Xeonr Developer Docs
API SpecificationOAuth Clients

Update Client

POST
/xeonr.auth.api.v1.ClientsService/UpdateClient

Updates an existing OAuth client's configuration. Use update_mask to specify which fields to update.

Required scopes: auth:clients:edit

Authorization

AuthorizationBearer <token>

JWT access token obtained via OAuth2 flow or service account

In: header

Header Parameters

Connect-Protocol-Version*number

Define the version of the Connect protocol

Value in1
Connect-Timeout-Ms?number

Define the timeout, in ms

Request Body

application/json

clientId?string

Unique identifier for the OAuth Client

Formatuuid
name?string

Optional name for the OAuth Client

Length1 <= length <= 64
redirectUri?stringDeprecated

Optional URI to redirect to after authentication.

Deprecated: use redirect_uris. Honored only when redirect_uris is not supplied in the same update (backward compatibility).

Formaturi
Length1 <= length <= 256
redirectUris?redirect_uris

The full set of allowed redirect URIs. Include "redirect_uris" in update_mask to sync (must keep at least one to remain usable). Each must be an absolute URI.

supportsRefreshToken?boolean

Optional support for refresh tokens

supportsImplicitGrant?boolean

Optional support for implicit grant flow

supportsDeviceCodeGrant?boolean

Optional support for device code grant flow

supportsCodeGrant?boolean

Optional support for authorization code grant flow

supportsClientCredentials?boolean

Optional support for the client_credentials grant (RFC 6749 §4.4). Only effective for confidential, application-owned clients.

websiteUrl?string

Optional website URL of the OAuth Client

Formaturi
Length1 <= length <= 128
description?string

Optional description of the OAuth Client

Length1 <= length <= 256
applicationBindings?
allowedDelegators?allowed_delegators

List of client IDs from which this client will accept delegated tokens via token exchange (RFC 8693)

updateMask?string

Fields to update. If not provided, all set fields are updated. Include "logo_url" to clear/update the logo (empty string removes the logo). Include "allowed_delegators" to sync delegators (empty array removes all).

logoUrl?string|null

Optional logo URL - set to empty string in update_mask to clear the logo

backchannelLogoutUri?string|null

Backchannel logout URI for OIDC Back-Channel Logout 1.0 (must be HTTPS, or HTTP for localhost)

Formaturi
backchannelLogoutSessionRequired?boolean|null

Whether the RP requires a sid claim in the logout token

frontchannelLogoutUri?string|null

Front-channel logout URI for OIDC Front-Channel Logout 1.0 (must be HTTPS, or HTTP for localhost)

Formaturi
frontchannelLogoutSessionRequired?boolean|null

Whether the RP requires sid and iss in the logout request

postLogoutRedirectUris?post_logout_redirect_uris

List of allowed post-logout redirect URIs for RP-Initiated Logout

isVerified?boolean|null

Whether the client is verified (admin only - ignored for non-admin users)

iacManaged?boolean|null
onBehalfOfUserId?string|null

Act on the client owned by this user URN. Service-account only; requires the caller to be an auth-application SA. Used by upstream services to reconcile or fix user-owned clients without a user session.

clearClientSecret?boolean

When true, clears the client secret (makes the client public). Honored only when included in update_mask.

brandProfileId?string|null

The brand profile this client uses for its sign-in flow. Empty clears it (→ organisation default branding). Honored only when in update_mask.

[key: string]?never

Response Body

application/json

application/json

curl -X POST "https://auth.xeonr.io/xeonr.auth.api.v1.ClientsService/UpdateClient" \  -H "Connect-Protocol-Version: 1" \  -H "Content-Type: application/json" \  -d '{}'
{
  "client": {
    "clientId": "550e8400-e29b-41d4-a716-446655440000",
    "clientSecret": "sk_live_a1b2c3d4e5f6g7h8i9j0...",
    "name": "My OAuth App",
    "redirectUri": "https://myapp.example.com/oauth/callback",
    "redirectUris": [
      "https://myapp.example.com/oauth/callback"
    ],
    "supportsRefreshToken": true,
    "supportsImplicitGrant": true,
    "supportsDeviceCodeGrant": true,
    "supportsCodeGrant": true,
    "supportsClientCredentials": true,
    "websiteUrl": "https://myapp.example.com",
    "createdAt": "2023-01-15T01:30:15.01Z",
    "updatedAt": "2023-01-15T01:30:15.01Z",
    "description": "A sample OAuth application for demonstration purposes",
    "isVerified": true,
    "applicationId": "app_prod_myapp",
    "usesManagedBuckets": true,
    "applicationBindings": [
      {
        "applicationId": "app_prod_myapp",
        "config": {
          "jsonConfig": {
            "property1": {},
            "property2": {}
          }
        },
        "iacManaged": true
      }
    ],
    "allowedDelegators": [
      "550e8400-e29b-41d4-a716-446655440001"
    ],
    "logoUrl": "https://cdn.example.com/logos/myapp.png",
    "backchannelLogoutUri": "https://myapp.example.com/backchannel-logout",
    "backchannelLogoutSessionRequired": true,
    "frontchannelLogoutUri": "https://myapp.example.com/frontchannel-logout",
    "frontchannelLogoutSessionRequired": true,
    "postLogoutRedirectUris": [
      "https://myapp.example.com/logged-out"
    ],
    "hasSecret": true,
    "iacManaged": true,
    "brandProfileId": "string"
  }
}
{
  "code": "not_found",
  "message": "string",
  "details": [
    {
      "type": "string",
      "value": "string",
      "debug": {}
    }
  ]
}

Regenerate Client Secret POST

Generates a new client secret for an OAuth client. The old secret will be immediately invalidated. **Required scopes:** `auth:clients:edit`

Upload Client Logo POST

Uploads a logo image for an OAuth client. Supported formats: PNG, JPEG, WebP, GIF. Maximum size: 2MB, 512x512 pixels. **Required scopes:** `auth:clients:edit`