Skip to content
Subako Docs
English
English日本語Not translated
Esc
↑↓navigate↵open⌘Jpreview

Create an OAuth client

Registers a client you created at a provider, for connecting vault credentials through it: an http credential always, and an mcp one whose server registers no client on the spot. The provider must send the browser back to the page that starts each connection, so register that page’s URL with the provider as a redirect URI. The secret is sealed on the way in and is never returned by any route.

POST/v1/oauth-clients
Authorization
AuthorizationBearer token · headerrequired
Header parameters
Idempotency-Keystring
Retry the same operation with this key to return its saved receipt. Scoped by the operation's authenticated caller or resource. A different input under the same key returns 409. Receipts are retained for at least 7 days after completion, then removed by an hourly sweep. After removal the key can execute again. Fresh-only secrets are never included in a replay.
min length 1 · max length 255
Kikuvi-Workspacestring<uuid>
Workspace to create in. Required for a user caller; implied by the key for an API key caller.
Request body
requiredapplication/json
authorization_endpointstringrequired
The provider's authorization endpoint (RFC 6749 §3.1), which the browser is sent to. A query is kept; a fragment is refused.
min length 1 · max length 2048
authorization_paramsAuthorizationParamBody[]
Appended to the authorization URL in order, each name at most once.
max items 16
Show properties
Array of AuthorizationParamBody
namestringrequired
Letters, digits, and `-._~`; none Subako sets itself (`response_type`, `client_id`, `redirect_uri`, `state`, `code_challenge`, `code_challenge_method`, `scope`, `resource`).
min length 1 · max length 64
valuestringrequired
max length 512
client_idstringrequired
The client identifier the provider issued.
min length 1 · max length 512
display_namestringrequired
max length 200
scopesOAuthScopeBody[]
Each at most once, joined by spaces into the `scope` parameter. Empty asks for none, leaving the provider's default.
max items 64
token_endpointstringrequired
The provider's token endpoint (RFC 6749 §3.2), which Subako redeems codes and refreshes tokens at.
min length 1 · max length 2048
token_endpoint_authTokenEndpointAuthBodyrequired
How Subako authenticates at the provider's token endpoint as this client (RFC 7591 §2): `none` for a public client, which PKCE alone proves, or the client secret in the form or in a `Basic` header.
Show properties
One of:
object
methodstringrequired
Allowed:none
object
client_secretstringrequired
min length 1 · max length 1024
methodstringrequired
Allowed:client_secret_post
object
client_secretstringrequired
min length 1 · max length 1024
methodstringrequired
Allowed:client_secret_basic
Responses
201Created.
idstring<uuid>required
400Malformed body, a field outside its bound, an endpoint the deployment's network policy does not reach, a malformed workspace header, or a user caller with no workspace header.
errorErrorDetailrequired
What went wrong: a `code` to branch on and a `message` to show. The message is written for a person and may change; the code will not.
Show properties
codeErrorCoderequired
The machine-readable half of an error response, and the field a client branches on. Closed: every error carries exactly one of these.
Allowed:unauthorizedforbiddennot_foundinvalid_requestconflictclient_outdatedprecondition_failedtoo_many_requestsinternal
messagestringrequired
401Missing, malformed, or invalid bearer token.
errorErrorDetailrequired
What went wrong: a `code` to branch on and a `message` to show. The message is written for a person and may change; the code will not.
Show properties
codeErrorCoderequired
The machine-readable half of an error response, and the field a client branches on. Closed: every error carries exactly one of these.
Allowed:unauthorizedforbiddennot_foundinvalid_requestconflictclient_outdatedprecondition_failedtoo_many_requestsinternal
messagestringrequired
403Caller lacks vault.manage, the organization may not create, or an API key's Kikuvi-Workspace header names another workspace.
errorErrorDetailrequired
What went wrong: a `code` to branch on and a `message` to show. The message is written for a person and may change; the code will not.
Show properties
codeErrorCoderequired
The machine-readable half of an error response, and the field a client branches on. Closed: every error carries exactly one of these.
Allowed:unauthorizedforbiddennot_foundinvalid_requestconflictclient_outdatedprecondition_failedtoo_many_requestsinternal
messagestringrequired
404No such workspace, or the caller cannot see it.
errorErrorDetailrequired
What went wrong: a `code` to branch on and a `message` to show. The message is written for a person and may change; the code will not.
Show properties
codeErrorCoderequired
The machine-readable half of an error response, and the field a client branches on. Closed: every error carries exactly one of these.
Allowed:unauthorizedforbiddennot_foundinvalid_requestconflictclient_outdatedprecondition_failedtoo_many_requestsinternal
messagestringrequired
409Idempotency-Key was already used for a different request.
errorErrorDetailrequired
What went wrong: a `code` to branch on and a `message` to show. The message is written for a person and may change; the code will not.
Show properties
codeErrorCoderequired
The machine-readable half of an error response, and the field a client branches on. Closed: every error carries exactly one of these.
Allowed:unauthorizedforbiddennot_foundinvalid_requestconflictclient_outdatedprecondition_failedtoo_many_requestsinternal
messagestringrequired
Try it
Server
Authorization
Parameters
Bodyapplication/json
Request
curl -X POST "https://api.us.cloud.subako.ai/v1/oauth-clients" \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
  "authorization_endpoint": "string",
  "authorization_params": [
    {
      "name": "string",
      "value": "string"
    }
  ],
  "client_id": "string",
  "display_name": "string",
  "scopes": [
    "string"
  ],
  "token_endpoint": "string",
  "token_endpoint_auth": {
    "method": "none"
  }
}'
Response
{
  "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08"
}