The RFC 9068 JWT access token's lifetime. Default 900.
maximum: 3600, minimum: 300
applicationTypeweborspaornativerequired
web is confidential; spa and native are public clients that must use PKCE (S256). Can't change.
backchannelLogoutUristring | nullrequired
A public https URL that receives OpenID Connect back-channel logout tokens, through hardened egress.
format: uri
clientIdstringrequired
clientSecretsarray ofobject{ … }required
Live client secrets' metadata, oldest first. Never a secret.
5 properties
createdAtstringrequired
format: date-time
createdByobject{ … }required
2 properties
idstringrequired
typestringrequired
idstringrequired
format: uuid
lastUsedAtstring | nullrequired
format: date-time
prefixstringrequired
The first 13 characters (ezgh_scs_ and four more).
groupsClaimassignedorallrequired
With the groups scope: the user's groups that are assigned to this application (the default), or all of them.
idTokenSignedResponseAlgRS256orES256required
Signs the ID token and the access token. Default RS256.
initiateLoginUristring | nullrequired
https; the portal tile opens it with ?iss= (OpenID Connect third-party-initiated login).
format: uri
issuerstringrequired
format: uri
jwksobject | nullrequired
The client's public keys by value, a JWK set ({ keys: [...] }), for private_key_jwt. 1–10 RSA (2048+ bits) or EC (P-256/384/521) signing keys, a kid on each when there are several.
jwksFetchErrorstring | nullrequired
jwksFetchedAtstring | nullrequired
format: date-time
jwksUristring | nullrequired
A public https URL of the client's JWK set, for private_key_jwt; fetched through hardened egress and stored.
format: uri
postLogoutRedirectUrisarray ofstringrequired
format: uri
redirectUrisarray ofstringrequired
Exact URIs. https, or http on loopback; a native application may use a reverse-domain private scheme, and its loopback IP redirects match any port (RFC 8252).
