oauth client registration audit derived

{
  "input": {
    "body": {
      "client": {
        "client_id": "web-dashboard",
        "client_name": "Example Dashboard",
        "grant_types": [
          "authorization_code",
          "implicit",
          "client_credentials"
        ],
        "client_secret": "redacted-example-value-not-a-real-secret",
        "redirect_uris": [
          "https://*.example.com/oauth/callback",
          "http://dashboard.example.com/oauth/callback",
          "https://dashboard.example.com/oauth/callback?returnTo=%2Fhome",
          "https://dashboard.example.com/"
        ],
        "response_types": [
          "code",
          "token"
        ],
        "token_endpoint_auth_method": "none"
      }
    },
    "type": "http",
    "method": "POST",
    "bodyType": "json"
  },
  "output": {
    "type": "json",
    "example": {
      "limits": {
        "maxKeys": 100,
        "maxFindings": 500,
        "maxRedirectUris": 100,
        "maxDocumentBytes": 262144,
        "minRsaModulusBits": 2048,
        "maxTokenLifetimeSeconds": 28800
      },
      "passed": false,
      "complete": false,
      "findings": [
        {
          "code": "REDIRECT_URI_WILDCARD",
          "detail": "https://*.example.com/oauth/callback: A wildcard in a registered redirect URI means any host or path matching the pattern receives authorization codes.",
          "redirect_uri": "https://*.example.com/oauth/callback"
        },
        {
          "code": "REDIRECT_URI_PLAINTEXT_HTTP",
          "detail": "http://dashboard.example.com/oauth/callback: A plaintext redirect carries the authorization code over the network in the clear.",
          "redirect_uri": "http://dashboard.example.com/oauth/callback"
        },
        {
          "code": "REDIRECT_URI_FORWARDS_ELSEWHERE",
          "detail": "https://dashboard.example.com/oauth/callback?returnTo=%2Fhome: This URI carries its own redirect parameter, so a code delivered to it can be forwarded off the client's origin while still matching the ...",
          "redirect_uri": "https://dashboard.example.com/oauth/callback?returnTo=%2Fhome"
        }
      ],
      "client_id": "web-dashboard",
      "request_id": "example-request",
      "service_id": "oauth_client_registration_audit",
      "assumptions": [
        "A client is treated as public when token_endpoint_auth_method is none, which is what makes a bare-origin redirect and a missing PKCE declaration worth reporting.",
        "A plaintext redirect to a loopback host is permitted, because that is how a native client receives a code during development.",
        "A custom scheme is recorded as not examined rather than reported: it is normal for a native client and cannot be exclusively claimed on most platforms, so safety is not decidable from the registration..."
      ],
      "grant_types": [
        "authorization_code",
        "implicit",
        "client_credentials"
      ],
      "limitations": [
        "No signature is verified and no cryptographic operation is performed. These findings are about declared configuration, so a verdict is never a statement that a token or document is authentic.",
        "Nothing is fetched. The documents are supplied, so an arbitrary provider or client can be audited without a credential and without the provider being contacted.",
        "No client secret value, and no part of one, appears in any finding."
      ],
      "observed_at": "2026-10-02T00:00:00.000Z",
      "not_examined": [
        "PUBLIC_CLIENT_PKCE_NOT_DECLARED: This is a public client using the authorization code grant and the registration does not declare a code_challenge_method. PKCE may still be enforced by the provider, w..."
      ],
      "finding_count": 7,
      "response_types": [
        "code",
        "token"
      ],
      "service_version": "1.0.0",
      "findings_by_code": {
        "REDIRECT_URI_WILDCARD": 1,
        "REDIRECT_URI_BARE_ORIGIN": 1,
        "IMPLICIT_GRANT_REGISTERED": 1,
        "REDIRECT_URI_PLAINTEXT_HTTP": 1,
        "REDIRECT_URI_FORWARDS_ELSEWHERE": 1,
        "CLIENT_SECRET_PRESENT_IN_DOCUMENT": 1,
        "PUBLIC_CLIENT_WITH_CLIENT_CREDENTIALS": 1
      },
      "is_public_client": true,
      "safe_registration": false,
      "redirect_uri_count": 4,
      "token_endpoint_auth_method": "none"
    }
  }
}