{
    "$schema": "http://json-schema.org/draft-04/schema#",
    "id": "http://localhost:3000/schemas/post-client-response.json#",
    "title": "Response returned after the client has been successfully created",
    "type": "object",
    "additionalProperties": false,
    "required": [
        "client_id",
        "client_secret_expires_at"
    ],
    "properties": {
        "client_id": {
            "type": "string",
            "description": "REQUIRED.  OAuth 2.0 client identifier. It SHOULD NOT be currently valid for any other registered client, though an Authorization Server MAY issue the same client identifier to multiple instances of a registered client, at its discretion."
        },
        "client_secret": {
            "type": "string",
            "description": "OPTIONAL.  OAuth 2.0 client secret.  If issued, this MUST be unique for each \"client_id\".  This value is used by confidential clients to authenticate to the token endpoint as described in OAuth 2.0 [RFC6749] Section 2.3.1."
        },
        "client_id_issued_at": {
            "type": "string",
            "description": "OPTIONAL.  Time at which the client identifier was issued. The time is represented as the number of seconds from 1970-01- 01T0:0:0Z as measured in UTC until the date/time."
        },
        "registration_access_token": {
            "type": "string",
            "description": "Registration Access Token that can be used at the Client Configuration Endpoint to perform subsequent operations upon the Client registration."
        },
        "registration_client_uri": {
            "type": "string",
            "description": "Location of the Client Configuration Endpoint where the Registration Access Token can be used to perform subsequent operations upon the resulting Client registration. Implementations MUST either return both a Client Configuration Endpoint and a Registration Access Token or neither of them."
        },
        "client_secret_expires_at": {
            "type": "string",
            "default": 0,
            "description": "REQUIRED if \"client_secret\" is issued.  Time at which the client secret will expire or 0 if it will not expire.  The time is represented as the number of seconds from 1970-01-01T0:0:0Z as measured in UTC until the date/time."
        },
        "client_uri": {
            "type": "string",
            "description": "URL of a Web page providing information about the client. If present, the server SHOULD display this URL to the end user in a clickable fashion.  It is RECOMMENDED that clients always send this field.  The value of this field MUST point to a valid web page.  The value of this field MAY be internationalized, as described in Section 2.2."
        },
        "grant_types": {
            "type": "array",
            "description": "Array of OAuth 2.0 grant types that the client may use",
            "items": {
                "type": "string",
                "enum": [
                    "authorization_code",
                    "implicit",
                    "password",
                    "client_credentials",
                    "refresh_token",
                    "urn:ietf:params:oauth:grant-type:jwt-bearer",
                    "urn:ietf:params:oauth:grant-type:saml2-bearer"
                ]
            }
        },
        "responses_types": {
            "type": "array",
            "enum": [
                "code",
                "token"
            ],
            "description": "Array of the OAuth 2.0 response types that the client may use"
        },
        "client_name": {
            "type": "string",
            "description": "Human-readable name of the client to be presented to the user during authorization.  If omitted, the authorization server MAY display the raw \"client_id\" value to the user instead.  It is RECOMMENDED that clients always send this field.  The value of this field MAY be internationalized, as described in Section 2.2."
        },
        "contacts": {
            "type": "array",
            "items": {
                "type": "string"
            },
            "description": "Array of strings representing ways to contact people responsible for this client, typically email addresses.  The authorization server MAY make these addresses available to end users for support requests for the client."
        },
        "logo_uri": {
            "type": "string",
            "description": "URL that references a logo for the client. If present, the server SHOULD display this image to the end user during approval.  The value of this field MUST point to a valid image file.  The value of this field MAY be internationalized, as described in Section 2.2."
        },
        "tos_uri": {
            "type": "string",
            "description": "URL that points to a human-readable Terms of Service document for the client. The Authorization Server SHOULD display this URL to the end-user if it is given. The Terms of Service usually describe a contractual relationship between the end-user and the client that the end-user accepts when authorizing the client.  The value of this field MUST point to a valid web page.  The value of this field MAY be internationalized, as described in Section 2.2."
        },
        "policy_uri": {
            "type": "string",
            "description": "URL that points to a human-readable Policy document for the client. The authorization server SHOULD display this URL to the end-user if it is given.  The policy usually describes how an end-user's data will be used by the client.  The value of this field MUST point to a valid web page. The value of this field MAY be internationalized, as described in Section 2.2."
        },
        "redirect_uris": {
            "type": "array",
            "items": {
                "type": "string"
            },
            "description": "Array of redirect URIs for use in redirect-based flows such as the authorization code and implicit grant types.  It is RECOMMENDED that clients using these flows register this parameter, and an authorization server SHOULD require registration of valid redirect URIs for all clients that use these grant types to protect against token and credential theft attacks."
        },
        "application_type": {
            "type": "string",
            "enum": [
                "native",
                "web"
            ]
        },
        "token_endpoint_auth_method": {
            "type": "string",
            "description": "The requested authentication method for the token endpoint",
            "description_none": "The client is a public client as defined in OAuth 2.0 and does not have a client secret.",
            "description_client_secret_post": "The client uses the HTTP POST parameters defined in OAuth 2.0",
            "description_client_secret_basic": "the client uses HTTP Basic defined in OAuth 2.0",
            "enum": [
                "none",
                "client_secret_post",
                "client_secret_basic"
            ]
        },
        "scope": {
            "type": "array",
            "items": {
                "type": "string"
            },
            "description": "Space separated list of scope values (as described in Section 3.3 of OAuth 2.0 [RFC6749]) that the client can use when requesting access tokens.  The semantics of values in this list is service specific.  If omitted, an authorization server MAY register a client with a default set of scopes."
        },
        "jwks_uri": {
            "type": "string",
            "description": "URL of the client's JSON Web Key Set [JWK] document containing the client's public keys. The value of this field MUST point to a valid JWK Set document.  These keys can be used by higher level protocols that use signing or encryption."
        },
        "jwks": {
            "type": "string",
            "description": "JSON Web Key Set [JWK] value containing the client's public keys. The value of this field MUST be a JSON object containing a valid JWK Set. These keys can be used by higher level protocols that use signing or encryption.  This parameter is intended to be used by clients that cannot use the \"jwks_uri\" parameter.  For instance, a native application might not have a location to host the contents of the JWK Set that would be reachable by the authorization server.  The \"jwks_uri\" and \"jwks\" parameters MUST NOT be used together."
        },
        "software_id": {
            "type": "string",
            "description": "Identifier for the software that comprises a client. Unlike \"client_id\", which is issued by the authorization server and may vary between instances, the \"software_id\" is asserted by the client software and is intended to be shared among all instances of the client software. The identifier SHOULD NOT change when software version changes or when a new installation occurs."
        },
        "software_version": {
            "type": "string",
            "description": "Version identifier for the software that comprises a client. The value of this field is a string that is intended to be compared using string equality matching.  The value of the \"software_version\" SHOULD change on any update to the client software."
        }
    }
}