type: object
description: |
    OAuth 2.0 client registered with the Bigscreen OAuth provider. Mirrors
    `OAuthClientDatabase.OAuthClientRow`. The `clientSecretHash` is **never**
    returned in any response — the plaintext secret is returned exactly once on
    create / rotate (see `OAuthClientCreated` for that response shape).
required: [uniqueId, clientId, clientType, name, ownerAccountId, createdAt]
properties:
    uniqueId:
        type: string
        description: Internal id used for admin operations and step-up unlocks.
    clientId:
        type: string
        description: Public client identifier sent to the OAuth `/authorize` endpoint.
    clientType:
        type: string
        description: |
            Client type. `confidential` is the only value supported in v1; `public`
            is reserved for a later phase.
        enum: [confidential, public]
    name: { type: string }
    description:
        type: [string, "null"]
    logoUrl:
        type: [string, "null"]
        format: uri
    homepageUrl:
        type: [string, "null"]
        format: uri
    redirectUris:
        type: array
        items: { type: string, format: uri }
    allowedScopes:
        type: array
        items: { type: string }
        description: Scopes the client may request.
    serverIps:
        type: array
        items: { type: string }
        description: IP allowlist (required — clients must call from one of these IPs).
    securityGroupRuleIds:
        type: array
        items: { type: string }
        description: AWS security-group rule ids backing the IP allowlist.
    ownerAccountId:
        type: string
        description: Bigscreen account that owns the client. Required for ownership-or-SuperUser checks on mutations.
    createdAt:
        type: integer
        format: int64
        description: Creation timestamp in Unix ms.
    createdByAccountId:
        type: [string, "null"]
    disabledAt:
        type: [integer, "null"]
        format: int64
        description: When the client was disabled, if disabled.
    disabledReason:
        type: [string, "null"]
    deletedAt:
        type: [integer, "null"]
        format: int64
        description: When the client was soft-deleted, if applicable.
example:
    uniqueId: "oac_01HXKV2M3X8FQ7P4ABCDEFGH9"
    clientId: "arda-internal"
    clientType: "confidential"
    name: "Arda"
    description: "Internal admin webapp"
    logoUrl: null
    homepageUrl: "https://arda.internal.bigscreenvr.com"
    redirectUris: ["https://arda.internal.bigscreenvr.com/oauth/callback"]
    allowedScopes: ["openid", "profile", "admin:all"]
    serverIps: ["10.0.42.10"]
    securityGroupRuleIds: ["sgr-0a1b2c3d4e5f6789"]
    ownerAccountId: "acct_01HXJ4Q12345"
    createdAt: 1747088000000
    createdByAccountId: "acct_01HXJ4Q12345"
    disabledAt: null
    disabledReason: null
    deletedAt: null
