AXIAM PHP SDK

__construct()

Constructs a CreateOAuth2ClientRequest.

Parameters

$grantTypes : array<int, string>

Grant types this client is authorized to use.

$name : string

Human-readable name for the client.

$redirectUris : array<int, string>

Allowed redirect URIs (must be HTTPS, except localhost for dev). SEC-089 / T21.3: this list also authorises token-exchange audiences, and that coupling is now deprecated — allowed_resources is the field that means "audiences this client may address". The redirect-URI branch survives one release so that no deployment's working exchange breaks on upgrade, and it logs a deprecation warning when it is the branch that matched. Register exchange targets in allowed_resources (see docs/api/token-exchange.md#audience).

$scopes : array<int, string>

Scopes the client may request.

$allowedResources : array<int, string>|null = null

T21.3 / RFC 8707 — the target services this client may name in a resource parameter, at /oauth2/authorize, /oauth2/par, /oauth2/device_authorization and /oauth2/token. Each entry must be an absolute URI without a fragment (RFC 8707 §2). Entries are stored in their RFC 3986 §6.2.2 normalised form, which is what the read-back shows and what every comparison uses; matching is by equivalence and never by prefix. Empty (the default) means the client may name no resource, so every token it obtains carries axiam:user or axiam:m2m exactly as before RFC 8707 support existed. This is also the list the RFC 8693 token exchange consults for its audience/resource target. (optional)

$authnRequestParams : AuthnRequestParamsMode|null = null

X7.1 — whether this client's authorization requests may carry the OpenID Connect authentication-request parameters (prompt, max_age, acr_values, claims, id_token_hint, login_hint, display, ui_locales, claims_locales). "ignore" (the default) is what every AXIAM client has always done: they are dropped and reach no decision. "honour" opts in, and is refused on a fapi2 client* at both this gate and the authorization endpoint — the two are different answers to the same question about what a request from this client means. (optional)

$backchannelAuthenticationRequestSigningAlg : string|null = null

G-7 — CIBA Core §4: PS256, ES256 or EdDSA. When set, every backchannel authentication request must be a signed request JWT under this algorithm, verified against jwks or jwks_uri (exactly one is required; an inline jwks must hold a key of the algorithm). Required for a fapi2 client holding the CIBA grant. (optional)

$backchannelClientNotificationEndpoint : string|null = null

G-7 — CIBA Core §4: where a ping-mode client is notified. Required in ping mode and refused in poll mode; an absolute https URL held to the webhook address policy (no credentials, no fragment, no private, loopback or internal host). (optional)

$backchannelLogoutUri : string|null = null

B5 — where OIDC back-channel logout tokens are delivered. Omit for a client that does not participate. Must be an absolute https URL with no credentials and no fragment, naming a public host: an IP literal that is loopback, private, link-local or the cloud metadata address, and the names localhost, *.localhost, *.local and *.internal, are refused with 400. Delivery is one request that does not follow redirects, and a name that resolves to a non-public address is refused when it is sent. (optional)

$backchannelTokenDeliveryMode : string|null = null

G-7 — CIBA Core §4 backchannel_token_delivery_mode: poll or ping. Required when grant_types holds urn:openid:params:grant-type:ciba, refused otherwise; push is not offered. A CIBA client must be confidential; a fapi2 one must also register backchannel_authentication_request_signing_alg. (optional)

$backchannelUserCodeParameter : bool|null = null

G-7 — CIBA Core §4. true is refused*: this server holds no user code to verify. (optional)

$browserSso : bool|null = null

X7.3 — whether an unauthenticated authorization request from this client may be answered with a redirect to the login page rather than the 401 AXIAM answers today. Accepted and stored, but nothing reads it yet: the login hop it gates is a later wave. Unlike authn_request_params it is permitted on a fapi2 client, because it relaxes nothing — it decides only how an anonymous browser is answered. (optional)

$dpopBoundAccessTokens : bool|null = null

RFC 9449 §5.2 — issue DPoP-bound (sender-constrained) access tokens to this client. Independent of both the authentication method and tls_client_certificate_bound_access_tokens; a client may ask for both constraints, and a token carrying both must satisfy both. (optional)

$dpopRequireNonce : bool|null = null

RFC 9449 §8 — require this client's DPoP proofs to carry a server-issued nonce. Not implemented in this build (SEC-097). true is refused with 400; only false (the default) is accepted. Nothing reads the stored value, so accepting true would persist and echo back a security switch that does nothing. DPoP proofs are made single-use at the token endpoint by jti replay detection instead — see docs/security-profiles.md. (optional)

$jwks : string|null = null

RFC 7591 §2 — the client's public key set, inline, for private_key_jwt. Exactly one of jwks and jwks_uri may be set. (optional)

$jwksUri : string|null = null

RFC 7591 §2 — where the client publishes its public key set. Must be an absolute https URL, and is fetched through the SSRF-guarded JWKS cache, which refuses private and loopback addresses. (optional)

$postLogoutRedirectUris : array<int, string>|null = null

B5 — allow-list for RP-initiated logout's post_logout_redirect_uri. Separate from redirect_uris on purpose: that list receives authorization codes, this one receives a browser after logout. (optional)

$profile : ClientProfile|null = null

X5.1 — the security posture this client is registered under. "standard" (the default) is every AXIAM client that has ever existed. "fapi2" turns on the whole FAPI 2.0 constraint bundle at once, and the registration is refused unless it also sets require_par, a strong token_endpoint_auth_method (either mTLS method or private_key_jwt), and at least one sender-constraining mechanism (tls_client_certificate_bound_access_tokens or dpop_bound_access_tokens). See the FAPI operator guide. (optional)

$requirePar : bool|null = null

B5 — require this client to push its authorization parameters to /oauth2/par (RFC 9126) rather than sending them through the browser. (optional)

$selfSignedTlsClientAuthThumbprints : array<int, string>|null = null

Accepted certificate thumbprints for self_signed_tls_client_auth, as base64url-unpadded SHA-256 digests of the DER certificate (the same x5t#S256 encoding as the cnf claim). More than one permits an overlapping rotation. (optional)

$tlsClientAuthSanDns : string|null = null

RFC 8705 §2.1.2 — expected dNSName SAN. (optional)

$tlsClientAuthSanUri : string|null = null

RFC 8705 §2.1.2 — expected uniformResourceIdentifier SAN. (optional)

$tlsClientAuthSubjectDn : string|null = null

RFC 8705 §2.1.2 — expected certificate subject DN, RFC 4514 form. Exactly one of the three tls_client_auth_* parameters may be set. (optional)

$tlsClientCertificateBoundAccessTokens : bool|null = null

RFC 8705 §3.4 — issue certificate-bound (sender-constrained) access tokens to this client. Independent of the authentication method. (optional)

$tokenEndpointAuthMethod : ClientAuthMethod|null = null

X5.1 — how this client authenticates at the token endpoint (RFC 8705 §2). Defaults to client_secret_post. (optional)

jsonSerialize()

Renders this object for `json_encode()`.

toArray()

Renders this object back to its wire form.

unknownEnumValue()

The string the server sent for an open-enum member this SDK has no name for, or `null`.

Parameters

$wire : string

The member's wire name.