Clients
OAuth client registration and credentials. 30 operations
Expand an endpoint for authentication, parameters, request fields and responses.
GET/api/v1/realms/{realm}/clients+
List clients
Parameters
| Name | Location | Required | Details |
|---|---|---|---|
realm | path | Yes | Realm name (path-based issuer). Unknown realms return 404.{"type":"string"} |
X-Request-Id | header | — | Optional caller-supplied correlation ID (printable ASCII, at most 64 characters); otherwise generated. Echoed in X-Request-Id and problem request_id.{"type":"string","maxLength":64,"pattern":"^[\\x21-\\x7e]+$"} |
cursor | query | — | Opaque cursor from a previous page (next_cursor). Cursors are HMAC-bound to the realm and listing.{"type":"string"} |
limit | query | — | Page size; defaults to limits.default_page_size and is capped at limits.max_page_size.{"type":"integer","minimum":1} |
Responses
200 OK
application/json
| Field | Type | Required | Description |
|---|---|---|---|
items | array | Yes | |
next_cursor | string | Yes | Opaque cursor for the next page; an empty string when there are no more results. Cursors are bound to the realm and listing and cannot be replayed elsewhere. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}400 Malformed request, invalid JSON (duplicate members, unknown fields, wrong types), invalid cursor or invalid transaction (code invalid_request, transaction_invalid, invalid_proof, invitation_invalid).
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}401 Missing or invalid credentials (code unauthenticated or invalid_credentials). Includes WWW-Authenticate.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
},
"WWW-Authenticate": {
"$ref": "#/components/headers/WWW-Authenticate"
}
}403 Authenticated but not allowed (code forbidden, mfa_required, step_up_required, recent_authentication_required, grant_ceiling_exceeded, impersonation_restricted, account_unavailable, sso_required, recovery_restricted). Step-up problems carry obligations.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}404 Unknown realm or resource, or existence concealed from the caller (code not_found, feature_disabled).
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}500 Unexpected error (code internal_error); no stack traces or secrets.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}503 Load shedding, realm unavailable or dependency failure (code unavailable, upstream_unavailable). May include Retry-After.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
},
"Retry-After": {
"$ref": "#/components/headers/Retry-After"
}
}Operation listClients · Schema definitions · OpenAPI contract
POST/api/v1/realms/{realm}/clients+
Register a client
Parameters
| Name | Location | Required | Details |
|---|---|---|---|
realm | path | Yes | Realm name (path-based issuer). Unknown realms return 404.{"type":"string"} |
X-Request-Id | header | — | Optional caller-supplied correlation ID (printable ASCII, at most 64 characters); otherwise generated. Echoed in X-Request-Id and problem request_id.{"type":"string","maxLength":64,"pattern":"^[\\x21-\\x7e]+$"} |
Idempotency-Key | header | — | Actor/realm/route-bound idempotency key (API-005) for POST requests, at most 255 characters (422 otherwise), kept for 24 hours; only a digest of the key is stored. The request is identified by its method, exact path and body: a replay with the same path and body returns the stored status and response with Idempotent-Replayed: true; the same key with a different body or another path on the same route (another resource) returns 422 idempotency_key_reused; a request still in progress returns 409. Only successful responses are recorded: when the original request failed (an error or a status of 400 or above) the key is released and a retry runs again. Responses containing one-time secrets (members such as client_secret, token, api_key, access_token, refresh_token, id_token, recovery_codes, secret or webhook_secrets) are never stored or replayed (409 with original_status).{"type":"string","maxLength":255} |
Request body
application/json · required
| Field | Type | Required | Description |
|---|---|---|---|
access_token_claims | object,null | — | Static values, or attribute mappings {"$attr": "user.<given_name|family_name|display_name|locale|zoneinfo>" or "profile.<claimable attribute>", "transform": "lower|upper", "default": "..."} (APP-011). At most 20 claims; reserved claims are refused; profile attributes not marked claimable are never released. |
allow_offline_access | boolean | — | |
allow_remember_me | boolean | — | |
allowed_origins | array,null | — | |
backchannel_logout_uri | string | — | |
frontchannel_logout_uri | string | — | Front-channel logout (SES-018): loaded in an iframe when a session the client took part in ends at the logout endpoint. Same scheme, host and port as a registered redirect URI. Browser privacy controls may keep it from working; back-channel logout is the reliable mechanism. |
frontchannel_logout_session_required | boolean | — | Add iss and sid to frontchannel_logout_uri. Requires frontchannel_logout_uri. |
id_token_encrypted_response_alg | string | — | TOK-020: encrypt ID tokens (signed, then encrypted: a nested JWT) to the client's newest active registered public key that fits (use enc or no use; RSA for RSA-OAEP-256, EC for ECDH-ES). Issuance fails with unauthorized_client when no key fits.RSA-OAEP-256 | ECDH-ES | ECDH-ES+A128KW | ECDH-ES+A256KW |
id_token_encrypted_response_enc | string | — | Required with id_token_encrypted_response_alg (the specification default A128CBC-HS256 is not offered).A128GCM | A256GCM |
userinfo_signed_response_alg | string | — | OIDC-013: return UserInfo as a JWT signed with the realm key; must be the realm's signing algorithm.RS256 | PS256 | ES256 | EdDSA |
userinfo_encrypted_response_alg | string | — | RSA-OAEP-256 | ECDH-ES | ECDH-ES+A128KW | ECDH-ES+A256KW |
userinfo_encrypted_response_enc | string | — | A128GCM | A256GCM |
authorization_signed_response_alg | string | — | JARM (ADV-002): the signing algorithm of JWT authorization responses; must be the realm's (responses are always signed with the realm key).RS256 | PS256 | ES256 | EdDSA |
authorization_encrypted_response_alg | string | — | JARM: encrypt JWT authorization responses (nested, signed first) to the client's registered key.RSA-OAEP-256 | ECDH-ES | ECDH-ES+A128KW | ECDH-ES+A256KW |
authorization_encrypted_response_enc | string | — | A128GCM | A256GCM |
tls_client_auth_subject_dn | string | — | tls_client_auth (RFC 8705): the certificate must chain to a realm client trust anchor and carry exactly one registered identity: this subject DN (RFC 4514 as Go prints it) or one SAN below. |
tls_client_auth_san_dns | string | — | |
tls_client_auth_san_uri | string | — | |
tls_client_auth_san_ip | string | — | |
tls_client_auth_san_email | string | — | |
tls_client_certificate_bound_access_tokens | boolean | — | TOK-019: every access token is bound to the presented TLS client certificate (cnf x5t#S256); a token request without a certificate is refused (invalid_request), never answered with a bearer token. |
client_id | string | — | Generated when omitted; at most 128 URL-safe characters. |
client_type | string | Yes | confidential | public_browser | native | device | machine |
consent_mode | string | — | Defaults to preauthorized for first-party clients and required otherwise. |
consent_terms_version | string | — | The client's current terms (APP-013). Consents record the version they were given for; a consent for another version no longer covers the client, so users are asked again. |
contacts | array,null | — | |
default_resource_id | string | — | |
description | string | — | |
environment | string | — | Defaults to production (or the project's environment); controls redirect URI and origin registration rules. Fixed at registration (APP-015): register a new client instead of changing it. Clients of a project must use the project's environment, and token exchange never accepts a token minted for a client of another environment. |
first_party | boolean | — | |
grant_types | array,null | — | Allowed per client type; password and implicit grants are unsupported. Defaults depend on client_type. |
id_token_claims | object,null | — | Static values, or attribute mappings {"$attr": "user.<given_name|family_name|display_name|locale|zoneinfo>" or "profile.<claimable attribute>", "transform": "lower|upper", "default": "..."} (APP-011). At most 20 claims; reserved claims are refused and standard user claims are released by scope, never mapped; profile attributes not marked claimable are never released. |
jwks | object | — | Public JWK Set for private_key_jwt client authentication. |
login_ui_url | string | — | |
name | string | Yes | |
owner_user_id | string | — | |
post_logout_redirect_uris | array,null | — | |
project_id | string | — | |
redirect_uris | array,null | — | |
sector_identifier | string | — | |
security_profile | string | — | Defaults to standard. fapi2 (ADV-001) enforces the FAPI 2.0 Security Profile: confidential client, private_key_jwt (PS256, ES256 or EdDSA) or mutual TLS, authorization code (and refresh tokens) only, PAR required, sender-constrained tokens (require_dpop or tls_client_certificate_bound_access_tokens), https redirects, a realm signing algorithm of PS256/ES256/EdDSA, 60-second codes, access tokens of at most 10 minutes, refresh tokens not rotated. Not certified by the OpenID Foundation.standard | third_party | privileged | high_assurance | fapi2 |
service_principal_id | string | — | |
subject_type | string | — | Defaults to public; pairwise requires sector_identifier.public | pairwise |
token_endpoint_auth_method | string | — | Defaults to client_secret_basic for confidential and machine clients and none for public, native and device clients. tls_client_auth and self_signed_tls_client_auth (RFC 8705, MCH-014; confidential and machine clients) authenticate with the TLS client certificate presented on the mutual-TLS endpoint (or through a trusted proxy).client_secret_basic | client_secret_post | private_key_jwt | none | tls_client_auth | self_signed_tls_client_auth |
token_policy | ApplicationTokenPolicy | — |
Complete request schema
{
"additionalProperties": false,
"properties": {
"access_token_claims": {
"additionalProperties": {},
"type": [
"object",
"null"
],
"description": "Static values, or attribute mappings {\"$attr\": \"user.<given_name|family_name|display_name|locale|zoneinfo>\" or \"profile.<claimable attribute>\", \"transform\": \"lower|upper\", \"default\": \"...\"} (APP-011). At most 20 claims; reserved claims are refused; profile attributes not marked claimable are never released."
},
"allow_offline_access": {
"type": "boolean"
},
"allow_remember_me": {
"type": "boolean"
},
"allowed_origins": {
"items": {
"type": "string"
},
"type": [
"array",
"null"
]
},
"backchannel_logout_uri": {
"type": "string"
},
"frontchannel_logout_uri": {
"type": "string",
"description": "Front-channel logout (SES-018): loaded in an iframe when a session the client took part in ends at the logout endpoint. Same scheme, host and port as a registered redirect URI. Browser privacy controls may keep it from working; back-channel logout is the reliable mechanism."
},
"frontchannel_logout_session_required": {
"type": "boolean",
"description": "Add iss and sid to frontchannel_logout_uri. Requires frontchannel_logout_uri."
},
"id_token_encrypted_response_alg": {
"type": "string",
"enum": [
"RSA-OAEP-256",
"ECDH-ES",
"ECDH-ES+A128KW",
"ECDH-ES+A256KW"
],
"description": "TOK-020: encrypt ID tokens (signed, then encrypted: a nested JWT) to the client's newest active registered public key that fits (use enc or no use; RSA for RSA-OAEP-256, EC for ECDH-ES). Issuance fails with unauthorized_client when no key fits."
},
"id_token_encrypted_response_enc": {
"type": "string",
"enum": [
"A128GCM",
"A256GCM"
],
"description": "Required with id_token_encrypted_response_alg (the specification default A128CBC-HS256 is not offered)."
},
"userinfo_signed_response_alg": {
"type": "string",
"enum": [
"RS256",
"PS256",
"ES256",
"EdDSA"
],
"description": "OIDC-013: return UserInfo as a JWT signed with the realm key; must be the realm's signing algorithm."
},
"userinfo_encrypted_response_alg": {
"type": "string",
"enum": [
"RSA-OAEP-256",
"ECDH-ES",
"ECDH-ES+A128KW",
"ECDH-ES+A256KW"
]
},
"userinfo_encrypted_response_enc": {
"type": "string",
"enum": [
"A128GCM",
"A256GCM"
]
},
"authorization_signed_response_alg": {
"type": "string",
"enum": [
"RS256",
"PS256",
"ES256",
"EdDSA"
],
"description": "JARM (ADV-002): the signing algorithm of JWT authorization responses; must be the realm's (responses are always signed with the realm key)."
},
"authorization_encrypted_response_alg": {
"type": "string",
"enum": [
"RSA-OAEP-256",
"ECDH-ES",
"ECDH-ES+A128KW",
"ECDH-ES+A256KW"
],
"description": "JARM: encrypt JWT authorization responses (nested, signed first) to the client's registered key."
},
"authorization_encrypted_response_enc": {
"type": "string",
"enum": [
"A128GCM",
"A256GCM"
]
},
"tls_client_auth_subject_dn": {
"type": "string",
"description": "tls_client_auth (RFC 8705): the certificate must chain to a realm client trust anchor and carry exactly one registered identity: this subject DN (RFC 4514 as Go prints it) or one SAN below."
},
"tls_client_auth_san_dns": {
"type": "string"
},
"tls_client_auth_san_uri": {
"type": "string"
},
"tls_client_auth_san_ip": {
"type": "string"
},
"tls_client_auth_san_email": {
"type": "string"
},
"tls_client_certificate_bound_access_tokens": {
"type": "boolean",
"description": "TOK-019: every access token is bound to the presented TLS client certificate (cnf x5t#S256); a token request without a certificate is refused (invalid_request), never answered with a bearer token."
},
"client_id": {
"type": "string",
"maxLength": 128,
"description": "Generated when omitted; at most 128 URL-safe characters."
},
"client_type": {
"type": "string",
"enum": [
"confidential",
"public_browser",
"native",
"device",
"machine"
]
},
"consent_mode": {
"type": "string",
"description": "Defaults to preauthorized for first-party clients and required otherwise."
},
"consent_terms_version": {
"type": "string",
"maxLength": 64,
"description": "The client's current terms (APP-013). Consents record the version they were given for; a consent for another version no longer covers the client, so users are asked again."
},
"contacts": {
"items": {
"type": "string"
},
"type": [
"array",
"null"
]
},
"default_resource_id": {
"type": "string"
},
"description": {
"type": "string"
},
"environment": {
"type": "string",
"description": "Defaults to production (or the project's environment); controls redirect URI and origin registration rules. Fixed at registration (APP-015): register a new client instead of changing it. Clients of a project must use the project's environment, and token exchange never accepts a token minted for a client of another environment."
},
"first_party": {
"type": "boolean"
},
"grant_types": {
"items": {
"type": "string"
},
"type": [
"array",
"null"
],
"description": "Allowed per client type; password and implicit grants are unsupported. Defaults depend on client_type."
},
"id_token_claims": {
"additionalProperties": {},
"type": [
"object",
"null"
],
"description": "Static values, or attribute mappings {\"$attr\": \"user.<given_name|family_name|display_name|locale|zoneinfo>\" or \"profile.<claimable attribute>\", \"transform\": \"lower|upper\", \"default\": \"...\"} (APP-011). At most 20 claims; reserved claims are refused and standard user claims are released by scope, never mapped; profile attributes not marked claimable are never released."
},
"jwks": {
"description": "Public JWK Set for private_key_jwt client authentication."
},
"login_ui_url": {
"type": "string"
},
"name": {
"type": "string",
"maxLength": 200
},
"owner_user_id": {
"type": "string"
},
"post_logout_redirect_uris": {
"items": {
"type": "string"
},
"type": [
"array",
"null"
]
},
"project_id": {
"type": "string"
},
"redirect_uris": {
"items": {
"type": "string"
},
"type": [
"array",
"null"
]
},
"sector_identifier": {
"type": "string"
},
"security_profile": {
"type": "string",
"enum": [
"standard",
"third_party",
"privileged",
"high_assurance",
"fapi2"
],
"description": "Defaults to standard. fapi2 (ADV-001) enforces the FAPI 2.0 Security Profile: confidential client, private_key_jwt (PS256, ES256 or EdDSA) or mutual TLS, authorization code (and refresh tokens) only, PAR required, sender-constrained tokens (require_dpop or tls_client_certificate_bound_access_tokens), https redirects, a realm signing algorithm of PS256/ES256/EdDSA, 60-second codes, access tokens of at most 10 minutes, refresh tokens not rotated. Not certified by the OpenID Foundation."
},
"service_principal_id": {
"type": "string"
},
"subject_type": {
"type": "string",
"enum": [
"public",
"pairwise"
],
"description": "Defaults to public; pairwise requires sector_identifier."
},
"token_endpoint_auth_method": {
"type": "string",
"enum": [
"client_secret_basic",
"client_secret_post",
"private_key_jwt",
"none",
"tls_client_auth",
"self_signed_tls_client_auth"
],
"description": "Defaults to client_secret_basic for confidential and machine clients and none for public, native and device clients. tls_client_auth and self_signed_tls_client_auth (RFC 8705, MCH-014; confidential and machine clients) authenticate with the TLS client certificate presented on the mutual-TLS endpoint (or through a trusted proxy)."
},
"token_policy": {
"$ref": "#/components/schemas/ApplicationTokenPolicy"
}
},
"type": "object",
"required": [
"client_type",
"name"
]
}Responses
201 Created
application/json
| Field | Type | Required | Description |
|---|---|---|---|
client | Client | Yes | |
client_secretone-time secret | string | — | Client secret for client_secret_* authentication. Returned exactly once; it is never stored in plaintext, never shown again and never replayed from the idempotency store. |
notice | string | — |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
},
"ETag": {
"$ref": "#/components/headers/ETag"
},
"Idempotent-Replayed": {
"$ref": "#/components/headers/Idempotent-Replayed"
}
}400 Malformed request, invalid JSON (duplicate members, unknown fields, wrong types), invalid cursor or invalid transaction (code invalid_request, transaction_invalid, invalid_proof, invitation_invalid).
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}401 Missing or invalid credentials (code unauthenticated or invalid_credentials). Includes WWW-Authenticate.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
},
"WWW-Authenticate": {
"$ref": "#/components/headers/WWW-Authenticate"
}
}403 Authenticated but not allowed (code forbidden, mfa_required, step_up_required, recent_authentication_required, grant_ceiling_exceeded, impersonation_restricted, account_unavailable, sso_required, recovery_restricted). Step-up problems carry obligations.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}404 Unknown realm or resource, or existence concealed from the caller (code not_found, feature_disabled).
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}409 Conflicts with current state, or an idempotent request with the same key is still in progress / carried a one-time secret (code conflict, unexpected_step, last_owner, last_sign_in_method).
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}413 Body exceeds limits.max_body_bytes (code payload_too_large).
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}415 Wrong Content-Type (code unsupported_media_type).
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}422 Validation failed (code validation_failed, password_policy, idempotency_key_reused); errors maps fields to messages.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}500 Unexpected error (code internal_error); no stack traces or secrets.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}503 Load shedding, realm unavailable or dependency failure (code unavailable, upstream_unavailable). May include Retry-After.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
},
"Retry-After": {
"$ref": "#/components/headers/Retry-After"
}
}Operation createClient · Schema definitions · OpenAPI contract
GET/api/v1/realms/{realm}/clients/{client}+
Get a client
Parameters
| Name | Location | Required | Details |
|---|---|---|---|
realm | path | Yes | Realm name (path-based issuer). Unknown realms return 404.{"type":"string"} |
client | path | Yes | Client reference (internal client id, not the OAuth client_id).{"type":"string"} |
X-Request-Id | header | — | Optional caller-supplied correlation ID (printable ASCII, at most 64 characters); otherwise generated. Echoed in X-Request-Id and problem request_id.{"type":"string","maxLength":64,"pattern":"^[\\x21-\\x7e]+$"} |
Responses
200 OK
application/json
| Field | Type | Required | Description |
|---|---|---|---|
client | Client | Yes | |
resource_grants | array,null | Yes | |
credentials | array,null | Yes |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
},
"ETag": {
"$ref": "#/components/headers/ETag"
}
}401 Missing or invalid credentials (code unauthenticated or invalid_credentials). Includes WWW-Authenticate.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
},
"WWW-Authenticate": {
"$ref": "#/components/headers/WWW-Authenticate"
}
}403 Authenticated but not allowed (code forbidden, mfa_required, step_up_required, recent_authentication_required, grant_ceiling_exceeded, impersonation_restricted, account_unavailable, sso_required, recovery_restricted). Step-up problems carry obligations.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}404 Unknown realm or resource, or existence concealed from the caller (code not_found, feature_disabled).
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}500 Unexpected error (code internal_error); no stack traces or secrets.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}503 Load shedding, realm unavailable or dependency failure (code unavailable, upstream_unavailable). May include Retry-After.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
},
"Retry-After": {
"$ref": "#/components/headers/Retry-After"
}
}Operation getClient · Schema definitions · OpenAPI contract
PUT/api/v1/realms/{realm}/clients/{client}+
Replace a client definition
client_type cannot change.
Parameters
| Name | Location | Required | Details |
|---|---|---|---|
realm | path | Yes | Realm name (path-based issuer). Unknown realms return 404.{"type":"string"} |
client | path | Yes | Client reference (internal client id, not the OAuth client_id).{"type":"string"} |
X-Request-Id | header | — | Optional caller-supplied correlation ID (printable ASCII, at most 64 characters); otherwise generated. Echoed in X-Request-Id and problem request_id.{"type":"string","maxLength":64,"pattern":"^[\\x21-\\x7e]+$"} |
If-Match | header | Yes | Expected resource version from the ETag. Required: missing returns 428, stale returns 412.{"type":"string","examples":["W/\"v12\""]} |
Request body
application/json · required
| Field | Type | Required | Description |
|---|---|---|---|
access_token_claims | object,null | — | Static values, or attribute mappings {"$attr": "user.<given_name|family_name|display_name|locale|zoneinfo>" or "profile.<claimable attribute>", "transform": "lower|upper", "default": "..."} (APP-011). At most 20 claims; reserved claims are refused; profile attributes not marked claimable are never released. |
allow_offline_access | boolean | — | |
allow_remember_me | boolean | — | |
allowed_origins | array,null | — | |
backchannel_logout_uri | string | — | |
frontchannel_logout_uri | string | — | Front-channel logout (SES-018): loaded in an iframe when a session the client took part in ends at the logout endpoint. Same scheme, host and port as a registered redirect URI. Browser privacy controls may keep it from working; back-channel logout is the reliable mechanism. |
frontchannel_logout_session_required | boolean | — | Add iss and sid to frontchannel_logout_uri. Requires frontchannel_logout_uri. |
id_token_encrypted_response_alg | string | — | TOK-020: encrypt ID tokens (signed, then encrypted: a nested JWT) to the client's newest active registered public key that fits (use enc or no use; RSA for RSA-OAEP-256, EC for ECDH-ES). Issuance fails with unauthorized_client when no key fits.RSA-OAEP-256 | ECDH-ES | ECDH-ES+A128KW | ECDH-ES+A256KW |
id_token_encrypted_response_enc | string | — | Required with id_token_encrypted_response_alg (the specification default A128CBC-HS256 is not offered).A128GCM | A256GCM |
userinfo_signed_response_alg | string | — | OIDC-013: return UserInfo as a JWT signed with the realm key; must be the realm's signing algorithm.RS256 | PS256 | ES256 | EdDSA |
userinfo_encrypted_response_alg | string | — | RSA-OAEP-256 | ECDH-ES | ECDH-ES+A128KW | ECDH-ES+A256KW |
userinfo_encrypted_response_enc | string | — | A128GCM | A256GCM |
authorization_signed_response_alg | string | — | JARM (ADV-002): the signing algorithm of JWT authorization responses; must be the realm's (responses are always signed with the realm key).RS256 | PS256 | ES256 | EdDSA |
authorization_encrypted_response_alg | string | — | JARM: encrypt JWT authorization responses (nested, signed first) to the client's registered key.RSA-OAEP-256 | ECDH-ES | ECDH-ES+A128KW | ECDH-ES+A256KW |
authorization_encrypted_response_enc | string | — | A128GCM | A256GCM |
tls_client_auth_subject_dn | string | — | tls_client_auth (RFC 8705): the certificate must chain to a realm client trust anchor and carry exactly one registered identity: this subject DN (RFC 4514 as Go prints it) or one SAN below. |
tls_client_auth_san_dns | string | — | |
tls_client_auth_san_uri | string | — | |
tls_client_auth_san_ip | string | — | |
tls_client_auth_san_email | string | — | |
tls_client_certificate_bound_access_tokens | boolean | — | TOK-019: every access token is bound to the presented TLS client certificate (cnf x5t#S256); a token request without a certificate is refused (invalid_request), never answered with a bearer token. |
client_id | string | — | Generated when omitted; at most 128 URL-safe characters. |
client_type | string | Yes | confidential | public_browser | native | device | machine |
consent_mode | string | — | Defaults to preauthorized for first-party clients and required otherwise. |
consent_terms_version | string | — | The client's current terms (APP-013). Consents record the version they were given for; a consent for another version no longer covers the client, so users are asked again. |
contacts | array,null | — | |
default_resource_id | string | — | |
description | string | — | |
environment | string | — | Defaults to production (or the project's environment); controls redirect URI and origin registration rules. Fixed at registration (APP-015): register a new client instead of changing it. Clients of a project must use the project's environment, and token exchange never accepts a token minted for a client of another environment. |
first_party | boolean | — | |
grant_types | array,null | — | Allowed per client type; password and implicit grants are unsupported. Defaults depend on client_type. |
id_token_claims | object,null | — | Static values, or attribute mappings {"$attr": "user.<given_name|family_name|display_name|locale|zoneinfo>" or "profile.<claimable attribute>", "transform": "lower|upper", "default": "..."} (APP-011). At most 20 claims; reserved claims are refused and standard user claims are released by scope, never mapped; profile attributes not marked claimable are never released. |
jwks | object | — | Public JWK Set for private_key_jwt client authentication. |
login_ui_url | string | — | |
name | string | Yes | |
owner_user_id | string | — | |
post_logout_redirect_uris | array,null | — | |
project_id | string | — | |
redirect_uris | array,null | — | |
sector_identifier | string | — | |
security_profile | string | — | Defaults to standard. fapi2 (ADV-001) enforces the FAPI 2.0 Security Profile: confidential client, private_key_jwt (PS256, ES256 or EdDSA) or mutual TLS, authorization code (and refresh tokens) only, PAR required, sender-constrained tokens (require_dpop or tls_client_certificate_bound_access_tokens), https redirects, a realm signing algorithm of PS256/ES256/EdDSA, 60-second codes, access tokens of at most 10 minutes, refresh tokens not rotated. Not certified by the OpenID Foundation.standard | third_party | privileged | high_assurance | fapi2 |
service_principal_id | string | — | |
subject_type | string | — | Defaults to public; pairwise requires sector_identifier.public | pairwise |
token_endpoint_auth_method | string | — | Defaults to client_secret_basic for confidential and machine clients and none for public, native and device clients. tls_client_auth and self_signed_tls_client_auth (RFC 8705, MCH-014; confidential and machine clients) authenticate with the TLS client certificate presented on the mutual-TLS endpoint (or through a trusted proxy).client_secret_basic | client_secret_post | private_key_jwt | none | tls_client_auth | self_signed_tls_client_auth |
token_policy | ApplicationTokenPolicy | — |
Complete request schema
{
"additionalProperties": false,
"properties": {
"access_token_claims": {
"additionalProperties": {},
"type": [
"object",
"null"
],
"description": "Static values, or attribute mappings {\"$attr\": \"user.<given_name|family_name|display_name|locale|zoneinfo>\" or \"profile.<claimable attribute>\", \"transform\": \"lower|upper\", \"default\": \"...\"} (APP-011). At most 20 claims; reserved claims are refused; profile attributes not marked claimable are never released."
},
"allow_offline_access": {
"type": "boolean"
},
"allow_remember_me": {
"type": "boolean"
},
"allowed_origins": {
"items": {
"type": "string"
},
"type": [
"array",
"null"
]
},
"backchannel_logout_uri": {
"type": "string"
},
"frontchannel_logout_uri": {
"type": "string",
"description": "Front-channel logout (SES-018): loaded in an iframe when a session the client took part in ends at the logout endpoint. Same scheme, host and port as a registered redirect URI. Browser privacy controls may keep it from working; back-channel logout is the reliable mechanism."
},
"frontchannel_logout_session_required": {
"type": "boolean",
"description": "Add iss and sid to frontchannel_logout_uri. Requires frontchannel_logout_uri."
},
"id_token_encrypted_response_alg": {
"type": "string",
"enum": [
"RSA-OAEP-256",
"ECDH-ES",
"ECDH-ES+A128KW",
"ECDH-ES+A256KW"
],
"description": "TOK-020: encrypt ID tokens (signed, then encrypted: a nested JWT) to the client's newest active registered public key that fits (use enc or no use; RSA for RSA-OAEP-256, EC for ECDH-ES). Issuance fails with unauthorized_client when no key fits."
},
"id_token_encrypted_response_enc": {
"type": "string",
"enum": [
"A128GCM",
"A256GCM"
],
"description": "Required with id_token_encrypted_response_alg (the specification default A128CBC-HS256 is not offered)."
},
"userinfo_signed_response_alg": {
"type": "string",
"enum": [
"RS256",
"PS256",
"ES256",
"EdDSA"
],
"description": "OIDC-013: return UserInfo as a JWT signed with the realm key; must be the realm's signing algorithm."
},
"userinfo_encrypted_response_alg": {
"type": "string",
"enum": [
"RSA-OAEP-256",
"ECDH-ES",
"ECDH-ES+A128KW",
"ECDH-ES+A256KW"
]
},
"userinfo_encrypted_response_enc": {
"type": "string",
"enum": [
"A128GCM",
"A256GCM"
]
},
"authorization_signed_response_alg": {
"type": "string",
"enum": [
"RS256",
"PS256",
"ES256",
"EdDSA"
],
"description": "JARM (ADV-002): the signing algorithm of JWT authorization responses; must be the realm's (responses are always signed with the realm key)."
},
"authorization_encrypted_response_alg": {
"type": "string",
"enum": [
"RSA-OAEP-256",
"ECDH-ES",
"ECDH-ES+A128KW",
"ECDH-ES+A256KW"
],
"description": "JARM: encrypt JWT authorization responses (nested, signed first) to the client's registered key."
},
"authorization_encrypted_response_enc": {
"type": "string",
"enum": [
"A128GCM",
"A256GCM"
]
},
"tls_client_auth_subject_dn": {
"type": "string",
"description": "tls_client_auth (RFC 8705): the certificate must chain to a realm client trust anchor and carry exactly one registered identity: this subject DN (RFC 4514 as Go prints it) or one SAN below."
},
"tls_client_auth_san_dns": {
"type": "string"
},
"tls_client_auth_san_uri": {
"type": "string"
},
"tls_client_auth_san_ip": {
"type": "string"
},
"tls_client_auth_san_email": {
"type": "string"
},
"tls_client_certificate_bound_access_tokens": {
"type": "boolean",
"description": "TOK-019: every access token is bound to the presented TLS client certificate (cnf x5t#S256); a token request without a certificate is refused (invalid_request), never answered with a bearer token."
},
"client_id": {
"type": "string",
"maxLength": 128,
"description": "Generated when omitted; at most 128 URL-safe characters."
},
"client_type": {
"type": "string",
"enum": [
"confidential",
"public_browser",
"native",
"device",
"machine"
]
},
"consent_mode": {
"type": "string",
"description": "Defaults to preauthorized for first-party clients and required otherwise."
},
"consent_terms_version": {
"type": "string",
"maxLength": 64,
"description": "The client's current terms (APP-013). Consents record the version they were given for; a consent for another version no longer covers the client, so users are asked again."
},
"contacts": {
"items": {
"type": "string"
},
"type": [
"array",
"null"
]
},
"default_resource_id": {
"type": "string"
},
"description": {
"type": "string"
},
"environment": {
"type": "string",
"description": "Defaults to production (or the project's environment); controls redirect URI and origin registration rules. Fixed at registration (APP-015): register a new client instead of changing it. Clients of a project must use the project's environment, and token exchange never accepts a token minted for a client of another environment."
},
"first_party": {
"type": "boolean"
},
"grant_types": {
"items": {
"type": "string"
},
"type": [
"array",
"null"
],
"description": "Allowed per client type; password and implicit grants are unsupported. Defaults depend on client_type."
},
"id_token_claims": {
"additionalProperties": {},
"type": [
"object",
"null"
],
"description": "Static values, or attribute mappings {\"$attr\": \"user.<given_name|family_name|display_name|locale|zoneinfo>\" or \"profile.<claimable attribute>\", \"transform\": \"lower|upper\", \"default\": \"...\"} (APP-011). At most 20 claims; reserved claims are refused and standard user claims are released by scope, never mapped; profile attributes not marked claimable are never released."
},
"jwks": {
"description": "Public JWK Set for private_key_jwt client authentication."
},
"login_ui_url": {
"type": "string"
},
"name": {
"type": "string",
"maxLength": 200
},
"owner_user_id": {
"type": "string"
},
"post_logout_redirect_uris": {
"items": {
"type": "string"
},
"type": [
"array",
"null"
]
},
"project_id": {
"type": "string"
},
"redirect_uris": {
"items": {
"type": "string"
},
"type": [
"array",
"null"
]
},
"sector_identifier": {
"type": "string"
},
"security_profile": {
"type": "string",
"enum": [
"standard",
"third_party",
"privileged",
"high_assurance",
"fapi2"
],
"description": "Defaults to standard. fapi2 (ADV-001) enforces the FAPI 2.0 Security Profile: confidential client, private_key_jwt (PS256, ES256 or EdDSA) or mutual TLS, authorization code (and refresh tokens) only, PAR required, sender-constrained tokens (require_dpop or tls_client_certificate_bound_access_tokens), https redirects, a realm signing algorithm of PS256/ES256/EdDSA, 60-second codes, access tokens of at most 10 minutes, refresh tokens not rotated. Not certified by the OpenID Foundation."
},
"service_principal_id": {
"type": "string"
},
"subject_type": {
"type": "string",
"enum": [
"public",
"pairwise"
],
"description": "Defaults to public; pairwise requires sector_identifier."
},
"token_endpoint_auth_method": {
"type": "string",
"enum": [
"client_secret_basic",
"client_secret_post",
"private_key_jwt",
"none",
"tls_client_auth",
"self_signed_tls_client_auth"
],
"description": "Defaults to client_secret_basic for confidential and machine clients and none for public, native and device clients. tls_client_auth and self_signed_tls_client_auth (RFC 8705, MCH-014; confidential and machine clients) authenticate with the TLS client certificate presented on the mutual-TLS endpoint (or through a trusted proxy)."
},
"token_policy": {
"$ref": "#/components/schemas/ApplicationTokenPolicy"
}
},
"type": "object",
"required": [
"client_type",
"name"
]
}Responses
200 OK
application/json
| Field | Type | Required | Description |
|---|---|---|---|
access_token_claims | object,null | — | |
allow_offline_access | boolean | Yes | |
allow_remember_me | boolean | Yes | |
allowed_origins | array,null | Yes | |
backchannel_logout_uri | string | — | |
frontchannel_logout_uri | string | — | Front-channel logout (SES-018): loaded in an iframe when a session the client took part in ends at the logout endpoint. Same scheme, host and port as a registered redirect URI. Browser privacy controls may keep it from working; back-channel logout is the reliable mechanism. |
frontchannel_logout_session_required | boolean | — | Add iss and sid to frontchannel_logout_uri. Requires frontchannel_logout_uri. |
id_token_encrypted_response_alg | string | — | TOK-020: encrypt ID tokens (signed, then encrypted: a nested JWT) to the client's newest active registered public key that fits (use enc or no use; RSA for RSA-OAEP-256, EC for ECDH-ES). Issuance fails with unauthorized_client when no key fits.RSA-OAEP-256 | ECDH-ES | ECDH-ES+A128KW | ECDH-ES+A256KW |
id_token_encrypted_response_enc | string | — | Required with id_token_encrypted_response_alg (the specification default A128CBC-HS256 is not offered).A128GCM | A256GCM |
userinfo_signed_response_alg | string | — | OIDC-013: return UserInfo as a JWT signed with the realm key; must be the realm's signing algorithm.RS256 | PS256 | ES256 | EdDSA |
userinfo_encrypted_response_alg | string | — | RSA-OAEP-256 | ECDH-ES | ECDH-ES+A128KW | ECDH-ES+A256KW |
userinfo_encrypted_response_enc | string | — | A128GCM | A256GCM |
authorization_signed_response_alg | string | — | JARM (ADV-002): the signing algorithm of JWT authorization responses; must be the realm's (responses are always signed with the realm key).RS256 | PS256 | ES256 | EdDSA |
authorization_encrypted_response_alg | string | — | JARM: encrypt JWT authorization responses (nested, signed first) to the client's registered key.RSA-OAEP-256 | ECDH-ES | ECDH-ES+A128KW | ECDH-ES+A256KW |
authorization_encrypted_response_enc | string | — | A128GCM | A256GCM |
tls_client_auth_subject_dn | string | — | tls_client_auth (RFC 8705): the certificate must chain to a realm client trust anchor and carry exactly one registered identity: this subject DN (RFC 4514 as Go prints it) or one SAN below. |
tls_client_auth_san_dns | string | — | |
tls_client_auth_san_uri | string | — | |
tls_client_auth_san_ip | string | — | |
tls_client_auth_san_email | string | — | |
tls_client_certificate_bound_access_tokens | boolean | — | TOK-019: every access token is bound to the presented TLS client certificate (cnf x5t#S256); a token request without a certificate is refused (invalid_request), never answered with a bearer token. |
client_id | string | Yes | |
client_type | string | Yes | confidential | public_browser | native | device | machine |
consent_mode | string | Yes | |
consent_terms_version | string | — | |
contacts | array,null | — | |
created_at | string | Yes | |
default_resource_id | string | — | |
description | string | — | |
dynamically_registered | boolean | Yes | |
environment | string | Yes | |
first_party | boolean | Yes | |
grant_types | array,null | Yes | |
id | string | Yes | |
id_token_claims | object,null | — | |
login_ui_url | string | — | |
name | string | Yes | |
owner_user_id | string | — | |
post_logout_redirect_uris | array,null | Yes | |
project_id | string | — | |
realm_id | string | Yes | |
redirect_uris | array,null | Yes | |
sector_identifier | string | — | |
protocol | string | — | saml for the client backing a SAML application; managed only through /saml/applications (PUT /clients/{client} answers 409) and refused by every OAuth endpoint.oidc | saml |
security_profile | string | Yes | |
service_principal_id | string | — | |
state | string | Yes | active | suspended | decommissioned |
subject_type | string | Yes | |
token_endpoint_auth_method | string | Yes | |
token_policy | ApplicationTokenPolicy | Yes | |
updated_at | string | Yes | |
version | integer | Yes |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
},
"ETag": {
"$ref": "#/components/headers/ETag"
}
}400 Malformed request, invalid JSON (duplicate members, unknown fields, wrong types), invalid cursor or invalid transaction (code invalid_request, transaction_invalid, invalid_proof, invitation_invalid).
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}401 Missing or invalid credentials (code unauthenticated or invalid_credentials). Includes WWW-Authenticate.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
},
"WWW-Authenticate": {
"$ref": "#/components/headers/WWW-Authenticate"
}
}403 Authenticated but not allowed (code forbidden, mfa_required, step_up_required, recent_authentication_required, grant_ceiling_exceeded, impersonation_restricted, account_unavailable, sso_required, recovery_restricted). Step-up problems carry obligations.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}404 Unknown realm or resource, or existence concealed from the caller (code not_found, feature_disabled).
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}409 Conflicts with current state, or an idempotent request with the same key is still in progress / carried a one-time secret (code conflict, unexpected_step, last_owner, last_sign_in_method).
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}412 If-Match does not match the current version (code precondition_failed).
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}413 Body exceeds limits.max_body_bytes (code payload_too_large).
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}415 Wrong Content-Type (code unsupported_media_type).
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}422 Validation failed (code validation_failed, password_policy, idempotency_key_reused); errors maps fields to messages.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}428 If-Match header is required (code precondition_required).
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}500 Unexpected error (code internal_error); no stack traces or secrets.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}503 Load shedding, realm unavailable or dependency failure (code unavailable, upstream_unavailable). May include Retry-After.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
},
"Retry-After": {
"$ref": "#/components/headers/Retry-After"
}
}Operation replaceClient · Schema definitions · OpenAPI contract
POST/api/v1/realms/{realm}/clients/{client}/suspend+
Suspend a client
Note: the body is decoded leniently (decode errors are ignored).
Parameters
| Name | Location | Required | Details |
|---|---|---|---|
realm | path | Yes | Realm name (path-based issuer). Unknown realms return 404.{"type":"string"} |
client | path | Yes | Client reference (internal client id, not the OAuth client_id).{"type":"string"} |
X-Request-Id | header | — | Optional caller-supplied correlation ID (printable ASCII, at most 64 characters); otherwise generated. Echoed in X-Request-Id and problem request_id.{"type":"string","maxLength":64,"pattern":"^[\\x21-\\x7e]+$"} |
Idempotency-Key | header | — | Actor/realm/route-bound idempotency key (API-005) for POST requests, at most 255 characters (422 otherwise), kept for 24 hours; only a digest of the key is stored. The request is identified by its method, exact path and body: a replay with the same path and body returns the stored status and response with Idempotent-Replayed: true; the same key with a different body or another path on the same route (another resource) returns 422 idempotency_key_reused; a request still in progress returns 409. Only successful responses are recorded: when the original request failed (an error or a status of 400 or above) the key is released and a retry runs again. Responses containing one-time secrets (members such as client_secret, token, api_key, access_token, refresh_token, id_token, recovery_codes, secret or webhook_secrets) are never stored or replayed (409 with original_status).{"type":"string","maxLength":255} |
Request body
application/json
| Field | Type | Required | Description |
|---|---|---|---|
reason | string | — |
Complete request schema
{
"type": "object",
"properties": {
"reason": {
"type": "string"
}
},
"additionalProperties": false
}Responses
200 OK
application/json
| Field | Type | Required | Description |
|---|---|---|---|
state | string | Yes |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
},
"Idempotent-Replayed": {
"$ref": "#/components/headers/Idempotent-Replayed"
}
}400 Malformed request, invalid JSON (duplicate members, unknown fields, wrong types), invalid cursor or invalid transaction (code invalid_request, transaction_invalid, invalid_proof, invitation_invalid).
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}401 Missing or invalid credentials (code unauthenticated or invalid_credentials). Includes WWW-Authenticate.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
},
"WWW-Authenticate": {
"$ref": "#/components/headers/WWW-Authenticate"
}
}403 Authenticated but not allowed (code forbidden, mfa_required, step_up_required, recent_authentication_required, grant_ceiling_exceeded, impersonation_restricted, account_unavailable, sso_required, recovery_restricted). Step-up problems carry obligations.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}404 Unknown realm or resource, or existence concealed from the caller (code not_found, feature_disabled).
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}409 Conflicts with current state, or an idempotent request with the same key is still in progress / carried a one-time secret (code conflict, unexpected_step, last_owner, last_sign_in_method).
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}413 Body exceeds limits.max_body_bytes (code payload_too_large).
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}415 Wrong Content-Type (code unsupported_media_type).
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}422 Validation failed (code validation_failed, password_policy, idempotency_key_reused); errors maps fields to messages.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}500 Unexpected error (code internal_error); no stack traces or secrets.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}503 Load shedding, realm unavailable or dependency failure (code unavailable, upstream_unavailable). May include Retry-After.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
},
"Retry-After": {
"$ref": "#/components/headers/Retry-After"
}
}Operation suspendClient · Schema definitions · OpenAPI contract
POST/api/v1/realms/{realm}/clients/{client}/reactivate+
Reactivate a client
Note: the body is decoded leniently (decode errors are ignored). A decommissioned client cannot be reactivated (409), and neither can a dynamically registered client whose registration is pending approval (409; approve it with POST /client-registrations/{client}/approve).
Parameters
| Name | Location | Required | Details |
|---|---|---|---|
realm | path | Yes | Realm name (path-based issuer). Unknown realms return 404.{"type":"string"} |
client | path | Yes | Client reference (internal client id, not the OAuth client_id).{"type":"string"} |
X-Request-Id | header | — | Optional caller-supplied correlation ID (printable ASCII, at most 64 characters); otherwise generated. Echoed in X-Request-Id and problem request_id.{"type":"string","maxLength":64,"pattern":"^[\\x21-\\x7e]+$"} |
Idempotency-Key | header | — | Actor/realm/route-bound idempotency key (API-005) for POST requests, at most 255 characters (422 otherwise), kept for 24 hours; only a digest of the key is stored. The request is identified by its method, exact path and body: a replay with the same path and body returns the stored status and response with Idempotent-Replayed: true; the same key with a different body or another path on the same route (another resource) returns 422 idempotency_key_reused; a request still in progress returns 409. Only successful responses are recorded: when the original request failed (an error or a status of 400 or above) the key is released and a retry runs again. Responses containing one-time secrets (members such as client_secret, token, api_key, access_token, refresh_token, id_token, recovery_codes, secret or webhook_secrets) are never stored or replayed (409 with original_status).{"type":"string","maxLength":255} |
Request body
application/json
| Field | Type | Required | Description |
|---|---|---|---|
reason | string | — |
Complete request schema
{
"type": "object",
"properties": {
"reason": {
"type": "string"
}
},
"additionalProperties": false
}Responses
200 OK
application/json
| Field | Type | Required | Description |
|---|---|---|---|
state | string | Yes |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
},
"Idempotent-Replayed": {
"$ref": "#/components/headers/Idempotent-Replayed"
}
}400 Malformed request, invalid JSON (duplicate members, unknown fields, wrong types), invalid cursor or invalid transaction (code invalid_request, transaction_invalid, invalid_proof, invitation_invalid).
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}401 Missing or invalid credentials (code unauthenticated or invalid_credentials). Includes WWW-Authenticate.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
},
"WWW-Authenticate": {
"$ref": "#/components/headers/WWW-Authenticate"
}
}403 Authenticated but not allowed (code forbidden, mfa_required, step_up_required, recent_authentication_required, grant_ceiling_exceeded, impersonation_restricted, account_unavailable, sso_required, recovery_restricted). Step-up problems carry obligations.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}404 Unknown realm or resource, or existence concealed from the caller (code not_found, feature_disabled).
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}409 Conflicts with current state, or an idempotent request with the same key is still in progress / carried a one-time secret (code conflict, unexpected_step, last_owner, last_sign_in_method).
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}413 Body exceeds limits.max_body_bytes (code payload_too_large).
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}415 Wrong Content-Type (code unsupported_media_type).
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}422 Validation failed (code validation_failed, password_policy, idempotency_key_reused); errors maps fields to messages.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}500 Unexpected error (code internal_error); no stack traces or secrets.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}503 Load shedding, realm unavailable or dependency failure (code unavailable, upstream_unavailable). May include Retry-After.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
},
"Retry-After": {
"$ref": "#/components/headers/Retry-After"
}
}Operation reactivateClient · Schema definitions · OpenAPI contract
POST/api/v1/realms/{realm}/clients/{client}/decommission+
Decommission a client
Note: the body is decoded leniently (decode errors are ignored).
Parameters
| Name | Location | Required | Details |
|---|---|---|---|
realm | path | Yes | Realm name (path-based issuer). Unknown realms return 404.{"type":"string"} |
client | path | Yes | Client reference (internal client id, not the OAuth client_id).{"type":"string"} |
X-Request-Id | header | — | Optional caller-supplied correlation ID (printable ASCII, at most 64 characters); otherwise generated. Echoed in X-Request-Id and problem request_id.{"type":"string","maxLength":64,"pattern":"^[\\x21-\\x7e]+$"} |
Idempotency-Key | header | — | Actor/realm/route-bound idempotency key (API-005) for POST requests, at most 255 characters (422 otherwise), kept for 24 hours; only a digest of the key is stored. The request is identified by its method, exact path and body: a replay with the same path and body returns the stored status and response with Idempotent-Replayed: true; the same key with a different body or another path on the same route (another resource) returns 422 idempotency_key_reused; a request still in progress returns 409. Only successful responses are recorded: when the original request failed (an error or a status of 400 or above) the key is released and a retry runs again. Responses containing one-time secrets (members such as client_secret, token, api_key, access_token, refresh_token, id_token, recovery_codes, secret or webhook_secrets) are never stored or replayed (409 with original_status).{"type":"string","maxLength":255} |
Request body
application/json
| Field | Type | Required | Description |
|---|---|---|---|
reason | string | — |
Complete request schema
{
"type": "object",
"properties": {
"reason": {
"type": "string"
}
},
"additionalProperties": false
}Responses
200 OK
application/json
| Field | Type | Required | Description |
|---|---|---|---|
state | string | Yes |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
},
"Idempotent-Replayed": {
"$ref": "#/components/headers/Idempotent-Replayed"
}
}400 Malformed request, invalid JSON (duplicate members, unknown fields, wrong types), invalid cursor or invalid transaction (code invalid_request, transaction_invalid, invalid_proof, invitation_invalid).
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}401 Missing or invalid credentials (code unauthenticated or invalid_credentials). Includes WWW-Authenticate.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
},
"WWW-Authenticate": {
"$ref": "#/components/headers/WWW-Authenticate"
}
}403 Authenticated but not allowed (code forbidden, mfa_required, step_up_required, recent_authentication_required, grant_ceiling_exceeded, impersonation_restricted, account_unavailable, sso_required, recovery_restricted). Step-up problems carry obligations.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}404 Unknown realm or resource, or existence concealed from the caller (code not_found, feature_disabled).
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}409 Conflicts with current state, or an idempotent request with the same key is still in progress / carried a one-time secret (code conflict, unexpected_step, last_owner, last_sign_in_method).
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}413 Body exceeds limits.max_body_bytes (code payload_too_large).
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}415 Wrong Content-Type (code unsupported_media_type).
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}422 Validation failed (code validation_failed, password_policy, idempotency_key_reused); errors maps fields to messages.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}500 Unexpected error (code internal_error); no stack traces or secrets.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}503 Load shedding, realm unavailable or dependency failure (code unavailable, upstream_unavailable). May include Retry-After.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
},
"Retry-After": {
"$ref": "#/components/headers/Retry-After"
}
}Operation decommissionClient · Schema definitions · OpenAPI contract
POST/api/v1/realms/{realm}/clients/{client}/credentials+
Issue a client secret or add public keys
Without jwks a new secret is issued and, with retire_others_after_seconds, other secrets are scheduled for retirement.
Parameters
| Name | Location | Required | Details |
|---|---|---|---|
realm | path | Yes | Realm name (path-based issuer). Unknown realms return 404.{"type":"string"} |
client | path | Yes | Client reference (internal client id, not the OAuth client_id).{"type":"string"} |
X-Request-Id | header | — | Optional caller-supplied correlation ID (printable ASCII, at most 64 characters); otherwise generated. Echoed in X-Request-Id and problem request_id.{"type":"string","maxLength":64,"pattern":"^[\\x21-\\x7e]+$"} |
Idempotency-Key | header | — | Actor/realm/route-bound idempotency key (API-005) for POST requests, at most 255 characters (422 otherwise), kept for 24 hours; only a digest of the key is stored. The request is identified by its method, exact path and body: a replay with the same path and body returns the stored status and response with Idempotent-Replayed: true; the same key with a different body or another path on the same route (another resource) returns 422 idempotency_key_reused; a request still in progress returns 409. Only successful responses are recorded: when the original request failed (an error or a status of 400 or above) the key is released and a retry runs again. Responses containing one-time secrets (members such as client_secret, token, api_key, access_token, refresh_token, id_token, recovery_codes, secret or webhook_secrets) are never stored or replayed (409 with original_status).{"type":"string","maxLength":255} |
Request body
application/json
| Field | Type | Required | Description |
|---|---|---|---|
retire_others_after_seconds | integer | — | |
jwks | object | — | JWK Set to add for private_key_jwt; when present no secret is issued. |
Complete request schema
{
"type": "object",
"properties": {
"retire_others_after_seconds": {
"type": "integer",
"minimum": 0
},
"jwks": {
"description": "JWK Set to add for private_key_jwt; when present no secret is issued."
}
},
"additionalProperties": false
}Responses
201 Created
application/json
{
"oneOf": [
{
"type": "object",
"title": "SecretIssued",
"properties": {
"client_secret": {
"type": "string",
"x-secret": true,
"description": "New client secret. Returned exactly once; it is never stored in plaintext, never shown again and never replayed from the idempotency store."
},
"credential": {
"$ref": "#/components/schemas/ClientCredential"
},
"notice": {
"type": "string"
}
},
"required": [
"client_secret",
"credential",
"notice"
]
},
{
"type": "object",
"title": "KeysAdded",
"properties": {
"status": {
"type": "string",
"const": "keys_added"
}
},
"required": [
"status"
]
}
]
}Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
},
"Idempotent-Replayed": {
"$ref": "#/components/headers/Idempotent-Replayed"
}
}400 Malformed request, invalid JSON (duplicate members, unknown fields, wrong types), invalid cursor or invalid transaction (code invalid_request, transaction_invalid, invalid_proof, invitation_invalid).
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}401 Missing or invalid credentials (code unauthenticated or invalid_credentials). Includes WWW-Authenticate.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
},
"WWW-Authenticate": {
"$ref": "#/components/headers/WWW-Authenticate"
}
}403 Authenticated but not allowed (code forbidden, mfa_required, step_up_required, recent_authentication_required, grant_ceiling_exceeded, impersonation_restricted, account_unavailable, sso_required, recovery_restricted). Step-up problems carry obligations.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}404 Unknown realm or resource, or existence concealed from the caller (code not_found, feature_disabled).
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}409 Conflicts with current state, or an idempotent request with the same key is still in progress / carried a one-time secret (code conflict, unexpected_step, last_owner, last_sign_in_method).
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}413 Body exceeds limits.max_body_bytes (code payload_too_large).
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}415 Wrong Content-Type (code unsupported_media_type).
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}422 Validation failed (code validation_failed, password_policy, idempotency_key_reused); errors maps fields to messages.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}500 Unexpected error (code internal_error); no stack traces or secrets.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}503 Load shedding, realm unavailable or dependency failure (code unavailable, upstream_unavailable). May include Retry-After.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
},
"Retry-After": {
"$ref": "#/components/headers/Retry-After"
}
}Operation issueClientCredential · Schema definitions · OpenAPI contract
DELETE/api/v1/realms/{realm}/clients/{client}/credentials/{id}+
Revoke a client credential
Parameters
| Name | Location | Required | Details |
|---|---|---|---|
realm | path | Yes | Realm name (path-based issuer). Unknown realms return 404.{"type":"string"} |
client | path | Yes | Client reference (internal client id, not the OAuth client_id).{"type":"string"} |
id | path | Yes | Resource identifier.{"type":"string"} |
X-Request-Id | header | — | Optional caller-supplied correlation ID (printable ASCII, at most 64 characters); otherwise generated. Echoed in X-Request-Id and problem request_id.{"type":"string","maxLength":64,"pattern":"^[\\x21-\\x7e]+$"} |
Responses
204 No Content
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}401 Missing or invalid credentials (code unauthenticated or invalid_credentials). Includes WWW-Authenticate.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
},
"WWW-Authenticate": {
"$ref": "#/components/headers/WWW-Authenticate"
}
}403 Authenticated but not allowed (code forbidden, mfa_required, step_up_required, recent_authentication_required, grant_ceiling_exceeded, impersonation_restricted, account_unavailable, sso_required, recovery_restricted). Step-up problems carry obligations.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}404 Unknown realm or resource, or existence concealed from the caller (code not_found, feature_disabled).
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}409 Conflicts with current state, or an idempotent request with the same key is still in progress / carried a one-time secret (code conflict, unexpected_step, last_owner, last_sign_in_method).
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}500 Unexpected error (code internal_error); no stack traces or secrets.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}503 Load shedding, realm unavailable or dependency failure (code unavailable, upstream_unavailable). May include Retry-After.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
},
"Retry-After": {
"$ref": "#/components/headers/Retry-After"
}
}Operation revokeClientCredential · Schema definitions · OpenAPI contract
GET/api/v1/realms/{realm}/clients/{client}/resource-grants/{resource}+
Get a client's grant for a resource
Returns the grant with an entity tag; PUT honors If-Match against it (API-010).
Parameters
| Name | Location | Required | Details |
|---|---|---|---|
realm | path | Yes | Realm name (path-based issuer). Unknown realms return 404.{"type":"string"} |
client | path | Yes | Client reference (internal client id, not the OAuth client_id).{"type":"string"} |
resource | path | Yes | Resource (API) identifier.{"type":"string"} |
X-Request-Id | header | — | Optional caller-supplied correlation ID (printable ASCII, at most 64 characters); otherwise generated. Echoed in X-Request-Id and problem request_id.{"type":"string","maxLength":64,"pattern":"^[\\x21-\\x7e]+$"} |
Responses
200 OK
application/json
| Field | Type | Required | Description |
|---|---|---|---|
id | string | — | |
client_ref | string | — | |
resource_id | string | — | |
allowed_scopes | array | — | |
subject_types | array | — | |
exchange_policy | object | — |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
},
"ETag": {
"description": "Entity tag of the grant's state.",
"schema": {
"type": "string"
}
}
}401 Missing or invalid credentials (code unauthenticated or invalid_credentials). Includes WWW-Authenticate.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
},
"WWW-Authenticate": {
"$ref": "#/components/headers/WWW-Authenticate"
}
}403 Authenticated but not allowed (code forbidden, mfa_required, step_up_required, recent_authentication_required, grant_ceiling_exceeded, impersonation_restricted, account_unavailable, sso_required, recovery_restricted). Step-up problems carry obligations.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}404 Unknown realm or resource, or existence concealed from the caller (code not_found, feature_disabled).
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}500 Unexpected error (code internal_error); no stack traces or secrets.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}Operation getClientResourceGrant · Schema definitions · OpenAPI contract
PUT/api/v1/realms/{realm}/clients/{client}/resource-grants/{resource}+
Grant a client access to a resource
Parameters
| Name | Location | Required | Details |
|---|---|---|---|
realm | path | Yes | Realm name (path-based issuer). Unknown realms return 404.{"type":"string"} |
client | path | Yes | Client reference (internal client id, not the OAuth client_id).{"type":"string"} |
resource | path | Yes | Resource (API) identifier.{"type":"string"} |
If-Match | header | — | Expected resource version from the ETag (W/"v12" or "v12"). Stale versions return 412.{"type":"string","examples":["W/\"v12\""]} |
X-Request-Id | header | — | Optional caller-supplied correlation ID (printable ASCII, at most 64 characters); otherwise generated. Echoed in X-Request-Id and problem request_id.{"type":"string","maxLength":64,"pattern":"^[\\x21-\\x7e]+$"} |
Request body
application/json · required
| Field | Type | Required | Description |
|---|---|---|---|
allowed_scopes | array,null | — | |
subject_types | array,null | — | |
exchange_policy | ExchangePolicy | — |
Complete request schema
{
"type": "object",
"properties": {
"allowed_scopes": {
"type": [
"array",
"null"
],
"items": {
"type": "string"
}
},
"subject_types": {
"type": [
"array",
"null"
],
"items": {
"type": "string",
"enum": [
"user",
"service_principal"
]
}
},
"exchange_policy": {
"$ref": "#/components/schemas/ExchangePolicy"
}
},
"additionalProperties": false
}Responses
204 No Content
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}400 Malformed request, invalid JSON (duplicate members, unknown fields, wrong types), invalid cursor or invalid transaction (code invalid_request, transaction_invalid, invalid_proof, invitation_invalid).
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}401 Missing or invalid credentials (code unauthenticated or invalid_credentials). Includes WWW-Authenticate.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
},
"WWW-Authenticate": {
"$ref": "#/components/headers/WWW-Authenticate"
}
}403 Authenticated but not allowed (code forbidden, mfa_required, step_up_required, recent_authentication_required, grant_ceiling_exceeded, impersonation_restricted, account_unavailable, sso_required, recovery_restricted). Step-up problems carry obligations.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}404 Unknown realm or resource, or existence concealed from the caller (code not_found, feature_disabled).
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}409 Conflicts with current state, or an idempotent request with the same key is still in progress / carried a one-time secret (code conflict, unexpected_step, last_owner, last_sign_in_method).
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}412 If-Match does not match the current version (code precondition_failed).
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}413 Body exceeds limits.max_body_bytes (code payload_too_large).
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}415 Wrong Content-Type (code unsupported_media_type).
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}422 Validation failed (code validation_failed, password_policy, idempotency_key_reused); errors maps fields to messages.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}500 Unexpected error (code internal_error); no stack traces or secrets.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}503 Load shedding, realm unavailable or dependency failure (code unavailable, upstream_unavailable). May include Retry-After.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
},
"Retry-After": {
"$ref": "#/components/headers/Retry-After"
}
}Operation setClientResourceGrant · Schema definitions · OpenAPI contract
DELETE/api/v1/realms/{realm}/clients/{client}/resource-grants/{resource}+
Remove a client resource grant
Parameters
| Name | Location | Required | Details |
|---|---|---|---|
realm | path | Yes | Realm name (path-based issuer). Unknown realms return 404.{"type":"string"} |
client | path | Yes | Client reference (internal client id, not the OAuth client_id).{"type":"string"} |
resource | path | Yes | Resource (API) identifier.{"type":"string"} |
X-Request-Id | header | — | Optional caller-supplied correlation ID (printable ASCII, at most 64 characters); otherwise generated. Echoed in X-Request-Id and problem request_id.{"type":"string","maxLength":64,"pattern":"^[\\x21-\\x7e]+$"} |
Responses
204 No Content
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}401 Missing or invalid credentials (code unauthenticated or invalid_credentials). Includes WWW-Authenticate.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
},
"WWW-Authenticate": {
"$ref": "#/components/headers/WWW-Authenticate"
}
}403 Authenticated but not allowed (code forbidden, mfa_required, step_up_required, recent_authentication_required, grant_ceiling_exceeded, impersonation_restricted, account_unavailable, sso_required, recovery_restricted). Step-up problems carry obligations.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}404 Unknown realm or resource, or existence concealed from the caller (code not_found, feature_disabled).
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}409 Conflicts with current state, or an idempotent request with the same key is still in progress / carried a one-time secret (code conflict, unexpected_step, last_owner, last_sign_in_method).
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}500 Unexpected error (code internal_error); no stack traces or secrets.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}503 Load shedding, realm unavailable or dependency failure (code unavailable, upstream_unavailable). May include Retry-After.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
},
"Retry-After": {
"$ref": "#/components/headers/Retry-After"
}
}Operation removeClientResourceGrant · Schema definitions · OpenAPI contract
GET/api/v1/realms/{realm}/clients/{client}/consent-preauthorizations+
List consent pre-authorizations
Parameters
| Name | Location | Required | Details |
|---|---|---|---|
realm | path | Yes | Realm name (path-based issuer). Unknown realms return 404.{"type":"string"} |
client | path | Yes | Client reference (internal client id, not the OAuth client_id).{"type":"string"} |
X-Request-Id | header | — | Optional caller-supplied correlation ID (printable ASCII, at most 64 characters); otherwise generated. Echoed in X-Request-Id and problem request_id.{"type":"string","maxLength":64,"pattern":"^[\\x21-\\x7e]+$"} |
Responses
200 OK
application/json
| Field | Type | Required | Description |
|---|---|---|---|
items | array | — | |
next_cursor | string | — |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}400 Malformed request, invalid JSON (duplicate members, unknown fields, wrong types), invalid cursor or invalid transaction (code invalid_request, transaction_invalid, invalid_proof, invitation_invalid).
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}401 Missing or invalid credentials (code unauthenticated or invalid_credentials). Includes WWW-Authenticate.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
},
"WWW-Authenticate": {
"$ref": "#/components/headers/WWW-Authenticate"
}
}403 Authenticated but not allowed (code forbidden, mfa_required, step_up_required, recent_authentication_required, grant_ceiling_exceeded, impersonation_restricted, account_unavailable, sso_required, recovery_restricted). Step-up problems carry obligations.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}404 Unknown realm or resource, or existence concealed from the caller (code not_found, feature_disabled).
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}409 Conflicts with current state, or an idempotent request with the same key is still in progress / carried a one-time secret (code conflict, unexpected_step, last_owner, last_sign_in_method).
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}422 Validation failed (code validation_failed, password_policy, idempotency_key_reused); errors maps fields to messages.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}500 Unexpected error (code internal_error); no stack traces or secrets.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}Operation listConsentPreauthorizations · Schema definitions · OpenAPI contract
POST/api/v1/realms/{realm}/clients/{client}/consent-preauthorizations+
Pre-authorize a client on behalf of users
Administrative consent (APP-013) for the client's current terms version, realm-wide or for one organization. Users signing in are not asked for the covered scopes; their consent is recorded with mode preauthorized. offline_access always needs the user's own consent.
Parameters
| Name | Location | Required | Details |
|---|---|---|---|
realm | path | Yes | Realm name (path-based issuer). Unknown realms return 404.{"type":"string"} |
client | path | Yes | Client reference (internal client id, not the OAuth client_id).{"type":"string"} |
X-Request-Id | header | — | Optional caller-supplied correlation ID (printable ASCII, at most 64 characters); otherwise generated. Echoed in X-Request-Id and problem request_id.{"type":"string","maxLength":64,"pattern":"^[\\x21-\\x7e]+$"} |
Request body
application/json · required
| Field | Type | Required | Description |
|---|---|---|---|
organization_id | string | — | Limit the pre-authorization to users signing in to this organization; omit for the whole realm. |
scopes | array | Yes | |
reason | string | Yes |
Complete request schema
{
"type": "object",
"additionalProperties": false,
"required": [
"scopes",
"reason"
],
"properties": {
"organization_id": {
"type": "string",
"description": "Limit the pre-authorization to users signing in to this organization; omit for the whole realm."
},
"scopes": {
"type": "array",
"minItems": 1,
"maxItems": 50,
"items": {
"type": "string"
}
},
"reason": {
"type": "string"
}
}
}Responses
201 OK
application/json
| Field | Type | Required | Description |
|---|---|---|---|
id | string | — | |
client | string | — | |
organization_id | string | — | |
scopes | array | — | |
terms_version | string | — | |
reason | string | — | |
granted_by_id | string | — | |
granted_at | string | — | |
revoked_at | string | — |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}400 Malformed request, invalid JSON (duplicate members, unknown fields, wrong types), invalid cursor or invalid transaction (code invalid_request, transaction_invalid, invalid_proof, invitation_invalid).
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}401 Missing or invalid credentials (code unauthenticated or invalid_credentials). Includes WWW-Authenticate.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
},
"WWW-Authenticate": {
"$ref": "#/components/headers/WWW-Authenticate"
}
}403 Authenticated but not allowed (code forbidden, mfa_required, step_up_required, recent_authentication_required, grant_ceiling_exceeded, impersonation_restricted, account_unavailable, sso_required, recovery_restricted). Step-up problems carry obligations.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}404 Unknown realm or resource, or existence concealed from the caller (code not_found, feature_disabled).
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}409 Conflicts with current state, or an idempotent request with the same key is still in progress / carried a one-time secret (code conflict, unexpected_step, last_owner, last_sign_in_method).
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}422 Validation failed (code validation_failed, password_policy, idempotency_key_reused); errors maps fields to messages.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}500 Unexpected error (code internal_error); no stack traces or secrets.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}Operation createConsentPreauthorization · Schema definitions · OpenAPI contract
DELETE/api/v1/realms/{realm}/clients/{client}/consent-preauthorizations/{id}+
Revoke a consent pre-authorization
Also revokes every consent recorded under it and the grants built on those consents.
Parameters
| Name | Location | Required | Details |
|---|---|---|---|
realm | path | Yes | Realm name (path-based issuer). Unknown realms return 404.{"type":"string"} |
client | path | Yes | Client reference (internal client id, not the OAuth client_id).{"type":"string"} |
id | path | Yes | Resource identifier.{"type":"string"} |
X-Request-Id | header | — | Optional caller-supplied correlation ID (printable ASCII, at most 64 characters); otherwise generated. Echoed in X-Request-Id and problem request_id.{"type":"string","maxLength":64,"pattern":"^[\\x21-\\x7e]+$"} |
Responses
204 No Content
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}400 Malformed request, invalid JSON (duplicate members, unknown fields, wrong types), invalid cursor or invalid transaction (code invalid_request, transaction_invalid, invalid_proof, invitation_invalid).
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}401 Missing or invalid credentials (code unauthenticated or invalid_credentials). Includes WWW-Authenticate.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
},
"WWW-Authenticate": {
"$ref": "#/components/headers/WWW-Authenticate"
}
}403 Authenticated but not allowed (code forbidden, mfa_required, step_up_required, recent_authentication_required, grant_ceiling_exceeded, impersonation_restricted, account_unavailable, sso_required, recovery_restricted). Step-up problems carry obligations.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}404 Unknown realm or resource, or existence concealed from the caller (code not_found, feature_disabled).
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}409 Conflicts with current state, or an idempotent request with the same key is still in progress / carried a one-time secret (code conflict, unexpected_step, last_owner, last_sign_in_method).
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}422 Validation failed (code validation_failed, password_policy, idempotency_key_reused); errors maps fields to messages.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}500 Unexpected error (code internal_error); no stack traces or secrets.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}Operation revokeConsentPreauthorization · Schema definitions · OpenAPI contract
GET/api/v1/realms/{realm}/clients/{client}/workload-trusts+
List workload trusts
Workload federation trusts of a client (MCH-011..MCH-013): external workload identity issuers whose assertions the client may exchange for its service principal's tokens with the jwt-bearer grant.
Parameters
| Name | Location | Required | Details |
|---|---|---|---|
realm | path | Yes | Realm name (path-based issuer). Unknown realms return 404.{"type":"string"} |
client | path | Yes | Client reference (internal client id, not the OAuth client_id).{"type":"string"} |
X-Request-Id | header | — | Optional caller-supplied correlation ID (printable ASCII, at most 64 characters); otherwise generated. Echoed in X-Request-Id and problem request_id.{"type":"string","maxLength":64,"pattern":"^[\\x21-\\x7e]+$"} |
Responses
200 OK
application/json
| Field | Type | Required | Description |
|---|---|---|---|
items | array | Yes | |
next_cursor | string | — |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}400 Malformed request, invalid JSON (duplicate members, unknown fields, wrong types), invalid cursor or invalid transaction (code invalid_request, transaction_invalid, invalid_proof, invitation_invalid).
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}401 Missing or invalid credentials (code unauthenticated or invalid_credentials). Includes WWW-Authenticate.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
},
"WWW-Authenticate": {
"$ref": "#/components/headers/WWW-Authenticate"
}
}403 Authenticated but not allowed (code forbidden, mfa_required, step_up_required, recent_authentication_required, grant_ceiling_exceeded, impersonation_restricted, account_unavailable, sso_required, recovery_restricted). Step-up problems carry obligations.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}404 Unknown realm or resource, or existence concealed from the caller (code not_found, feature_disabled).
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}409 Conflicts with current state, or an idempotent request with the same key is still in progress / carried a one-time secret (code conflict, unexpected_step, last_owner, last_sign_in_method).
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}422 Validation failed (code validation_failed, password_policy, idempotency_key_reused); errors maps fields to messages.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}500 Unexpected error (code internal_error); no stack traces or secrets.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}Operation listWorkloadTrusts · Schema definitions · OpenAPI contract
POST/api/v1/realms/{realm}/clients/{client}/workload-trusts+
Create a workload trust
A credential change (audited as client.workload_trust.created). The client must be a machine client with a service principal and the urn:ietf:params:oauth:grant-type:jwt-bearer grant (409 otherwise). Profiles: github_actions (fixed issuer and key set, subject naming the repository, jti required), kubernetes (one service account: system:serviceaccount:<namespace>:<name>, no wildcards), spiffe (a SPIFFE ID or path prefix ending in /*; iss may be absent from JWT-SVIDs), generic (exact subject or one trailing *). Exactly one of jwks_uri and jwks; key sets from jwks_uri are fetched under the federation egress rules.
Parameters
| Name | Location | Required | Details |
|---|---|---|---|
realm | path | Yes | Realm name (path-based issuer). Unknown realms return 404.{"type":"string"} |
client | path | Yes | Client reference (internal client id, not the OAuth client_id).{"type":"string"} |
Idempotency-Key | header | — | Actor/realm/route-bound idempotency key (API-005) for POST requests, at most 255 characters (422 otherwise), kept for 24 hours; only a digest of the key is stored. The request is identified by its method, exact path and body: a replay with the same path and body returns the stored status and response with Idempotent-Replayed: true; the same key with a different body or another path on the same route (another resource) returns 422 idempotency_key_reused; a request still in progress returns 409. Only successful responses are recorded: when the original request failed (an error or a status of 400 or above) the key is released and a retry runs again. Responses containing one-time secrets (members such as client_secret, token, api_key, access_token, refresh_token, id_token, recovery_codes, secret or webhook_secrets) are never stored or replayed (409 with original_status).{"type":"string","maxLength":255} |
X-Request-Id | header | — | Optional caller-supplied correlation ID (printable ASCII, at most 64 characters); otherwise generated. Echoed in X-Request-Id and problem request_id.{"type":"string","maxLength":64,"pattern":"^[\\x21-\\x7e]+$"} |
Request body
application/json · required
| Field | Type | Required | Description |
|---|---|---|---|
name | string | Yes | |
profile | string | — | generic | github_actions | kubernetes | spiffe |
issuer | string | — | https issuer the assertion's iss must equal (github_actions defaults to https://token.actions.githubusercontent.com; spiffe defaults to spiffe://<trust domain> for JWT-SVIDs without iss). |
jwks_uri | string | — | |
jwks | object | — | Inline JSON Web Key Set of the issuer's public signing keys (1 to 20). |
audience | string | Yes | The exact audience the assertion must carry (in aud, string or array). |
subject | string | Yes | Exact subject, or a prefix ending in * where the profile allows it. |
claim_constraints | object | — | Claims that must have one of the listed values; nested claims use / (for example kubernetes.io/namespace). iss, sub, aud, exp, nbf, iat and jti are not allowed here. |
algorithms | array | — | |
max_assertion_lifetime_seconds | integer | — | Longest accepted exp minus iat (default 3600). |
require_jti | boolean | — | Refuse assertions without jti (default true for github_actions). A jti, when present, is single-use per trust. |
state | string | — | active | disabled |
Complete request schema
{
"type": "object",
"additionalProperties": false,
"properties": {
"name": {
"type": "string",
"maxLength": 100
},
"profile": {
"type": "string",
"enum": [
"generic",
"github_actions",
"kubernetes",
"spiffe"
]
},
"issuer": {
"type": "string",
"description": "https issuer the assertion's iss must equal (github_actions defaults to https://token.actions.githubusercontent.com; spiffe defaults to spiffe://<trust domain> for JWT-SVIDs without iss)."
},
"jwks_uri": {
"type": "string"
},
"jwks": {
"type": "object",
"description": "Inline JSON Web Key Set of the issuer's public signing keys (1 to 20)."
},
"audience": {
"type": "string",
"description": "The exact audience the assertion must carry (in aud, string or array)."
},
"subject": {
"type": "string",
"description": "Exact subject, or a prefix ending in * where the profile allows it."
},
"claim_constraints": {
"type": "object",
"additionalProperties": {
"type": "array",
"items": {
"type": "string"
}
},
"description": "Claims that must have one of the listed values; nested claims use / (for example kubernetes.io/namespace). iss, sub, aud, exp, nbf, iat and jti are not allowed here."
},
"algorithms": {
"type": "array",
"items": {
"type": "string",
"enum": [
"RS256",
"PS256",
"ES256",
"ES384",
"EdDSA"
]
}
},
"max_assertion_lifetime_seconds": {
"type": "integer",
"minimum": 60,
"maximum": 86400,
"description": "Longest accepted exp minus iat (default 3600)."
},
"require_jti": {
"type": "boolean",
"description": "Refuse assertions without jti (default true for github_actions). A jti, when present, is single-use per trust."
},
"state": {
"type": "string",
"enum": [
"active",
"disabled"
]
}
},
"required": [
"name",
"audience",
"subject"
]
}Responses
201 OK
application/json
| Field | Type | Required | Description |
|---|---|---|---|
id | string | — | |
client_id | string | — | The client's internal reference. |
name | string | — | |
profile | string | — | |
issuer | string | — | |
jwks_uri | string | — | |
jwks | object | — | |
audience | string | — | |
subject | string | — | |
claim_constraints | object | — | |
algorithms | array | — | |
max_assertion_lifetime_seconds | integer | — | |
require_jti | boolean | — | |
state | string | — | |
version | integer | — | |
created_by_id | string | — | |
created_at | string | — | |
updated_at | string | — | |
last_used_at | string | — |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}400 Malformed request, invalid JSON (duplicate members, unknown fields, wrong types), invalid cursor or invalid transaction (code invalid_request, transaction_invalid, invalid_proof, invitation_invalid).
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}401 Missing or invalid credentials (code unauthenticated or invalid_credentials). Includes WWW-Authenticate.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
},
"WWW-Authenticate": {
"$ref": "#/components/headers/WWW-Authenticate"
}
}403 Authenticated but not allowed (code forbidden, mfa_required, step_up_required, recent_authentication_required, grant_ceiling_exceeded, impersonation_restricted, account_unavailable, sso_required, recovery_restricted). Step-up problems carry obligations.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}404 Unknown realm or resource, or existence concealed from the caller (code not_found, feature_disabled).
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}409 Conflicts with current state, or an idempotent request with the same key is still in progress / carried a one-time secret (code conflict, unexpected_step, last_owner, last_sign_in_method).
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}422 Validation failed (code validation_failed, password_policy, idempotency_key_reused); errors maps fields to messages.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}500 Unexpected error (code internal_error); no stack traces or secrets.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}Operation createWorkloadTrust · Schema definitions · OpenAPI contract
GET/api/v1/realms/{realm}/clients/{client}/workload-trusts/{id}+
Get a workload trust
Parameters
| Name | Location | Required | Details |
|---|---|---|---|
realm | path | Yes | Realm name (path-based issuer). Unknown realms return 404.{"type":"string"} |
client | path | Yes | Client reference (internal client id, not the OAuth client_id).{"type":"string"} |
id | path | Yes | Resource identifier.{"type":"string"} |
X-Request-Id | header | — | Optional caller-supplied correlation ID (printable ASCII, at most 64 characters); otherwise generated. Echoed in X-Request-Id and problem request_id.{"type":"string","maxLength":64,"pattern":"^[\\x21-\\x7e]+$"} |
Responses
200 OK
application/json
| Field | Type | Required | Description |
|---|---|---|---|
id | string | — | |
client_id | string | — | The client's internal reference. |
name | string | — | |
profile | string | — | |
issuer | string | — | |
jwks_uri | string | — | |
jwks | object | — | |
audience | string | — | |
subject | string | — | |
claim_constraints | object | — | |
algorithms | array | — | |
max_assertion_lifetime_seconds | integer | — | |
require_jti | boolean | — | |
state | string | — | |
version | integer | — | |
created_by_id | string | — | |
created_at | string | — | |
updated_at | string | — | |
last_used_at | string | — |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}400 Malformed request, invalid JSON (duplicate members, unknown fields, wrong types), invalid cursor or invalid transaction (code invalid_request, transaction_invalid, invalid_proof, invitation_invalid).
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}401 Missing or invalid credentials (code unauthenticated or invalid_credentials). Includes WWW-Authenticate.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
},
"WWW-Authenticate": {
"$ref": "#/components/headers/WWW-Authenticate"
}
}403 Authenticated but not allowed (code forbidden, mfa_required, step_up_required, recent_authentication_required, grant_ceiling_exceeded, impersonation_restricted, account_unavailable, sso_required, recovery_restricted). Step-up problems carry obligations.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}404 Unknown realm or resource, or existence concealed from the caller (code not_found, feature_disabled).
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}409 Conflicts with current state, or an idempotent request with the same key is still in progress / carried a one-time secret (code conflict, unexpected_step, last_owner, last_sign_in_method).
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}422 Validation failed (code validation_failed, password_policy, idempotency_key_reused); errors maps fields to messages.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}500 Unexpected error (code internal_error); no stack traces or secrets.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}Operation getWorkloadTrust · Schema definitions · OpenAPI contract
PUT/api/v1/realms/{realm}/clients/{client}/workload-trusts/{id}+
Replace a workload trust
Requires If-Match (428 without it, 412 when stale). state=disabled stops the trust at once.
Parameters
| Name | Location | Required | Details |
|---|---|---|---|
realm | path | Yes | Realm name (path-based issuer). Unknown realms return 404.{"type":"string"} |
client | path | Yes | Client reference (internal client id, not the OAuth client_id).{"type":"string"} |
id | path | Yes | Resource identifier.{"type":"string"} |
If-Match | header | Yes | Expected resource version from the ETag. Required: missing returns 428, stale returns 412.{"type":"string","examples":["W/\"v12\""]} |
X-Request-Id | header | — | Optional caller-supplied correlation ID (printable ASCII, at most 64 characters); otherwise generated. Echoed in X-Request-Id and problem request_id.{"type":"string","maxLength":64,"pattern":"^[\\x21-\\x7e]+$"} |
Request body
application/json · required
| Field | Type | Required | Description |
|---|---|---|---|
name | string | Yes | |
profile | string | — | generic | github_actions | kubernetes | spiffe |
issuer | string | — | https issuer the assertion's iss must equal (github_actions defaults to https://token.actions.githubusercontent.com; spiffe defaults to spiffe://<trust domain> for JWT-SVIDs without iss). |
jwks_uri | string | — | |
jwks | object | — | Inline JSON Web Key Set of the issuer's public signing keys (1 to 20). |
audience | string | Yes | The exact audience the assertion must carry (in aud, string or array). |
subject | string | Yes | Exact subject, or a prefix ending in * where the profile allows it. |
claim_constraints | object | — | Claims that must have one of the listed values; nested claims use / (for example kubernetes.io/namespace). iss, sub, aud, exp, nbf, iat and jti are not allowed here. |
algorithms | array | — | |
max_assertion_lifetime_seconds | integer | — | Longest accepted exp minus iat (default 3600). |
require_jti | boolean | — | Refuse assertions without jti (default true for github_actions). A jti, when present, is single-use per trust. |
state | string | — | active | disabled |
Complete request schema
{
"type": "object",
"additionalProperties": false,
"properties": {
"name": {
"type": "string",
"maxLength": 100
},
"profile": {
"type": "string",
"enum": [
"generic",
"github_actions",
"kubernetes",
"spiffe"
]
},
"issuer": {
"type": "string",
"description": "https issuer the assertion's iss must equal (github_actions defaults to https://token.actions.githubusercontent.com; spiffe defaults to spiffe://<trust domain> for JWT-SVIDs without iss)."
},
"jwks_uri": {
"type": "string"
},
"jwks": {
"type": "object",
"description": "Inline JSON Web Key Set of the issuer's public signing keys (1 to 20)."
},
"audience": {
"type": "string",
"description": "The exact audience the assertion must carry (in aud, string or array)."
},
"subject": {
"type": "string",
"description": "Exact subject, or a prefix ending in * where the profile allows it."
},
"claim_constraints": {
"type": "object",
"additionalProperties": {
"type": "array",
"items": {
"type": "string"
}
},
"description": "Claims that must have one of the listed values; nested claims use / (for example kubernetes.io/namespace). iss, sub, aud, exp, nbf, iat and jti are not allowed here."
},
"algorithms": {
"type": "array",
"items": {
"type": "string",
"enum": [
"RS256",
"PS256",
"ES256",
"ES384",
"EdDSA"
]
}
},
"max_assertion_lifetime_seconds": {
"type": "integer",
"minimum": 60,
"maximum": 86400,
"description": "Longest accepted exp minus iat (default 3600)."
},
"require_jti": {
"type": "boolean",
"description": "Refuse assertions without jti (default true for github_actions). A jti, when present, is single-use per trust."
},
"state": {
"type": "string",
"enum": [
"active",
"disabled"
]
}
},
"required": [
"name",
"audience",
"subject"
]
}Responses
200 OK
application/json
| Field | Type | Required | Description |
|---|---|---|---|
id | string | — | |
client_id | string | — | The client's internal reference. |
name | string | — | |
profile | string | — | |
issuer | string | — | |
jwks_uri | string | — | |
jwks | object | — | |
audience | string | — | |
subject | string | — | |
claim_constraints | object | — | |
algorithms | array | — | |
max_assertion_lifetime_seconds | integer | — | |
require_jti | boolean | — | |
state | string | — | |
version | integer | — | |
created_by_id | string | — | |
created_at | string | — | |
updated_at | string | — | |
last_used_at | string | — |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}400 Malformed request, invalid JSON (duplicate members, unknown fields, wrong types), invalid cursor or invalid transaction (code invalid_request, transaction_invalid, invalid_proof, invitation_invalid).
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}401 Missing or invalid credentials (code unauthenticated or invalid_credentials). Includes WWW-Authenticate.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
},
"WWW-Authenticate": {
"$ref": "#/components/headers/WWW-Authenticate"
}
}403 Authenticated but not allowed (code forbidden, mfa_required, step_up_required, recent_authentication_required, grant_ceiling_exceeded, impersonation_restricted, account_unavailable, sso_required, recovery_restricted). Step-up problems carry obligations.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}404 Unknown realm or resource, or existence concealed from the caller (code not_found, feature_disabled).
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}409 Conflicts with current state, or an idempotent request with the same key is still in progress / carried a one-time secret (code conflict, unexpected_step, last_owner, last_sign_in_method).
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}422 Validation failed (code validation_failed, password_policy, idempotency_key_reused); errors maps fields to messages.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}500 Unexpected error (code internal_error); no stack traces or secrets.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}Operation replaceWorkloadTrust · Schema definitions · OpenAPI contract
DELETE/api/v1/realms/{realm}/clients/{client}/workload-trusts/{id}+
Delete a workload trust
Tokens already issued expire on their own (they never outlive the assertion they came from).
Parameters
| Name | Location | Required | Details |
|---|---|---|---|
realm | path | Yes | Realm name (path-based issuer). Unknown realms return 404.{"type":"string"} |
client | path | Yes | Client reference (internal client id, not the OAuth client_id).{"type":"string"} |
id | path | Yes | Resource identifier.{"type":"string"} |
X-Request-Id | header | — | Optional caller-supplied correlation ID (printable ASCII, at most 64 characters); otherwise generated. Echoed in X-Request-Id and problem request_id.{"type":"string","maxLength":64,"pattern":"^[\\x21-\\x7e]+$"} |
Responses
204 No Content
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}400 Malformed request, invalid JSON (duplicate members, unknown fields, wrong types), invalid cursor or invalid transaction (code invalid_request, transaction_invalid, invalid_proof, invitation_invalid).
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}401 Missing or invalid credentials (code unauthenticated or invalid_credentials). Includes WWW-Authenticate.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
},
"WWW-Authenticate": {
"$ref": "#/components/headers/WWW-Authenticate"
}
}403 Authenticated but not allowed (code forbidden, mfa_required, step_up_required, recent_authentication_required, grant_ceiling_exceeded, impersonation_restricted, account_unavailable, sso_required, recovery_restricted). Step-up problems carry obligations.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}404 Unknown realm or resource, or existence concealed from the caller (code not_found, feature_disabled).
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}409 Conflicts with current state, or an idempotent request with the same key is still in progress / carried a one-time secret (code conflict, unexpected_step, last_owner, last_sign_in_method).
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}422 Validation failed (code validation_failed, password_policy, idempotency_key_reused); errors maps fields to messages.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}500 Unexpected error (code internal_error); no stack traces or secrets.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}Operation deleteWorkloadTrust · Schema definitions · OpenAPI contract
GET/api/v1/realms/{realm}/client-registration-tokens+
List initial access tokens
Parameters
| Name | Location | Required | Details |
|---|---|---|---|
realm | path | Yes | Realm name (path-based issuer). Unknown realms return 404.{"type":"string"} |
X-Request-Id | header | — | Optional caller-supplied correlation ID (printable ASCII, at most 64 characters); otherwise generated. Echoed in X-Request-Id and problem request_id.{"type":"string","maxLength":64,"pattern":"^[\\x21-\\x7e]+$"} |
Responses
200 OK
application/json
| Field | Type | Required | Description |
|---|---|---|---|
items | array | Yes | |
next_cursor | string | — |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}400 Malformed request, invalid JSON (duplicate members, unknown fields, wrong types), invalid cursor or invalid transaction (code invalid_request, transaction_invalid, invalid_proof, invitation_invalid).
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}401 Missing or invalid credentials (code unauthenticated or invalid_credentials). Includes WWW-Authenticate.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
},
"WWW-Authenticate": {
"$ref": "#/components/headers/WWW-Authenticate"
}
}403 Authenticated but not allowed (code forbidden, mfa_required, step_up_required, recent_authentication_required, grant_ceiling_exceeded, impersonation_restricted, account_unavailable, sso_required, recovery_restricted). Step-up problems carry obligations.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}404 Unknown realm or resource, or existence concealed from the caller (code not_found, feature_disabled).
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}409 Conflicts with current state, or an idempotent request with the same key is still in progress / carried a one-time secret (code conflict, unexpected_step, last_owner, last_sign_in_method).
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}422 Validation failed (code validation_failed, password_policy, idempotency_key_reused); errors maps fields to messages.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}500 Unexpected error (code internal_error); no stack traces or secrets.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}Operation listInitialAccessTokens · Schema definitions · OpenAPI contract
POST/api/v1/realms/{realm}/client-registration-tokens+
Issue an initial access token
ADV-003 initial registration authority: allowed_scopes name business resources and non-privileged scopes registered clients may receive (privileged scopes are refused, and re-checked at use); max_uses defaults to 1, expiry to 7 days. The plaintext is returned once.
Parameters
| Name | Location | Required | Details |
|---|---|---|---|
realm | path | Yes | Realm name (path-based issuer). Unknown realms return 404.{"type":"string"} |
Idempotency-Key | header | — | Actor/realm/route-bound idempotency key (API-005) for POST requests, at most 255 characters (422 otherwise), kept for 24 hours; only a digest of the key is stored. The request is identified by its method, exact path and body: a replay with the same path and body returns the stored status and response with Idempotent-Replayed: true; the same key with a different body or another path on the same route (another resource) returns 422 idempotency_key_reused; a request still in progress returns 409. Only successful responses are recorded: when the original request failed (an error or a status of 400 or above) the key is released and a retry runs again. Responses containing one-time secrets (members such as client_secret, token, api_key, access_token, refresh_token, id_token, recovery_codes, secret or webhook_secrets) are never stored or replayed (409 with original_status).{"type":"string","maxLength":255} |
X-Request-Id | header | — | Optional caller-supplied correlation ID (printable ASCII, at most 64 characters); otherwise generated. Echoed in X-Request-Id and problem request_id.{"type":"string","maxLength":64,"pattern":"^[\\x21-\\x7e]+$"} |
Request body
application/json · required
| Field | Type | Required | Description |
|---|---|---|---|
description | string | — | |
allowed_scopes | array | — | |
project_id | string | — | |
max_uses | integer | — | |
expires_in_seconds | integer | — |
Complete request schema
{
"type": "object",
"additionalProperties": false,
"properties": {
"description": {
"type": "string",
"maxLength": 200
},
"allowed_scopes": {
"type": "array",
"maxItems": 20,
"items": {
"type": "object",
"additionalProperties": false,
"properties": {
"resource_id": {
"type": "string"
},
"scopes": {
"type": "array",
"items": {
"type": "string"
}
}
},
"required": [
"resource_id",
"scopes"
]
}
},
"project_id": {
"type": "string"
},
"max_uses": {
"type": "integer",
"minimum": 1,
"maximum": 1000
},
"expires_in_seconds": {
"type": "integer",
"minimum": 60,
"maximum": 7776000
}
}
}Responses
201 OK
application/json
| Field | Type | Required | Description |
|---|---|---|---|
initial_access_tokenone-time secret | string | — | |
token | RegistrationToken | — | |
notice | string | — |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}400 Malformed request, invalid JSON (duplicate members, unknown fields, wrong types), invalid cursor or invalid transaction (code invalid_request, transaction_invalid, invalid_proof, invitation_invalid).
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}401 Missing or invalid credentials (code unauthenticated or invalid_credentials). Includes WWW-Authenticate.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
},
"WWW-Authenticate": {
"$ref": "#/components/headers/WWW-Authenticate"
}
}403 Authenticated but not allowed (code forbidden, mfa_required, step_up_required, recent_authentication_required, grant_ceiling_exceeded, impersonation_restricted, account_unavailable, sso_required, recovery_restricted). Step-up problems carry obligations.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}404 Unknown realm or resource, or existence concealed from the caller (code not_found, feature_disabled).
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}409 Conflicts with current state, or an idempotent request with the same key is still in progress / carried a one-time secret (code conflict, unexpected_step, last_owner, last_sign_in_method).
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}422 Validation failed (code validation_failed, password_policy, idempotency_key_reused); errors maps fields to messages.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}500 Unexpected error (code internal_error); no stack traces or secrets.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}Operation createInitialAccessToken · Schema definitions · OpenAPI contract
DELETE/api/v1/realms/{realm}/client-registration-tokens/{id}+
Revoke an initial access token
Clients already registered with it are unaffected.
Parameters
| Name | Location | Required | Details |
|---|---|---|---|
realm | path | Yes | Realm name (path-based issuer). Unknown realms return 404.{"type":"string"} |
id | path | Yes | Resource identifier.{"type":"string"} |
X-Request-Id | header | — | Optional caller-supplied correlation ID (printable ASCII, at most 64 characters); otherwise generated. Echoed in X-Request-Id and problem request_id.{"type":"string","maxLength":64,"pattern":"^[\\x21-\\x7e]+$"} |
Responses
204 No Content
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}400 Malformed request, invalid JSON (duplicate members, unknown fields, wrong types), invalid cursor or invalid transaction (code invalid_request, transaction_invalid, invalid_proof, invitation_invalid).
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}401 Missing or invalid credentials (code unauthenticated or invalid_credentials). Includes WWW-Authenticate.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
},
"WWW-Authenticate": {
"$ref": "#/components/headers/WWW-Authenticate"
}
}403 Authenticated but not allowed (code forbidden, mfa_required, step_up_required, recent_authentication_required, grant_ceiling_exceeded, impersonation_restricted, account_unavailable, sso_required, recovery_restricted). Step-up problems carry obligations.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}404 Unknown realm or resource, or existence concealed from the caller (code not_found, feature_disabled).
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}409 Conflicts with current state, or an idempotent request with the same key is still in progress / carried a one-time secret (code conflict, unexpected_step, last_owner, last_sign_in_method).
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}422 Validation failed (code validation_failed, password_policy, idempotency_key_reused); errors maps fields to messages.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}500 Unexpected error (code internal_error); no stack traces or secrets.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}Operation revokeInitialAccessToken · Schema definitions · OpenAPI contract
GET/api/v1/realms/{realm}/client-registrations+
List dynamically registered clients
Filter with approval_state=pending, approved or rejected.
Parameters
| Name | Location | Required | Details |
|---|---|---|---|
realm | path | Yes | Realm name (path-based issuer). Unknown realms return 404.{"type":"string"} |
X-Request-Id | header | — | Optional caller-supplied correlation ID (printable ASCII, at most 64 characters); otherwise generated. Echoed in X-Request-Id and problem request_id.{"type":"string","maxLength":64,"pattern":"^[\\x21-\\x7e]+$"} |
Responses
200 OK
application/json
| Field | Type | Required | Description |
|---|---|---|---|
items | array | Yes | |
next_cursor | string | — |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}400 Malformed request, invalid JSON (duplicate members, unknown fields, wrong types), invalid cursor or invalid transaction (code invalid_request, transaction_invalid, invalid_proof, invitation_invalid).
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}401 Missing or invalid credentials (code unauthenticated or invalid_credentials). Includes WWW-Authenticate.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
},
"WWW-Authenticate": {
"$ref": "#/components/headers/WWW-Authenticate"
}
}403 Authenticated but not allowed (code forbidden, mfa_required, step_up_required, recent_authentication_required, grant_ceiling_exceeded, impersonation_restricted, account_unavailable, sso_required, recovery_restricted). Step-up problems carry obligations.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}404 Unknown realm or resource, or existence concealed from the caller (code not_found, feature_disabled).
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}409 Conflicts with current state, or an idempotent request with the same key is still in progress / carried a one-time secret (code conflict, unexpected_step, last_owner, last_sign_in_method).
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}422 Validation failed (code validation_failed, password_policy, idempotency_key_reused); errors maps fields to messages.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}500 Unexpected error (code internal_error); no stack traces or secrets.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}Operation listClientRegistrations · Schema definitions · OpenAPI contract
POST/api/v1/realms/{realm}/client-registrations/{client}/approve+
Approve a pending registration
Activates the client (audited client.registration.approved).
Parameters
| Name | Location | Required | Details |
|---|---|---|---|
realm | path | Yes | Realm name (path-based issuer). Unknown realms return 404.{"type":"string"} |
client | path | Yes | Client reference (internal client id, not the OAuth client_id).{"type":"string"} |
X-Request-Id | header | — | Optional caller-supplied correlation ID (printable ASCII, at most 64 characters); otherwise generated. Echoed in X-Request-Id and problem request_id.{"type":"string","maxLength":64,"pattern":"^[\\x21-\\x7e]+$"} |
Request body
application/json · required
{
"type": "object",
"additionalProperties": false
}Complete request schema
{
"type": "object",
"additionalProperties": false
}Responses
204 No Content
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}400 Malformed request, invalid JSON (duplicate members, unknown fields, wrong types), invalid cursor or invalid transaction (code invalid_request, transaction_invalid, invalid_proof, invitation_invalid).
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}401 Missing or invalid credentials (code unauthenticated or invalid_credentials). Includes WWW-Authenticate.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
},
"WWW-Authenticate": {
"$ref": "#/components/headers/WWW-Authenticate"
}
}403 Authenticated but not allowed (code forbidden, mfa_required, step_up_required, recent_authentication_required, grant_ceiling_exceeded, impersonation_restricted, account_unavailable, sso_required, recovery_restricted). Step-up problems carry obligations.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}404 Unknown realm or resource, or existence concealed from the caller (code not_found, feature_disabled).
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}409 Conflicts with current state, or an idempotent request with the same key is still in progress / carried a one-time secret (code conflict, unexpected_step, last_owner, last_sign_in_method).
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}422 Validation failed (code validation_failed, password_policy, idempotency_key_reused); errors maps fields to messages.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}500 Unexpected error (code internal_error); no stack traces or secrets.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}Operation approveClientRegistration · Schema definitions · OpenAPI contract
POST/api/v1/realms/{realm}/client-registrations/{client}/reject+
Reject a pending registration
Decommissions the client (audited client.registration.rejected).
Parameters
| Name | Location | Required | Details |
|---|---|---|---|
realm | path | Yes | Realm name (path-based issuer). Unknown realms return 404.{"type":"string"} |
client | path | Yes | Client reference (internal client id, not the OAuth client_id).{"type":"string"} |
X-Request-Id | header | — | Optional caller-supplied correlation ID (printable ASCII, at most 64 characters); otherwise generated. Echoed in X-Request-Id and problem request_id.{"type":"string","maxLength":64,"pattern":"^[\\x21-\\x7e]+$"} |
Request body
application/json · required
{
"type": "object",
"additionalProperties": false
}Complete request schema
{
"type": "object",
"additionalProperties": false
}Responses
204 No Content
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}400 Malformed request, invalid JSON (duplicate members, unknown fields, wrong types), invalid cursor or invalid transaction (code invalid_request, transaction_invalid, invalid_proof, invitation_invalid).
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}401 Missing or invalid credentials (code unauthenticated or invalid_credentials). Includes WWW-Authenticate.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
},
"WWW-Authenticate": {
"$ref": "#/components/headers/WWW-Authenticate"
}
}403 Authenticated but not allowed (code forbidden, mfa_required, step_up_required, recent_authentication_required, grant_ceiling_exceeded, impersonation_restricted, account_unavailable, sso_required, recovery_restricted). Step-up problems carry obligations.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}404 Unknown realm or resource, or existence concealed from the caller (code not_found, feature_disabled).
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}409 Conflicts with current state, or an idempotent request with the same key is still in progress / carried a one-time secret (code conflict, unexpected_step, last_owner, last_sign_in_method).
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}422 Validation failed (code validation_failed, password_policy, idempotency_key_reused); errors maps fields to messages.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}500 Unexpected error (code internal_error); no stack traces or secrets.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}Operation rejectClientRegistration · Schema definitions · OpenAPI contract
GET/api/v1/realms/{realm}/certificate-trust-anchors+
List trust anchors
Optional purpose filter.
Parameters
| Name | Location | Required | Details |
|---|---|---|---|
realm | path | Yes | Realm name (path-based issuer). Unknown realms return 404.{"type":"string"} |
X-Request-Id | header | — | Optional caller-supplied correlation ID (printable ASCII, at most 64 characters); otherwise generated. Echoed in X-Request-Id and problem request_id.{"type":"string","maxLength":64,"pattern":"^[\\x21-\\x7e]+$"} |
Responses
200 OK
application/json
| Field | Type | Required | Description |
|---|---|---|---|
items | array | Yes | |
next_cursor | string | — |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}400 Malformed request, invalid JSON (duplicate members, unknown fields, wrong types), invalid cursor or invalid transaction (code invalid_request, transaction_invalid, invalid_proof, invitation_invalid).
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}401 Missing or invalid credentials (code unauthenticated or invalid_credentials). Includes WWW-Authenticate.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
},
"WWW-Authenticate": {
"$ref": "#/components/headers/WWW-Authenticate"
}
}403 Authenticated but not allowed (code forbidden, mfa_required, step_up_required, recent_authentication_required, grant_ceiling_exceeded, impersonation_restricted, account_unavailable, sso_required, recovery_restricted). Step-up problems carry obligations.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}404 Unknown realm or resource, or existence concealed from the caller (code not_found, feature_disabled).
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}409 Conflicts with current state, or an idempotent request with the same key is still in progress / carried a one-time secret (code conflict, unexpected_step, last_owner, last_sign_in_method).
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}422 Validation failed (code validation_failed, password_policy, idempotency_key_reused); errors maps fields to messages.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}500 Unexpected error (code internal_error); no stack traces or secrets.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}Operation listCertificateTrustAnchors · Schema definitions · OpenAPI contract
POST/api/v1/realms/{realm}/certificate-trust-anchors+
Trust a certificate authority
MCH-014, PROV-016: client anchors (realm.clients.credentials) for mutual-TLS client authentication; user anchors (realm.settings.write) for X.509 sign-in. 409 while an active anchor already trusts the authority for that purpose (a removed anchor's authority can be added again, as a new anchor). With revocation crl, crl_pem must carry a nextUpdate; every certificate of the chain below the anchor is checked against its issuer's CRL, and a certificate issued by an intermediate (whose CRL the anchor does not hold) is refused.
Parameters
| Name | Location | Required | Details |
|---|---|---|---|
realm | path | Yes | Realm name (path-based issuer). Unknown realms return 404.{"type":"string"} |
X-Request-Id | header | — | Optional caller-supplied correlation ID (printable ASCII, at most 64 characters); otherwise generated. Echoed in X-Request-Id and problem request_id.{"type":"string","maxLength":64,"pattern":"^[\\x21-\\x7e]+$"} |
Request body
application/json · required
| Field | Type | Required | Description |
|---|---|---|---|
purpose | string | Yes | client | user |
name | string | Yes | |
certificate_pem | string | Yes | Exactly one PEM CA certificate (basic constraints CA, not expired). |
revocation | string | — | none | crl |
crl_pem | string | — | With revocation crl: a PEM X509 CRL signed by this authority; certificates are refused once it passes its next update. |
map_san_email | boolean | — | User anchors: a certificate's single e-mail address signs in the account that verified that address, without a binding. |
multi_factor | boolean | — | User anchors: the certificate key is protected by a second factor (smart card and PIN); sign-in counts as phishing-resistant MFA. |
Complete request schema
{
"type": "object",
"additionalProperties": false,
"properties": {
"purpose": {
"type": "string",
"enum": [
"client",
"user"
]
},
"name": {
"type": "string",
"maxLength": 100
},
"certificate_pem": {
"type": "string",
"description": "Exactly one PEM CA certificate (basic constraints CA, not expired)."
},
"revocation": {
"type": "string",
"enum": [
"none",
"crl"
]
},
"crl_pem": {
"type": "string",
"description": "With revocation crl: a PEM X509 CRL signed by this authority; certificates are refused once it passes its next update."
},
"map_san_email": {
"type": "boolean",
"description": "User anchors: a certificate's single e-mail address signs in the account that verified that address, without a binding."
},
"multi_factor": {
"type": "boolean",
"description": "User anchors: the certificate key is protected by a second factor (smart card and PIN); sign-in counts as phishing-resistant MFA."
}
},
"required": [
"purpose",
"name",
"certificate_pem"
]
}Responses
201 OK
application/json
| Field | Type | Required | Description |
|---|---|---|---|
id | string | — | |
purpose | string | — | client | user |
name | string | — | |
certificate_pem | string | — | |
subject | string | — | |
fingerprint | string | — | base64url SHA-256 of the authority certificate. |
not_after | string | — | |
revocation | string | — | none | crl |
crl_next_update | string | — | |
map_san_email | boolean | — | |
multi_factor | boolean | — | |
state | string | — | |
created_by_id | string | — | |
created_at | string | — |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}400 Malformed request, invalid JSON (duplicate members, unknown fields, wrong types), invalid cursor or invalid transaction (code invalid_request, transaction_invalid, invalid_proof, invitation_invalid).
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}401 Missing or invalid credentials (code unauthenticated or invalid_credentials). Includes WWW-Authenticate.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
},
"WWW-Authenticate": {
"$ref": "#/components/headers/WWW-Authenticate"
}
}403 Authenticated but not allowed (code forbidden, mfa_required, step_up_required, recent_authentication_required, grant_ceiling_exceeded, impersonation_restricted, account_unavailable, sso_required, recovery_restricted). Step-up problems carry obligations.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}404 Unknown realm or resource, or existence concealed from the caller (code not_found, feature_disabled).
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}409 Conflicts with current state, or an idempotent request with the same key is still in progress / carried a one-time secret (code conflict, unexpected_step, last_owner, last_sign_in_method).
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}422 Validation failed (code validation_failed, password_policy, idempotency_key_reused); errors maps fields to messages.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}500 Unexpected error (code internal_error); no stack traces or secrets.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}Operation addCertificateTrustAnchor · Schema definitions · OpenAPI contract
PUT/api/v1/realms/{realm}/certificate-trust-anchors/{id}/crl+
Replace a trust anchor CRL
A newer CRL signed by the authority: a greater CRL number (or, when either list has none, a later thisUpdate), or the identical list again; an equal number with other content, an older list or a list without nextUpdate is 422. Switches the anchor to revocation crl.
Parameters
| Name | Location | Required | Details |
|---|---|---|---|
realm | path | Yes | Realm name (path-based issuer). Unknown realms return 404.{"type":"string"} |
id | path | Yes | Resource identifier.{"type":"string"} |
X-Request-Id | header | — | Optional caller-supplied correlation ID (printable ASCII, at most 64 characters); otherwise generated. Echoed in X-Request-Id and problem request_id.{"type":"string","maxLength":64,"pattern":"^[\\x21-\\x7e]+$"} |
Request body
application/json · required
| Field | Type | Required | Description |
|---|---|---|---|
crl_pem | string | Yes |
Complete request schema
{
"type": "object",
"additionalProperties": false,
"properties": {
"crl_pem": {
"type": "string"
}
},
"required": [
"crl_pem"
]
}Responses
200 OK
application/json
| Field | Type | Required | Description |
|---|---|---|---|
id | string | — | |
purpose | string | — | client | user |
name | string | — | |
certificate_pem | string | — | |
subject | string | — | |
fingerprint | string | — | base64url SHA-256 of the authority certificate. |
not_after | string | — | |
revocation | string | — | none | crl |
crl_next_update | string | — | |
map_san_email | boolean | — | |
multi_factor | boolean | — | |
state | string | — | |
created_by_id | string | — | |
created_at | string | — |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}400 Malformed request, invalid JSON (duplicate members, unknown fields, wrong types), invalid cursor or invalid transaction (code invalid_request, transaction_invalid, invalid_proof, invitation_invalid).
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}401 Missing or invalid credentials (code unauthenticated or invalid_credentials). Includes WWW-Authenticate.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
},
"WWW-Authenticate": {
"$ref": "#/components/headers/WWW-Authenticate"
}
}403 Authenticated but not allowed (code forbidden, mfa_required, step_up_required, recent_authentication_required, grant_ceiling_exceeded, impersonation_restricted, account_unavailable, sso_required, recovery_restricted). Step-up problems carry obligations.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}404 Unknown realm or resource, or existence concealed from the caller (code not_found, feature_disabled).
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}409 Conflicts with current state, or an idempotent request with the same key is still in progress / carried a one-time secret (code conflict, unexpected_step, last_owner, last_sign_in_method).
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}422 Validation failed (code validation_failed, password_policy, idempotency_key_reused); errors maps fields to messages.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}500 Unexpected error (code internal_error); no stack traces or secrets.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}Operation updateTrustAnchorCRL · Schema definitions · OpenAPI contract
DELETE/api/v1/realms/{realm}/certificate-trust-anchors/{id}+
Stop trusting an authority
Parameters
| Name | Location | Required | Details |
|---|---|---|---|
realm | path | Yes | Realm name (path-based issuer). Unknown realms return 404.{"type":"string"} |
id | path | Yes | Resource identifier.{"type":"string"} |
X-Request-Id | header | — | Optional caller-supplied correlation ID (printable ASCII, at most 64 characters); otherwise generated. Echoed in X-Request-Id and problem request_id.{"type":"string","maxLength":64,"pattern":"^[\\x21-\\x7e]+$"} |
Responses
204 No Content
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}400 Malformed request, invalid JSON (duplicate members, unknown fields, wrong types), invalid cursor or invalid transaction (code invalid_request, transaction_invalid, invalid_proof, invitation_invalid).
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}401 Missing or invalid credentials (code unauthenticated or invalid_credentials). Includes WWW-Authenticate.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
},
"WWW-Authenticate": {
"$ref": "#/components/headers/WWW-Authenticate"
}
}403 Authenticated but not allowed (code forbidden, mfa_required, step_up_required, recent_authentication_required, grant_ceiling_exceeded, impersonation_restricted, account_unavailable, sso_required, recovery_restricted). Step-up problems carry obligations.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}404 Unknown realm or resource, or existence concealed from the caller (code not_found, feature_disabled).
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}409 Conflicts with current state, or an idempotent request with the same key is still in progress / carried a one-time secret (code conflict, unexpected_step, last_owner, last_sign_in_method).
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}422 Validation failed (code validation_failed, password_policy, idempotency_key_reused); errors maps fields to messages.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}500 Unexpected error (code internal_error); no stack traces or secrets.
application/problem+json
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | https://auth.proudbase.com/problems/{code} |
title | string | Yes | |
status | integer | Yes | |
code | string | Yes | Stable machine-readable error code.invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable |
detail | string | — | Client-safe detail; never contains secrets. |
errors | object | — | Field name -> validation message. |
request_id | string | — | Correlation identifier, equal to the X-Request-Id response header. |
obligations | array | — | Present on step-up / recent-authentication / MFA problems. |
original_status | integer | — | Present when an idempotent replay is refused because the original response carried a one-time secret. |
Response headers
{
"X-Request-Id": {
"$ref": "#/components/headers/X-Request-Id"
}
}Operation removeCertificateTrustAnchor · Schema definitions · OpenAPI contract