Custom attributes as key-value pairs. Keys must be strings; values can be strings, numbers, booleans, or arrays.

JAR (JWT-Secured Authorization Request, RFC 9101) settings for Third Party Applications

clientCredentialsDisabled rejects the client_credentials grant for this app. Default false. A public client cannot use this grant.

jwtBearerDisabled rejects the JWT bearer grant (urn:ietf:params:oauth:grant-type:jwt-bearer) for this app. Default false. A public client cannot use this grant.

cibaEnabled allows the CIBA grant (urn:openid:params:grant-type:ciba) for this app and requires cibaSettings. Default false. A public client cannot use this grant.

scopeClaimMapping replaces the stored mapping when provided; when absent the existing mapping is preserved. Either way the legacy attributesScopes are cleared (v2 write-replace).

idJagTargetClients replaces the stored mapping when provided. An absent field preserves it, and so does an empty map: a protobuf map has no presence, so it reaches the service as nil after the gRPC hop. Clear the mapping through the full update, which always writes the field.

clientAuthMethod: "clientSecret" (default when empty), "privateKeyJwt" (only clientAssertions are accepted), "workloadIdentity" (only workloadClientAssertions are accepted) or "mtls" (only a registered mTLS certificate is accepted).

clientAssertions replaces the stored list when provided; absent preserves it.

workloadClientAssertions replaces the stored list when provided; absent preserves it.

mtlsClientAuthMethods replaces the stored certificates when set; absent keeps them.

authorizationCodeDisabled rejects the authorization_code grant for this app, including its authorization requests. Default false.

refreshTokenDisabled rejects the refresh_token grant for this app, so its tokens cannot be refreshed. Default false.

deviceCodeDisabled rejects the device authorization grant (urn:ietf:params:oauth:grant-type:device_code) for this app. Default false.

tokenExchangeDisabled rejects the token exchange grant (urn:ietf:params:oauth:grant-type:token-exchange) for this app. Default false.

tags replace the app's labels when provided, matched by policy rules through client.tags conditions. Up to 100 tags, each up to 100 bytes. An absent or empty list preserves the stored tags; clear them through the full update.