Update a customer client

Learn about updating the client associated with the customer as specified in the request body.

Use Update a customer client to update the client associated with the customer as specified in the request body. All client parameters must be defined in the body of the request, else they are overwritten with empty values. The only exception is the client secret, where if no client secret is sent, the current client secret will remain. However, any other missing attributes are considered to be empty.

You need either of the following role and permission to use this API:

ROLE_ADMIN_CUSTOMER
Auth.Customer.Clients UPDATE

To reset a client secret, you must be assigned the ROLE_ADMIN_CUSTOMER role. If you are not assigned this role, but are assigned any other role along with the Auth.Customer.Clients UPDATE permission, the role that you are assigned must have the permission to access all your tenants. We have added this additional security control to ensure users who have access to only one tenant, cannot access other tenants using clients. This rule does not apply if you need to modify any other attribute of the client.

Important: Clients tokens are revoked if the list of roles, or, the secret is modified during the update.

HTTP method and endpoint

Use the following HTTP method and endpoint to submit the request:

PUT https://auth.reltio.com/oauth/customers/{customerId}/clients/{clientId}

Use the GET client API to retrieve the current client configuration. Edit the returned JSON, and then submit the complete document with this PUT API. The PUT request replaces the stored client configuration with the request body, so omitted values might not be retained.

The following table describes the endpoint path parameters.


Parameter	Type	Required	Description
`customerId`	String	Yes	Identifier of the customer associated with the client.
`clientId`	String	Yes	Identifier of the client to update.

Query parameters

The following table describes the query parameters and their values.


Parameter	Type	Required	Description	Accepted values / Default
`skipTokenRevocation`	Boolean	No	Prevents active client tokens from being revoked when the update changes the client's roles. Use this parameter only for controlled migrations.	Accepted values: `true`, `false`. Default: not confirmed in the provided source.

Request headers

Include the following headers in the request.


Header	Value	Required
`Authorization`	`Bearer <access_token>`	Yes
`Content-Type`	`application/json`	Yes

Request body

The following table describes the request body parameters.


Parameter	Type	Required	Description	Accepted values / Example
`clientId`	String	Yes	Identifier of the client.	`{clientId}`
`scope`	Array	No	Scopes assigned to the client.	`[]`
`authorities`	Array	No	Authorities assigned to the client.	`[]`
`resourceIds`	Array	Yes	Resource identifiers associated with the client.	`[]`
`authorizedGrantTypes`	Array	Yes	OAuth grant types assigned to the client.	`client_credentials`
`clientDescription`	String	Yes	Description of the client.	`Test client 005 - API only`
`clientName`	String	Yes	Name of the client.	`Migration Test Client 005`
`clientEmail`	String or null	Yes	Email address associated with the client.	`null`
`redirectUri`	Array	Yes	Redirect URIs configured for the client.	`[]`
`accessTokenValidity`	Number or null	Yes	Access token validity value configured for the client.	`null`
`refreshTokenValidity`	Number or null	Yes	Refresh token validity value configured for the client.	`null`
`defaultRolesAssignmentEnabled`	Boolean	No	Controls whether `ROLE_API` is assigned by default when tokens are issued. If omitted or set to `true`, `ROLE_API` may be assigned for all customer tenants. Set it to `false` to use only the roles defined in `clientPermissions.roles`.	`true` ,`false`
`clientAuthenticationMethods`	Array	Yes	Authentication methods supported by the client.	`client_secret_post`, `client_secret_basic`
`enabled`	Boolean	Yes	Indicates whether the client is enabled.	`true`
`clientPermissions.roles`	Object	Yes	Maps each registered role name to an array of tenant scopes assigned to that role. Role names can be standard or custom. `ROLE_API` and `ROLE_USER` are examples only and are not required.	Contains `roles`, `permissions`, and `permissionsByService`.
`permissions`	Object	Yes	Permissions assigned to the client.	`{}`
`permissionsByService`	Object	Yes	Permissions assigned to the client and grouped by service.	`{}`
`clientSecret`	String	No	Specifies a new secret for the client. Omit this parameter unless you intend to rotate the secret. If omitted, the existing client secret remains unchanged.	Accepted value: a valid client secret. Default: retains the existing secret when omitted.
`jwtVersion`	Eum	No	Specifies the JWT version associated with the client. If this parameter is present in the current client configuration, include it in the PUT request to preserve its value.	Accepted value: "V1", Default value: null
`consumer`	String	No	Specifies the consumer value associated with the client. If this parameter is present in the current client configuration, include it in the PUT request to preserve its value.	Any string. The value isn't validated against an allowlist, and no length restriction is enforced.

Example request

The following example updates a customer client:

PUT https://auth.reltio.com/oauth/customers/{customerId}/clients/{clientId}

{
    "clientId": "{{clientId}}",
    "scope": [],
    "authorities": [],
    "resourceIds": [],
  "authorizedGrantTypes": [
    "client_credentials"
  ],
  "clientDescription": "Description of the client",
  "clientName": "Name of the client",
  "clientEmail": null,
  "redirectUri": [],
  "accessTokenValidity": null,
  "refreshTokenValidity": null,
  "defaultRolesAssignmentEnabled": false,
  "clientAuthenticationMethods": [
    "client_secret_post",
    "client_secret_basic"
  ],
  "enabled": true,
  "clientPermissions": {
    "roles": {
      "ROLE_API": [],
      "ROLE_USER": []
    },
    "permissions": {},
    "permissionsByService": {}
  }
}

Example response

The following example shows the updated client definition:

{
     "clientId": "{{clientId}}"",
    "scope": [],
    "authorities": [],
    "resourceIds": [],
  "authorizedGrantTypes": [
    "client_credentials"
  ],
  "clientDescription": "Description of the client.",
  "clientName": "Name of the client",
  "clientEmail": null,
  "redirectUri": [],
  "accessTokenValidity": null,
  "refreshTokenValidity": null,
  "defaultRolesAssignmentEnabled": false,
  "clientAuthenticationMethods": [
    "client_secret_post",
    "client_secret_basic"
  ],
  "enabled": true,
  "clientPermissions": {
    "roles": {
      "ROLE_API": [],
      "ROLE_USER": []
    },
    "permissions": {},
    "permissionsByService": {}
  },
  "createdBy": "xyz@reltio.com",
  "updatedBy": "xyz@reltio.com",
  "createdDate": 1785230002716,
  "updatedDate": 1785230046420
}

Response body

The following table describes the fields returned in the response body.


Field	Type	Description
`clientId`	String	Identifier of the updated client.
`scope`	Array	Scopes assigned to the client.
`authorities`	Array	Authorities assigned to the client.
`resourceIds`	Array	Resource identifiers associated with the client.
`authorizedGrantTypes`	Array	OAuth grant types configured for the client.
`clientDescription`	String	Description of the client.
`clientName`	String	Name of the client.
`clientEmail`	String or null	Email address associated with the client.
`redirectUri`	Array	Redirect URIs configured for the client.
`accessTokenValidity`	Number or null	Access token validity value configured for the client.
`refreshTokenValidity`	Number or null	Refresh token validity value configured for the client.
`defaultRolesAssignmentEnabled`	Boolean	Indicates whether default role assignment is enabled for the client.
`clientAuthenticationMethods`	Array	Authentication methods configured for the client.
`enabled`	Boolean	Indicates whether the client is enabled.
`clientPermissions`	Object	Contains the roles and permissions assigned to the client.
`roles`	Object	Maps each registered role name to an array of tenant scopes assigned to that role. Role names can include standard or custom roles.`ROLE_API` and `ROLE_USER` are examples of valid role names.
`ROLE_API`	Array	Assignments associated with the `ROLE_API` role.
`ROLE_USER`	Array	Assignments associated with the `ROLE_USER` role.
`permissions`	Object	Permissions assigned to the client.
`permissionsByService`	Object	Permissions assigned to the client, grouped by service.
`createdBy`	String	User who created the client.
`updatedBy`	String	User who last updated the client.
`createdDate`	Number	Date and time when the client was created, represented as an epoch timestamp in milliseconds.
`updatedDate`	Number	Date and time when the client was last updated, represented as an epoch timestamp in milliseconds.

Unify and manage your data