{
  "info": {
    "title": "core/oauth-clients",
    "version": ""
  },
  "paths": {
    "/api/core/oauth-clients": {
      "get": {
        "tags": [
          "oauth-clients"
        ],
        "summary": "List OAuth clients",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/OAuthClientAdminListResponse"
                }
              }
            },
            "description": "OAuth clients retrieved successfully."
          },
          "400": {
            "$ref": "#/components/responses/BadRequest"
          },
          "401": {
            "$ref": "#/components/responses/Unauthorized"
          },
          "403": {
            "$ref": "#/components/responses/Forbidden"
          },
          "500": {
            "$ref": "#/components/responses/InternalServerError"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "parameters": [
          {
            "in": "query",
            "name": "filter",
            "schema": {
              "type": "string"
            },
            "example": "appType eq \"spa\" and clientId eq \"b3ee66d6f21d1611efa89a425f656f6f\"",
            "required": false,
            "description": "A filter expression used to narrow the list of OAuth clients. The filter syntax follows RFC 7644. Valid filter attributes are `clientId`, `clientName`, `appType`, and `createdByType`."
          },
          {
            "in": "query",
            "name": "limit",
            "schema": {
              "type": "number",
              "default": 20,
              "maximum": 100,
              "minimum": 1
            },
            "description": "The maximum number of OAuth clients to return per page."
          },
          {
            "in": "query",
            "name": "next",
            "schema": {
              "type": "string"
            },
            "required": false,
            "description": "The cursor for the next page of results."
          },
          {
            "in": "query",
            "name": "prev",
            "schema": {
              "type": "string"
            },
            "required": false,
            "description": "The cursor for the previous page of results."
          },
          {
            "in": "query",
            "name": "sort",
            "schema": {
              "enum": [
                "+clientId",
                "-clientId",
                "+clientName",
                "-clientName",
                "+appType",
                "-appType",
                "+createdAt",
                "-createdAt",
                "+updatedAt",
                "-updatedAt"
              ],
              "type": "string"
            },
            "required": false,
            "description": "The field to sort by, prefixed with `+` for ascending or `-` for descending order. Valid fields for sorting are `clientId`, `clientName`, `appType`, `createdAt`, `updatedAt`."
          },
          {
            "in": "query",
            "name": "totalResults",
            "schema": {
              "type": "boolean",
              "default": false
            },
            "example": true,
            "required": false,
            "description": "When `true`, the response includes the total number of matching OAuth clients in the `totalResults` field. When `false` or omitted, `totalResults` is excluded from the response."
          }
        ],
        "description": "Retrieves all OAuth clients registered.\nResults are paginated using cursor-based pagination; use the `next` and `prev`\nparameters to navigate between pages. Use the `filter` and `sort` parameters to\nnarrow or order the results.\n",
        "operationId": "readAllOAuthClientsQCC",
        "x-qlik-visibility": "public",
        "x-qlik-stability": "stable",
        "x-qlik-deprecated": false,
        "x-qlik-tier": {
          "tier": "1",
          "limit": 1000
        }
      },
      "post": {
        "tags": [
          "oauth-clients"
        ],
        "summary": "Create an OAuth client",
        "responses": {
          "201": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/OAuthClientCreateResponse"
                }
              }
            },
            "description": "OAuth client created successfully."
          },
          "400": {
            "$ref": "#/components/responses/BadRequest"
          },
          "401": {
            "$ref": "#/components/responses/Unauthorized"
          },
          "403": {
            "$ref": "#/components/responses/Forbidden"
          },
          "500": {
            "$ref": "#/components/responses/InternalServerError"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "description": "Registers a new OAuth client in the tenant. The `appType` field determines the\nclient type and cannot be changed after creation. Only the `web` client type is\nsupported and redirect URIs and allowed origins are not supported. The consent\nmethod and published state can be updated after creation using the PATCH operation.\n",
        "operationId": "createOAuthClientQCC",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/OAuthClientCreateRequest"
              }
            }
          },
          "required": true
        },
        "x-qlik-visibility": "public",
        "x-qlik-stability": "stable",
        "x-qlik-deprecated": false,
        "x-qlik-tier": {
          "tier": "2",
          "limit": 100
        }
      }
    },
    "/api/core/oauth-clients/{id}": {
      "get": {
        "tags": [
          "oauth-clients"
        ],
        "summary": "Get an OAuth client",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/OAuthClientAdminReadResponse"
                }
              }
            },
            "description": "OAuth client retrieved successfully."
          },
          "400": {
            "$ref": "#/components/responses/BadRequest"
          },
          "401": {
            "$ref": "#/components/responses/Unauthorized"
          },
          "403": {
            "$ref": "#/components/responses/Forbidden"
          },
          "404": {
            "$ref": "#/components/responses/NotFound"
          },
          "500": {
            "$ref": "#/components/responses/InternalServerError"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "schema": {
              "type": "string"
            },
            "required": true,
            "description": "The unique identifier for the OAuth client."
          }
        ],
        "description": "Retrieves a single OAuth client by its unique identifier. The response includes\nthe client's configuration, allowed scopes, authentication methods, and public keys.\n",
        "operationId": "readOAuthClientQCC",
        "x-qlik-visibility": "public",
        "x-qlik-stability": "stable",
        "x-qlik-deprecated": false,
        "x-qlik-tier": {
          "tier": "1",
          "limit": 1000
        }
      },
      "patch": {
        "tags": [
          "oauth-clients"
        ],
        "summary": "Update an OAuth client",
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/OAuthClientPatchResponse"
                }
              }
            },
            "description": "A new client secret was generated. The response body contains the new secret value."
          },
          "204": {
            "description": "The OAuth client was updated successfully."
          },
          "400": {
            "$ref": "#/components/responses/BadRequest"
          },
          "401": {
            "$ref": "#/components/responses/Unauthorized"
          },
          "403": {
            "$ref": "#/components/responses/Forbidden"
          },
          "404": {
            "$ref": "#/components/responses/NotFound"
          },
          "500": {
            "$ref": "#/components/responses/InternalServerError"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "schema": {
              "type": "string"
            },
            "required": true,
            "description": "The unique identifier for the OAuth client."
          }
        ],
        "description": "Updates one or more properties of an OAuth client using JSON Patch (RFC 6902).\nSupply an array of patch operations targeting the fields you want to change. If\nthe update results in a new client secret being generated, the response returns\n`202 Accepted` with the new secret in the body; otherwise it returns `204 No Content`.\n",
        "operationId": "patchOAuthClientQCC",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "type": "array",
                "items": {
                  "$ref": "#/components/schemas/OAuthClientUpdate"
                }
              }
            }
          },
          "required": true
        },
        "x-qlik-visibility": "public",
        "x-qlik-stability": "stable",
        "x-qlik-deprecated": false,
        "x-qlik-tier": {
          "tier": "2",
          "limit": 100
        }
      },
      "delete": {
        "tags": [
          "oauth-clients"
        ],
        "summary": "Delete an OAuth client",
        "responses": {
          "204": {
            "description": "The OAuth client was deleted successfully."
          },
          "400": {
            "$ref": "#/components/responses/BadRequest"
          },
          "401": {
            "$ref": "#/components/responses/Unauthorized"
          },
          "403": {
            "$ref": "#/components/responses/Forbidden"
          },
          "404": {
            "$ref": "#/components/responses/NotFound"
          },
          "500": {
            "$ref": "#/components/responses/InternalServerError"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "schema": {
              "type": "string"
            },
            "required": true,
            "description": "The unique identifier for the OAuth client."
          },
          {
            "in": "header",
            "name": "qlik-confirm-delete",
            "schema": {
              "type": "string"
            },
            "required": true,
            "description": "A confirmation string that must equal the `id` of the OAuth client to delete."
          }
        ],
        "description": "Deletes an OAuth client. After deletion, no new tokens can be issued for the client.\nExisting tokens may remain valid until they expire unless invalidated by a downstream revocation mechanism.\nSupply the `qlik-confirm-delete` header to confirm the deletion.\n",
        "operationId": "deleteOAuthClientQCC",
        "x-qlik-visibility": "public",
        "x-qlik-stability": "stable",
        "x-qlik-deprecated": false,
        "x-qlik-tier": {
          "tier": "2",
          "limit": 100
        }
      }
    },
    "/api/core/oauth-clients/{id}/client-secrets": {
      "post": {
        "tags": [
          "oauth-clients"
        ],
        "summary": "Create an OAuth client secret",
        "responses": {
          "201": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/OAuthClientSecretResponse"
                }
              }
            },
            "description": "Client secret created successfully. The secret value is returned only once and cannot be retrieved again."
          },
          "400": {
            "$ref": "#/components/responses/BadRequest"
          },
          "401": {
            "$ref": "#/components/responses/Unauthorized"
          },
          "403": {
            "$ref": "#/components/responses/Forbidden"
          },
          "404": {
            "$ref": "#/components/responses/NotFound"
          },
          "409": {
            "$ref": "#/components/responses/ClientSecretCreateExceedLimit"
          },
          "500": {
            "$ref": "#/components/responses/InternalServerError"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "schema": {
              "type": "string"
            },
            "required": true,
            "description": "The unique identifier for the OAuth client."
          }
        ],
        "description": "Generates a new client secret for the specified OAuth client. Client secrets are\nsupported only for clients with `appType` set to `web` and `client_secret` listed\nin `allowedAuthMethods`. An OAuth client can have a maximum of 5 client secrets at\none time. The secret value is returned only in the response and cannot be retrieved again.\n",
        "operationId": "createOAuthClientSecretQCC",
        "x-qlik-visibility": "public",
        "x-qlik-stability": "stable",
        "x-qlik-deprecated": false,
        "x-qlik-tier": {
          "tier": "2",
          "limit": 100
        }
      }
    },
    "/api/core/oauth-clients/{id}/client-secrets/{hint}": {
      "delete": {
        "tags": [
          "oauth-clients"
        ],
        "summary": "Delete an OAuth client secret",
        "responses": {
          "204": {
            "description": "The client secret was deleted successfully."
          },
          "400": {
            "$ref": "#/components/responses/BadRequest"
          },
          "401": {
            "$ref": "#/components/responses/Unauthorized"
          },
          "403": {
            "$ref": "#/components/responses/Forbidden"
          },
          "404": {
            "$ref": "#/components/responses/NotFound"
          },
          "500": {
            "$ref": "#/components/responses/InternalServerError"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "parameters": [
          {
            "in": "path",
            "name": "hint",
            "schema": {
              "type": "string"
            },
            "required": true,
            "description": "The hint identifying the client secret to delete."
          },
          {
            "in": "path",
            "name": "id",
            "schema": {
              "type": "string"
            },
            "required": true,
            "description": "The unique identifier for the OAuth client."
          }
        ],
        "description": "Deletes a specific client secret for an OAuth client. After deletion, the secret\ncan no longer be used for future client authentication or token requests that\nrequire that secret.\n",
        "operationId": "deleteOAuthClientSecretQCC",
        "x-qlik-visibility": "public",
        "x-qlik-stability": "stable",
        "x-qlik-deprecated": false,
        "x-qlik-tier": {
          "tier": "2",
          "limit": 100
        }
      }
    }
  },
  "openapi": "3.0.0",
  "components": {
    "responses": {
      "BadRequest": {
        "content": {
          "application/json": {
            "schema": {
              "$ref": "#/components/schemas/ErrorResponse"
            }
          }
        },
        "description": "The request is invalid. Check the request body or parameters for errors."
      },
      "ClientSecretCreateExceedLimit": {
        "content": {
          "application/json": {
            "schema": {
              "$ref": "#/components/schemas/ErrorResponse"
            }
          }
        },
        "description": "The maximum number of client secrets is 5."
      },
      "Forbidden": {
        "content": {
          "application/json": {
            "schema": {
              "$ref": "#/components/schemas/ErrorResponse"
            }
          }
        },
        "description": "Access denied. You lack the required permissions to perform this operation."
      },
      "InternalServerError": {
        "content": {
          "application/json": {
            "schema": {
              "$ref": "#/components/schemas/ErrorResponse"
            }
          }
        },
        "description": "An unexpected error occurred on the server. Try again later."
      },
      "NotFound": {
        "content": {
          "application/json": {
            "schema": {
              "$ref": "#/components/schemas/ErrorResponse"
            }
          }
        },
        "description": "The requested resource was not found."
      },
      "ServiceUnavailable": {
        "content": {
          "application/json": {
            "schema": {
              "$ref": "#/components/schemas/ErrorResponse"
            }
          }
        },
        "description": "The service is temporarily unavailable. Try again later."
      },
      "Unauthorized": {
        "content": {
          "application/json": {
            "schema": {
              "$ref": "#/components/schemas/ErrorResponse"
            }
          }
        },
        "description": "Unauthorized."
      }
    },
    "schemas": {
      "ClientSecrets": {
        "type": "array",
        "items": {
          "type": "object",
          "required": [
            "hint"
          ],
          "properties": {
            "hint": {
              "type": "string",
              "maxLength": 5,
              "description": "Hint of a client application secret"
            },
            "createdAt": {
              "type": "string",
              "format": "date-time",
              "example": "2025-11-06T14:30:00.123456Z",
              "description": "The timestamp for when the client-secret record was created."
            },
            "createdBy": {
              "type": "string",
              "description": "The identifier for the user that created the client-secret record."
            }
          }
        },
        "readOnly": true,
        "description": "Partial identifiers (hints) for the client secrets associated with this OAuth client."
      },
      "ConnectionConfigReadResponse": {
        "type": "object",
        "required": [
          "consentMethod"
        ],
        "properties": {
          "status": {
            "type": "string",
            "readOnly": true,
            "description": "The current status of the client connection configuration."
          },
          "consentMethod": {
            "type": "string",
            "readOnly": true,
            "description": "The method used to obtain user consent when this client requests access to Qlik Cloud resources."
          },
          "deletedByOwner": {
            "type": "boolean",
            "readOnly": true,
            "description": "OAuth client has been deleted by owner, only applies for published clients."
          }
        },
        "description": "Connection configuration for an OAuth client, including the consent method and deletion status."
      },
      "Error": {
        "type": "object",
        "required": [
          "code",
          "title"
        ],
        "properties": {
          "code": {
            "type": "string",
            "description": "A machine-readable error code."
          },
          "title": {
            "type": "string",
            "description": "A summary of the error."
          },
          "detail": {
            "type": "string",
            "description": "Additional context about the error to help with debugging."
          }
        },
        "description": "A single error object describing what went wrong with the request."
      },
      "ErrorResponse": {
        "type": "object",
        "properties": {
          "errors": {
            "type": "array",
            "items": {
              "$ref": "#/components/schemas/Error"
            }
          }
        },
        "description": "The error response returned when an API request fails."
      },
      "JWK": {
        "type": "object",
        "required": [
          "kty",
          "use",
          "alg",
          "kid"
        ],
        "properties": {
          "e": {
            "type": "string",
            "example": "AQAB",
            "description": "The RSA key public exponent, Base64URL-encoded."
          },
          "n": {
            "type": "string",
            "example": "0vx7agoebGcQSuuPiLJXZptN9nndrQmbXEps2aiAFbWhM78LhWx",
            "description": "The RSA key modulus, Base64URL-encoded."
          },
          "x": {
            "type": "string",
            "example": "WKn-ZIGevcwGIyyrzFoZNBdaq9_TsqzGl96oc0CWuis",
            "description": "The X coordinate of the EC public key, Base64URL-encoded."
          },
          "y": {
            "type": "string",
            "example": "y77t-RvAHRKTsSGdIYUfweuOvwrvDD-Q3Hv5J0fSKbE",
            "description": "The Y coordinate of the EC public key, Base64URL-encoded."
          },
          "alg": {
            "enum": [
              "RS256",
              "RS512",
              "ES384"
            ],
            "type": "string",
            "example": "RS256",
            "description": "The algorithm intended for use with the key."
          },
          "crv": {
            "type": "string",
            "example": "P-384",
            "description": "The elliptic curve used with this key."
          },
          "kid": {
            "type": "string",
            "example": "key-1",
            "description": "A unique identifier for this key."
          },
          "kty": {
            "enum": [
              "RSA",
              "EC"
            ],
            "type": "string",
            "example": "RSA",
            "description": "The cryptographic key type."
          },
          "use": {
            "enum": [
              "sig"
            ],
            "type": "string",
            "example": "sig",
            "description": "Intended use of the key. The only accepted value is `sig` (signature verification)."
          }
        },
        "description": "JSON Web Key (JWK) for the public key used to verify the signature of a client assertion JWT."
      },
      "Link": {
        "type": "object",
        "required": [
          "href"
        ],
        "properties": {
          "href": {
            "type": "string",
            "format": "uri",
            "description": "The absolute URL of the linked resource."
          }
        },
        "description": "A navigational link containing an absolute URL."
      },
      "Links": {
        "type": "object",
        "properties": {
          "next": {
            "$ref": "#/components/schemas/Link"
          },
          "prev": {
            "$ref": "#/components/schemas/Link"
          },
          "self": {
            "$ref": "#/components/schemas/Link"
          }
        },
        "description": "Pagination links for navigating between pages of results."
      },
      "OAuthClientAdminListItem": {
        "type": "object",
        "allOf": [
          {
            "$ref": "#/components/schemas/OAuthClientBase"
          }
        ],
        "required": [
          "clientId"
        ],
        "properties": {
          "clientId": {
            "type": "string",
            "readOnly": true,
            "maxLength": 512,
            "description": "The unique identifier of the OAuth client application."
          },
          "publicKeys": {
            "type": "array",
            "items": {
              "$ref": "#/components/schemas/JWK"
            },
            "description": "List of public keys for JWT authentication."
          },
          "redirectUris": {
            "type": "array",
            "items": {
              "type": "string",
              "maxItems": 5,
              "maxLength": 256,
              "uniqueItems": true
            },
            "description": "List of allowed redirect URIs for login."
          },
          "allowedOrigins": {
            "type": "array",
            "items": {
              "type": "string",
              "maxItems": 5,
              "maxLength": 256,
              "uniqueItems": true
            },
            "description": "List of allowed origins for the client."
          },
          "connectionConfig": {
            "$ref": "#/components/schemas/ConnectionConfigReadResponse"
          },
          "allowedAuthMethods": {
            "type": "array",
            "items": {
              "enum": [
                "client_secret",
                "private_key_jwt"
              ],
              "type": "string"
            },
            "description": "List of allowed authentication methods for the client."
          }
        },
        "description": "An OAuth client entry returned in a list response."
      },
      "OAuthClientAdminListResponse": {
        "type": "object",
        "required": [
          "data",
          "links"
        ],
        "properties": {
          "data": {
            "type": "array",
            "items": {
              "$ref": "#/components/schemas/OAuthClientAdminListItem"
            }
          },
          "links": {
            "$ref": "#/components/schemas/Links"
          },
          "totalResults": {
            "type": "integer",
            "nullable": true,
            "description": "Total number of OAuth clients. Included only when the `totalResults` query parameter is set to `true`."
          }
        },
        "description": "A paginated list of OAuth clients registered in the tenant."
      },
      "OAuthClientAdminReadResponse": {
        "type": "object",
        "allOf": [
          {
            "$ref": "#/components/schemas/OAuthClientBase"
          }
        ],
        "required": [
          "clientId"
        ],
        "properties": {
          "clientId": {
            "type": "string",
            "readOnly": true,
            "maxLength": 512,
            "description": "The unique identifier of the OAuth client application."
          },
          "publicKeys": {
            "type": "array",
            "items": {
              "$ref": "#/components/schemas/JWK"
            },
            "description": "List of public keys for JWT authentication"
          },
          "redirectUris": {
            "type": "array",
            "items": {
              "type": "string",
              "maxItems": 5,
              "maxLength": 256,
              "uniqueItems": true
            },
            "description": "List of allowed redirect URIs for login"
          },
          "clientSecrets": {
            "$ref": "#/components/schemas/ClientSecrets"
          },
          "allowedOrigins": {
            "type": "array",
            "items": {
              "type": "string",
              "maxItems": 5,
              "maxLength": 256,
              "uniqueItems": true
            },
            "description": "List of allowed origins for the client."
          },
          "allowedAuthMethods": {
            "type": "array",
            "items": {
              "enum": [
                "client_secret",
                "private_key_jwt"
              ],
              "type": "string"
            },
            "description": "List of allowed authentication methods for the client."
          }
        },
        "description": "Detailed properties for a single OAuth client, including configuration, secrets, and public keys."
      },
      "OAuthClientBase": {
        "type": "object",
        "required": [
          "appType",
          "clientName",
          "createdAt",
          "ownerId"
        ],
        "properties": {
          "appType": {
            "enum": [
              "web",
              "native",
              "spa",
              "anonymous-embed"
            ],
            "type": "string",
            "maxLength": 64,
            "description": "The type of application the OAuth client represents."
          },
          "logoUri": {
            "type": "string",
            "maxLength": 2048,
            "description": "The URI for the client application's logo image."
          },
          "clientUri": {
            "type": "string",
            "maxLength": 2048,
            "description": "The URI for the client application's homepage."
          },
          "createdAt": {
            "type": "string",
            "format": "date-time",
            "example": "2025-11-06T14:30:00.123456Z",
            "description": "The timestamp for when the oauth-clients record was created."
          },
          "deletedAt": {
            "type": "string",
            "format": "date-time",
            "example": "2025-11-06T15:45:30.789012Z",
            "description": "The timestamp for when the oauth-clients record was deleted."
          },
          "updatedAt": {
            "type": "string",
            "format": "date-time",
            "example": "2025-11-06T16:20:15.456789Z",
            "description": "The timestamp for when the oauth-clients record was updated."
          },
          "clientName": {
            "type": "string",
            "maxLength": 512,
            "description": "The display name of the OAuth client application."
          },
          "disableTag": {
            "type": "string",
            "readOnly": true,
            "description": "Indicates the reason the client is disabled. Present only when the client has been disabled."
          },
          "publicKeys": {
            "type": "array",
            "items": {
              "$ref": "#/components/schemas/JWK"
            },
            "description": "List of public keys for JWT authentication"
          },
          "description": {
            "type": "string",
            "maxLength": 4096,
            "description": "A text description of the OAuth client."
          },
          "publishedAt": {
            "type": "string",
            "format": "date-time",
            "example": "2025-11-06T17:00:00.321654Z",
            "description": "The timestamp when the client was published. Present only for published clients."
          },
          "allowedScopes": {
            "type": "array",
            "items": {
              "type": "string",
              "maxLength": 256,
              "uniqueItems": true
            },
            "description": "List of allowed scopes for this client."
          },
          "clientSecrets": {
            "type": "array",
            "items": {
              "type": "object",
              "required": [
                "hint"
              ],
              "properties": {
                "hint": {
                  "type": "string",
                  "maxLength": 5,
                  "description": "Hint of a client application secret"
                },
                "createdAt": {
                  "type": "string",
                  "format": "date-time",
                  "example": "2025-12-03T14:59:46.331Z",
                  "description": "The timestamp for when the client-secret record was created."
                },
                "createdBy": {
                  "type": "string",
                  "description": "The identifier for the user that created the client-secret record."
                }
              }
            },
            "readOnly": true,
            "description": "Partial identifiers (hints) for the client secrets associated with this OAuth client."
          },
          "createdByType": {
            "type": "string",
            "readOnly": true,
            "description": "The type of caller that created this client. Possible values are `user`, `service`, and `dcr` for Dynamic Client Registration."
          },
          "connectionConfig": {
            "type": "object",
            "properties": {
              "consentMethod": {
                "enum": [
                  "required",
                  "trusted"
                ],
                "type": "string",
                "example": "required",
                "description": "Specifies the consent method for the connection."
              }
            },
            "description": "Optional settings for configuring the client connection."
          },
          "allowedGrantTypes": {
            "type": "array",
            "items": {
              "enum": [
                "client_credentials",
                "urn:qlik:oauth:user-impersonation"
              ],
              "type": "string"
            },
            "description": "Allowed grant types. Only applicable when `appType` is `web`."
          },
          "allowedAuthMethods": {
            "type": "array",
            "items": {
              "enum": [
                "client_secret",
                "private_key_jwt"
              ],
              "type": "string"
            },
            "description": "List of allowed authentication methods for the client."
          }
        },
        "description": "Core properties shared across OAuth client request and response objects."
      },
      "OAuthClientCreateRequest": {
        "type": "object",
        "required": [
          "appType",
          "clientName"
        ],
        "properties": {
          "appType": {
            "enum": [
              "web",
              "native",
              "spa",
              "anonymous-embed"
            ],
            "type": "string",
            "example": "web",
            "maxLength": 64,
            "description": "The type of application the OAuth client represents. Cloud Console only supports\n`web`; any other value is rejected with `400`.\n"
          },
          "logoUri": {
            "type": "string",
            "example": "https://org.us.qlik.com/logo.png",
            "maxLength": 2048,
            "description": "The URI for the client application's logo image."
          },
          "clientUri": {
            "type": "string",
            "example": "https://org.us.qlik.com/",
            "maxLength": 2048,
            "description": "The URI for the client application's homepage."
          },
          "clientName": {
            "type": "string",
            "example": "My_test_application",
            "maxLength": 512,
            "description": "The display name of the OAuth client application."
          },
          "publicKeys": {
            "type": "array",
            "items": {
              "$ref": "#/components/schemas/JWK"
            },
            "description": "List of public keys for JWT authentication. Required when `private_key_jwt` is listed in `allowedAuthMethods`."
          },
          "description": {
            "type": "string",
            "example": "A test application client",
            "maxLength": 4096,
            "description": "A text description of the OAuth client."
          },
          "redirectUris": {
            "type": "array",
            "items": {
              "type": "string",
              "example": "https://org.us.qlik.com/home",
              "maxItems": 5,
              "maxLength": 256,
              "description": "A redirect URI for the client.",
              "uniqueItems": true
            },
            "description": "List of allowed redirect URIs for login. Not supported in Cloud Console, where a\nnon-empty value is rejected with `400`.\n"
          },
          "allowedScopes": {
            "type": "array",
            "items": {
              "type": "string",
              "example": "automations",
              "maxLength": 256,
              "description": "A scope that the client is allowed to request",
              "uniqueItems": true
            },
            "description": "List of allowed scopes for this client."
          },
          "allowedOrigins": {
            "type": "array",
            "items": {
              "type": "string",
              "example": "https://qlik.com",
              "maxItems": 5,
              "maxLength": 256,
              "description": "An allowed origin for the client",
              "uniqueItems": true
            },
            "description": "List of allowed origins for this client. Only applicable when `appType` is `spa`.\nNot supported in Cloud Console, where a non-empty value is rejected with `400`.\n"
          },
          "connectionConfig": {
            "type": "object",
            "properties": {
              "consentMethod": {
                "enum": [
                  "trusted"
                ],
                "type": "string",
                "example": "trusted",
                "description": "Specifies the consent method for the connection. The only allowed value is `trusted`."
              }
            },
            "description": "Optional settings for configuring the client connection."
          },
          "allowedGrantTypes": {
            "type": "array",
            "items": {
              "enum": [
                "client_credentials",
                "urn:qlik:oauth:user-impersonation"
              ],
              "type": "string",
              "example": "client_credentials",
              "description": "Grant type"
            },
            "description": "Allowed grant types. Only applicable when `appType` is `web`."
          },
          "allowedAuthMethods": {
            "type": "array",
            "items": {
              "enum": [
                "client_secret",
                "private_key_jwt"
              ],
              "type": "string",
              "example": "client_secret",
              "description": "An authentication method for the client."
            },
            "description": "List of allowed authentication methods for the client."
          }
        },
        "description": "Request body for creating a new OAuth client."
      },
      "OAuthClientCreateResponse": {
        "type": "object",
        "allOf": [
          {
            "$ref": "#/components/schemas/OAuthClientBase"
          }
        ],
        "required": [
          "clientId",
          "clientSecret"
        ],
        "properties": {
          "clientId": {
            "type": "string",
            "readOnly": true,
            "maxLength": 512,
            "description": "The unique identifier of the OAuth client application."
          },
          "publicKeys": {
            "type": "array",
            "items": {
              "$ref": "#/components/schemas/JWK"
            },
            "description": "List of public keys for JWT authentication."
          },
          "clientSecret": {
            "type": "string",
            "readOnly": true,
            "maxLength": 64,
            "description": "The initial client secret. Returned only at creation time; store it securely."
          },
          "redirectUris": {
            "type": "array",
            "items": {
              "type": "string",
              "maxItems": 5,
              "maxLength": 256,
              "uniqueItems": true
            },
            "description": "List of allowed redirect URIs for login."
          },
          "allowedOrigins": {
            "type": "array",
            "items": {
              "type": "string",
              "maxItems": 5,
              "maxLength": 256,
              "uniqueItems": true
            },
            "description": "List of allowed origins for the client."
          },
          "allowedAuthMethods": {
            "type": "array",
            "items": {
              "enum": [
                "client_secret",
                "private_key_jwt"
              ],
              "type": "string"
            },
            "description": "List of allowed authentication methods for the client."
          }
        },
        "description": "The created OAuth client, including the generated `clientId` and initial `clientSecret`."
      },
      "OAuthClientPatchResponse": {
        "type": "object",
        "required": [
          "clientSecret"
        ],
        "properties": {
          "clientSecret": {
            "type": "string",
            "example": "a1b2c3d4e5f6...",
            "readOnly": true,
            "maxLength": 64,
            "description": "The generated client application secret."
          }
        },
        "description": "The response body returned when a PATCH operation generates a new client secret."
      },
      "OAuthClientSecretResponse": {
        "type": "object",
        "required": [
          "clientId",
          "clientSecret",
          "hint"
        ],
        "properties": {
          "hint": {
            "type": "string",
            "readOnly": true,
            "description": "A short identifier for this client secret, used to distinguish it from other secrets."
          },
          "clientId": {
            "type": "string",
            "readOnly": true,
            "description": "The unique identifier of the OAuth client."
          },
          "createdAt": {
            "type": "string",
            "format": "date-time",
            "example": "2025-11-06T14:30:00.123456Z",
            "description": "The timestamp for when the client-secret record was created."
          },
          "createdBy": {
            "type": "string",
            "description": "The identifier for the user that created the client-secret record."
          },
          "clientSecret": {
            "type": "string",
            "readOnly": true,
            "description": "The client secret value. Store this securely; it cannot be retrieved again."
          }
        },
        "description": "The newly created client secret. The secret value is returned only once and cannot be retrieved again."
      },
      "OAuthClientUpdate": {
        "type": "object",
        "required": [
          "op",
          "path"
        ],
        "properties": {
          "op": {
            "enum": [
              "add",
              "remove",
              "replace"
            ],
            "type": "string",
            "description": "The patch operation to perform. Use `add` or `replace` to set a value. `remove` clears\nthe whole field only for `/allowedScopes` and `/allowedGrantTypes`. For the other paths\nsend `replace` with an empty value instead.\n"
          },
          "path": {
            "enum": [
              "/clientName",
              "/description",
              "/allowedScopes",
              "/allowedGrantTypes",
              "/redirectUris",
              "/allowedOrigins"
            ],
            "type": "string",
            "description": "The JSON pointer path of the field to patch. `/allowedGrantTypes` accepts any\ncombination of `client_credentials` and `urn:qlik:oauth:user-impersonation`.\n`/redirectUris` and `/allowedOrigins` are only patchable on clients that already\nhave them, which is the case for clients created before Cloud Console stopped\nsupporting those fields. Adding them to any other client is rejected with `400`.\nBoth are cleared with `replace` and an empty array.\n"
          },
          "value": {
            "oneOf": [
              {
                "type": "string"
              },
              {
                "type": "array",
                "items": {
                  "type": "string"
                }
              }
            ],
            "description": "The value to set for the targeted field. Required for `add` and `replace` operations."
          }
        },
        "description": "A JSON Patch operation as defined in RFC 6902."
      }
    }
  },
  "servers": [
    {
      "url": "https://console.qlikcloud.com"
    }
  ]
}