string backChannelLogoutUrl = 10 [(validate).string = {url: true, optional: true}];

Custom attributes as key-value pairs. Keys must be strings; values can be strings, numbers, booleans, or arrays.

JAR (JWT-Secured Authorization Request, RFC 9101) settings for Third Party Applications

clientCredentialsDisabled rejects the client_credentials grant for this app. Default false. A public client cannot use this grant.

jwtBearerDisabled rejects the JWT bearer grant (urn:ietf:params:oauth:grant-type:jwt-bearer) for this app. Default false. A public client cannot use this grant.

cibaEnabled allows the CIBA grant (urn:openid:params:grant-type:ciba) for this app and requires cibaSettings. Default false. A public client cannot use this grant.

scopeClaimMapping is the structured scope→claim model. Consumed by UpdateThirdPartyApplicationV2 (v2 write-replace: attributesScopes is ignored/cleared). v1 ignores this field.

clientAuthMethod: "clientSecret" (default when empty), "privateKeyJwt" (only clientAssertions are accepted), "workloadIdentity" (only workloadClientAssertions are accepted) or "mtls" (only a registered mTLS certificate is accepted).

clientAssertions are the private_key_jwt trust entries (JWKS URL or PEM public key per entry).

workloadClientAssertions are the workload identity trust entries (SPIFFE trust domain or OIDC issuer per entry).

authorizationCodeDisabled rejects the authorization_code grant for this app, including its authorization requests. Default false.

refreshTokenDisabled rejects the refresh_token grant for this app, so its tokens cannot be refreshed. Default false.

deviceCodeDisabled rejects the device authorization grant (urn:ietf:params:oauth:grant-type:device_code) for this app. Default false.

tokenExchangeDisabled rejects the token exchange grant (urn:ietf:params:oauth:grant-type:token-exchange) for this app. Default false.