Gravitee protected-resource API

openapi: 3.2.0
info:
  title: Gravitee.io - Access Management Protected Resource API
  version: 4.12.0-alpha.3
servers:
- url: /management
security:
- gravitee-auth: []
tags:
- name: protected-resource
paths:
  /organizations/{organizationId}/environments/{environmentId}/domains/{domain}/protected-resources:
    get:
      tags:
      - protected-resource
      summary: List registered protected resources for a security domain
      description: User must have the PROTECTED_RESOURCE[LIST] permission on the specified domain, environment or organization AND either PROTECTED_RESOURCE[READ] permission on each domain's protected resource or PROTECTED_RESOURCE[READ] permission on the specified domain or PROTECTED_RESOURCE[READ] permission on the specified environment or PROTECTED_RESOURCE[READ] permission on the specified organization. Each returned protected resource is filtered and contains only basic information such as id, name, description and isEnabled.
      operationId: listProtectedResources
      parameters:
      - name: organizationId
        in: path
        required: true
        schema:
          type: string
      - name: environmentId
        in: path
        required: true
        schema:
          type: string
      - name: domain
        in: path
        required: true
        schema:
          type: string
      - name: q
        in: query
        schema:
          type: string
      - name: type
        in: query
        schema:
          type: string
      - name: page
        in: query
        schema:
          type: integer
          format: int32
          default: 0
      - name: size
        in: query
        schema:
          type: integer
          format: int32
          default: 50
      - name: sort
        in: query
        schema:
          type: string
          default: updatedAt.desc
      responses:
        '200':
          description: List registered protected resources for a security domain
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProtectedResourcePage'
        '500':
          description: Internal server error
    post:
      tags:
      - protected-resource
      summary: Create a Protected Resource definition
      description: User must have PROTECTED_RESOURCE[CREATE] permission on the specified domain or PROTECTED_RESOURCE[CREATE] permission on the specified environment or PROTECTED_RESOURCE[CREATE] permission on the specified organization
      operationId: createProtectedResource
      parameters:
      - name: organizationId
        in: path
        required: true
        schema:
          type: string
      - name: environmentId
        in: path
        required: true
        schema:
          type: string
      - name: domain
        in: path
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/NewProtectedResource'
        required: true
      responses:
        '201':
          description: Protected Resource successfully created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProtectedResourceSecret'
        '500':
          description: Internal server error
  /organizations/{organizationId}/environments/{environmentId}/domains/{domain}/protected-resources/{protected-resource}:
    get:
      tags:
      - protected-resource
      summary: Get a Protected Resource
      description: 'User must have the PROTECTED_RESOURCE[READ] permission on the specified resource or PROTECTED_RESOURCE[READ] permission on the specified domain or PROTECTED_RESOURCE[READ] permission on the specified environment or PROTECTED_RESOURCE[READ] permission on the specified organization. '
      operationId: findProtectedResource
      parameters:
      - name: organizationId
        in: path
        required: true
        schema:
          type: string
      - name: environmentId
        in: path
        required: true
        schema:
          type: string
      - name: domain
        in: path
        required: true
        schema:
          type: string
      - name: protected-resource
        in: path
        required: true
        schema:
          type: string
      - name: type
        in: query
        schema:
          type: string
      responses:
        '200':
          description: Protected Resource
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProtectedResourcePrimaryData'
        '500':
          description: Internal server error
    put:
      tags:
      - protected-resource
      summary: Update a Protected Resource
      description: 'User must have the PROTECTED_RESOURCE[UPDATE] permission on the specified resource or PROTECTED_RESOURCE[UPDATE] permission on the specified domain or PROTECTED_RESOURCE[UPDATE] permission on the specified environment or PROTECTED_RESOURCE[UPDATE] permission on the specified organization. '
      operationId: updateProtectedResource
      parameters:
      - name: organizationId
        in: path
        required: true
        schema:
          type: string
      - name: environmentId
        in: path
        required: true
        schema:
          type: string
      - name: domain
        in: path
        required: true
        schema:
          type: string
      - name: protected-resource
        in: path
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateProtectedResource'
        required: true
      responses:
        '200':
          description: Protected Resource successfully updated
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProtectedResourcePrimaryData'
        '500':
          description: Internal server error
    delete:
      tags:
      - protected-resource
      summary: Delete a Protected Resource
      description: 'User must have the PROTECTED_RESOURCE[DELETE] permission on the specified resource or PROTECTED_RESOURCE[DELETE] permission on the specified domain or PROTECTED_RESOURCE[DELETE] permission on the specified environment or PROTECTED_RESOURCE[DELETE] permission on the specified organization. '
      operationId: deleteProtectedResource
      parameters:
      - name: organizationId
        in: path
        required: true
        schema:
          type: string
      - name: environmentId
        in: path
        required: true
        schema:
          type: string
      - name: domain
        in: path
        required: true
        schema:
          type: string
      - name: protected-resource
        in: path
        required: true
        schema:
          type: string
      - name: type
        in: query
        schema:
          type: string
      responses:
        '204':
          description: Protected Resource successfully deleted
        '404':
          description: Protected Resource not found
        '403':
          description: Forbidden
        '500':
          description: Internal server error
    patch:
      tags:
      - protected-resource
      summary: Patch a Protected Resource
      description: 'User must have the PROTECTED_RESOURCE[UPDATE] permission on the specified resource or PROTECTED_RESOURCE[UPDATE] permission on the specified domain or PROTECTED_RESOURCE[UPDATE] permission on the specified environment or PROTECTED_RESOURCE[UPDATE] permission on the specified organization. '
      operationId: patchProtectedResource
      parameters:
      - name: organizationId
        in: path
        required: true
        schema:
          type: string
      - name: environmentId
        in: path
        required: true
        schema:
          type: string
      - name: domain
        in: path
        required: true
        schema:
          type: string
      - name: protected-resource
        in: path
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PatchProtectedResource'
        required: true
      responses:
        '200':
          description: Protected Resource successfully patched
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProtectedResourcePrimaryData'
        '500':
          description: Internal server error
  ? /organizations/{organizationId}/environments/{environmentId}/domains/{domain}/protected-resources/{protected-resource}/members
  : get:
      tags:
      - protected-resource
      summary: List members for an protected resource
      description: User must have PROTECTED_RESOURCE_MEMBER[LIST] permission on the specified protected resource or PROTECTED_RESOURCE_MEMBER[LIST] permission on the specified domain or PROTECTED_RESOURCE_MEMBER[LIST] permission on the specified environment or PROTECTED_RESOURCE_MEMBER[LIST] permission on the specified organization
      operationId: getMembers_1
      parameters:
      - name: organizationId
        in: path
        required: true
        schema:
          type: string
      - name: environmentId
        in: path
        required: true
        schema:
          type: string
      - name: domain
        in: path
        required: true
        schema:
          type: string
      - name: protected-resource
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          description: List members for an protected resource
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MembershipListItem'
        '500':
          description: Internal server error
    post:
      tags:
      - protected-resource
      summary: Add or update an protected resource member
      description: User must have PROTECTED_RESOURCE_MEMBER[CREATE] permission on the specified protected resource or PROTECTED_RESOURCE_MEMBER[CREATE] permission on the specified domain or PROTECTED_RESOURCE_MEMBER[CREATE] permission on the specified environment or PROTECTED_RESOURCE_MEMBER[CREATE] permission on the specified organization
      operationId: addOrUpdateMember_2
      parameters:
      - name: organizationId
        in: path
        required: true
        schema:
          type: string
      - name: environmentId
        in: path
        required: true
        schema:
          type: string
      - name: domain
        in: path
        required: true
        schema:
          type: string
      - name: protected-resource
        in: path
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/NewMembership'
        required: true
      responses:
        '201':
          description: Member has been added or updated successfully
        '400':
          description: Membership parameter is not valid
        '404':
          description: Domain or protected resource is not found
        '500':
          description: Internal server error
  ? /organizations/{organizationId}/environments/{environmentId}/domains/{domain}/protected-resources/{protected-resource}/members/permissions
  : get:
      tags:
      - protected-resource
      summary: List protected resource member's permissions
      description: User must have PROTECTED_RESOURCE[READ] permission on the specified protected resource or PROTECTED_RESOURCE[READ] permission on the specified domain or PROTECTED_RESOURCE[READ] permission on the specified environment or PROTECTED_RESOURCE[READ] permission on the specified organization
      operationId: getProtectedResourceMemberPermissions
      parameters:
      - name: organizationId
        in: path
        required: true
        schema:
          type: string
      - name: environmentId
        in: path
        required: true
        schema:
          type: string
      - name: domain
        in: path
        required: true
        schema:
          type: string
      - name: protected-resource
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Protected resource member's permissions
          content:
            application/json:
              schema:
                type: string
        '500':
          description: Internal server error
  ? /organizations/{organizationId}/environments/{environmentId}/domains/{domain}/protected-resources/{protected-resource}/members/{member}
  : delete:
      tags:
      - protected-resource
      summary: Remove a membership
      description: User must have PROTECTED_RESOURCE_MEMBER[DELETE] permission on the specified protected resource or PROTECTED_RESOURCE_MEMBER[DELETE] permission on the specified domain or PROTECTED_RESOURCE_MEMBER[DELETE] permission on the specified environment or PROTECTED_RESOURCE_MEMBER[DELETE] permission on the specified organization
      operationId: removeProtectedResourceMember
      parameters:
      - name: organizationId
        in: path
        required: true
        schema:
          type: string
      - name: environmentId
        in: path
        required: true
        schema:
          type: string
      - name: domain
        in: path
        required: true
        schema:
          type: string
      - name: protected-resource
        in: path
        required: true
        schema:
          type: string
      - name: member
        in: path
        required: true
        schema:
          type: string
      responses:
        '204':
          description: Membership successfully deleted
        '500':
          description: Internal server error
  ? /organizations/{organizationId}/environments/{environmentId}/domains/{domain}/protected-resources/{protected-resource}/secrets
  : get:
      tags:
      - protected-resource
      summary: List secrets of a protected resource
      description: User must have the PROTECTED_RESOURCE_OAUTH[LIST] permission on the specified resource or PROTECTED_RESOURCE_OAUTH[LIST] permission on the specified domain or PROTECTED_RESOURCE_OAUTH[LIST] permission on the specified environment or PROTECTED_RESOURCE_OAUTH[LIST] permission on the specified organization.
      operationId: getSecrets
      parameters:
      - name: organizationId
        in: path
        required: true
        schema:
          type: string
      - name: environmentId
        in: path
        required: true
        schema:
          type: string
      - name: domain
        in: path
        required: true
        schema:
          type: string
      - name: protected-resource
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          description: List secrets of a protected resource
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/ClientSecret'
        '500':
          description: Internal server error
    post:
      tags:
      - protected-resource
      summary: Create a secret for a protected resource
      description: User must have the PROTECTED_RESOURCE_OAUTH[CREATE] permission on the specified resource or PROTECTED_RESOURCE_OAUTH[CREATE] permission on the specified domain or PROTECTED_RESOURCE_OAUTH[CREATE] permission on the specified environment or PROTECTED_RESOURCE_OAUTH[CREATE] permission on the specified organization.
      operationId: create
      parameters:
      - name: organizationId
        in: path
        required: true
        schema:
          type: string
      - name: environmentId
        in: path
        required: true
        schema:
          type: string
      - name: domain
        in: path
        required: true
        schema:
          type: string
      - name: protected-resource
        in: path
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/NewClientSecret'
        required: true
      responses:
        '201':
          description: Protected Resource secret successfully created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ClientSecret'
        '500':
          description: Internal server error
  ? /organizations/{organizationId}/environments/{environmentId}/domains/{domain}/protected-resources/{protected-resource}/secrets/{secretId}
  : delete:
      tags:
      - protected-resource
      summary: Remove a secret for a protected resource
      description: User must have the PROTECTED_RESOURCE_OAUTH[DELETE] permission on the specified resource or PROTECTED_RESOURCE_OAUTH[DELETE] permission on the specified domain or PROTECTED_RESOURCE_OAUTH[DELETE] permission on the specified environment or PROTECTED_RESOURCE_OAUTH[DELETE] permission on the specified organization.
      operationId: delete
      parameters:
      - name: organizationId
        in: path
        required: true
        schema:
          type: string
      - name: environmentId
        in: path
        required: true
        schema:
          type: string
      - name: domain
        in: path
        required: true
        schema:
          type: string
      - name: protected-resource
        in: path
        required: true
        schema:
          type: string
      - name: secretId
        in: path
        required: true
        schema:
          type: string
      responses:
        '204':
          description: Protected Resource secret successfully deleted
        '404':
          description: Protected Resource or secret not found
        '500':
          description: Internal server error
  ? /organizations/{organizationId}/environments/{environmentId}/domains/{domain}/protected-resources/{protected-resource}/secrets/{secretId}/_renew
  : post:
      tags:
      - protected-resource
      summary: Renew a secret for a protected resource
      description: User must have the PROTECTED_RESOURCE_OAUTH[UPDATE] permission on the specified resource or PROTECTED_RESOURCE_OAUTH[UPDATE] permission on the specified domain or PROTECTED_RESOURCE_OAUTH[UPDATE] permission on the specified environment or PROTECTED_RESOURCE_OAUTH[UPDATE] permission on the specified organization.
      operationId: renew
      parameters:
      - name: organizationId
        in: path
        required: true
        schema:
          type: string
      - name: environmentId
        in: path
        required: true
        schema:
          type: string
      - name: domain
        in: path
        required: true
        schema:
          type: string
      - name: protected-resource
        in: path
        required: true
        schema:
          type: string
      - name: secretId
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Protected Resource secret successfully renewed
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ClientSecret'
        '500':
          description: Internal server error
components:
  schemas:
    ApplicationSecretSettings:
      type: object
      properties:
        algorithm:
          type: string
        id:
          type: string
    SecretExpirationSettings:
      type: object
      properties:
        enabled:
          type: boolean
        expiryTimeSeconds:
          type: integer
          format: int64
    NewProtectedResourceFeature:
      required:
      - key
      - type
      type: object
      properties:
        description:
          type: string
        key:
          maxLength: 64
          minLength: 1
          pattern: ^[a-zA-Z0-9_-]+$
          type: string
        type:
          type: string
      discriminator:
        propertyName: type
    RememberDeviceSettings:
      type: object
      properties:
        active:
          type: boolean
        deviceIdentifierId:
          type: string
        expirationTimeSeconds:
          type: integer
          format: int64
        skipChallengeWhenRememberDevice:
          type: boolean
        skipRememberDevice:
          type: boolean
    PasswordSettings:
      type: object
      properties:
        excludePasswordsInDictionary:
          type: boolean
        excludeUserProfileInfoInPassword:
          type: boolean
        expiryDuration:
          type: integer
          format: int32
        includeNumbers:
          type: boolean
        includeSpecialCharacters:
          type: boolean
        inherited:
          type: boolean
        lettersInMixedCase:
          type: boolean
        maxConsecutiveLetters:
          type: integer
          format: int32
        maxLength:
          type: integer
          format: int32
        minLength:
          type: integer
          format: int32
        oldPasswords:
          type: integer
          format: int32
        passwordHistoryEnabled:
          type: boolean
    FormField:
      type: object
      properties:
        key:
          type: string
        label:
          type: string
        type:
          type: string
    UpdateProtectedResource:
      required:
      - name
      - resourceIdentifiers
      type: object
      properties:
        description:
          type: string
        features:
          type: array
          items:
            $ref: '#/components/schemas/UpdateProtectedResourceFeature'
        name:
          maxLength: 64
          minLength: 1
          pattern: ^[^\s].*
          type: string
        resourceIdentifiers:
          minItems: 1
          type: array
          items:
            minLength: 1
            type: string
        settings:
          $ref: '#/components/schemas/ApplicationSettings'
    ProtectedResourceFeature:
      type: object
      properties:
        createdAt:
          type: string
          format: date-time
        description:
          type: string
        key:
          type: string
        type:
          type: string
          enum:
          - MCP_TOOL
        updatedAt:
          type: string
          format: date-time
      discriminator:
        propertyName: type
        mapping:
          MCP_TOOL: '#/components/schemas/McpTool'
    LoginSettings:
      type: object
      properties:
        certificateBasedAuthEnabled:
          type: boolean
        certificateBasedAuthUrl:
          type: string
        enforcePasswordPolicyEnabled:
          type: boolean
        forgotPasswordEnabled:
          type: boolean
        hideForm:
          type: boolean
        identifierFirstEnabled:
          type: boolean
        inherited:
          type: boolean
        magicLinkAuthEnabled:
          type: boolean
        passwordlessDeviceNamingEnabled:
          type: boolean
        passwordlessEnabled:
          type: boolean
        passwordlessEnforcePasswordEnabled:
          type: boolean
        passwordlessEnforcePasswordMaxAge:
          type: integer
          format: int32
        passwordlessRememberDeviceEnabled:
          type: boolean
        registerEnabled:
          type: boolean
        rememberMeEnabled:
          type: boolean
        resetPasswordOnExpiration:
          type: boolean
    ApplicationSAMLSettings:
      type: object
      properties:
        assertionAttributes:
          type: array
          items:
            $ref: '#/components/schemas/SAMLAssertionAttribute'
        assertionValiditySeconds:
          type: integer
          format: int32
        attributeConsumeServiceUrl:
          type: string
        audiences:
          type: array
          items:
            type: string
        certificate:
          type: string
        dataEncryptionAlgorithm:
          type: string
        entityId:
          type: string
        includeAssertionConditions:
          type: boolean
        keyTransportEncryptionAlgorithm:
          type: string
        nameIdMapping:
          type: string
        notBeforeTimeSkewSeconds:
          type: integer
          format: int32
        notOnOrAfterTimeSkewSeconds:
          type: integer
          format: int32
        responseBinding:
          type: string
        singleLogoutServiceUrl:
          type: string
        wantAssertionsEncrypted:
          type: boolean
        wantAssertionsSigned:
          type: boolean
        wantResponseSigned:
          type: boolean
    StepUpAuthenticationSettings:
      type: object
      properties:
        active:
          type: boolean
        stepUpAuthenticationRule:
          type: string
    EnrollSettings:
      type: object
      properties:
        active:
          type: boolean
        enrollmentRule:
          type: string
        enrollmentSkipActive:
          type: boolean
        enrollmentSkipRule:
          type: string
        forceEnrollment:
          type: boolean
        skipTimeSeconds:
          type: integer
          format: int64
        type:
          type: string
          enum:
          - OPTIONAL
          - REQUIRED
          - CONDITIONAL
    FactorSettings:
      type: object
      properties:
        applicationFactors:
          type: array
          items:
            $ref: '#/components/schemas/ApplicationFactorSettings'
        defaultFactorId:
          type: string
    EnrollmentSettings:
      type: object
      properties:
        forceEnrollment:
          type: boolean
        skipTimeSeconds:
          type: integer
          format: int64
    UpdateProtectedResourceFeature:
      required:
      - key
      - type
      type: object
      properties:
        description:
          type: string
        key:
          maxLength: 64
          minLength: 1
          pattern: ^[a-zA-Z0-9_-]+$
          type: string
        type:
          type: string
      discriminator:
        propertyName: type
    AssessmentSettings:
      type: object
      properties:
        enabled:
          type: boolean
        thresholds:
          type: object
          additionalProperties:
            type: number
            format: double
    ProtectedResourcePrimaryData:
      type: object
      properties:
        certificate:
          type: string
        clientId:
          type: string
        description:
          type: string
        features:
          type: array
          items:
            $ref: '#/components/schemas/ProtectedResourceFeature'
        id:
          type: string
        name:
          type: string
        resourceIdentifiers:
          type: array
          items:
            type: string
        secretSettings:
          type: array
          items:
            $ref: '#/components/schemas/ApplicationSecretSettings'
        settings:
          $ref: '#/components/schemas/ApplicationSettings'
        type:
          type: string
          enum:
          - MCP_SERVER
        updatedAt:
          type: string
          format: date-time
    CookieSettings:
      type: object
      properties:
        inherited:
          type: boolean
        session:
          $ref: '#/components/schemas/SessionSettings'
    ApplicationSettings:
      type: object
      properties:
        account:
          $ref: '#/components/schemas/AccountSettings'
        advanced:
          $ref: '#/components/schemas/ApplicationAdvancedSettings'
        cookieSettings:
          $ref: '#/components/schemas/CookieSettings'
        login:
          $ref: '#/components/schemas/LoginSettings'
        mfa:
          $ref: '#/components/schemas/MFASettings'
        oauth:
          $ref: '#/components/schemas/ApplicationOAuthSettings'
        passwordSettings:
          $ref: '#/components/schemas/PasswordSettings'
        riskAssessment:
          $ref: '#/components/schemas/RiskAssessmentSettings'
        saml:
          $ref: '#/components/schemas/ApplicationSAMLSettings'
        secretExpirationSettings:
          $ref: '#/components/schemas/SecretExpirationSettings'
    ApplicationScopeSettings:
      type: object
      properties:
        defaultScope:
          type: boolean
        scope:
          type: string
        scopeApproval:
          type: integer
          format: int32
    NewMembership:
      required:
      - memberId
      - memberType
      - role
      type: object
      properties:
        memberId:
          type: string
        memberType:
          type: string
          enum:
          - USER
          - GROUP
        role:
          type: string
    PatchProtectedResource:
      type: object
      properties:
        certificate:
          type: string
        description:
          type: string
        features:
          type: array
          items:
            $ref: '#/components/schemas/UpdateProtectedResourceFeature'
        name:
          maxLength: 64
          minLength: 1
          pattern: ^[^\s].*
          type: string
        resourceIdentifiers:
          type: array
          items:
            type: string
        secretSettings:
          type: array
          items:
            $ref: '#/components/schemas/ApplicationSecretSettings'
        settings:
          $ref: '#/components/schemas/ApplicationSettings'
    JWK:
      type: object
      properties:
        alg:
          type: string
        keyOps:
          uniqueItems: true
          type: array
          items:
            type: string
        kid:
          type: string
        kty:
          type: string
        use:
          type: string
        x5c:
          uniqueItems: true
          type: array
          items:
            type: string
        x5t:
          type: string
        x5tS256:
          type: string
        x5u:
          type: string
    JWKSet:
      type: object
      properties:
        keys:
          type: array
          items:
            $ref: '#/components/schemas/JWK'
    ApplicationOAuthSettings:
      type: object
      properties:
        accessTokenValiditySeconds:
          type: integer
          format: int32
        applicationType:
          type: string
        authorizationEncryptedResponseAlg:
          type: string
        authorizationEncryptedResponseEnc:
          type: string
        authorizationSignedResponseAlg:
          type: string
        backchannelAuthRequestSignAlg:
          type: string
        backchannelClientNotificationEndpoint:
          type: string
        backchannelTokenDeliveryMode:
          type: string
        backchannelUserCodeParameter:
          type: boolean
        clientId:
          type: string
        clientIdIssuedAt:
          type: string
          format: date-time
        clientName:
          type: string
        clientSecret:
          type: string
        clientSecretExpiresAt:
          type: string
          format: date-time
        clientType:
          type: string
        clientUri:
          type: string
        contacts:
          type: array
          items:
            type: string
        defaultACRvalues:
          type: array
          items:
            type: string
        defaultMaxAge:
          type: integer
          format: int32
        defaultScopes:
          type: array
          items:
            type: string
        disableRefreshTokenRotation:
          type: boolean
        enhanceScopesWithUserPermissions:
          type: boolean
        forcePKCE:
          type: boolean
        forceS256CodeChallengeMethod:
          type: boolean
        grantTypes:
          type: array
          items:
            type: string
        idTokenEncryptedResponseAlg:
          type: string
        idTokenEncryptedResponseEnc:
          type: string
        idTokenSignedResponseAlg:
          type: string
        idTokenValiditySeconds:
          type: integer
          format: int32
        initiateLoginUri:
          type: string
        jwks:
          $ref: '#/components/schemas/JWKSet'
        jwksUri:
          type: string
        logoUri:
          type: string
        policyUri:
          type: string
        postLogoutRedirectUris:
          type: array
          items:
            type: string
        redirectUris:
          type: array
          items:
            type: string
        refreshTokenValiditySeconds:
          type: integer
          format: int32
        registrationAccessToken:
          type: string

# --- truncated at 32 KB (41 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/gravitee/refs/heads/main/openapi/gravitee-protected-resource-api-openapi.yml