Signicat · Schema

ClientDto

CompanyDigital IdentityAuthenticationE-SignatureKYCIdentity VerificationeIDFraud Prevention

Properties

Name	Type	Description
id	stringnull	Client identifier (Globally unique). If not provided a new ID will be generated.
name	string	Client name.
account	string	Client account id.
acr	object
pairWiseSubjectSalt	stringnull	Salt value used in pair-wise subjectId generation for users of this client.
uri	stringnull	URI to further information about client (used on consent screen).
logoUri	stringnull	URI to client logo (used on consent screen). Must be an absolute URI and Https.
encryptIdTokens	boolean	Enable/Disable IDTokens encryption. If enabled requires public keys allowed to encrypt.
requireSecret	boolean	Specifies whether this client needs a secret to request tokens from the token endpoint. At least one of these attributes must be 'true' (RequireSecret or RequirePkce). When 'PrimaryGrantType' is set t
requirePkce	boolean	Specifies whether clients using an authorization code based grant type must send a proof key. At least one of these attributes must be 'true' (RequireSecret or RequirePkce).
requireRequestObject	boolean	Specifies whether this client needs to wrap the authorize request parameters in a JWT. When 'PrimaryGrantType' is set to 'ClientCredentials' or 'DeviceFlow' it must be 'false'.
useReferenceAccessTokens	boolean	Specifies whether should use reference tokens or not.
redirectUris	arraynull	Specifies the allowed URIs to return tokens or authorization codes to. Must have at least one redirect URI in case of PrimaryGrantType attribute is DeviceFlow. Must be an absolute URI and Https. Http
allowedScopes	array	Specifies the allowed resources that client as access.
allowOfflineAccess	boolean	Specifies whether this client can request refresh tokens.
allowAccessTokensViaBrowser	boolean	Specifies whether this client is allowed to receive access tokens via the browser. This is useful to harden flows that allow multiple response types (e.g. by disallowing a hybrid flow client that is s
postLogoutRedirectUris	arraynull	Specifies allowed URIs to redirect to after logout. See the OIDC Connect Session Management spec (https://openid.net/specs/openid-connect-session-1_0.html) for more details.
frontChannelLogoutUri	stringnull	Specifies logout URI at client for HTTP based front-channel logout. See the OIDC Front-Channel spec (https://openid.net/specs/openid-connect-frontchannel-1_0.html) for more details. The URIs must be a
frontChannelLogoutSessionRequired	boolean	Specifies if the user’s session id should be sent to the FrontChannelLogoutUri.
identityProviderRestrictions	arraynull	Specifies which external IdPs can be used with this client (if list is empty all IdPs are allowed). Defaults to empty.
userSsoLifetime	integer	The maximum duration (in seconds) since the last time the user authenticated. You can adjust the lifetime of a session token to control when and how often a user is required to reenter credentials ins
identityTokenLifetime	integer	Lifetime to identity token in seconds. The default value is 600 seconds.
accessTokenLifetime	integer	Lifetime of access token in seconds. The default value is 600 seconds.
authorizationCodeLifetime	integer	Lifetime of authorization code in seconds. The default value is 15 seconds.
absoluteRefreshTokenLifetime	integer	Maximum lifetime of a refresh token in seconds. The default value is 86400 seconds. Must be greater then 1 when attribute SlidingRefreshTokenExpiry is off and AllowOfflineAccess is on.
slidingRefreshTokenLifetime	integer	Sliding lifetime of a refresh token in seconds. The default value is 86400 seconds. Must be greater then 1 when attribute SlidingRefreshTokenExpiry and AllowOfflineAccess is on.
allowRefreshTokenReuse	boolean	Allow reuse refresh token. The refresh token handle will stay the same when refreshing tokens. If set to false (default value) then the refresh token handle will be updated when refreshing tokens.
slidingRefreshTokenExpiry	boolean	Specifies whether refresh token should expire or not. Currently don´t have any default value and fail if not set. When set to 'true' and AllowOfflineAccess is on then SlidingRefreshTokenLifetime attri
deviceCodeLifetime	integer	Lifetime to device code in seconds. The default value is 300 seconds. Must be greater then 0 when PrimaryGrantType attribute is DeviceFlow grant type.
allowedCorsOrigins	arraynull	Specifies the allowed CORS origins that will be used by the default CORS policy service implementations (In-Memory and EF) to build a CORS policy for JavaScript clients.
primaryGrantType	string	Specifies the primary grant type the client is allowed to use.
contentEncryptionAlgorithm	stringnull	Content encryption algorithm for ID tokens and the UserInfo response. Defaults to A256CBC-HS512.
idTokenUserData	string	Defines the IdToken user data level.
userInfoResponseType	stringnull	User info response type. Defaults to 'Json'.
version	stringnull	Internal version of the client (Read only).
requireConsent	boolean	Specifies whether a consent screen is required.
createdDate	stringnull	Defines when the client was created (Read only).
lastUpdatedDate	stringnull	Defines the last change on the client (Read only).
automaticRedirectAfterSignOut	boolean	Indicates if after a logout, the client should be redirected automatically. Depends on the existence of at least one Uri in the PostLogoutRedirectUris property to operate as designed.
usageExternalReference	stringnull	External reference for transaction provided by the customer. Used to group transactions together for the customer.orderid:121232
subjectLookupsEnabled	booleannull	Enables the Enterprise Subject Lookup migration feature. Note: You need admin permissions to enable this feature.
useCookieless	booleannull	Enables the Client to not use cookies. Note: You need admin permissions to enable this feature.
requirePushedAuthorization	boolean	Enables the Client to require pushed authorization requests.
isInternalWorkloadClient	boolean	Specifies whether the client is a workload client.
forceLogin	boolean	Disables SSO for the client.
embeddedParentDomains	arraynull	Specify the parent domains that will embed the authentication. This will be used for content security frame ancestor header if set, as an extra security mechanism to protect against clickjacking.

View JSON Schema on GitHub

JSON Schema

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://raw.githubusercontent.com/api-evangelist/signicat/main/json-schema/signicat-client-dto-schema.json",
  "title": "ClientDto",
  "x-generated": "2026-10-18",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/signicat-oidc-config-openapi.yml#/components/schemas/ClientDto",
  "required": [
    "account",
    "allowedScopes",
    "name",
    "primaryGrantType"
  ],
  "type": "object",
  "properties": {
    "id": {
      "maxLength": 100,
      "minLength": 8,
      "type": [
        "string",
        "null"
      ],
      "description": "Client identifier (Globally unique).\n\nIf not provided a new ID will be generated."
    },
    "name": {
      "maxLength": 255,
      "minLength": 8,
      "type": "string",
      "description": "Client name."
    },
    "account": {
      "maxLength": 100,
      "minLength": 1,
      "type": "string",
      "description": "Client account id."
    },
    "acr": {
      "$ref": "#/$defs/Acr"
    },
    "pairWiseSubjectSalt": {
      "maxLength": 255,
      "type": [
        "string",
        "null"
      ],
      "description": "Salt value used in pair-wise subjectId generation for users of this client."
    },
    "uri": {
      "type": [
        "string",
        "null"
      ],
      "description": "URI to further information about client (used on consent screen).",
      "format": "uri"
    },
    "logoUri": {
      "type": [
        "string",
        "null"
      ],
      "description": "URI to client logo (used on consent screen).\n\nMust be an absolute URI and Https.",
      "format": "uri"
    },
    "encryptIdTokens": {
      "type": "boolean",
      "description": "Enable/Disable IDTokens encryption.\n\nIf enabled requires public keys allowed to encrypt.",
      "default": false
    },
    "requireSecret": {
      "type": "boolean",
      "description": "Specifies whether this client needs a secret to request tokens from the token endpoint.\n\nAt least one of these attributes must be 'true' (RequireSecret or RequirePkce).\nWhen 'PrimaryGrantType' is set to 'ClientCredentials' or 'DeviceFlow' it must be 'true'.",
      "default": true
    },
    "requirePkce": {
      "type": "boolean",
      "description": "Specifies whether clients using an authorization code based grant type must send a proof key.\n\nAt least one of these attributes must be 'true' (RequireSecret or RequirePkce).",
      "default": false
    },
    "requireRequestObject": {
      "type": "boolean",
      "description": "Specifies whether this client needs to wrap the authorize request parameters in a JWT.\n\nWhen 'PrimaryGrantType' is set to 'ClientCredentials' or 'DeviceFlow' it must be 'false'.",
      "default": false
    },
    "useReferenceAccessTokens": {
      "type": "boolean",
      "description": "Specifies whether should use reference tokens or not.",
      "default": false
    },
    "redirectUris": {
      "maxItems": 200,
      "type": [
        "array",
        "null"
      ],
      "items": {
        "type": "string",
        "format": "uri"
      },
      "description": "Specifies the allowed URIs to return tokens or authorization codes to.\n\nMust have at least one redirect URI in case of PrimaryGrantType attribute is DeviceFlow.\nMust be an absolute URI and Https.\nHttp URIs are only allowed if pointing at localhost."
    },
    "allowedScopes": {
      "maxItems": 200,
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Specifies the allowed resources that client as access."
    },
    "allowOfflineAccess": {
      "type": "boolean",
      "description": "Specifies whether this client can request refresh tokens.",
      "default": true
    },
    "allowAccessTokensViaBrowser": {
      "type": "boolean",
      "description": "Specifies whether this client is allowed to receive access tokens via the browser. This is useful to harden flows that allow multiple response types (e.g. by disallowing a hybrid flow client that is supposed to use code id_token to add the token response type and thus leaking the token to the browser).",
      "default": false
    },
    "postLogoutRedirectUris": {
      "maxItems": 200,
      "type": [
        "array",
        "null"
      ],
      "items": {
        "type": "string",
        "format": "uri"
      },
      "description": "Specifies allowed URIs to redirect to after logout. See the OIDC Connect Session Management spec (https://openid.net/specs/openid-connect-session-1_0.html) for more details."
    },
    "frontChannelLogoutUri": {
      "type": [
        "string",
        "null"
      ],
      "description": "Specifies logout URI at client for HTTP based front-channel logout. See the OIDC Front-Channel spec (https://openid.net/specs/openid-connect-frontchannel-1_0.html) for more details.\n\nThe URIs must be an absolute URI and Https.\nHttp uris are only allowed if pointing at localhost.",
      "format": "uri"
    },
    "frontChannelLogoutSessionRequired": {
      "type": "boolean",
      "description": "Specifies if the user’s session id should be sent to the FrontChannelLogoutUri.",
      "default": false
    },
    "identityProviderRestrictions": {
      "maxItems": 200,
      "type": [
        "array",
        "null"
      ],
      "items": {
        "type": "string"
      },
      "description": "Specifies which external IdPs can be used with this client (if list is empty all IdPs are allowed).\n\nDefaults to empty."
    },
    "userSsoLifetime": {
      "maximum": 10800,
      "minimum": 1,
      "type": "integer",
      "description": "The maximum duration (in seconds) since the last time the user authenticated.\n\nYou can adjust the lifetime of a session token to control when and how often a user is required to reenter credentials instead of being silently authenticated, when using a web application.\nThe default value is 3600 seconds.",
      "format": "int32",
      "default": 3600
    },
    "identityTokenLifetime": {
      "maximum": 3600,
      "minimum": 1,
      "type": "integer",
      "description": "Lifetime to identity token in seconds.\n\nThe default value is 600 seconds.",
      "format": "int32",
      "default": 600
    },
    "accessTokenLifetime": {
      "maximum": 3600,
      "minimum": 1,
      "type": "integer",
      "description": "Lifetime of access token in seconds.\n\nThe default value is 600 seconds.",
      "format": "int32",
      "default": 600
    },
    "authorizationCodeLifetime": {
      "maximum": 60,
      "minimum": 1,
      "type": "integer",
      "description": "Lifetime of authorization code in seconds.\n\nThe default value is 15 seconds.",
      "format": "int32",
      "default": 15
    },
    "absoluteRefreshTokenLifetime": {
      "maximum": 2592000,
      "minimum": 1,
      "type": "integer",
      "description": "Maximum lifetime of a refresh token in seconds.\n\nThe default value is 86400 seconds.\nMust be greater then 1 when attribute SlidingRefreshTokenExpiry is off and AllowOfflineAccess is on.",
      "format": "int32",
      "default": 86400
    },
    "slidingRefreshTokenLifetime": {
      "maximum": 1296000,
      "minimum": 1,
      "type": "integer",
      "description": "Sliding lifetime of a refresh token in seconds.\n\nThe default value is 86400 seconds.\nMust be greater then 1 when attribute SlidingRefreshTokenExpiry and AllowOfflineAccess is on.",
      "format": "int32",
      "default": 86400
    },
    "allowRefreshTokenReuse": {
      "type": "boolean",
      "description": "Allow reuse refresh token. The refresh token handle will stay the same when refreshing tokens.\n\nIf set to false (default value) then the refresh token handle will be updated when refreshing tokens.",
      "default": false
    },
    "slidingRefreshTokenExpiry": {
      "type": "boolean",
      "description": "Specifies whether refresh token should expire or not.\n\nCurrently don´t have any default value and fail if not set.\nWhen set to 'true' and AllowOfflineAccess is on then SlidingRefreshTokenLifetime attribute must be greater then 0.\nWhen set to 'false' and AllowOfflineAccess is on then AbsoluteRefreshTokenLifetime attribute must be greater then 0.",
      "default": false
    },
    "deviceCodeLifetime": {
      "maximum": 600,
      "minimum": 1,
      "type": "integer",
      "description": "Lifetime to device code in seconds.\n\nThe default value is 300 seconds.\nMust be greater then 0 when PrimaryGrantType attribute is DeviceFlow grant type.",
      "format": "int32",
      "default": 300
    },
    "allowedCorsOrigins": {
      "maxItems": 200,
      "type": [
        "array",
        "null"
      ],
      "items": {
        "type": "string"
      },
      "description": "Specifies the allowed CORS origins that will be used by the default CORS policy service implementations (In-Memory and EF) to build a CORS policy for JavaScript clients."
    },
    "primaryGrantType": {
      "enum": [
        "ClientCredentials",
        "AuthorizationCode",
        "Hybrid",
        "Ciba",
        "DeviceFlow"
      ],
      "type": "string",
      "description": "Specifies the primary grant type the client is allowed to use."
    },
    "contentEncryptionAlgorithm": {
      "enum": [
        "A128CBC-HS256",
        "A192CBC-HS384",
        "A256CBC-HS512"
      ],
      "type": [
        "string",
        "null"
      ],
      "description": "Content encryption algorithm for ID tokens and the UserInfo response.\n\nDefaults to A256CBC-HS512."
    },
    "idTokenUserData": {
      "enum": [
        "Minimal",
        "StandardScopes",
        "All"
      ],
      "type": "string",
      "description": "Defines the IdToken user data level."
    },
    "userInfoResponseType": {
      "enum": [
        "Json",
        "Signed",
        "Encrypted",
        "SignedAndEncrypted"
      ],
      "type": [
        "string",
        "null"
      ],
      "description": "User info response type.\n\nDefaults to 'Json'."
    },
    "version": {
      "maxLength": 255,
      "type": [
        "string",
        "null"
      ],
      "description": "Internal version of the client (Read only)."
    },
    "requireConsent": {
      "type": "boolean",
      "description": "Specifies whether a consent screen is required.",
      "default": false
    },
    "createdDate": {
      "type": [
        "string",
        "null"
      ],
      "description": "Defines when the client was created (Read only).",
      "format": "date-time"
    },
    "lastUpdatedDate": {
      "type": [
        "string",
        "null"
      ],
      "description": "Defines the last change on the client (Read only).",
      "format": "date-time"
    },
    "automaticRedirectAfterSignOut": {
      "type": "boolean",
      "description": "Indicates if after a logout, the client should be redirected automatically.\n\nDepends on the existence of at least one Uri in the PostLogoutRedirectUris property to operate as designed.",
      "default": false
    },
    "usageExternalReference": {
      "maxLength": 100,
      "type": [
        "string",
        "null"
      ],
      "description": "External reference for transaction provided by the customer.\n\nUsed to group transactions together for the customer.<example>orderid:121232</example>"
    },
    "subjectLookupsEnabled": {
      "type": [
        "boolean",
        "null"
      ],
      "description": "Enables the Enterprise Subject Lookup migration feature.\n\nNote: You need admin permissions to enable this feature.",
      "default": false
    },
    "useCookieless": {
      "type": [
        "boolean",
        "null"
      ],
      "description": "Enables the Client to not use cookies.\n\nNote: You need admin permissions to enable this feature.",
      "default": false
    },
    "requirePushedAuthorization": {
      "type": "boolean",
      "description": "Enables the Client to require pushed authorization requests.",
      "default": false
    },
    "isInternalWorkloadClient": {
      "type": "boolean",
      "description": "Specifies whether the client is a workload client."
    },
    "forceLogin": {
      "type": "boolean",
      "description": "Disables SSO for the client."
    },
    "embeddedParentDomains": {
      "maxItems": 200,
      "type": [
        "array",
        "null"
      ],
      "items": {
        "type": "string"
      },
      "description": "Specify the parent domains that will embed the authentication. This will be used for content security frame ancestor header if set, as an extra security mechanism to protect against clickjacking."
    }
  },
  "additionalProperties": false,
  "$defs": {
    "Acr": {
      "type": "object",
      "properties": {
        "values": {
          "maxLength": 255,
          "type": [
            "string",
            "null"
          ],
          "description": "Gets or Sets the ACR values (space separated)."
        },
        "forced": {
          "type": "boolean",
          "description": "Gets or sets a value indicating whether gets or Sets if the ACR value should be always used."
        }
      },
      "additionalProperties": false
    }
  }
}

Work with this as data

Every JSON Schema here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for schemas

4 MCP tools reach this

find_json_schemasBrowse and filter every JSON Schema in the catalog.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This JSON Schema

curl "https://apis.io/api/v1/json-schemas/signicat-client-dto"

All schemas

curl "https://apis.io/api/v1/json-schemas?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.