Deutsche Telekom Clients API

openapi: 3.0.1
info:
  title: Controlplane Api ApiChangelog Clients API
  description: API of the TARDIS control plane. With this API configuration connectivity between different Tardis instances in ensured
  contact:
    name: TARDIS
    url: https://developer.telekom.de/docs/src/tardis_customer_handbook/support/
    email: FMB_TARDIS_Support@telekom.de
  version: 1.0.0
  x-api-category: TARDIS
  x-vendor: false
servers:
- url: https://api.telekom.de/controlplane/v1
tags:
- name: Clients
paths:
  /{realm}/clients:
    parameters:
    - in: path
      name: realm
      description: realm name (not id!)
      required: true
      schema:
        type: string
      style: simple
    get:
      tags:
      - Clients
      summary: Get clients belonging to the realm   Returns a list of clients belonging to the realm
      parameters:
      - in: query
        name: clientId
        description: filter by clientId
        schema:
          type: string
        style: form
      - in: query
        name: first
        description: the first result
        schema:
          type: integer
          format: int32
        style: form
      - in: query
        name: max
        description: the max results to return
        schema:
          type: integer
          format: int32
        style: form
      - in: query
        name: search
        description: whether this is a search query or a getClientById query
        schema:
          type: boolean
        style: form
      - in: query
        name: viewableOnly
        description: filter clients that cannot be viewed in full by admin
        schema:
          type: boolean
        style: form
      responses:
        2XX:
          description: success
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/ClientRepresentation'
    post:
      tags:
      - Clients
      summary: Create a new client   Client’s client_id must be unique!
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ClientRepresentation'
        required: true
      responses:
        2XX:
          description: success
  /{realm}/clients/{id}:
    parameters:
    - in: path
      name: realm
      description: realm name (not id!)
      required: true
      schema:
        type: string
      style: simple
    - in: path
      name: id
      description: id of client (not client-id)
      required: true
      schema:
        type: string
      style: simple
    get:
      tags:
      - Clients
      summary: Get representation of the client
      responses:
        2XX:
          description: success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ClientRepresentation'
    put:
      tags:
      - Clients
      summary: Update the client
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ClientRepresentation'
        required: true
      responses:
        2XX:
          description: success
    delete:
      tags:
      - Clients
      summary: Delete the client
      responses:
        2XX:
          description: success
  /{realm}/clients/{id}/client-secret:
    parameters:
    - in: path
      name: realm
      description: realm name (not id!)
      required: true
      schema:
        type: string
      style: simple
    - in: path
      name: id
      description: id of client (not client-id)
      required: true
      schema:
        type: string
      style: simple
    get:
      tags:
      - Clients
      summary: Get the client secret
      responses:
        2XX:
          description: success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CredentialRepresentation'
    post:
      tags:
      - Clients
      summary: Generate a new secret for the client
      responses:
        2XX:
          description: success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CredentialRepresentation'
  /{realm}/clients/{id}/client-secret/rotated:
    parameters:
    - in: path
      name: realm
      description: realm name (not id!)
      required: true
      schema:
        type: string
      style: simple
    - in: path
      name: id
      description: id of client (not client-id)
      required: true
      schema:
        type: string
      style: simple
    get:
      tags:
      - Clients
      summary: Get the rotated client secret
      responses:
        2XX:
          description: success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CredentialRepresentation'
    delete:
      tags:
      - Clients
      summary: Invalidate the rotated secret for the client
      responses:
        2XX:
          description: success
  /{realm}/clients/{id}/default-client-scopes:
    parameters:
    - in: path
      name: realm
      description: realm name (not id!)
      required: true
      schema:
        type: string
      style: simple
    - in: path
      name: id
      description: id of client (not client-id)
      required: true
      schema:
        type: string
      style: simple
    get:
      tags:
      - Clients
      summary: Get default client scopes.
      responses:
        2XX:
          description: success
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/ClientScopeRepresentation'
  /{realm}/clients/{id}/default-client-scopes/{clientScopeId}:
    parameters:
    - in: path
      name: realm
      description: realm name (not id!)
      required: true
      schema:
        type: string
      style: simple
    - in: path
      name: id
      description: id of client (not client-id)
      required: true
      schema:
        type: string
      style: simple
    - in: path
      name: clientScopeId
      required: true
      schema:
        type: string
      style: simple
    put:
      tags:
      - Clients
      responses:
        2XX:
          description: success
    delete:
      tags:
      - Clients
      responses:
        2XX:
          description: success
  /{realm}/clients/{id}/evaluate-scopes/generate-example-access-token:
    parameters:
    - in: path
      name: realm
      description: realm name (not id!)
      required: true
      schema:
        type: string
      style: simple
    - in: path
      name: id
      description: id of client (not client-id)
      required: true
      schema:
        type: string
      style: simple
    get:
      tags:
      - Clients
      summary: Create JSON with payload of example access token
      parameters:
      - in: query
        name: scope
        schema:
          type: string
        style: form
      - in: query
        name: userId
        schema:
          type: string
        style: form
      responses:
        2XX:
          description: success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AccessToken'
  /{realm}/clients/{id}/evaluate-scopes/protocol-mappers:
    parameters:
    - in: path
      name: realm
      description: realm name (not id!)
      required: true
      schema:
        type: string
      style: simple
    - in: path
      name: id
      description: id of client (not client-id)
      required: true
      schema:
        type: string
      style: simple
    get:
      tags:
      - Clients
      summary: Return list of all protocol mappers, which will be used when generating tokens issued for particular client.
      parameters:
      - in: query
        name: scope
        schema:
          type: string
        style: form
      responses:
        2XX:
          description: success
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/ClientScopeEvaluateResource-ProtocolMapperEvaluationRepresentation'
  /{realm}/clients/{id}/evaluate-scopes/scope-mappings/{roleContainerId}/granted:
    parameters:
    - in: path
      name: realm
      description: realm name (not id!)
      required: true
      schema:
        type: string
      style: simple
    - in: path
      name: id
      description: id of client (not client-id)
      required: true
      schema:
        type: string
      style: simple
    - in: path
      name: roleContainerId
      description: either realm name OR client UUID
      required: true
      schema:
        type: string
      style: simple
    get:
      tags:
      - Clients
      summary: Get effective scope mapping of all roles of particular role container, which this client is defacto allowed to have in the accessToken issued for him.
      parameters:
      - in: query
        name: scope
        schema:
          type: string
        style: form
      responses:
        2XX:
          description: success
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/RoleRepresentation'
  /{realm}/clients/{id}/evaluate-scopes/scope-mappings/{roleContainerId}/not-granted:
    parameters:
    - in: path
      name: realm
      description: realm name (not id!)
      required: true
      schema:
        type: string
      style: simple
    - in: path
      name: id
      description: id of client (not client-id)
      required: true
      schema:
        type: string
      style: simple
    - in: path
      name: roleContainerId
      description: either realm name OR client UUID
      required: true
      schema:
        type: string
      style: simple
    get:
      tags:
      - Clients
      summary: Get roles, which this client doesn’t have scope for and can’t have them in the accessToken issued for him.
      parameters:
      - in: query
        name: scope
        schema:
          type: string
        style: form
      responses:
        2XX:
          description: success
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/RoleRepresentation'
  /{realm}/clients/{id}/installation/providers/{providerId}:
    parameters:
    - in: path
      name: realm
      description: realm name (not id!)
      required: true
      schema:
        type: string
      style: simple
    - in: path
      name: id
      description: id of client (not client-id)
      required: true
      schema:
        type: string
      style: simple
    - in: path
      name: providerId
      required: true
      schema:
        type: string
      style: simple
    get:
      tags:
      - Clients
      responses:
        2XX:
          description: success
  /{realm}/clients/{id}/management/permissions:
    parameters:
    - in: path
      name: realm
      description: realm name (not id!)
      required: true
      schema:
        type: string
      style: simple
    - in: path
      name: id
      description: id of client (not client-id)
      required: true
      schema:
        type: string
      style: simple
    get:
      tags:
      - Clients
      summary: Return object stating whether client Authorization permissions have been initialized or not and a reference
      responses:
        2XX:
          description: success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ManagementPermissionReference'
    put:
      tags:
      - Clients
      summary: Return object stating whether client Authorization permissions have been initialized or not and a reference
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ManagementPermissionReference'
        required: true
      responses:
        2XX:
          description: success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ManagementPermissionReference'
  /{realm}/clients/{id}/nodes:
    parameters:
    - in: path
      name: realm
      description: realm name (not id!)
      required: true
      schema:
        type: string
      style: simple
    - in: path
      name: id
      description: id of client (not client-id)
      required: true
      schema:
        type: string
      style: simple
    post:
      tags:
      - Clients
      summary: Register a cluster node with the client   Manually register cluster node to this client - usually it’s not needed to call this directly as adapter should handle  by sending registration request to Keycloak
      requestBody:
        content:
          application/json:
            schema:
              type: object
              additionalProperties: true
        required: true
      responses:
        2XX:
          description: success
  /{realm}/clients/{id}/nodes/{node}:
    parameters:
    - in: path
      name: realm
      description: realm name (not id!)
      required: true
      schema:
        type: string
      style: simple
    - in: path
      name: id
      description: id of client (not client-id)
      required: true
      schema:
        type: string
      style: simple
    - in: path
      name: node
      required: true
      schema:
        type: string
      style: simple
    delete:
      tags:
      - Clients
      summary: Unregister a cluster node from the client
      responses:
        2XX:
          description: success
  /{realm}/clients/{id}/offline-session-count:
    parameters:
    - in: path
      name: realm
      description: realm name (not id!)
      required: true
      schema:
        type: string
      style: simple
    - in: path
      name: id
      description: id of client (not client-id)
      required: true
      schema:
        type: string
      style: simple
    get:
      tags:
      - Clients
      summary: 'Get application offline session count   Returns a number of offline user sessions associated with this client   {      "count": number  }'
      responses:
        2XX:
          description: success
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
  /{realm}/clients/{id}/offline-sessions:
    parameters:
    - in: path
      name: realm
      description: realm name (not id!)
      required: true
      schema:
        type: string
      style: simple
    - in: path
      name: id
      description: id of client (not client-id)
      required: true
      schema:
        type: string
      style: simple
    get:
      tags:
      - Clients
      summary: Get offline sessions for client   Returns a list of offline user sessions associated with this client
      parameters:
      - in: query
        name: first
        description: Paging offset
        schema:
          type: integer
          format: int32
        style: form
      - in: query
        name: max
        description: Maximum results size (defaults to 100)
        schema:
          type: integer
          format: int32
        style: form
      responses:
        2XX:
          description: success
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/UserSessionRepresentation'
  /{realm}/clients/{id}/optional-client-scopes:
    parameters:
    - in: path
      name: realm
      description: realm name (not id!)
      required: true
      schema:
        type: string
      style: simple
    - in: path
      name: id
      description: id of client (not client-id)
      required: true
      schema:
        type: string
      style: simple
    get:
      tags:
      - Clients
      summary: Get optional client scopes.
      responses:
        2XX:
          description: success
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/ClientScopeRepresentation'
  /{realm}/clients/{id}/optional-client-scopes/{clientScopeId}:
    parameters:
    - in: path
      name: realm
      description: realm name (not id!)
      required: true
      schema:
        type: string
      style: simple
    - in: path
      name: id
      description: id of client (not client-id)
      required: true
      schema:
        type: string
      style: simple
    - in: path
      name: clientScopeId
      required: true
      schema:
        type: string
      style: simple
    put:
      tags:
      - Clients
      responses:
        2XX:
          description: success
    delete:
      tags:
      - Clients
      responses:
        2XX:
          description: success
  /{realm}/clients/{id}/push-revocation:
    parameters:
    - in: path
      name: realm
      description: realm name (not id!)
      required: true
      schema:
        type: string
      style: simple
    - in: path
      name: id
      description: id of client (not client-id)
      required: true
      schema:
        type: string
      style: simple
    post:
      tags:
      - Clients
      summary: Push the client’s revocation policy to its admin URL   If the client has an admin URL, push revocation policy to it.
      responses:
        2XX:
          description: success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GlobalRequestResult'
  /{realm}/clients/{id}/registration-access-token:
    parameters:
    - in: path
      name: realm
      description: realm name (not id!)
      required: true
      schema:
        type: string
      style: simple
    - in: path
      name: id
      description: id of client (not client-id)
      required: true
      schema:
        type: string
      style: simple
    post:
      tags:
      - Clients
      summary: Generate a new registration access token for the client
      responses:
        2XX:
          description: success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ClientRepresentation'
  /{realm}/clients/{id}/service-account-user:
    parameters:
    - in: path
      name: realm
      description: realm name (not id!)
      required: true
      schema:
        type: string
      style: simple
    - in: path
      name: id
      description: id of client (not client-id)
      required: true
      schema:
        type: string
      style: simple
    get:
      tags:
      - Clients
      summary: Get a user dedicated to the service account
      responses:
        2XX:
          description: success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UserRepresentation'
  /{realm}/clients/{id}/session-count:
    parameters:
    - in: path
      name: realm
      description: realm name (not id!)
      required: true
      schema:
        type: string
      style: simple
    - in: path
      name: id
      description: id of client (not client-id)
      required: true
      schema:
        type: string
      style: simple
    get:
      tags:
      - Clients
      summary: 'Get application session count   Returns a number of user sessions associated with this client   {      "count": number  }'
      responses:
        2XX:
          description: success
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
  /{realm}/clients/{id}/test-nodes-available:
    parameters:
    - in: path
      name: realm
      description: realm name (not id!)
      required: true
      schema:
        type: string
      style: simple
    - in: path
      name: id
      description: id of client (not client-id)
      required: true
      schema:
        type: string
      style: simple
    get:
      tags:
      - Clients
      summary: Test if registered cluster nodes are available   Tests availability by sending 'ping' request to all cluster nodes.
      responses:
        2XX:
          description: success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GlobalRequestResult'
  /{realm}/clients/{id}/user-sessions:
    parameters:
    - in: path
      name: realm
      description: realm name (not id!)
      required: true
      schema:
        type: string
      style: simple
    - in: path
      name: id
      description: id of client (not client-id)
      required: true
      schema:
        type: string
      style: simple
    get:
      tags:
      - Clients
      summary: Get user sessions for client   Returns a list of user sessions associated with this client
      parameters:
      - in: query
        name: first
        description: Paging offset
        schema:
          type: integer
          format: int32
        style: form
      - in: query
        name: max
        description: Maximum results size (defaults to 100)
        schema:
          type: integer
          format: int32
        style: form
      responses:
        2XX:
          description: success
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/UserSessionRepresentation'
components:
  schemas:
    AccessToken-CertConf:
      type: object
      properties:
        x5t#S256:
          type: string
    CredentialRepresentation:
      type: object
      properties:
        createdDate:
          type: integer
          format: int64
        credentialData:
          type: string
        id:
          type: string
        priority:
          type: integer
          format: int32
        secretData:
          type: string
        temporary:
          type: boolean
        type:
          type: string
        userLabel:
          type: string
        value:
          type: string
    AccessToken:
      type: object
      properties:
        acr:
          type: string
        address:
          $ref: '#/components/schemas/AddressClaimSet'
        allowed-origins:
          type: array
          items:
            type: string
        at_hash:
          type: string
        auth_time:
          type: integer
          format: int64
        authorization:
          $ref: '#/components/schemas/AccessToken-Authorization'
        azp:
          type: string
        birthdate:
          type: string
        c_hash:
          type: string
        category:
          type: string
          enum:
          - INTERNAL
          - ACCESS
          - ID
          - ADMIN
          - USERINFO
        claims_locales:
          type: string
        cnf:
          $ref: '#/components/schemas/AccessToken-CertConf'
        email:
          type: string
        email_verified:
          type: boolean
        exp:
          type: integer
          format: int64
        family_name:
          type: string
        gender:
          type: string
        given_name:
          type: string
        iat:
          type: integer
          format: int64
        iss:
          type: string
        jti:
          type: string
        locale:
          type: string
        middle_name:
          type: string
        name:
          type: string
        nbf:
          type: integer
          format: int64
        nickname:
          type: string
        nonce:
          type: string
        otherClaims:
          type: object
          additionalProperties: true
        phone_number:
          type: string
        phone_number_verified:
          type: boolean
        picture:
          type: string
        preferred_username:
          type: string
        profile:
          type: string
        realm_access:
          $ref: '#/components/schemas/AccessToken-Access'
        s_hash:
          type: string
        scope:
          type: string
        session_state:
          type: string
        sub:
          type: string
        trusted-certs:
          type: array
          items:
            type: string
        typ:
          type: string
        updated_at:
          type: integer
          format: int64
        website:
          type: string
        zoneinfo:
          type: string
    ResourceRepresentation:
      type: object
      properties:
        id:
          type: string
        attributes:
          type: object
          additionalProperties: true
        displayName:
          type: string
        icon_uri:
          type: string
        name:
          type: string
        ownerManagedAccess:
          type: boolean
        scopes:
          type: array
          items:
            $ref: '#/components/schemas/ScopeRepresentation'
        type:
          type: string
        uris:
          type: array
          items:
            type: string
    AccessToken-Authorization:
      type: object
      properties:
        permissions:
          type: array
          items:
            $ref: '#/components/schemas/Permission'
    AddressClaimSet:
      type: object
      properties:
        country:
          type: string
        formatted:
          type: string
        locality:
          type: string
        postal_code:
          type: string
        region:
          type: string
        street_address:
          type: string
    UserRepresentation:
      type: object
      properties:
        access:
          type: object
          additionalProperties: true
        attributes:
          type: object
          additionalProperties: true
        clientConsents:
          type: array
          items:
            $ref: '#/components/schemas/UserConsentRepresentation'
        clientRoles:
          type: object
          additionalProperties: true
        createdTimestamp:
          type: integer
          format: int64
        credentials:
          type: array
          items:
            $ref: '#/components/schemas/CredentialRepresentation'
        disableableCredentialTypes:
          type: array
          items:
            type: string
        email:
          type: string
        emailVerified:
          type: boolean
        enabled:
          type: boolean
        federatedIdentities:
          type: array
          items:
            $ref: '#/components/schemas/FederatedIdentityRepresentation'
        federationLink:
          type: string
        firstName:
          type: string
        groups:
          type: array
          items:
            type: string
        id:
          type: string
        lastName:
          type: string
        notBefore:
          type: integer
          format: int32
        origin:
          type: string
        realmRoles:
          type: array
          items:
            type: string
        requiredActions:
          type: array
          items:
            type: string
        self:
          type: string
        serviceAccountClientId:
          type: string
        username:
          type: string
    FederatedIdentityRepresentation:
      type: object
      properties:
        identityProvider:
          type: string
        userId:
          type: string
        userName:
          type: string
    UserSessionRepresentation:
      type: object
      properties:
        clients:
          type: object
          additionalProperties: true
        id:
          type: string
        ipAddress:
          type: string
        lastAccess:
          type: integer
          format: int64
        start:
          type: integer
          format: int64
        userId:
          type: string
        username:
          type: string
    GlobalRequestResult:
      type: object
      properties:
        failedRequests:
          type: array
          items:
            type: string
        successRequests:
          type: array
          items:
            type: string
    ClientScopeEvaluateResource-ProtocolMapperEvaluationRepresentation:
      type: object
      properties:
        containerId:
          type: string
        containerName:
          type: string
        containerType:
          type: string
        mapperId:
          type: string
        mapperName:
          type: string
        protocolMapper:
          type: string
    Permission:
      type: object
      properties:
        claims:
          type: object
          additionalProperties: true
        rsid:
          type: string
        rsname:
          type: string
        scopes:
          type: array
          items:
            type: string
    ProtocolMapperRepresentation:
      type: object
      properties:
        config:
          type: object
          additionalProperties: true
        id:
          type: string
        name:
          type: string
        protocol:
          type: string
        protocolMapper:
          type: string
    ScopeRepresentation:
      type: object
      properties:
        displayName:
          type: string
        iconUri:
          type: string
        id:
          type: string
        name:
          type: string
        policies:
          type: array
          items:
            $ref: '#/components/schemas/PolicyRepresentation'
        resources:
          type: array
          items:
            $ref: '#/components/schemas/ResourceRepresentation'
    RoleRepresentation-Composites:
      type: object
      properties:
        client:
          type: object
          additionalProperties: true
        realm:
          type: array
          items:
            type: string
    ClientRepresentation:
      type: object
      properties:
        access:
          type: object
          additionalProperties: true
        adminUrl:
          type: string
        alwaysDisplayInConsole:
          type: boolean
        attributes:
          type: object
          additionalProperties: true
        authenticationFlowBindingOverrides:
          type: object
          additionalProperties: true
        authorizationServicesEnabled:
          type: boolean
        authorizationSettings:
          $ref: '#/components/schemas/ResourceServerRepresentation'
        baseUrl:
          type: string
        bearerOnly:
          type: boolean
        clientAuthenticatorType:
          type: string
        clientId:
          type: string
        consentRequired:
          type: boolean
        defaultClientScopes:
          type: array
          items:
            type: string
        defaultRoles:
          type: array
          items:
            type: string
        description:
          type: string
        directAccessGrantsEnabled:
          type: boolean
        enabled:
          type: boolean
        frontchannelLogout:
          type: boolean
        fullScopeAllowed:
          type: boolean
        id:
          type: string
        implicitFlowEnabled:
          type: boolean
        name:
          type: string
        nodeReRegistrationTimeout:
          type: integer
          format: int32
        notBefore:
          type: integer
          format: int32
        optionalClientScopes:
          type: array
          items:
            type: string
        origin:
          type: string
        protocol:
          type: string
        protocolMappers:
          type: array
          items:
            $ref: '#/components/schemas/ProtocolMapperRepresentation'
        publicClient:
          type: boolean
        redirectUris:
          type: array
          items:
            type: string
        registeredNodes:
          type: object
          additionalProperties: true
        registrationAccessToken:
          type: string
        rootUrl:
          type: string
        secret:
          type: string
        serviceAccountsEnabled:
          type: boolean
        standardFlowEnabled:
          type: boolean
        surrogateAuthRequired:
          type: boolean
        webOrigins:
          type: array
          items:
            type: string
    UserConsentRepresentation:
      type: object
      properties:
        clientId:
          type: string
        createdDate:
          type: integer
          format: int64
        grantedClientScopes:
          type: array
          items:
            type: string
        lastUpdatedDate:
          type: integer
          forma

# --- truncated at 32 KB (35 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/deutsche-telekom/refs/heads/main/openapi/deutsche-telekom-clients-api-openapi.yml