A new reusable OAuth 2.0 client credential set. Attach it to a webhook by passing the returned id as that webhook's webhookOauthId. Several webhooks may share one credential set, so rotating its client secret covers all of them at once.
| Name | Type | Description | Notes |
|---|---|---|---|
| name | String | A label for this credential set, shown when listing them. | |
| clientId | String | OAuth client ID used to authenticate with the token endpoint. | |
| clientSecret | String | OAuth client secret. Write-only — never returned. Limited to 480 bytes UTF-8 encoded. With `client_secret_jwt` it signs the assertion rather than being sent. | |
| url | String | Token endpoint URL. HTTPS on port 443 only, and the host must resolve publicly — localhost and private, link-local or loopback addresses are rejected. | |
| authMethod | String | How the client credentials reach the token endpoint. `client_secret_basic` uses an HTTP Basic header, `client_secret_post` uses form fields in the body, and `client_secret_jwt` sends a JWT assertion signed with the secret, so the secret itself is never transmitted. Defaults to `client_secret_basic`. | [optional] |
| customJwtClaims | Map<String, Object> | Extra claims for the JWT assertion. Used only when `authMethod` is `client_secret_jwt`. The usual one to set is `aud`, which defaults to the token endpoint URL; some authorization servers expect their own identifier instead. A value may be any JSON type except `null` — `null` is reserved for deleting a claim on update. `iss`, `sub`, `jti`, `iat` and `exp` are set by Fireblocks and cannot be overridden. Names are case-sensitive. The whole object must be under 16 KB. Values are write-only; responses return only the claim names. On update this merges claim by claim rather than replacing — see `WebhookOAuthCustomJwtClaimsUpdate`. | [optional] |
| customBodyParams | Map<String, String> | Extra parameters for the token request body — `scope` most commonly, sometimes `audience` or `resource`. Applies to every authentication method. Values must be strings, because the token request body is form-encoded rather than JSON. An empty string is allowed. `grant_type`, `client_id`, `client_secret`, `client_assertion` and `client_assertion_type` are set by Fireblocks and cannot be overridden. Names are case-sensitive. The whole object must be under 16 KB. Values are write-only; responses return only the parameter names. On update this merges key by key rather than replacing — see `WebhookOAuthCustomBodyParamsUpdate`. | [optional] |
| customHeaders | Map<String, String> | Extra HTTP headers for the token request to your authorization server — not for the webhook delivery, which has its own separate `customHeaders`. A gateway API key is the usual case. Applies to every authentication method. Values must be strings; an empty string is allowed. Names are matched case-insensitively, so two names differing only in case are a duplicate. Names are stored and returned lowercased, so `X-Api-Key` comes back as `x-api-key`. `Content-Type`, `Authorization`, `Content-Length` and `Host` are set by Fireblocks and cannot be overridden. The whole object must be under 16 KB. Values are write-only; responses return only the header names. On update this merges name by name rather than replacing — see `WebhookOAuthCustomHeadersUpdate`. | [optional] |
| mtlsClientSignedCert | String | PEM-encoded client certificate for mTLS when fetching tokens. Must be a valid X.509 certificate inside its validity window. | [optional] |