nsindocs Search the docs⌘K
API
  1. Docs
  2. API reference
  3. SSO

Change an app's domain access

puthttps://api.nsin.ir/oauth/grants/{client_id}

Auth: panel session — see API keys.

Replaces the domain selection of an active grant. It takes effect on the app's key and tokens with their next request. Ids outside the domains the user has a role on answer 400 invalid_request.

Path parameters

  • client_idstringrequiredpath

Request body

Content type: application/json · required

  • domainsstring | array of integerrequired

    "all", or a non-empty list of domain ids.

    Fields
    • Option 1string
    • Option 2array of integer

Responses

200The updated row, in the shape of the list.

Content type: application/json

  • client_idstring
  • namestring
  • first_partyboolean
  • scopestring
  • created_atstring (date-time)
  • last_used_atstring | null (date-time)
  • domain_accessDomainAccess

    Which domains a client-bound credential (NSIN SSO) may touch. all true means every domain, including ones added later. Otherwise domain_ids is the selection as stored and domains names the live ones among them; an empty selection is what a revoked grant leaves behind. GET /whoami reports it for SSO tokens and app-minted keys.

    Fields
    • allbooleanrequired
    • domain_idsarray of integer
    • domainsarray of object
      Item fields
      • idinteger
      • namestring
json
{
  "client_id": "string",
  "name": "string",
  "first_party": true,
  "scope": "string",
  "created_at": "2026-01-01T00:00:00Z",
  "last_used_at": "2026-01-01T00:00:00Z",
  "domain_access": {
    "all": true,
    "domain_ids": [
      0
    ],
    "domains": [
      {
        "id": 0,
        "name": "string"
      }
    ]
  }
}
400Malformed domains, or an id the user has no role on.

Content type: application/json

  • errorstringrequired

    The machine-readable code.

  • error_descriptionstring

    A human-readable explanation. Never match on this.

json
{
  "error": "invalid_grant",
  "error_description": "authorization code is invalid or expired"
}
401Missing, malformed, revoked or expired API key. (A valid key whose account has been deactivated gets 403 account is inactive instead.)

Content type: application/json

  • errorstringrequired

    Human-readable description of what went wrong.

json
{
  "error": "invalid API key"
}
404No active grant for this client.

Content type: application/json

  • errorstringrequired

    The machine-readable code.

  • error_descriptionstring

    A human-readable explanation. Never match on this.

json
{
  "error": "invalid_grant",
  "error_description": "authorization code is invalid or expired"
}

Example request

bash
curl -X PUT "https://api.nsin.ir/oauth/grants/%7Bclient_id%7D" \
  -H "Authorization: Bearer $NSIN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "domains": "all"
}'
esc