AXIAM PHP SDK

__construct()

Constructs a OidcPolicy.

Parameters

$sensitiveScopesEnabled : bool

Whether address and phone may be registered on a client, requested at the authorization endpoint, and released at UserInfo (X7 G8). Off unless an organization turns it on. The two scopes release a postal address and a telephone number — categories of personal data AXIAM has no other use for — so the deployment that has never thought about them releases nothing, and the operator who has thought about them says so once, at the organization level, where the lawful basis for holding the data was decided. The switch is a capability, not a grant: with it on, a client still has to register the scope, the request still has to ask for it, and the user still has to have consented. It is the first of four gates, and it is the only one an operator can close for everybody at once.

$cimd : CimdPolicy|null = null

T21.5 — whether a URL-shaped client_id is resolved by fetching the document it names, and on what terms. See [CimdPolicy]; off unless somebody turns it on (I1). Nested, and therefore inherited or overridden whole: the fields are terms of one decision, and a half-merged posture is one neither the organization nor the tenant wrote. (optional)

$dcrAllowedRedirectHosts : array<int, string>|null = null

T21.4 — hosts a self-registered client's redirect_uris may point at, as globs (*.example.com, or * for any). The loopback hosts (127.0.0.1, [::1], localhost) are always allowed whatever this says, because RFC 8252 §7.3 is how every desktop MCP client receives its callback and a tenant that forbade them would have turned registration on for nobody. (optional)

$dcrAllowedScopes : array<int, string>|null = null

T21.4 — the scopes a self-registered client may ask for. A scope a registration names that is not on this list is invalid_client_metadata; an empty list means a self-registered client gets no scopes at all, which is the honest default for a tenant that has turned registration on without deciding what it grants. May not contain address or phone — see this module's [sensitive_scope_in_dcr_list]. (optional)

$dcrMaxClients : int|null = null

T21.4 — how many externally registered clients this tenant may hold. See [DEFAULT_DCR_MAX_CLIENTS]. Counted once per mechanism, against the same number (T21.8): managed_by: dcr rows and managed_by: cimd rows each have this many. So a tenant running both cannot have shadow rows materialised from documents exhaust the allowance for self-registration, or the reverse. The CIMD count is checked before* the document is fetched, so a tenant at its ceiling is not an outbound amplifier either. It keeps its dcr_ name because dynamic registration defined it, on the same precedent as [Self::dcr_allowed_scopes]. (optional)

$dcrUnusedClientTtlDays : int|null = null

T21.4 — how long an externally registered client survives without being used. See [DEFAULT_DCR_UNUSED_CLIENT_TTL_DAYS]. 0 disables the sweep for this tenant, which an operator who prunes out of band may legitimately want. Two sweeps read it, over different clocks (T21.8). A managed_by: dcr row is measured from its last authorization, falling back to when it was registered. A managed_by: cimd row is measured from the last time its document was presented, which every authorize, token and PAR request moves — so a document in daily use is never swept however old its registration is, and one nobody has presented since the window is, and re-materialises on the next request if it is still published. Like the ceiling, it keeps its dcr_ name. (optional)

$defaultLocale : string|null = null

The BCP 47 tag the sign-in page falls back to when the relying party's ui_locales selects nothing (W5's chain, plan §4.6). None means "no tenant preference", which lands on the deployment default (en) — the behaviour every deployment had before this field existed. A tag this build does not ship also lands there: the parse is exact rather than a language lookup, so a stored fr-CA reads as "somebody wrote something this binary does not ship" rather than as a guess at French. Stored as a string rather than as the Locale enum because that enum lives in axiam-oauth2, four layers above this crate, and the crate layering points inward. (optional)

$dynamicRegistration : string|null = null

T21.4 — whether a client may register itself (RFC 7591), and on what terms. disabled unless somebody says otherwise (I1). (optional)

$externalClientAllowedResources : array<int, string>|null = null

D3 — the audiences an externally registered client may address. The single most important field on this policy, and the reason the settings handler refuses dynamic_registration: anonymous while it is empty. A client an unrelated party registered cannot declare its own allowed_resources; it inherits this list verbatim, so what a stranger can mint a token for* is a decision the tenant took in advance rather than one the registration request makes. Empty means an externally registered client can obtain only today's axiam:user tokens — which AXIAM's own APIs accept. That is why the interlock exists: the empty list is not a safe default for an open registration endpoint, it is the most dangerous one. Shared with T5 (CIMD), which inherits the same list for the same reason. (optional)

$samlIdpEnabled : bool|null = null

G-2 / D-20 — whether this tenant may act as a SAML 2.0 identity provider: publish IdP metadata and accept AuthnRequests on /saml/v2/{tenant}/{metadata,sso,slo}. Off unless an organization turns it on. A SAML IdP issues assertions that other systems accept as proof of identity, so a deployment that has never decided to be one issues none, and the three endpoints answer 404 as if they did not exist. The switch lives on this policy, beside the other OpenID Provider surface controls, because the SSO endpoint is the same browser login hop and OP session with a different wire format. Disable-only, with the shape of [Self::sensitive_scopes_enabled]: a tenant may turn its organization's true off but never its false on, because the decision to issue identity assertions on behalf of the organization's tenants is the organization's. A deployment built without the saml feature answers 404 whatever this says; the setting is a capability, not a grant (each SP must still be registered, and allow_idp_initiated is its own opt-in). (optional)

$ssfEnabled : bool|null = null

G-5 / D-45 — whether the tenant is a Shared Signals Framework transmitter: its /.well-known/ssf-configuration is served, its receivers can use the stream management API, and events are signed and transmitted on its streams. Default false. Disable-only, with the shape of [Self::saml_idp_enabled]: sending security events about the organization's users to third parties is the organization's decision. Streams can be registered while it is off; they carry nothing until it is on. (optional)

$ssfInactiveReason : string|null = null

Read-only, D-55: set on a settings response when ssf_enabled is on but the transmitter is inactive anyway, saying why — the deployment holds more than one tenant and serves no per-tenant issuers. Never stored. (optional)

jsonSerialize()

Renders this object for `json_encode()`.

toArray()

Renders this object back to its wire form.