Replace a client IdP.
Full replacement of an existing client IdP. name and jwks_uri are required. client_idp_id is preserved when absent from the request body but can be changed when explicitly provided (mirroring policy id behaviour). _id and org_id are always preserved from the stored document.
Authorizations
The Tyk Dashboard API Access Credentials
Path Parameters
Internal record ID hex or custom client_idp_id.
Body
Human-readable name. Required.
JWKS endpoint URL. Required — this is the IdP's signing-key source with no discovery fallback.
Optional stable identifier. If not provided, defaults to the record's internal ID hex. Must be unique within the org.
Issuer URL. Optional — used as a selection hint downstream; an empty value is accepted.
JWT claim that holds the OAuth scopes (e.g. scope, scp, roles). Optional — when empty the gateway falls back to the scope claim.
Map of api_id → ScopeMapping. Defaults to an empty map if not provided.
Response
Client IdP updated.
A client Identity Provider stored beside API definitions.
Internal record ID hex. Set server-side on creation.
Stable user-facing identifier. Defaults to _id hex when not supplied on create.
Organisation ID. Set server-side from the session; cannot be overridden.
JWT claim holding the OAuth scopes (e.g. scope, scp, roles). Empty falls back to scope gateway-side.
Map of api_id → ScopeMapping.