{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://raw.githubusercontent.com/api-evangelist/snyk/main/json-schema/snyk-client-credentials-schema.json",
  "title": "ClientCredentials",
  "x-generated": "2026-10-04",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/snyk-oauth2-api-openapi.yml#/components/schemas/ClientCredentials",
  "oneOf": [
    {
      "$ref": "#/$defs/ClientCredentialsSecret"
    },
    {
      "$ref": "#/$defs/ClientCredentialsJWT"
    }
  ],
  "$defs": {
    "ClientCredentialsBase": {
      "type": "object",
      "properties": {
        "grant_type": {
          "description": "The type of grant used in the request. Use `client_credentials` to exchange credentials for an access token, typically used with Service Accounts. Supports either client_secret or private_key_jwt auth.",
          "type": "string",
          "enum": [
            "client_credentials"
          ]
        }
      },
      "required": [
        "grant_type"
      ]
    },
    "ClientCredentialsJWT": {
      "allOf": [
        {
          "$ref": "#/$defs/ClientCredentialsBase"
        },
        {
          "type": "object",
          "properties": {
            "client_id": {
              "description": "The client ID of the client application.",
              "type": "string"
            },
            "client_assertion": {
              "description": "A compact signed JWT containing claims detailed in OIDC Connect Core 1.0, section 9.\n\nRequired header claims:\n- kid: KeyID which matches a public key in the registered JWKS endpoint.\n\nRequired payload claims:\n- sub: client_id of your Service Account.\n- iss: client_id of your Service Account.\n- jti: A cryptographically unique value (nonce) to prevent replay attacks.\n- aud: Full URL for this token endpoint - \"https://api.snyk.io/oauth2/token\".\n- exp: Unix timestamp of when the token shouldn't be accepted for processing. We suggest now() + 5 minutes.\n\nThe JWT must be signed using a private key with RSA256 (RSASSA-PKCS-v1.5 using SHA-256), and its public key must be exposed on the previously registered JWKS endpoint",
              "type": "string"
            },
            "client_assertion_type": {
              "description": "The method of client_assertion being sent. Only \"urn:ietf:params:oauth:client-assertion-type:jwt-bearer\" is supported.",
              "type": "string",
              "enum": [
                "urn:ietf:params:oauth:client-assertion-type:jwt-bearer"
              ]
            }
          },
          "required": [
            "client_assertion",
            "client_assertion_type"
          ]
        }
      ]
    },
    "ClientCredentialsSecret": {
      "allOf": [
        {
          "$ref": "#/$defs/ClientCredentialsBase"
        },
        {
          "type": "object",
          "properties": {
            "client_id": {
              "description": "The client ID of the client application.",
              "type": "string"
            },
            "client_secret": {
              "description": "The client secret of the client application.",
              "type": "string"
            }
          },
          "required": [
            "client_id",
            "client_secret"
          ]
        }
      ]
    }
  }
}