Storm MCP Register API

openapi: 3.2.0
info:
  title: MCP Gateway Register API
  description: API for MCP Gateway operations
  version: v1
servers:
- url: https://dev.stormmcp.ai/
tags:
- name: Register
paths:
  /.well-known/oauth-authorization-server/v1/register:
    post:
      tags:
      - Register
      summary: Allows dynamic client registration for MCP clients
      parameters:
      - name: Cf-Warp-Tag-Id
        in: header
        schema:
          type: string
      - name: Cf-Connecting-Ip
        in: header
        schema:
          type: string
      requestBody:
        description: A token to monitor for cancellation requests.
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/OIDCClientRepresentation'
          text/json:
            schema:
              $ref: '#/components/schemas/OIDCClientRepresentation'
          application/*+json:
            schema:
              $ref: '#/components/schemas/OIDCClientRepresentation'
        required: true
      responses:
        '201':
          description: A IActionResult representing the registered client metadata.
      operationId: postWellKnownOauthAuthorizationServerV1Register
      x-operation-id-source: derived
components:
  schemas:
    OIDCClientRepresentation:
      type: object
      properties:
        redirect_uris:
          type:
          - 'null'
          - array
          items:
            type: string
          description: 'Gets or sets the array of redirection URI values used by the Client.

            One of these registered redirection URI values MUST exactly match the redirect_uri parameter

            value used in each Authorization Request.'
        token_endpoint_auth_method:
          type:
          - 'null'
          - string
          description: 'Gets or sets the requested Client authentication method for the Token Endpoint.

            Values: "none", "client_secret_post", "client_secret_basic", "client_secret_jwt", "private_key_jwt".'
        token_endpoint_auth_signing_alg:
          type:
          - 'null'
          - string
          description: Gets or sets the requested Client authentication signing algorithm for the Token Endpoint.
        grant_types:
          type:
          - 'null'
          - array
          items:
            type: string
          description: 'Gets or sets the array of OAuth 2.0 grant type strings that the Client is declaring that it will restrict itself to using.

            Values: "authorization_code", "implicit", "password", "client_credentials", "refresh_token", "urn:ietf:params:oauth:grant-type:jwt-bearer", "urn:ietf:params:oauth:grant-type:saml2-bearer".'
        response_types:
          type:
          - 'null'
          - array
          items:
            type: string
          description: 'Gets or sets the array of the OAuth 2.0 response_type values that the Client is declaring that it will restrict itself to using.

            Values: "code", "token", "id_token".'
        application_type:
          type:
          - 'null'
          - string
          description: 'Gets or sets the kind of the application. The default, if omitted, is "web".

            Values: "web", "native".'
        client_id:
          type:
          - 'null'
          - string
          description: Gets or sets the client identifier string. If omitted, the authorization server MUST generate a unique Client Identifier.
        client_secret:
          type:
          - 'null'
          - string
          description: Gets or sets the client secret string. If omitted, the authorization server MAY issue a Client Secret or MAY leave it blank.
        client_name:
          type:
          - 'null'
          - string
          description: Gets or sets the human-readable string name of the Client to be presented to the End-User.
        client_uri:
          type:
          - 'null'
          - string
          description: Gets or sets the URL of the home page of the Client.
        logo_uri:
          type:
          - 'null'
          - string
          description: Gets or sets the URL that references a logo for the Client application.
        scope:
          type:
          - 'null'
          - string
          description: Gets or sets the string containing a space-separated list of scope values that the client can use when requesting access tokens.
        contacts:
          type:
          - 'null'
          - array
          items:
            type: string
          description: Gets or sets the array of strings representing ways to contact people responsible for this Client, typically email addresses.
        tos_uri:
          type:
          - 'null'
          - string
          description: Gets or sets the URL that the Relying Party Client provides to the End-User to read about the how the profile data will be used.
        policy_uri:
          type:
          - 'null'
          - string
          description: Gets or sets the URL that the Relying Party Client provides to the End-User to read about the Relying Party's terms of service.
        jwks_uri:
          type:
          - 'null'
          - string
          description: Gets or sets the URL for the Client's JSON Web Key Set document.
        jwks:
          description: Gets or sets the Client's JSON Web Key Set document, passed by value.
        sector_identifier_uri:
          type:
          - 'null'
          - string
          description: Gets or sets the URL using the https scheme to be used in calculating Pseudonymous Identifiers by the OP.
        subject_type:
          type:
          - 'null'
          - string
          description: 'Gets or sets the subject identifier type requested for responses to this Client.

            Values: "public", "pairwise".'
        id_token_signed_response_alg:
          type:
          - 'null'
          - string
          description: Gets or sets the JWS alg algorithm required for signing the ID Token issued to this Client.
        id_token_encrypted_response_alg:
          type:
          - 'null'
          - string
          description: Gets or sets the JWE alg algorithm required for encrypting the ID Token issued to this Client.
        id_token_encrypted_response_enc:
          type:
          - 'null'
          - string
          description: Gets or sets the JWE enc algorithm required for encrypting the ID Token issued to this Client.
        userinfo_signed_response_alg:
          type:
          - 'null'
          - string
          description: Gets or sets the JWS alg algorithm required for signing UserInfo Responses.
        userinfo_encrypted_response_alg:
          type:
          - 'null'
          - string
          description: Gets or sets the JWE alg algorithm required for encrypting UserInfo Responses.
        userinfo_encrypted_response_enc:
          type:
          - 'null'
          - string
          description: Gets or sets the JWE enc algorithm required for encrypting UserInfo Responses.
        request_object_signing_alg:
          type:
          - 'null'
          - string
          description: Gets or sets the JWS alg algorithm that MUST be used for signing Request Objects sent to the OP.
        request_object_encryption_alg:
          type:
          - 'null'
          - string
          description: Gets or sets the JWE alg algorithm the RP is declaring that it may use for encrypting Request Objects sent to the OP.
        request_object_encryption_enc:
          type:
          - 'null'
          - string
          description: Gets or sets the JWE enc algorithm the RP is declaring that it may use for encrypting Request Objects sent to the OP.
        default_max_age:
          pattern: ^-?(?:0|[1-9]\d*)$
          type:
          - 'null'
          - integer
          - string
          description: Gets or sets the Default Maximum Authentication Age. Specifies that the End-User MUST be actively authenticated if the End-User was authenticated longer ago than the specified number of seconds.
          format: int32
        require_auth_time:
          type:
          - 'null'
          - boolean
          description: Gets or sets a value indicating whether the auth_time Claim in the ID Token is REQUIRED.
        default_acr_values:
          type:
          - 'null'
          - array
          items:
            type: string
          description: Gets or sets the default requested Authentication Context Class Reference values.
        initiate_login_uri:
          type:
          - 'null'
          - string
          description: Gets or sets the URI using the https scheme that a third party can use to initiate a login by the RP.
        request_uris:
          type:
          - 'null'
          - array
          items:
            type: string
          description: Gets or sets the array of request_uri values that are pre-registered by the RP for use at the OP.
        post_logout_redirect_uris:
          type:
          - 'null'
          - array
          items:
            type: string
          description: Gets or sets the array of URLs supplied by the RP to which it MAY request that the End-User's User Agent be redirected using the post_logout_redirect_uri parameter after a logout has been performed.
        software_id:
          type:
          - 'null'
          - string
          description: Gets or sets a unique identifier string assigned by the client developer or software publisher.
        software_version:
          type:
          - 'null'
          - string
          description: Gets or sets a version identifier string for the client software identified by "software_id".
        client_id_issued_at:
          pattern: ^-?(?:0|[1-9]\d*)$
          type:
          - 'null'
          - integer
          - string
          description: Gets or sets the time at which the client_id was issued. Represented as seconds from 1970-01-01T00:00:00Z as measured in UTC.
          format: int32
        client_secret_expires_at:
          pattern: ^-?(?:0|[1-9]\d*)$
          type:
          - 'null'
          - integer
          - string
          description: Gets or sets the time at which the client_secret will expire or 0 if it will not expire. Represented as seconds from 1970-01-01T00:00:00Z as measured in UTC.
          format: int32
        registration_client_uri:
          type:
          - 'null'
          - string
          description: Gets or sets the location of the Client Configuration Endpoint where the Registration Access Token can be used to perform subsequent operations upon the Client registration.
        registration_access_token:
          type:
          - 'null'
          - string
          description: Gets or sets the Registration Access Token that can be used at the Client Configuration Endpoint to perform subsequent operations upon the Client registration.
        tls_client_certificate_bound_access_tokens:
          type:
          - 'null'
          - boolean
          description: Gets or sets a value indicating the client's intention to use mutual TLS client certificate bound access tokens.
        dpop_bound_access_tokens:
          type:
          - 'null'
          - boolean
          description: Gets or sets a value indicating the client's intention to use DPoP proof-of-possession for access tokens.
        backchannel_logout_uri:
          type:
          - 'null'
          - string
          description: Gets or sets the RP URL that will cause the RP to log the user out when sent a Logout Token by the OP.
        backchannel_logout_session_required:
          type:
          - 'null'
          - boolean
          description: Gets or sets a value indicating whether the RP requires that a sid (session ID) Claim be included in the Logout Token.
        backchannel_logout_revoke_offline_tokens:
          type:
          - 'null'
          - boolean
          description: Gets or sets a value indicating whether the RP wants to have refresh tokens and offline access revoked when the user logs out at the OP.
        tls_client_auth_subject_dn:
          type:
          - 'null'
          - string
          description: Gets or sets the Subject Distinguished Name of the certificate, which the OAuth client will use in mutual TLS authentication.
        backchannel_token_delivery_mode:
          type:
          - 'null'
          - string
          description: 'Gets or sets the backchannel token delivery mode. Values: "poll", "ping".'
        backchannel_client_notification_endpoint:
          type:
          - 'null'
          - string
          description: Gets or sets the backchannel client notification endpoint URL.
        backchannel_authentication_request_signing_alg:
          type:
          - 'null'
          - string
          description: Gets or sets the JWS algorithm for signing backchannel authentication requests.
        authorization_signed_response_alg:
          type:
          - 'null'
          - string
          description: Gets or sets the JWS algorithm for signing authorization responses.
        authorization_encrypted_response_alg:
          type:
          - 'null'
          - string
          description: Gets or sets the JWE algorithm for encrypting authorization responses.
        authorization_encrypted_response_enc:
          type:
          - 'null'
          - string
          description: Gets or sets the JWE encryption algorithm for authorization responses.
        require_pushed_authorization_requests:
          type:
          - 'null'
          - boolean
          description: Gets or sets a value indicating whether the client requires the use of pushed authorization requests.
        frontchannel_logout_uri:
          type:
          - 'null'
          - string
          description: Gets or sets the RP URL that will cause the RP to log the user out when called by the OP.
        frontchannel_logout_session_required:
          type:
          - 'null'
          - boolean
          description: Gets or sets a value indicating whether the RP requires that iss (issuer) and sid (session ID) query parameters are included to identify the RP session with the OP when the frontchannel_logout_uri is used.
      description: 'Represents an OIDC client representation for dynamic client registration in Keycloak.


        This class is based on the Keycloak OIDCClientRepresentation Java class structure

        from Keycloak version 26.0.8 documentation:

        https://www.keycloak.org/docs-api/26.0.8/javadocs/org/keycloak/representations/oidc/OIDCClientRepresentation.html


        Note: This implementation is compatible with Keycloak v26.0.6 and is used for

        POST requests to /realms/{realm}/clients-registrations/openid-connect endpoint.


        Reference: OpenID Connect Dynamic Client Registration 1.0 specification.'