Change an app's domain access

PUT

/oauth/grants/{client_id}

curl --request PUT \
  --url https://api.nsin.ir/oauth/grants/example \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{ "domains": "all" }'

• Production

Replaces the domain selection of an active grant. It takes effect on the app’s key and tokens with their next request. Ids outside the domains the user has a role on answer 400 invalid_request.

Authorizations

• panelAuth

Parameters

Path Parameters

client_id

required

string

Request Body ^required

Media type application/json

object

domains

required

One of:

string

string

Allowed values: all

Array<integer>

Array<integer>

Responses

200

The updated row, in the shape of the list.

Media type application/json

object

client_id

string

name

string

first_party

boolean

scope

string

created_at

string format: date-time

last_used_at

string format: date-time

nullable

domain_access

Which domains a client-bound credential (NSIN SSO) may touch. all true means every domain, including ones added later. Otherwise domain_ids is the selection as stored and domains names the live ones among them; an empty selection is what a revoked grant leaves behind. GET /whoami reports it for SSO tokens and app-minted keys.

object

all

required

boolean

domain_ids

Array<integer>

domains

Array<object>

object

id

integer

name

string

Example ^generated

{
  "client_id": "example",
  "name": "example",
  "first_party": true,
  "scope": "example",
  "created_at": "2026-04-15T12:00:00Z",
  "last_used_at": "2026-04-15T12:00:00Z",
  "domain_access": {
    "all": true,
    "domain_ids": [
      1
    ],
    "domains": [
      {
        "id": 1,
        "name": "example"
      }
    ]
  }
}

400

Malformed domains, or an id the user has no role on.

Media type application/json

The RFC 6749 error shape, used by the NSIN SSO endpoints only. It is deliberately different from Error: OAuth clients match on the machine error code, and only show error_description to a developer.

object

error

required

The machine-readable code.

string

error_description

A human-readable explanation. Never match on this.

string

Example

{
  "error": "invalid_grant",
  "error_description": "authorization code is invalid or expired"
}

401

Missing, malformed, revoked or expired API key — or the owning account is inactive.

Media type application/json

The single error shape used by every endpoint.

object

error

required

Human-readable description of what went wrong.

string

Examples

Example invalidKey

{
  "error": "invalid API key"
}

404

No active grant for this client.

Media type application/json

The RFC 6749 error shape, used by the NSIN SSO endpoints only. It is deliberately different from Error: OAuth clients match on the machine error code, and only show error_description to a developer.

object

error

required

The machine-readable code.

string

error_description

A human-readable explanation. Never match on this.

string

Example

{
  "error": "invalid_grant",
  "error_description": "authorization code is invalid or expired"
}