oAuthClientIdentifiers
oAuthClientIdentifiers was an attribute in an early agent draft. It tied the SCIM record of an agent to the OAuth client the agent uses to authenticate. It is not in the current joint draft.
| Defined in | draft-wahl-scim-agent-schema-01 (expired) |
|---|---|
| Type | complex, multi-valued |
| Required | No, optional |
| Context | Agents that authenticate with OAuth token exchange |
Sub-attributes
| Name | Meaning in the draft |
|---|---|
clientId | A client identifier as in section 2.2 of RFC 6749. Returned by the server. |
issuer | The identity provider of the agent. Same format as the JWT iss claim. |
subject | The identifier of the agent at the identity provider. Same format as the sub claim. |
audiences | Values in the format of the aud claim. |
name, description | Human-readable labels for the OAuth client identity. |
Why it was interesting
The attribute puts the lifecycle record and the access mechanism side by side. A service could look up which agent record stands behind a token's iss and sub, and check whether it is still active. This is the bridge described in SCIM vs OAuth for AI agents.
Status
The draft was an optional attribute for servers that support OAuth token exchange (RFC 8693). It expired on 20 February 2026. The joint draft has no equivalent. The Oracle credentialDiscoveryUri takes a different route, a link to a discovery document. The Okta draft used a subject string to correlate the agent with the sub claim of an inbound OpenID Connect token.
Example
An illustration built from the sub-attribute names in the draft. The values are placeholders.
Source: draft-wahl-scim-agent-schema-01 (datatracker). Drafts change. Read on 18 October 2026. Independent site, not affiliated with the IETF.
Own the name for this category.
agentscim.com is for sale. If you build identity, security or agent tooling, write to me. Serious offers get a reply within 24 hours.
Make an offer