AXIAM PHP SDK

OAuth2ClientResponse
in package
implements JsonSerializable

FinalYes

OAuth2 client response -- omits client_secret_hash.

Table of Contents

Interfaces

JsonSerializable

Properties

$allowedResources  : array<string|int, mixed>
$authnRequestParams  : AuthnRequestParamsMode
$backchannelAuthenticationRequestSigningAlg  : CibaRequestSigningAlg|null
$backchannelClientNotificationEndpoint  : string|null
$backchannelTokenDeliveryMode  : CibaDeliveryMode|null
$browserSso  : bool
$clientId  : string
$createdAt  : string
$dpopBoundAccessTokens  : bool
$dpopRequireNonce  : bool
$grantTypes  : array<string|int, mixed>
$id  : string
$jwks  : string|null
$jwksUri  : string|null
$lastAuthorizedAt  : string|null
$managedBy  : ManagedBy
$name  : string
$profile  : ClientProfile
$redirectUris  : array<string|int, mixed>
$requirePar  : bool
$scopes  : array<string|int, mixed>
$selfSignedTlsClientAuthThumbprints  : array<string|int, mixed>
$tenantId  : string
$tlsClientAuthSanDns  : string|null
$tlsClientAuthSanUri  : string|null
$tlsClientAuthSubjectDn  : string|null
$tlsClientCertificateBoundAccessTokens  : bool
$tokenEndpointAuthMethod  : ClientAuthMethod
$updatedAt  : string

Methods

__construct()  : mixed
Constructs a OAuth2ClientResponse.
fromArray()  : self
Rebuilds a OAuth2ClientResponse from one decoded JSON object.
jsonSerialize()  : array<string, mixed>
Renders this object for `json_encode()`.
toArray()  : array<string, mixed>
Renders this object back to its wire form.
unknownEnumValue()  : string|null
The string the server sent for an open-enum member this SDK has no name for, or `null`.

Properties

$backchannelClientNotificationEndpoint read-only

public string|null $backchannelClientNotificationEndpoint = null

$selfSignedTlsClientAuthThumbprints read-only

public array<string|int, mixed> $selfSignedTlsClientAuthThumbprints

$tlsClientCertificateBoundAccessTokens read-only

public bool $tlsClientCertificateBoundAccessTokens

Methods

__construct()

Constructs a OAuth2ClientResponse.

public __construct(array<int, string> $allowedResources, AuthnRequestParamsMode $authnRequestParams, bool $browserSso, string $clientId, string $createdAt, bool $dpopBoundAccessTokens, bool $dpopRequireNonce, array<int, string> $grantTypes, string $id, ManagedBy $managedBy, string $name, ClientProfile $profile, array<int, string> $redirectUris, bool $requirePar, array<int, string> $scopes, array<int, string> $selfSignedTlsClientAuthThumbprints, string $tenantId, bool $tlsClientCertificateBoundAccessTokens, ClientAuthMethod $tokenEndpointAuthMethod, string $updatedAt[, CibaRequestSigningAlg|null $backchannelAuthenticationRequestSigningAlg = null ][, string|null $backchannelClientNotificationEndpoint = null ][, CibaDeliveryMode|null $backchannelTokenDeliveryMode = null ][, string|null $jwks = null ][, string|null $jwksUri = null ][, string|null $lastAuthorizedAt = null ][, string|null $tlsClientAuthSanDns = null ][, string|null $tlsClientAuthSanUri = null ][, string|null $tlsClientAuthSubjectDn = null ]) : mixed
Parameters
$allowedResources : array<int, string>

T21.3 — echoed in its stored, normalised form, so an operator auditing which audiences a client may mint tokens for reads the strings the server actually compares rather than the ones they typed.

$authnRequestParams : AuthnRequestParamsMode

X7.1 — echoed so an operator can audit which clients act on the OIDC authentication-request parameters, from this endpoint rather than from the database.

$browserSso : bool

X7.3 — echoed for the same reason.

$clientId : string

the server's client_id field

$createdAt : string

the server's created_at field

$dpopBoundAccessTokens : bool

the server's dpop_bound_access_tokens field

$dpopRequireNonce : bool

the server's dpop_require_nonce field

$grantTypes : array<int, string>

the server's grant_types field

$id : string

the server's id field

$managedBy : ManagedBy

T21.4 / D5 — who created this registration: admin, dcr or cimd. Echoed because an operator auditing a tenant needs to answer "which of these did we create?" from this endpoint rather than from the database, and because three behaviours hang off it: a non-admin client may never carry the FAPI profile, is always consent-gated, and is the only kind the unused-client sweeper touches. Read-only. There is no corresponding member on the update DTO: a registration's provenance is a fact about how it came to exist, and a field that could be edited to admin would be a field that launders one.

$name : string

the server's name field

$profile : ClientProfile

X5.1 — the registered posture and mTLS credentials. Read-back matters: an operator auditing which clients are financial-grade should be able to answer it from this endpoint rather than from the database.

$redirectUris : array<int, string>

the server's redirect_uris field

$requirePar : bool

the server's require_par field

$scopes : array<int, string>

the server's scopes field

$selfSignedTlsClientAuthThumbprints : array<int, string>

the server's self_signed_tls_client_auth_thumbprints field

$tenantId : string

the server's tenant_id field

$tlsClientCertificateBoundAccessTokens : bool

the server's tls_client_certificate_bound_access_tokens field

$tokenEndpointAuthMethod : ClientAuthMethod

the server's token_endpoint_auth_method field

$updatedAt : string

the server's updated_at field

$backchannelAuthenticationRequestSigningAlg : CibaRequestSigningAlg|null = null

the server's backchannel_authentication_request_signing_alg field (optional)

$backchannelClientNotificationEndpoint : string|null = null

G-7 — the ping-mode notification endpoint. (optional)

$backchannelTokenDeliveryMode : CibaDeliveryMode|null = null

the server's backchannel_token_delivery_mode field (optional)

$jwks : string|null = null

X5.1 — echoed so an operator can confirm which key source is registered. The document itself is public key material, so returning it leaks nothing; a jwks_uri is likewise public by construction. (optional)

$jwksUri : string|null = null

the server's jwks_uri field (optional)

$lastAuthorizedAt : string|null = null

T21.4 — when this client was last issued an authorization code, for the sweeper that deletes self-registered clients nobody uses. Always absent for an admin client: the stamp is written only for a non-admin one, so that an administrator's client takes exactly the path it took before T21.4 (I1). null on a self-registered client means it has never been authorized, and the sweeper reads created_at instead. (optional)

$tlsClientAuthSanDns : string|null = null

the server's tls_client_auth_san_dns field (optional)

$tlsClientAuthSanUri : string|null = null

the server's tls_client_auth_san_uri field (optional)

$tlsClientAuthSubjectDn : string|null = null

the server's tls_client_auth_subject_dn field (optional)

fromArray()

Rebuilds a OAuth2ClientResponse from one decoded JSON object.

public static fromArray(array<string, mixed> $data) : self
Parameters
$data : array<string, mixed>

The raw wire object.

Return values
self

jsonSerialize()

Renders this object for `json_encode()`.

public jsonSerialize() : array<string, mixed>

Any Sensitive it carries stays WRAPPED here, so a log line or a json_encode($model) in application code prints [SENSITIVE]. The one place a secret is revealed is ManagementTransport, on the way to the wire and nowhere else (§27.5).

Rendering for a log line never fails: an unknown union arm renders its discriminator and an unrecognised enum value its empty Unknown spelling here, and only self::toArray() -- the request path -- refuses to send it (CONTRACT.md §31.2, §34.2 P12.2).

Return values
array<string, mixed>

toArray()

Renders this object back to its wire form.

public toArray() : array<string, mixed>

§27.4 rule 5: a null property is OMITTED, not emitted as null. On a sparse update those two say opposite things — "leave this alone" versus "set this to nothing" — and only omission means the first.

Return values
array<string, mixed>

unknownEnumValue()

The string the server sent for an open-enum member this SDK has no name for, or `null`.

public unknownEnumValue(string $wire) : string|null

Only a model decoded by self::fromArray() knows it, and only for a member that decoded to Unknown (CONTRACT.md §27.6.2 item 4, §34.8 (c)): it lets a refusal name the value. It is for messages -- it is never rendered by self::toArray() or self::jsonSerialize() and so is never sent.

Parameters
$wire : string

The member's wire name.

Return values
string|null
On this page

Search results