#### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index')
### [Abblix\.Oidc\.Server\.Model](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model 'Abblix\.Oidc\.Server\.Model')

## ClientRegistrationRequest Class

Represents metadata for an OAuth2 client based on the OpenID Connect discovery specification\.

```csharp
public record ClientRegistrationRequest : System.IEquatable<Abblix.Oidc.Server.Model.ClientRegistrationRequest>
```

Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → ClientRegistrationRequest

Implements [System\.IEquatable&lt;](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[ClientRegistrationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.ClientRegistrationRequest 'Abblix\.Oidc\.Server\.Model\.ClientRegistrationRequest')[&gt;](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')

### Remarks
See the OpenID Connect Registration specification at https://openid.net/specs/openid-connect-registration-1\_0.html.
### Properties

## ClientRegistrationRequest\.ApplicationType Property {#Abblix.Oidc.Server.Model.ClientRegistrationRequest.ApplicationType}

The `application_type` declared at registration \(OIDC Dynamic Client Registration §2\),
typically `web` or `native`\. Influences allowed redirect URI schemes and other policy\.

```csharp
public string ApplicationType { get; init; }
```

#### Property Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

## ClientRegistrationRequest\.AuthorizationDetailsTypes Property {#Abblix.Oidc.Server.Model.ClientRegistrationRequest.AuthorizationDetailsTypes}

The `authorization_details_types` client metadata per RFC 9396 §5\.1: the per\-client
allowlist of authorization\-detail `type` values this client may use in RAR requests\.
Maps to [AuthorizationDetailsTypes](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.AuthorizationDetailsTypes 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo\.AuthorizationDetailsTypes')\.
`null` means no per\-client constraint; empty array means this client cannot use RAR\.

```csharp
public string[]? AuthorizationDetailsTypes { get; init; }
```

#### Property Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array')

## ClientRegistrationRequest\.AuthorizationEncryptedResponseAlg Property {#Abblix.Oidc.Server.Model.ClientRegistrationRequest.AuthorizationEncryptedResponseAlg}

The `authorization_encrypted_response_alg` \(JARM §3\): the JWE key\-management algorithm the OP must
use when encrypting authorization responses for this client\. When set, the signed response JWT is
additionally encrypted \(a Nested JWT\)\.

```csharp
public string? AuthorizationEncryptedResponseAlg { get; init; }
```

#### Property Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

### Remarks
Deliberately not constrained by a declarative value list: the permissible algorithms are
determined at runtime by the keyed signing/encryption registrations, so a static list
would misstate the host's actual capabilities\.

## ClientRegistrationRequest\.AuthorizationEncryptedResponseEnc Property {#Abblix.Oidc.Server.Model.ClientRegistrationRequest.AuthorizationEncryptedResponseEnc}

The `authorization_encrypted_response_enc` \(JARM §3\): the JWE content\-encryption algorithm paired
with [AuthorizationEncryptedResponseAlg](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.ClientRegistrationRequest#Abblix.Oidc.Server.Model.ClientRegistrationRequest.AuthorizationEncryptedResponseAlg 'Abblix\.Oidc\.Server\.Model\.ClientRegistrationRequest\.AuthorizationEncryptedResponseAlg') for authorization responses to this client\.
Defaults to `A128CBC-HS256` when the encryption algorithm is set\.

```csharp
public string? AuthorizationEncryptedResponseEnc { get; init; }
```

#### Property Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

### Remarks
Deliberately not constrained by a declarative value list: the permissible algorithms are
determined at runtime by the keyed signing/encryption registrations, so a static list
would misstate the host's actual capabilities\.

## ClientRegistrationRequest\.AuthorizationHeader Property {#Abblix.Oidc.Server.Model.ClientRegistrationRequest.AuthorizationHeader}

The Authorization header from the HTTP request, used for initial access token validation
per RFC 7591 Section 3\. This is a transport\-level property, not part of the registration metadata\.

```csharp
public System.Net.Http.Headers.AuthenticationHeaderValue? AuthorizationHeader { get; init; }
```

#### Property Value
[System\.Net\.Http\.Headers\.AuthenticationHeaderValue](https://learn.microsoft.com/en-us/dotnet/api/system.net.http.headers.authenticationheadervalue 'System\.Net\.Http\.Headers\.AuthenticationHeaderValue')

## ClientRegistrationRequest\.AuthorizationSignedResponseAlg Property {#Abblix.Oidc.Server.Model.ClientRegistrationRequest.AuthorizationSignedResponseAlg}

The `authorization_signed_response_alg` \(JARM §3\): the JWS algorithm the OP must use to sign
authorization responses packed into a JWT for this client\. Defaults to `RS256`; `none` is
not permitted\.

```csharp
public string? AuthorizationSignedResponseAlg { get; init; }
```

#### Property Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

### Remarks
Deliberately not constrained by a declarative value list: the permissible algorithms are
determined at runtime by the keyed signing/encryption registrations, so a static list
would misstate the host's actual capabilities\.

## ClientRegistrationRequest\.BackChannelAuthenticationRequestSigningAlg Property {#Abblix.Oidc.Server.Model.ClientRegistrationRequest.BackChannelAuthenticationRequestSigningAlg}

The signing algorithm used for backchannel authentication requests sent to this client\.

```csharp
public string? BackChannelAuthenticationRequestSigningAlg { get; init; }
```

#### Property Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

### Remarks
Deliberately not constrained by a declarative value list: the permissible algorithms are
determined at runtime by the keyed signing/encryption registrations, so a static list
would misstate the host's actual capabilities\.

## ClientRegistrationRequest\.BackChannelClientNotificationEndpoint Property {#Abblix.Oidc.Server.Model.ClientRegistrationRequest.BackChannelClientNotificationEndpoint}

The endpoint where backchannel client notifications are sent for this client\.

```csharp
public System.Uri? BackChannelClientNotificationEndpoint { get; init; }
```

#### Property Value
[System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri')

## ClientRegistrationRequest\.BackChannelLogoutSessionRequired Property {#Abblix.Oidc.Server.Model.ClientRegistrationRequest.BackChannelLogoutSessionRequired}

The `backchannel_logout_session_required` flag: when `true`, the OP must include the
`sid` claim in the back\-channel logout token so the client can identify the session being ended\.

```csharp
public System.Nullable<bool> BackChannelLogoutSessionRequired { get; init; }
```

#### Property Value
[System\.Nullable&lt;](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean')[&gt;](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')

## ClientRegistrationRequest\.BackChannelLogoutUri Property {#Abblix.Oidc.Server.Model.ClientRegistrationRequest.BackChannelLogoutUri}

The `backchannel_logout_uri` \(OIDC Back\-Channel Logout 1\.0\): an absolute URL at the client
that the OP calls server\-to\-server with a logout token to terminate the user's session at the client\.

```csharp
public System.Uri? BackChannelLogoutUri { get; init; }
```

#### Property Value
[System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri')

## ClientRegistrationRequest\.BackChannelTokenDeliveryMode Property {#Abblix.Oidc.Server.Model.ClientRegistrationRequest.BackChannelTokenDeliveryMode}

The backchannel token delivery mode to be used by this client\. This determines how tokens are delivered
during backchannel authentication\.

```csharp
public string? BackChannelTokenDeliveryMode { get; init; }
```

#### Property Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

## ClientRegistrationRequest\.BackChannelUserCodeParameter Property {#Abblix.Oidc.Server.Model.ClientRegistrationRequest.BackChannelUserCodeParameter}

Indicates whether the backchannel authentication process supports user codes for this client\.

```csharp
public bool BackChannelUserCodeParameter { get; init; }
```

#### Property Value
[System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean')

## ClientRegistrationRequest\.ClientId Property {#Abblix.Oidc.Server.Model.ClientRegistrationRequest.ClientId}

A client\-proposed `client_id`\. Servers MAY ignore this and assign their own identifier;
when accepted, the value is echoed back in the registration response\.

```csharp
public string? ClientId { get; init; }
```

#### Property Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

## ClientRegistrationRequest\.ClientName Property {#Abblix.Oidc.Server.Model.ClientRegistrationRequest.ClientName}

The `client_name` \(RFC 7591 §2\): a human\-readable display name for the client, shown to end\-users
on consent screens\.

```csharp
public string? ClientName { get; init; }
```

#### Property Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

## ClientRegistrationRequest\.ClientUri Property {#Abblix.Oidc.Server.Model.ClientRegistrationRequest.ClientUri}

The `client_uri`: an absolute URL of the client application's home page, shown to end\-users
alongside [ClientName](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.ClientRegistrationRequest#Abblix.Oidc.Server.Model.ClientRegistrationRequest.ClientName 'Abblix\.Oidc\.Server\.Model\.ClientRegistrationRequest\.ClientName')\.

```csharp
public System.Uri? ClientUri { get; init; }
```

#### Property Value
[System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri')

## ClientRegistrationRequest\.Contacts Property {#Abblix.Oidc.Server.Model.ClientRegistrationRequest.Contacts}

The `contacts` array \(RFC 7591 §2\): email addresses of people responsible for this client,
used for operational notifications by the authorization server\.

```csharp
public string[]? Contacts { get; init; }
```

#### Property Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array')

## ClientRegistrationRequest\.DefaultAcrValues Property {#Abblix.Oidc.Server.Model.ClientRegistrationRequest.DefaultAcrValues}

The `default_acr_values`: an ordered list of ACR values the OP should use as defaults for this
client when the authorization request omits `acr_values`\.

```csharp
public string[]? DefaultAcrValues { get; init; }
```

#### Property Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array')

## ClientRegistrationRequest\.DefaultMaxAge Property {#Abblix.Oidc.Server.Model.ClientRegistrationRequest.DefaultMaxAge}

The `default_max_age` \(OIDC Dynamic Client Registration §2\): the default maximum elapsed time
since the user's last authentication that the OP should honor for authorization requests from this
client\. Serialized as an integer number of seconds\.

```csharp
public System.Nullable<System.TimeSpan> DefaultMaxAge { get; init; }
```

#### Property Value
[System\.Nullable&lt;](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[System\.TimeSpan](https://learn.microsoft.com/en-us/dotnet/api/system.timespan 'System\.TimeSpan')[&gt;](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')

## ClientRegistrationRequest\.DpopBoundAccessTokens Property {#Abblix.Oidc.Server.Model.ClientRegistrationRequest.DpopBoundAccessTokens}

The `dpop_bound_access_tokens` client metadata per RFC 9449 §5\.2: when `true`,
access tokens issued to this client must be sender\-constrained via DPoP \(the server
will require a valid DPoP proof on every token request and bind `cnf.jkt` on
the issued token\)\. Maps to [RequireDPoP](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.RequireDPoP 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo\.RequireDPoP')\. When omitted, treated
as `false` per RFC 9449 §5\.2\.

```csharp
public System.Nullable<bool> DpopBoundAccessTokens { get; init; }
```

#### Property Value
[System\.Nullable&lt;](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean')[&gt;](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')

## ClientRegistrationRequest\.FrontChannelLogoutSessionRequired Property {#Abblix.Oidc.Server.Model.ClientRegistrationRequest.FrontChannelLogoutSessionRequired}

The `frontchannel_logout_session_required` flag: when `true`, the OP must append `iss`
and `sid` query parameters to [FrontChannelLogoutUri](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.ClientRegistrationRequest#Abblix.Oidc.Server.Model.ClientRegistrationRequest.FrontChannelLogoutUri 'Abblix\.Oidc\.Server\.Model\.ClientRegistrationRequest\.FrontChannelLogoutUri') so the client can target the
specific session being ended\.

```csharp
public System.Nullable<bool> FrontChannelLogoutSessionRequired { get; init; }
```

#### Property Value
[System\.Nullable&lt;](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean')[&gt;](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')

## ClientRegistrationRequest\.FrontChannelLogoutUri Property {#Abblix.Oidc.Server.Model.ClientRegistrationRequest.FrontChannelLogoutUri}

The `frontchannel_logout_uri` \(OIDC Front\-Channel Logout 1\.0\): an absolute URL the OP renders
in an iframe inside its logout page so the client can clear its own session in the user agent\.

```csharp
public System.Uri? FrontChannelLogoutUri { get; init; }
```

#### Property Value
[System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri')

## ClientRegistrationRequest\.GrantTypes Property {#Abblix.Oidc.Server.Model.ClientRegistrationRequest.GrantTypes}

The `grant_types` the client will request at the token endpoint per RFC 7591 §2,
for example `authorization_code`, `refresh_token`, or `urn:openid:params:grant-type:ciba`\.

```csharp
public string[] GrantTypes { get; init; }
```

#### Property Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array')

### Remarks
Deliberately not constrained by a declarative value list: grant handlers are an extensible
set, and the registration pipeline already validates every requested grant against the
union the server actually supports and advertises in its discovery document\.

## ClientRegistrationRequest\.IdTokenEncryptedResponseAlg Property {#Abblix.Oidc.Server.Model.ClientRegistrationRequest.IdTokenEncryptedResponseAlg}

The `id_token_encrypted_response_alg`: the JWE key\-management algorithm the OP must use when
encrypting ID Tokens for this client\.

```csharp
public string? IdTokenEncryptedResponseAlg { get; init; }
```

#### Property Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

### Remarks
Deliberately not constrained by a declarative value list: the permissible algorithms are
determined at runtime by the keyed signing/encryption registrations, so a static list
would misstate the host's actual capabilities\.

## ClientRegistrationRequest\.IdTokenEncryptedResponseEnc Property {#Abblix.Oidc.Server.Model.ClientRegistrationRequest.IdTokenEncryptedResponseEnc}

The `id_token_encrypted_response_enc`: the JWE content\-encryption algorithm paired with
[IdTokenEncryptedResponseAlg](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.ClientRegistrationRequest#Abblix.Oidc.Server.Model.ClientRegistrationRequest.IdTokenEncryptedResponseAlg 'Abblix\.Oidc\.Server\.Model\.ClientRegistrationRequest\.IdTokenEncryptedResponseAlg') for ID Tokens issued to this client\.

```csharp
public string? IdTokenEncryptedResponseEnc { get; init; }
```

#### Property Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

### Remarks
Deliberately not constrained by a declarative value list: the permissible algorithms are
determined at runtime by the keyed signing/encryption registrations, so a static list
would misstate the host's actual capabilities\.

## ClientRegistrationRequest\.IdTokenSignedResponseAlg Property {#Abblix.Oidc.Server.Model.ClientRegistrationRequest.IdTokenSignedResponseAlg}

The `id_token_signed_response_alg` \(OIDC Core §2\): the JWS `alg` the OP must use to sign
ID Tokens issued to this client \(e\.g\. `RS256`, `ES256`\)\.

```csharp
public string? IdTokenSignedResponseAlg { get; init; }
```

#### Property Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

### Remarks
Deliberately not constrained by a declarative value list: the permissible algorithms are
determined at runtime by the keyed signing/encryption registrations, so a static list
would misstate the host's actual capabilities\.

## ClientRegistrationRequest\.InitiateLoginUri Property {#Abblix.Oidc.Server.Model.ClientRegistrationRequest.InitiateLoginUri}

The `initiate_login_uri`: an absolute URL the OP can call to initiate a login flow at the client,
for example to recover an interrupted session\.

```csharp
public System.Uri? InitiateLoginUri { get; init; }
```

#### Property Value
[System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri')

## ClientRegistrationRequest\.IntrospectionEncryptedResponseAlg Property {#Abblix.Oidc.Server.Model.ClientRegistrationRequest.IntrospectionEncryptedResponseAlg}

The `introspection_encrypted_response_alg` \(RFC 9701\): the JWE key\-management algorithm the OP must use
when encrypting introspection responses for this client\.

```csharp
public string? IntrospectionEncryptedResponseAlg { get; init; }
```

#### Property Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

### Remarks
Deliberately not constrained by a declarative value list: the permissible algorithms are
determined at runtime by the keyed signing/encryption registrations, so a static list
would misstate the host's actual capabilities\.

## ClientRegistrationRequest\.IntrospectionEncryptedResponseEnc Property {#Abblix.Oidc.Server.Model.ClientRegistrationRequest.IntrospectionEncryptedResponseEnc}

The `introspection_encrypted_response_enc` \(RFC 9701\): the JWE content\-encryption algorithm paired with
[IntrospectionEncryptedResponseAlg](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.ClientRegistrationRequest#Abblix.Oidc.Server.Model.ClientRegistrationRequest.IntrospectionEncryptedResponseAlg 'Abblix\.Oidc\.Server\.Model\.ClientRegistrationRequest\.IntrospectionEncryptedResponseAlg') for introspection responses to this client\.

```csharp
public string? IntrospectionEncryptedResponseEnc { get; init; }
```

#### Property Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

### Remarks
Deliberately not constrained by a declarative value list: the permissible algorithms are
determined at runtime by the keyed signing/encryption registrations, so a static list
would misstate the host's actual capabilities\.

## ClientRegistrationRequest\.IntrospectionSignedResponseAlg Property {#Abblix.Oidc.Server.Model.ClientRegistrationRequest.IntrospectionSignedResponseAlg}

The `introspection_signed_response_alg` \(RFC 9701\): the JWS algorithm the OP must use when signing
introspection responses returned to this client\. When omitted, introspection is returned as plain JSON\.

```csharp
public string? IntrospectionSignedResponseAlg { get; init; }
```

#### Property Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

### Remarks
Deliberately not constrained by a declarative value list: the permissible algorithms are
determined at runtime by the keyed signing/encryption registrations, so a static list
would misstate the host's actual capabilities\.

## ClientRegistrationRequest\.Jwks Property {#Abblix.Oidc.Server.Model.ClientRegistrationRequest.Jwks}

The inline `jwks` value: the client's JSON Web Key Set provided directly in registration metadata,
used as an alternative to [JwksUri](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.ClientRegistrationRequest#Abblix.Oidc.Server.Model.ClientRegistrationRequest.JwksUri 'Abblix\.Oidc\.Server\.Model\.ClientRegistrationRequest\.JwksUri')\. Only one of the two may be provided per RFC 7591 §2\.

```csharp
public Abblix.Jwt.JsonWebKeySet? Jwks { get; init; }
```

#### Property Value
[JsonWebKeySet](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKeySet 'Abblix\.Jwt\.JsonWebKeySet')

## ClientRegistrationRequest\.JwksUri Property {#Abblix.Oidc.Server.Model.ClientRegistrationRequest.JwksUri}

The `jwks_uri`: an absolute URL where the client publishes its JSON Web Key Set, used by the OP
to verify signed assertions and to encrypt content addressed to the client\.

```csharp
public System.Uri? JwksUri { get; init; }
```

#### Property Value
[System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri')

## ClientRegistrationRequest\.LogoUri Property {#Abblix.Oidc.Server.Model.ClientRegistrationRequest.LogoUri}

The `logo_uri`: an absolute URL of an image displayed to end\-users alongside [ClientName](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.ClientRegistrationRequest#Abblix.Oidc.Server.Model.ClientRegistrationRequest.ClientName 'Abblix\.Oidc\.Server\.Model\.ClientRegistrationRequest\.ClientName')
during authentication and consent\.

```csharp
public System.Uri? LogoUri { get; init; }
```

#### Property Value
[System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri')

## ClientRegistrationRequest\.OfflineAccessAllowed Property {#Abblix.Oidc.Server.Model.ClientRegistrationRequest.OfflineAccessAllowed}

When `true`, the client is permitted to request the `offline_access` scope and receive
refresh tokens\. Server extension to RFC 7591 metadata; defaults to `true`\.

```csharp
public System.Nullable<bool> OfflineAccessAllowed { get; init; }
```

#### Property Value
[System\.Nullable&lt;](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean')[&gt;](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')

## ClientRegistrationRequest\.PkceRequired Property {#Abblix.Oidc.Server.Model.ClientRegistrationRequest.PkceRequired}

When `true`, this client must present a PKCE `code_challenge` on every authorization request
per RFC 7636\. Server extension to RFC 7591 metadata; defaults to `false`\.

```csharp
public System.Nullable<bool> PkceRequired { get; init; }
```

#### Property Value
[System\.Nullable&lt;](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean')[&gt;](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')

## ClientRegistrationRequest\.PolicyUri Property {#Abblix.Oidc.Server.Model.ClientRegistrationRequest.PolicyUri}

The `policy_uri`: an absolute URL the relying party provides describing how end\-user
profile data is used\.

```csharp
public System.Uri? PolicyUri { get; init; }
```

#### Property Value
[System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri')

## ClientRegistrationRequest\.PostLogoutRedirectUris Property {#Abblix.Oidc.Server.Model.ClientRegistrationRequest.PostLogoutRedirectUris}

The `post_logout_redirect_uris` \(OIDC RP\-Initiated Logout\): the absolute URIs the OP may redirect
the user agent to after RP\-initiated logout\. Logout requests must specify a
`post_logout_redirect_uri` that exactly matches one of these\.

```csharp
public System.Uri[] PostLogoutRedirectUris { get; init; }
```

#### Property Value
[System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array')

## ClientRegistrationRequest\.RedirectUris Property {#Abblix.Oidc.Server.Model.ClientRegistrationRequest.RedirectUris}

The `redirect_uris` array \(RFC 7591 §2\) listing every absolute URI the OP may use to deliver
authorization responses to this client\. At least one entry is required, and authorization requests
must specify a redirect URI that exactly matches one of these values\.

```csharp
public System.Uri[] RedirectUris { get; init; }
```

#### Property Value
[System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array')

## ClientRegistrationRequest\.RequestObjectEncryptionAlg Property {#Abblix.Oidc.Server.Model.ClientRegistrationRequest.RequestObjectEncryptionAlg}

The `request_object_encryption_alg`: the JWE key\-management algorithm the client may use when
encrypting Request Objects sent to the OP\.

```csharp
public string? RequestObjectEncryptionAlg { get; init; }
```

#### Property Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

### Remarks
Deliberately not constrained by a declarative value list: the permissible algorithms are
determined at runtime by the keyed signing/encryption registrations, so a static list
would misstate the host's actual capabilities\.

## ClientRegistrationRequest\.RequestObjectEncryptionEnc Property {#Abblix.Oidc.Server.Model.ClientRegistrationRequest.RequestObjectEncryptionEnc}

The `request_object_encryption_enc`: the JWE content\-encryption algorithm paired with
[RequestObjectEncryptionAlg](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.ClientRegistrationRequest#Abblix.Oidc.Server.Model.ClientRegistrationRequest.RequestObjectEncryptionAlg 'Abblix\.Oidc\.Server\.Model\.ClientRegistrationRequest\.RequestObjectEncryptionAlg') for Request Objects\.

```csharp
public string? RequestObjectEncryptionEnc { get; init; }
```

#### Property Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

### Remarks
Deliberately not constrained by a declarative value list: the permissible algorithms are
determined at runtime by the keyed signing/encryption registrations, so a static list
would misstate the host's actual capabilities\.

## ClientRegistrationRequest\.RequestObjectSigningAlg Property {#Abblix.Oidc.Server.Model.ClientRegistrationRequest.RequestObjectSigningAlg}

The `request_object_signing_alg`: the JWS algorithm the client uses when signing Request Objects
\(OIDC Core §6\) sent to the authorization endpoint\. `none` indicates an unsigned Request Object\.

```csharp
public string? RequestObjectSigningAlg { get; init; }
```

#### Property Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

### Remarks
Deliberately not constrained by a declarative value list: the permissible algorithms are
determined at runtime by the keyed signing/encryption registrations, so a static list
would misstate the host's actual capabilities\.

## ClientRegistrationRequest\.RequestUris Property {#Abblix.Oidc.Server.Model.ClientRegistrationRequest.RequestUris}

The `request_uris` \(OIDC Core §6\.2\): URIs that the OP may pre\-fetch and cache for use as
`request_uri` values in authorization requests from this client\.

```csharp
public System.Uri[]? RequestUris { get; init; }
```

#### Property Value
[System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array')

## ClientRegistrationRequest\.RequireAuthTime Property {#Abblix.Oidc.Server.Model.ClientRegistrationRequest.RequireAuthTime}

The `require_auth_time` flag: when `true`, the OP must always include the `auth_time`
claim in ID Tokens issued to this client\.

```csharp
public System.Nullable<bool> RequireAuthTime { get; init; }
```

#### Property Value
[System\.Nullable&lt;](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean')[&gt;](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')

## ClientRegistrationRequest\.RequirePushedAuthorizationRequests Property {#Abblix.Oidc.Server.Model.ClientRegistrationRequest.RequirePushedAuthorizationRequests}

The `require_pushed_authorization_requests` client metadata per RFC 9126 §6: when
`true`, pushed authorization requests are the only way this client may start an
authorization flow\. Maps to
[RequirePushedAuthorizationRequests](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.RequirePushedAuthorizationRequests 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo\.RequirePushedAuthorizationRequests')\.
When omitted, treated as `false`\.

```csharp
public System.Nullable<bool> RequirePushedAuthorizationRequests { get; init; }
```

#### Property Value
[System\.Nullable&lt;](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean')[&gt;](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')

## ClientRegistrationRequest\.RequireSignedRequestObject Property {#Abblix.Oidc.Server.Model.ClientRegistrationRequest.RequireSignedRequestObject}

The `require_signed_request_object` client metadata per RFC 9101 §10\.5: when
`true`, the client must deliver its authorization request parameters as a signed
request object\. Maps to
[RequireSignedRequestObject](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.RequireSignedRequestObject 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo\.RequireSignedRequestObject')\.
When omitted, treated as `false`\.

```csharp
public System.Nullable<bool> RequireSignedRequestObject { get; init; }
```

#### Property Value
[System\.Nullable&lt;](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean')[&gt;](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')

## ClientRegistrationRequest\.ResponseTypes Property {#Abblix.Oidc.Server.Model.ClientRegistrationRequest.ResponseTypes}

The `response_types` the client intends to use \(RFC 7591 §2\)\. Each entry is itself a
space\-separated combination of `code`, `token`, and/or `id_token`; the array therefore
represents the full set of response type combinations registered for this client\.

```csharp
public string[][] ResponseTypes { get; init; }
```

#### Property Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array')

### Remarks
Deliberately not constrained by a declarative value list: authorization response processors
are registered per flow \(the implicit flow is off by default\), and the registration pipeline
already validates every requested response type against the set the server actually supports
and advertises in its discovery document\.

## ClientRegistrationRequest\.Scope Property {#Abblix.Oidc.Server.Model.ClientRegistrationRequest.Scope}

A space\-separated list of scope values the client will use per RFC 7591 Section 2\.

```csharp
public string[]? Scope { get; set; }
```

#### Property Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array')

## ClientRegistrationRequest\.SectorIdentifierUri Property {#Abblix.Oidc.Server.Model.ClientRegistrationRequest.SectorIdentifierUri}

The `sector_identifier_uri` \(OIDC Core §8\.1\): an absolute HTTPS URL whose host is used to compute
pairwise pseudonymous subject identifiers, allowing multiple registered redirect URIs to share the same
pairwise sector\.

```csharp
public System.Uri? SectorIdentifierUri { get; init; }
```

#### Property Value
[System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri')

## ClientRegistrationRequest\.SoftwareId Property {#Abblix.Oidc.Server.Model.ClientRegistrationRequest.SoftwareId}

A unique identifier string assigned by the client developer or software publisher
to identify the client software per RFC 7591 Section 2\.

```csharp
public string? SoftwareId { get; set; }
```

#### Property Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

## ClientRegistrationRequest\.SoftwareStatement Property {#Abblix.Oidc.Server.Model.ClientRegistrationRequest.SoftwareStatement}

A digitally signed or MACed JWT that asserts metadata values about the client software,
issued by a third\-party software statement issuer per RFC 7591 Section 2\.3\.

```csharp
public string? SoftwareStatement { get; set; }
```

#### Property Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

## ClientRegistrationRequest\.SoftwareVersion Property {#Abblix.Oidc.Server.Model.ClientRegistrationRequest.SoftwareVersion}

A version identifier string for the client software per RFC 7591 Section 2\.

```csharp
public string? SoftwareVersion { get; set; }
```

#### Property Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

## ClientRegistrationRequest\.SubjectType Property {#Abblix.Oidc.Server.Model.ClientRegistrationRequest.SubjectType}

The `subject_type` \(OIDC Core §8\) requested for ID Token `sub` claim generation:
`public` \(same identifier across clients\) or `pairwise` \(per\-sector pseudonymous\)\.

```csharp
public string? SubjectType { get; init; }
```

#### Property Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

## ClientRegistrationRequest\.TermsOfServiceUri Property {#Abblix.Oidc.Server.Model.ClientRegistrationRequest.TermsOfServiceUri}

The `tos_uri`: an absolute URL where the relying party publishes its terms of service\.

```csharp
public System.Uri? TermsOfServiceUri { get; init; }
```

#### Property Value
[System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri')

## ClientRegistrationRequest\.TlsClientAuthSanDns Property {#Abblix.Oidc.Server.Model.ClientRegistrationRequest.TlsClientAuthSanDns}

Required DNS Subject Alternative Names for tls\_client\_auth\.

```csharp
public string[]? TlsClientAuthSanDns { get; init; }
```

#### Property Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array')

## ClientRegistrationRequest\.TlsClientAuthSanEmail Property {#Abblix.Oidc.Server.Model.ClientRegistrationRequest.TlsClientAuthSanEmail}

Required email Subject Alternative Names for tls\_client\_auth\.

```csharp
public string[]? TlsClientAuthSanEmail { get; init; }
```

#### Property Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array')

## ClientRegistrationRequest\.TlsClientAuthSanIp Property {#Abblix.Oidc.Server.Model.ClientRegistrationRequest.TlsClientAuthSanIp}

Required IP Subject Alternative Names for tls\_client\_auth\.

```csharp
public string[]? TlsClientAuthSanIp { get; init; }
```

#### Property Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array')

## ClientRegistrationRequest\.TlsClientAuthSanUri Property {#Abblix.Oidc.Server.Model.ClientRegistrationRequest.TlsClientAuthSanUri}

Required URI Subject Alternative Names for tls\_client\_auth\.

```csharp
public System.Uri[]? TlsClientAuthSanUri { get; init; }
```

#### Property Value
[System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array')

## ClientRegistrationRequest\.TlsClientAuthSubjectDn Property {#Abblix.Oidc.Server.Model.ClientRegistrationRequest.TlsClientAuthSubjectDn}

Exact Subject Distinguished Name the client certificate must present when using tls\_client\_auth\.

```csharp
public string? TlsClientAuthSubjectDn { get; init; }
```

#### Property Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

## ClientRegistrationRequest\.TlsClientCertificateBoundAccessTokens Property {#Abblix.Oidc.Server.Model.ClientRegistrationRequest.TlsClientCertificateBoundAccessTokens}

The `tls_client_certificate_bound_access_tokens` client metadata per RFC 8705 §3\.4:
when `true`, access tokens issued to this client are certificate\-bound whenever the
token request arrives over mutual TLS, independently of the authentication method\. Maps to
[TlsClientCertificateBoundAccessTokens](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.TlsClientCertificateBoundAccessTokens 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo\.TlsClientCertificateBoundAccessTokens')\.
When omitted, treated as `false`\.

```csharp
public System.Nullable<bool> TlsClientCertificateBoundAccessTokens { get; init; }
```

#### Property Value
[System\.Nullable&lt;](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean')[&gt;](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')

## ClientRegistrationRequest\.TokenEndpointAuthMethod Property {#Abblix.Oidc.Server.Model.ClientRegistrationRequest.TokenEndpointAuthMethod}

The `token_endpoint_auth_method` \(RFC 7591 §2\): the client authentication method used at the
token endpoint, such as `client_secret_basic`, `client_secret_post`, `private_key_jwt`,
`tls_client_auth`, or `none`\.

```csharp
public string TokenEndpointAuthMethod { get; init; }
```

#### Property Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

### Remarks
Deliberately not constrained by a declarative value list: client authenticators are an
extensible set, and the registration pipeline already validates the value against the
methods the server actually supports and announces in its discovery document\.

## ClientRegistrationRequest\.TokenEndpointAuthSigningAlg Property {#Abblix.Oidc.Server.Model.ClientRegistrationRequest.TokenEndpointAuthSigningAlg}

The `token_endpoint_auth_signing_alg`: the JWS algorithm the client uses when signing
authentication assertions for `private_key_jwt` or `client_secret_jwt` at the token endpoint\.

```csharp
public string? TokenEndpointAuthSigningAlg { get; init; }
```

#### Property Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

### Remarks
Deliberately not constrained by a declarative value list: the permissible algorithms are
determined at runtime by the keyed signing/encryption registrations, so a static list
would misstate the host's actual capabilities\.

## ClientRegistrationRequest\.TokenExchangeAudiences Property {#Abblix.Oidc.Server.Model.ClientRegistrationRequest.TokenExchangeAudiences}

Non\-standard extension: the per\-client allowlist of RFC 8693 `audience` values this
client may request when exchanging a token\. RFC 8693 does not standardise a registration
parameter for this, so the property is exposed under the non\-standard
`token_exchange_audiences` name\. Maps to
[TokenExchangeAllowedAudiences](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.TokenExchangeAllowedAudiences 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo\.TokenExchangeAllowedAudiences')\.
Default\-deny: `null` or empty means the client may not request any `audience`;
a non\-empty array is the allowlist of accepted values\.

```csharp
public string[]? TokenExchangeAudiences { get; init; }
```

#### Property Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array')

## ClientRegistrationRequest\.TokenExchangeSubjectTokenTypes Property {#Abblix.Oidc.Server.Model.ClientRegistrationRequest.TokenExchangeSubjectTokenTypes}

Non\-standard extension: the per\-client allowlist of RFC 8693 `subject_token_type` URIs this
client may submit to the Token Exchange grant\. RFC 8693 does not standardise a registration
parameter for this, so the property is exposed under the non\-standard
`token_exchange_subject_token_types` name\. Maps to
[TokenExchangeAllowedSubjectTokenTypes](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.TokenExchangeAllowedSubjectTokenTypes 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo\.TokenExchangeAllowedSubjectTokenTypes')\.
`null` means no per\-client constraint; empty array means the client cannot use
Token Exchange at all\.

```csharp
public string[]? TokenExchangeSubjectTokenTypes { get; init; }
```

#### Property Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array')

## ClientRegistrationRequest\.UserInfoEncryptedResponseAlg Property {#Abblix.Oidc.Server.Model.ClientRegistrationRequest.UserInfoEncryptedResponseAlg}

The `userinfo_encrypted_response_alg`: the JWE key\-management algorithm the OP must use when
encrypting UserInfo responses for this client\.

```csharp
public string? UserInfoEncryptedResponseAlg { get; init; }
```

#### Property Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

### Remarks
Deliberately not constrained by a declarative value list: the permissible algorithms are
determined at runtime by the keyed signing/encryption registrations, so a static list
would misstate the host's actual capabilities\.

## ClientRegistrationRequest\.UserInfoEncryptedResponseEnc Property {#Abblix.Oidc.Server.Model.ClientRegistrationRequest.UserInfoEncryptedResponseEnc}

The `userinfo_encrypted_response_enc`: the JWE content\-encryption algorithm paired with
[UserInfoEncryptedResponseAlg](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.ClientRegistrationRequest#Abblix.Oidc.Server.Model.ClientRegistrationRequest.UserInfoEncryptedResponseAlg 'Abblix\.Oidc\.Server\.Model\.ClientRegistrationRequest\.UserInfoEncryptedResponseAlg') for UserInfo responses to this client\.

```csharp
public string? UserInfoEncryptedResponseEnc { get; init; }
```

#### Property Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

### Remarks
Deliberately not constrained by a declarative value list: the permissible algorithms are
determined at runtime by the keyed signing/encryption registrations, so a static list
would misstate the host's actual capabilities\.

## ClientRegistrationRequest\.UserInfoSignedResponseAlg Property {#Abblix.Oidc.Server.Model.ClientRegistrationRequest.UserInfoSignedResponseAlg}

The `userinfo_signed_response_alg`: the JWS algorithm the OP must use when signing UserInfo
responses returned to this client\. When omitted, UserInfo is returned as plain JSON\.

```csharp
public string? UserInfoSignedResponseAlg { get; init; }
```

#### Property Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

### Remarks
Deliberately not constrained by a declarative value list: the permissible algorithms are
determined at runtime by the keyed signing/encryption registrations, so a static list
would misstate the host's actual capabilities\.