openapi: 3.0.0
info:
title: Auth0 Authentication actions clients API
description: Auth0 Authentication API. Endpoints for authentication and authorization using OpenID Connect, OAuth 2.0, SAML, WS-Federation, and Passwordless flows.
version: 1.0.0
servers:
- url: '{auth0_domain}'
description: The Authentication API is served over HTTPS.
variables:
auth0_domain:
description: Auth0 domain
default: https://demo.us.auth0.com
tags:
- name: clients
paths:
/clients:
get:
summary: Get Clients
description: "Retrieve clients (applications and SSO integrations) matching provided filters. A list of fields to include or exclude may also be specified.\nFor more information, read <a href=\"https://www.auth0.com/docs/get-started/applications\"> Applications in Auth0</a> and <a href=\"https://www.auth0.com/docs/authenticate/single-sign-on\"> Single Sign-On</a>.\n\n<ul>\n <li>\n The following can be retrieved with any scope:\n <code>client_id</code>, <code>app_type</code>, <code>name</code>, and <code>description</code>.\n </li>\n <li>\n The following properties can only be retrieved with the <code>read:clients</code> or\n <code>read:client_keys</code> scope:\n <code>callbacks</code>, <code>oidc_logout</code>, <code>allowed_origins</code>,\n <code>web_origins</code>, <code>tenant</code>, <code>global</code>, <code>config_route</code>,\n <code>callback_url_template</code>, <code>jwt_configuration</code>,\n <code>jwt_configuration.lifetime_in_seconds</code>, <code>jwt_configuration.secret_encoded</code>,\n <code>jwt_configuration.scopes</code>, <code>jwt_configuration.alg</code>, <code>api_type</code>,\n <code>logo_uri</code>, <code>allowed_clients</code>, <code>owners</code>, <code>custom_login_page</code>,\n <code>custom_login_page_off</code>, <code>sso</code>, <code>addons</code>, <code>form_template</code>,\n <code>custom_login_page_codeview</code>, <code>resource_servers</code>, <code>client_metadata</code>,\n <code>mobile</code>, <code>mobile.android</code>, <code>mobile.ios</code>, <code>allowed_logout_urls</code>,\n <code>token_endpoint_auth_method</code>, <code>is_first_party</code>, <code>oidc_conformant</code>,\n <code>is_token_endpoint_ip_header_trusted</code>, <code>initiate_login_uri</code>, <code>grant_types</code>,\n <code>refresh_token</code>, <code>refresh_token.rotation_type</code>, <code>refresh_token.expiration_type</code>,\n <code>refresh_token.leeway</code>, <code>refresh_token.token_lifetime</code>, <code>refresh_token.policies</code>, <code>organization_usage</code>,\n <code>organization_require_behavior</code>.\n </li>\n <li>\n The following properties can only be retrieved with the\n <code>read:client_keys</code> or <code>read:client_credentials</code> scope:\n <code>encryption_key</code>, <code>encryption_key.pub</code>, <code>encryption_key.cert</code>,\n <code>client_secret</code>, <code>client_authentication_methods</code> and <code>signing_key</code>.\n </li>\n</ul>\n"
tags:
- clients
parameters:
- name: fields
in: query
description: Comma-separated list of fields to include or exclude (based on value provided for include_fields) in the result. Leave empty to retrieve all fields.
schema:
type: string
pattern: ^((name)|(description)|(callbacks)|(oidc_backchannel_logout)|(oidc_logout)|(session_transfer)|(allowed_origins)|(web_origins)|(client_id)|(tenant)|(global)|(config_route)|(callback_url_template)|(jwt_configuration)|(jwt_configuration\.lifetime_in_seconds)|(jwt_configuration\.secret_encoded)|(jwt_configuration\.scopes)|(jwt_configuration\.alg)|(api_type)|(logo_uri)|(allowed_clients)|(owners)|(custom_login_page)|(custom_login_page_on)|(sso)|(addons)|(form_template)|(custom_login_page_preview)|(encryption_key)|(encryption_key\.pub)|(encryption_key\.cert)|(client_secret)|(signing_keys)|(mobile)|(mobile\.android)|(mobile\.ios)|(token_endpoint_auth_method)|(allowed_logout_urls)|(app_type)|(is_first_party)|(oidc_conformant)|(client_metadata)|(is_token_endpoint_ip_header_trusted)|(initiate_login_uri)|(grant_types)|(refresh_token)|(refresh_token\.rotation_type)|(refresh_token\.expiration_type)|(refresh_token\.leeway)|(refresh_token\.policies)|(refresh_token\.token_lifetime)|(default_organization)|(organization_usage)|(organization_require_behavior)|(organization_discovery_methods)|(client_authentication_methods)|(client_authentication_methods\.private_key_jwt)|(require_pushed_authorization_requests)|(require_proof_of_possession)|(id_token)|(signed_request_object)|(signed_request_object\.required)|(signed_request_object\.credentials)|(compliance_level)|(skip_non_verifiable_callback_uri_confirmation_prompt)|(token_exchange)|(token_exchange\.allow_any_profile_of_type)|(token_quota)|(identity_assertion_authorization_grant)|(third_party_security_mode)|(subject_type_authorization)|(resource_server_identifier)|(express_configuration)|(my_organization_configuration)|(async_approval_notification_channels)|(token_vault_privileged_access)|(token_vault_privileged_access\.credentials)|(registration_type)|(external_metadata_type)|(external_metadata_created_by)|(external_client_id)|(redirection_policy))(,((name)|(description)|(callbacks)|(oidc_backchannel_logout)|(oidc_logout)|(session_transfer)|(allowed_origins)|(web_origins)|(client_id)|(tenant)|(global)|(config_route)|(callback_url_template)|(jwt_configuration)|(jwt_configuration\.lifetime_in_seconds)|(jwt_configuration\.secret_encoded)|(jwt_configuration\.scopes)|(jwt_configuration\.alg)|(api_type)|(logo_uri)|(allowed_clients)|(owners)|(custom_login_page)|(custom_login_page_on)|(sso)|(addons)|(form_template)|(custom_login_page_preview)|(encryption_key)|(encryption_key\.pub)|(encryption_key\.cert)|(client_secret)|(signing_keys)|(mobile)|(mobile\.android)|(mobile\.ios)|(token_endpoint_auth_method)|(allowed_logout_urls)|(app_type)|(is_first_party)|(oidc_conformant)|(client_metadata)|(is_token_endpoint_ip_header_trusted)|(initiate_login_uri)|(grant_types)|(refresh_token)|(refresh_token\.rotation_type)|(refresh_token\.expiration_type)|(refresh_token\.leeway)|(refresh_token\.policies)|(refresh_token\.token_lifetime)|(default_organization)|(organization_usage)|(organization_require_behavior)|(organization_discovery_methods)|(client_authentication_methods)|(client_authentication_methods\.private_key_jwt)|(require_pushed_authorization_requests)|(require_proof_of_possession)|(id_token)|(signed_request_object)|(signed_request_object\.required)|(signed_request_object\.credentials)|(compliance_level)|(skip_non_verifiable_callback_uri_confirmation_prompt)|(token_exchange)|(token_exchange\.allow_any_profile_of_type)|(token_quota)|(identity_assertion_authorization_grant)|(third_party_security_mode)|(subject_type_authorization)|(resource_server_identifier)|(express_configuration)|(my_organization_configuration)|(async_approval_notification_channels)|(token_vault_privileged_access)|(token_vault_privileged_access\.credentials)|(registration_type)|(external_metadata_type)|(external_metadata_created_by)|(external_client_id)|(redirection_policy)))*$
- name: include_fields
in: query
description: Whether specified fields are to be included (true) or excluded (false).
schema:
type: boolean
- name: page
in: query
description: Page index of the results to return. First page is 0.
schema:
type: integer
minimum: 0
- name: per_page
in: query
description: Number of results per page. Default value is 50, maximum value is 100
schema:
type: integer
minimum: 0
maximum: 100
- name: include_totals
in: query
description: Return results inside an object that contains the total result count (true) or as a direct array of results (false, default).
schema:
type: boolean
- name: from
in: query
description: Optional Id from which to start selection.
schema:
type: string
- name: take
in: query
description: Number of results per page. Defaults to 50.
schema:
type: integer
minimum: 1
maximum: 100
- name: is_global
in: query
description: Optional filter on the global client parameter.
schema:
type: boolean
- name: is_first_party
in: query
description: Optional filter on whether or not a client is a first-party client.
schema:
type: boolean
- name: app_type
in: query
description: Optional filter by a comma-separated list of application types.
schema:
type: string
pattern: ^((native)|(spa)|(regular_web)|(non_interactive)|(resource_server)|(express_configuration)|(rms)|(box)|(cloudbees)|(concur)|(dropbox)|(mscrm)|(echosign)|(egnyte)|(newrelic)|(office365)|(salesforce)|(sentry)|(sharepoint)|(slack)|(springcm)|(zendesk)|(zoom)|(sso_integration)|(oag))(,((native)|(spa)|(regular_web)|(non_interactive)|(resource_server)|(express_configuration)|(rms)|(box)|(cloudbees)|(concur)|(dropbox)|(mscrm)|(echosign)|(egnyte)|(newrelic)|(office365)|(salesforce)|(sentry)|(sharepoint)|(slack)|(springcm)|(zendesk)|(zoom)|(sso_integration)|(oag)))*$
- name: external_client_id
in: query
description: Optional filter by the <a href="https://www.ietf.org/archive/id/draft-ietf-oauth-client-id-metadata-document-04.html">Client ID Metadata Document</a> URI for CIMD-registered clients.
schema:
type: string
minLength: 1
maxLength: 120
- name: q
in: query
description: 'Advanced Query in <a href="https://lucene.apache.org/core/2_9_4/queryparsersyntax.html">Lucene</a> syntax.<br /><b>Permitted Queries</b>:<br /><ul><li><i>client_grant.organization_id:{organization_id}</i></li><li><i>client_grant.allow_any_organization:true</i></li></ul><b>Additional Restrictions</b>:<br /><ul><li>Cannot be used in combination with other filters</li><li>Requires use of the <i>from</i> and <i>take</i> paging parameters (checkpoint paginatinon)</li><li>Reduced rate limits apply. See <a href="https://auth0.com/docs/troubleshoot/customer-support/operational-policies/rate-limit-policy/rate-limit-configurations/enterprise-public">Rate Limit Configurations</a></li></ul><i><b>Note</b>: Recent updates may not be immediately reflected in query results</i>'
schema:
type: string
responses:
'200':
description: Clients successfully retrieved.
content:
application/json:
schema:
oneOf:
- type: array
items:
$ref: '#/components/schemas/Client'
- $ref: '#/components/schemas/ListClientsOffsetPaginatedResponseContent'
- $ref: '#/components/schemas/ListClientsPaginatedResponseContent'
'400':
description: Invalid request query string. The message will vary depending on the cause.
'401':
description: Invalid token.
x-description-1: Client is not global.
x-description-2: Invalid signature received for JSON Web Token validation.
'403':
description: 'Insufficient scope; expected any of: read:clients, read:client_keys, read:client_summary'
x-description-1: Some fields cannot be read with the permissions granted by the bearer token scopes. The message will vary depending on the fields and the scopes.
'429':
description: Too many requests. Check the X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset headers.
operationId: get_clients
x-release-lifecycle: GA
x-operation-name: list
x-operation-request-parameters-name: ListClientsRequestParameters
x-operation-group: clients
security:
- bearerAuth: []
- oAuth2ClientCredentials:
- read:clients
- read:client_keys
- read:client_credentials
- read:client_summary
post:
summary: Create a Client
description: "Create a new client (application or SSO integration). For more information, read <a href=\"https://www.auth0.com/docs/get-started/auth0-overview/create-applications\">Create Applications</a>\n<a href=\"https://www.auth0.com/docs/authenticate/single-sign-on/api-endpoints-for-single-sign-on>\">API Endpoints for Single Sign-On</a>. \n\nNotes: \n- We recommend leaving the `client_secret` parameter unspecified to allow the generation of a safe secret.\n- The <code>client_authentication_methods</code> and <code>token_endpoint_auth_method</code> properties are mutually exclusive. Use \n<code>client_authentication_methods</code> to configure the client with Private Key JWT authentication method. Otherwise, use <code>token_endpoint_auth_method</code>\nto configure the client with client secret (basic or post) or with no authentication method (none).\n- When using <code>client_authentication_methods</code> to configure the client with Private Key JWT authentication method, specify fully defined credentials. \nThese credentials will be automatically enabled for Private Key JWT authentication on the client. \n- To configure <code>client_authentication_methods</code>, the <code>create:client_credentials</code> scope is required.\n- To configure <code>client_authentication_methods</code>, the property <code>jwt_configuration.alg</code> must be set to RS256.\n\n<div class=\"alert alert-warning\">SSO Integrations created via this endpoint will accept login requests and share user profile information.</div>\n"
tags:
- clients
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/CreateClientRequestContent'
application/x-www-form-urlencoded:
schema:
$ref: '#/components/schemas/CreateClientRequestContent'
responses:
'201':
description: Client successfully created.
content:
application/json:
schema:
$ref: '#/components/schemas/CreateClientResponseContent'
'400':
description: Invalid request body. The message will vary depending on the cause.
'401':
description: Invalid token.
x-description-1: Client is not global.
x-description-2: Invalid signature received for JSON Web Token validation.
'403':
description: 'Insufficient scope; expected any of: create:clients.'
x-description-1: The account is not allowed to perform this operation.
x-description-2: You reached the limit of entities of this type for this tenant.
x-description-3: Organizations are only available to first party clients on user-based flows. Properties organization_usage and organization_require_behavior must be unset for third party clients.
'409':
description: Another client exists with the same alias.
'429':
description: Too many requests. Check the X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset headers.
operationId: post_clients
x-release-lifecycle: GA
x-operation-name: create
x-operation-group: clients
security:
- bearerAuth: []
- oAuth2ClientCredentials:
- create:clients
/clients/cimd/preview:
post:
summary: Preview and Validate Client ID Metadata Document
description: "\n Fetches and validates a Client ID Metadata Document without creating a client.\n Returns the raw metadata and how it would be mapped to Auth0 client fields.\n This endpoint is useful for testing metadata URIs before creating CIMD clients.\n "
tags:
- clients
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/PreviewCimdMetadataRequestContent'
application/x-www-form-urlencoded:
schema:
$ref: '#/components/schemas/PreviewCimdMetadataRequestContent'
responses:
'200':
description: Metadata successfully fetched and validated, or retrieval error returned with errors array.
content:
application/json:
schema:
$ref: '#/components/schemas/PreviewCimdMetadataResponseContent'
'400':
description: Invalid external_client_id. The message will vary depending on the cause.
'401':
description: Invalid token.
x-description-1: Invalid signature received for JSON Web Token validation.
'403':
description: 'Insufficient scope; expected any of: create:clients, update:clients.'
'429':
description: Too many requests. Check the X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset headers.
'500':
description: An internal server error occurred.
operationId: post_clients_cimd_preview
x-release-lifecycle: GA
x-operation-name: previewCimdMetadata
x-operation-group: clients
security:
- bearerAuth: []
- oAuth2ClientCredentials:
- read:clients
/clients/cimd/register:
post:
summary: Register or Update a CIMD Client Via Metadata URI
description: "\n Idempotent registration for Client ID Metadata Document (CIMD) clients.\n Uses external_client_id as the unique identifier for upsert operations.\n **Create:** Returns 201 when a new client is created (requires \\"
tags:
- clients
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/RegisterCimdClientRequestContent'
application/x-www-form-urlencoded:
schema:
$ref: '#/components/schemas/RegisterCimdClientRequestContent'
responses:
'200':
description: CIMD client successfully updated (idempotent).
content:
application/json:
schema:
$ref: '#/components/schemas/RegisterCimdClientResponseContent'
'201':
description: CIMD client successfully created.
content:
application/json:
schema:
$ref: '#/components/schemas/RegisterCimdClientResponseContent'
'400':
description: Invalid request body. The message will vary depending on the cause.
x-description-1: The Client Metadata document at [URL] cannot be applied.
x-description-2: The Client Metadata at [URL] could not be retrieved.
'401':
description: Invalid token.
x-description-1: Invalid signature received for JSON Web Token validation.
'403':
description: 'Insufficient scope; expected any of: create:clients, update:clients.'
'429':
description: Too many requests. Check the X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset headers.
'500':
description: An internal server error occurred.
operationId: post_clients_cimd_register
x-release-lifecycle: GA
x-operation-name: registerCimdClient
x-operation-group: clients
security:
- bearerAuth: []
- oAuth2ClientCredentials:
- create:clients
- update:clients
/clients/{client_id}/credentials:
get:
summary: Get Client Credentials
description: 'Get the details of a client credential.
<b>Important</b>: To enable credentials to be used for a client authentication method, set the <code>client_authentication_methods</code> property on the client. To enable credentials to be used for JWT-Secured Authorization requests set the <code>signed_request_object</code> property on the client.
'
tags:
- clients
parameters:
- name: client_id
in: path
description: ID of the client.
required: true
schema:
type: string
responses:
'200':
description: Credentials successfully retrieved.
content:
application/json:
schema:
type: array
items:
$ref: '#/components/schemas/ClientCredential'
'401':
description: Invalid token.
x-description-1: Invalid signature received for JSON Web Token validation.
'403':
description: 'Insufficient scope; expected any of: read:client_credentials.'
'404':
description: Client not found.
'429':
description: Too many requests. Check the X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset headers.
operationId: get_credentials
x-release-lifecycle: GA
x-operation-name: list
x-operation-group:
- clients
- credentials
security:
- bearerAuth: []
- oAuth2ClientCredentials:
- read:client_credentials
post:
summary: Create a Client Credential
description: "Create a client credential associated to your application. Credentials can be used to configure Private Key JWT and mTLS authentication methods, as well as for JWT-secured Authorization requests.\n\n<h5>Public Key</h5>Public Key credentials can be used to set up Private Key JWT client authentication and JWT-secured Authorization requests.\n\nSample: <pre><code>{\n \"credential_type\": \"public_key\",\n \"name\": \"string\",\n \"pem\": \"string\",\n \"alg\": \"RS256\",\n \"parse_expiry_from_cert\": false,\n \"expires_at\": \"2022-12-31T23:59:59Z\"\n}</code></pre>\n<h5>Certificate (CA-signed & self-signed)</h5>Certificate credentials can be used to set up mTLS client authentication. CA-signed certificates can be configured either with a signed certificate or with just the certificate Subject DN.\n\nCA-signed Certificate Sample (pem): <pre><code>{\n \"credential_type\": \"x509_cert\",\n \"name\": \"string\",\n \"pem\": \"string\"\n}</code></pre>CA-signed Certificate Sample (subject_dn): <pre><code>{\n \"credential_type\": \"cert_subject_dn\",\n \"name\": \"string\",\n \"subject_dn\": \"string\"\n}</code></pre>Self-signed Certificate Sample: <pre><code>{\n \"credential_type\": \"cert_subject_dn\",\n \"name\": \"string\",\n \"pem\": \"string\"\n}</code></pre>\n\nThe credential will be created but not yet enabled for use until you set the corresponding properties in the client:\n<ul>\n <li>To enable the credential for Private Key JWT or mTLS authentication methods, set the <code>client_authentication_methods</code> property on the client. For more information, read <a href=\"https://auth0.com/docs/get-started/applications/configure-private-key-jwt\">Configure Private Key JWT Authentication</a> and <a href=\"https://auth0.com/docs/get-started/applications/configure-mtls\">Configure mTLS Authentication</a></li>\n <li>To enable the credential for JWT-secured Authorization requests, set the <code>signed_request_object</code>property on the client. For more information, read <a href=\"https://auth0.com/docs/get-started/applications/configure-jar\">Configure JWT-secured Authorization Requests (JAR)</a></li>\n</ul>\n"
tags:
- clients
parameters:
- name: client_id
in: path
description: ID of the client.
required: true
schema:
type: string
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/PostClientCredentialRequestContent'
application/x-www-form-urlencoded:
schema:
$ref: '#/components/schemas/PostClientCredentialRequestContent'
responses:
'201':
description: Credential successfully created.
content:
application/json:
schema:
$ref: '#/components/schemas/PostClientCredentialResponseContent'
'400':
description: Invalid request body. The message will vary depending on the cause.
'401':
description: Invalid token.
x-description-1: Invalid signature received for JSON Web Token validation.
'403':
description: 'Insufficient scope; expected any of: create:client_credentials.'
'404':
description: Client not found.
'429':
description: Too many requests. Check the X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset headers.
operationId: post_credentials
x-release-lifecycle: GA
x-operation-name: create
x-operation-group:
- clients
- credentials
security:
- bearerAuth: []
- oAuth2ClientCredentials:
- create:client_credentials
/clients/{client_id}/credentials/{credential_id}:
get:
summary: Get Client Credential Details
description: 'Get the details of a client credential.
<b>Important</b>: To enable credentials to be used for a client authentication method, set the <code>client_authentication_methods</code> property on the client. To enable credentials to be used for JWT-Secured Authorization requests set the <code>signed_request_object</code> property on the client.
'
tags:
- clients
parameters:
- name: client_id
in: path
description: ID of the client.
required: true
schema:
type: string
- name: credential_id
in: path
description: ID of the credential.
required: true
schema:
type: string
responses:
'200':
description: Credential successfully retrieved.
content:
application/json:
schema:
$ref: '#/components/schemas/GetClientCredentialResponseContent'
'401':
description: Invalid token.
x-description-1: Invalid signature received for JSON Web Token validation.
'403':
description: 'Insufficient scope; expected any of: read:client_credentials.'
'404':
description: Client not found.
x-description-1: Credential does not exist
'429':
description: Too many requests. Check the X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset headers.
operationId: get_credentials_by_credential_id
x-release-lifecycle: GA
x-operation-name: get
x-operation-group:
- clients
- credentials
security:
- bearerAuth: []
- oAuth2ClientCredentials:
- read:client_credentials
delete:
summary: Delete a Client Credential
description: Delete a client credential you previously created. May be enabled or disabled. For more information, read <a href="https://www.auth0.com/docs/get-started/authentication-and-authorization-flow/client-credentials-flow">Client Credential Flow</a>.
tags:
- clients
parameters:
- name: client_id
in: path
description: ID of the client.
required: true
schema:
type: string
- name: credential_id
in: path
description: ID of the credential to delete.
required: true
schema:
type: string
responses:
'204':
description: Credential successfully deleted.
'400':
description: Invalid request URI. The message will vary depending on the cause.
'401':
description: Invalid token.
x-description-1: Invalid signature received for JSON Web Token validation.
'403':
description: 'Insufficient scope; expected any of: delete:client_credentials.'
'429':
description: Too many requests. Check the X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset headers.
operationId: delete_credentials_by_credential_id
x-release-lifecycle: GA
x-operation-name: delete
x-operation-group:
- clients
- credentials
security:
- bearerAuth: []
- oAuth2ClientCredentials:
- delete:client_credentials
patch:
summary: Update a Client Credential
description: Change a client credential you previously created. May be enabled or disabled. For more information, read <a href="https://www.auth0.com/docs/get-started/authentication-and-authorization-flow/client-credentials-flow">Client Credential Flow</a>.
tags:
- clients
parameters:
- name: client_id
in: path
description: ID of the client.
required: true
schema:
type: string
- name: credential_id
in: path
description: ID of the credential.
required: true
schema:
type: string
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/PatchClientCredentialRequestContent'
application/x-www-form-urlencoded:
schema:
$ref: '#/components/schemas/PatchClientCredentialRequestContent'
responses:
'201':
description: Credential successfully updated.
content:
application/json:
schema:
$ref: '#/components/schemas/PatchClientCredentialResponseContent'
'400':
description: Invalid request body. The message will vary depending on the cause.
'401':
description: Invalid token.
x-description-1: Invalid signature received for JSON Web Token validation.
'403':
description: 'Insufficient scope; expected any of: update:client_credentials.'
'404':
description: Client not found.
x-description-1: Credential does not exist
'429':
description: Too many requests. Check the X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset headers.
operationId: patch_credentials_by_credential_id
x-release-lifecycle: GA
x-operation-name: update
x-operation-group:
- clients
- credentials
security:
- bearerAuth: []
- oAuth2ClientCredentials:
- update:client_credentials
/clients/{id}:
get:
summary: Get Client by ID
description: "Retrieve client details by ID. Clients are SSO connections or Applications linked with your Auth0 tenant. A list of fields to include or exclude may also be specified. \nFor more information, read <a href=\"https://www.auth0.com/docs/get-started/applications\"> Applications in Auth0</a> and <a href=\"https://www.auth0.com/docs/authenticate/single-sign-on\"> Single Sign-On</a>.\n<ul>\n <li>\n The following properties can be retrieved with any of the scopes:\n <code>client_id</code>, <code>app_type</code>, <code>name</code>, and <code>description</code>.\n </li>\n <li>\n The following properties can only be retrieved with the <code>read:clients</code> or\n <code>read:client_keys</code> scopes:\n <code>callbacks</code>, <code>oidc_logout</code>, <code>allowed_origins</code>,\n <code>web_origins</code>, <code>tenant</code>, <code>global</code>, <code>config_route</code>,\n <code>callback_url_template</code>, <code>jwt_configuration</code>,\n <code>jwt_configuration.lifetime_in_seconds</code>, <code>jwt_configuration.secret_encoded</code>,\n <code>jwt_configuration.scopes</code>, <code>jwt_configuration.alg</code>, <code>api_type</code>,\n <code>logo_uri</code>, <code>allowed_clients</code>, <code>owners</code>, <code>custom_login_page</code>,\n <code>custom_login_page_off</code>, <code>sso</code>, <code>addons</code>, <code>form_template</code>,\n <code>custom_login_page_codeview</code>, <code>resource_servers</code>, <code>client_metadata</code>,\n <code>mobile</code>, <code>mobile.android</code>, <code>mobile.ios</code>, <code>allowed_logout_urls</code>,\n <code>token_endpoint_auth_method</code>, <code>is_first_party</code>, <code>oidc_conformant</code>,\n <code>is_token_endpoint_ip_header_trusted</code>, <code>initiate_login_uri</code>, <code>grant_types</code>,\n <code>refresh_token</code>, <code>refresh_token.rotation_type</code>, <code>refresh_token.expiration_type</code>,\n <code>refresh_token.leeway</code>, <code>refresh_token.token_lifetime</code>, <code>refresh_token.policies</code>, <code>organization_usage</code>,\n <code>organization_require_behavior</code>.\n </li>\n <li>\n The following properties can only be retrieved with the <code>read:client_keys</code> or <code>read:client_credentials</code> scopes:\n <code>encry
# --- truncated at 32 KB (201 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/auth0/refs/heads/main/openapi/auth0-clients-api-openapi.yml