{  "id": "string",  "enabled": true,  "useSelfAccount": true,  "clientId": "string",  "clientSecret": "string",  "callbackDomain": "string",  "redirectUrl": "string",  "scopes": null,  "prompts": null,  "allowedGrantTypes": null,  "manageProviderTokens": true,  "trustProvidedEmails": true,  "jitUpdatesDisabled": true,  "useNonce": true,  "useClientAssertion": true,  "description": "string",  "logo": "string",  "issuer": "string",  "authUrl": "string",  "tokenUrl": "string",  "userDataUrl": "string",  "jwksUrl": "string",  "userDataClaimsMapping": {    "loginId": "string",    "username": "string",    "name": "string",    "email": "string",    "verifiedEmail": "string",    "verifiedPhone": "string",    "picture": "string",    "givenName": "string",    "middleName": "string",    "familyName": "string",    "customAttributes": {      "property1": "string",      "property2": "string"    },    "group": "string"  },  "nativeClientId": "string",  "nativeClientSecret": "string",  "appleKeyGenerator": null,  "nativeAppleKeyGenerator": null}

/** * Single OAuth provider (Terraform: descope_oauth_provider). The id is the provider identity: the lowercase *  name of a system provider ("google"), or the caller-chosen key of a custom provider. Patch semantics: *  omitted fields are left untouched; present fields are written. The Get response uses the same message with *  all fields populated, except that Descope-managed fields of system providers (description, logo, issuer, *  the connection endpoints and the claims mapping) are rejected on write and omitted on read. */export interface Response {id?: stringenabled?: boolean/** * Whether logins use the caller's own OAuth app credentials rather than Descope's shared app; always true for custom providers */useSelfAccount?: booleanclientId?: string/** * Write-only. Read returns PLACEHOLDER_VALUE when set. PLACEHOLDER_VALUE=keep, ""=clear (rejected when required), value=set */clientSecret?: stringcallbackDomain?: stringredirectUrl?: string/** * JSON arrays of strings; Value makes empty and absent distinct: null/absent = keep, [] = clear, values = set. Validated in the service */scopes?: {[k: string]: unknown}/** * Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values. */prompts?: {[k: string]: unknown}/** * Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values. */allowedGrantTypes?: {[k: string]: unknown}manageProviderTokens?: booleantrustProvidedEmails?: booleanjitUpdatesDisabled?: booleanuseNonce?: booleanuseClientAssertion?: boolean/** * Configuration fields for custom providers; Descope-managed and rejected on system provider writes */description?: stringlogo?: stringissuer?: stringauthUrl?: stringtokenUrl?: stringuserDataUrl?: stringjwksUrl?: string/** * Replaced wholesale when present, left untouched when absent */userDataClaimsMapping?: {loginId?: stringusername?: stringname?: stringemail?: stringverifiedEmail?: stringverifiedPhone?: stringpicture?: stringgivenName?: stringmiddleName?: stringfamilyName?: stringcustomAttributes?: {[k: string]: string}group?: string}/** * Native (mobile) client credentials */nativeClientId?: string/** * Write-only. Read returns PLACEHOLDER_VALUE when set. PLACEHOLDER_VALUE=keep, ""=clear (rejected when required), value=set */nativeClientSecret?: string/** * JSON objects with the AppleKeyGenerator fields (keyId, teamId, privateKey); Value makes empty and absent *  distinct: null/absent = keep, {} = clear, object = set. Only valid for the apple system provider. Validated in the service */appleKeyGenerator?: {[k: string]: unknown}/** * Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values. */nativeAppleKeyGenerator?: {[k: string]: unknown}}