API reference

Propose an exact owned-client registration policy

Management API contract View .md

Requires a controlled credential preparation and fresh private issuer custody readback. Stores the full immutable registration and versioned digest with exact accepted owner and catalog evidence for independent review. Approval does not install a client or authorize an assignment. Idempotency-Key replays the exact actor and body after current authority and fresh custody checks.

POST/v1/projects/{project_id}/owned-clients

Authentication Bearer access token with audience taifa-management. Roles and local eligibility are reviewed separately from the OpenAPI bearer scheme.

Parameters

Name	In	Type	Required	Description
`project_id`	path	`string`	Yes
`idempotency-key`	header	`string`	Yes

Request body

application/jsonRequiredClientProposal

Field	Type	Required	Description
`reason`	`string`	Yes	Validation: min length 8; max length 500
`target_issuer`	`string`	Yes	Validation: min length 1; max length 2048
`client_id`	`string`	Yes	Validation: min length 1; max length 128
`client_version`	`integer`	Yes	Validation: minimum 1; maximum 9223372036854775807
`display_name`	`string`	Yes	Validation: min length 3; max length 120
`catalog_id`	`string`	Yes	Validation: min length 1; max length 200
`credential_preparation_id`	`string`	Yes	Canonical preparation UUID from controlled credential delivery. Management verifies fresh private issuer readback; browser proof is reference metadata only. Validation: min length 36; max length 36
`permission_ids`	`string[]`	Yes	Validation: min items 1; max items 32
`registration`	`RegistrationProposal`	Yes

Responses

201Successful Response

Content type: application/jsonClientRead

Field	Type	Required
`id`	`string`	Yes
`project_id`	`string`	Yes
`target_issuer`	`string`	Yes
`client_id`	`string`	Yes
`client_version`	`integer`	Yes
`generation`	`integer`	Yes
`display_name`	`string`	Yes
`catalog_id`	`string`	Yes
`catalog_digest`	`string`	Yes
`permission_ids`	`string[]`	Yes
`registration`	`RegistrationRead`	Yes
`registration_digest`	`string`	Yes
`policy_digest`	`string`	Yes
`credential_preparation_id`	`string \| null`	No
`custody_binding_digest`	`string \| null`	No
`status`	`pending_review \| approved_pending_readback \| superseded \| revoked`	Yes
`proposer`	`string`	Yes
`approver`	`string \| null`	Yes
`created_at`	`string`	Yes
`expires_at`	`string`	Yes
`actions`	`(approve \| revoke)[]`	Yes
`revocation`	`RevocationRead \| null`	No

Other responses

Status	Description	Schema
403	Current project authority or independent review required
409	Current exact proposal, catalog, version or idempotency conflict
413	Exact JSON request exceeds 64 KiB
422	Invalid exact reviewed policy or registration
503	Configured owned issuer authority unavailable

Request example

Illustrative only. TypeScript runs in Node.js on the server. Keep management tokens out of browser bundles. Replace the host, token, path values, and any header or required body placeholders before use. Examples do not send requests.

curl -X POST 'https://YOUR_IDENTITY_HOST/v1/projects/REPLACE_WITH_PROJECT_ID/owned-clients' \
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN' \
  -H 'idempotency-key: REPLACE_WITH_IDEMPOTENCY_KEY' \
  -H 'Content-Type: application/json' \
  --data '{
  "catalog_id": "00000000-0000-4000-8000-000000000001",
  "client_id": "case-app-test",
  "client_version": 1,
  "credential_preparation_id": "00000000-0000-4000-8000-000000000002",
  "display_name": "Case application test",
  "permission_ids": [
    "case.read"
  ],
  "reason": "Review an owned case application registration",
  "registration": {
    "enabled": true,
    "management_access": false,
    "post_logout_redirect_uris": [
      "https://case.example.test/signed-out"
    ],
    "redirect_uris": [
      "https://case.example.test/callback"
    ],
    "refresh_allowed": false,
    "resource_audiences": [
      "case-api-test"
    ],
    "secret_hash_fingerprint": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
  },
  "target_issuer": "https://owned-issuer.example.test"
}'

Response example

No response example in the current specification.

All Reviewed project clients operations