults to client_secret_basic (RFC 7591 Section 2). The token and revocation endpoints accept both methods for every client regardless.

Default:"client_secret_basic"

Enum:"client_secret_basic""client_secret_post"

curl -i -X PUT \
  https://cafe.redocly.com/_mock/openapi/cafe/oauth2/register/client_1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d \
  -H 'Authorization: Bearer <YOUR_TOKEN_HERE>' \
  -H 'Content-Type: application/json' \
  -d '{
    "client_id": "client_1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d",
    "client_name": "pos-terminal-v2",
    "redirect_uris": [
      "https://api.cafe.redocly.com/callback"
    ],
    "scope": "menu:read orders:read",
    "grant_types": [
      "authorization_code",
      "refresh_token"
    ]
  }'

Responses

Updated client registration.

Bodyapplication/json

client_idstringrequired

Client identifier issued by the authorization server.

client_secretstringrequired

Client secret issued by the authorization server. Store it securely.

client_id_issued_atinteger, (int64)required

Time when the client_id is issued, represented as seconds since epoch (RFC 7591).

client_secret_expires_atinteger, (int64)required

Time at which the client_secret expires, represented as seconds since epoch. 0 indicates the secret does not expire (RFC 7591).

registration_client_uristring, (uri)required

URL of the client configuration endpoint for managing this client registration (RFC 7592).

registration_access_tokenstringrequired

Bearer token for the client configuration endpoint (RFC 7592). Store it securely.

client_namestring

Client name (registered metadata). Omitted for clients registered without a name.

redirect_urisArray of strings, (uri)required

Registered redirect URIs.

grant_typesArray of stringsrequired

Registered grant types.

Items Enum:"authorization_code""client_credentials""refresh_token"

scopestringrequired

Space-separated registered scopes.

token_endpoint_auth_methodstringrequired

Registered token endpoint authentication method. Defaults to client_secret_basic when not requested at registration (RFC 7591 Section 2). The token and revocation endpoints accept both methods for every client regardless.

Enum:"client_secret_basic""client_secret_post"

Response

{
  "client_id": "string",
  "client_secret": "string",
  "client_id_issued_at": 0,
  "client_secret_expires_at": 0,
  "registration_client_uri": "http://example.com",
  "registration_access_token": "string",
  "client_name": "string",
  "redirect_uris": [
    "http://example.com"
  ],
  "grant_types": [
    "authorization_code"
  ],
  "scope": "string",
  "token_endpoint_auth_method": "client_secret_basic"
}