capabilities.work

Decommission a Client

A 5-step recipe with Keycloak. We can help you get access.

Recipe · 5 steps

Decommission a Client

with Keycloak · Identity & Access Management

Capture, disable, and optionally delete a client registration.

  1. Exchange the clientId for the internal client UUID that the detail and delete endpoints require.
  2. Read and retain the full client representation before touching it. This snapshot is the only rebuild record once the registration is deleted, since Keycloak keeps nothing recoverable afterwards.
  3. Disable the client. Token requests start failing immediately, which is the point: it surfaces any forgotten consumer while the change is still a one-field edit away from being undone.
  4. Read the client back to prove it is disabled, and stop here unless the caller explicitly asked for deletion.
  5. Permanently remove the client registration. Only reached when hardDelete is true, and only recoverable from the snapshot captured earlier.
What you'll need to have ready
  • realm: The name of the realm the client is registered in.
  • clientId: The OAuth client identifier to decommission.
  • hardDelete: When true the registration is permanently deleted after being disabled. When false the client is left disabled and restorable, which is the recommended first pa
For your developer

Arazzo workflow keycloak:decommission-client, 5 operations: getClients → getClient → updateClient → getClient → deleteClient. Specs on APIs.io.

More recipes with Keycloak

Assign a User to a GroupAudit Group MembershipAudit a User's Effective AccessFederate an Identity ProviderApply a Realm Security BaselineInventory a RealmOffboard a UserOnboard a UserProvision a Group HierarchyRegister a Confidential OIDC Client