# Airlock IAM technical OAuth client-registration route
# Date: 2026-11-10

Route: `POST /auth/rest/public/tech-client-registration/oauth2/{authorizationServerId}/register`

This is a server-only parameterized handler absent from the retained IAM client URL builders. It is installed identically on eight Airlock tenants.

## Method contract

With a fresh anonymous `AL_SESS-S`/`CSRFT759-S` session, matching `X-CSRFT759`, and `X-Same-Domain: 1`:

- GET returns the standard 132-byte JSON:API HTTP 405 response.
- OPTIONS returns HTTP 200 with `Allow: POST,OPTIONS` and an empty body.
- A different controlled `{authorizationServerId}` receives the same GET/OPTIONS dispatch, confirming the segment is parameterized rather than an Easylogin-only literal.
- POST without valid CSRF state redirects to `/auth/rest/public/invalid/csrf-token` before handler dispatch.

## POST request and current response

A captured JSON request used fields `client_name`, `grant_types`, `token_endpoint_auth_method`, and `jwks_uri`. With valid anonymous session/CSRF state and authorization-server id `Easylogin`, the handler returned JSON:API HTTP 404 with code `AUTHORIZATION_SERVER_NOT_FOUND`. No OAuth client was created.

Evidence:
- missing-CSRF boundary: `01a1c466-83b7-7405-839c-869841a40621`
- CSRF-valid current contract: `01a1c466-fdb4-77a8-88a1-3e65a703081c`
- earlier empty-object parity: `01a0fa33-4997-710d-8cd6-f9cbb4a87ca7`

## Eight-tenant read-only parity

host | GET 405 | OPTIONS 200 / Allow POST,OPTIONS
--- | --- | ---
infoportal.baloise.de | `01a1c468-2e0a-7736-8ed2-b2105e2b0c68` | `01a1c468-2e91-70ef-8c7d-94227fa2bc36`
maklerportal.baloise.de | `01a1c468-38d6-7369-a971-aa50409f3005` | `01a1c468-395e-75b2-a5fd-bf374f0fe83a`
si-portal.baloise.de | `01a1c468-451f-70dd-9b98-530bb7f5565f` | `01a1c468-45a8-768d-8614-cba633d87956`
vertriebsservice.baloise.de | `01a1c468-50a7-7398-b2e7-7fb36bb57949` | `01a1c468-5133-702c-972e-f3002ac035e6`
zeus-portal.baloise.de | `01a1c468-5e28-7101-91f8-9fc99a23ab4c` | `01a1c468-5eb2-7203-b73a-5ea5757b7ceb`
mein-portal.baloise.de | `01a1c468-6aac-729e-b438-e8f14ccc20ac` | `01a1c468-6b39-70b4-a033-8276a136911b`
mein-portal-registrierung.baloise.de | `01a1c468-7586-70b3-b32f-887f35692588` | `01a1c468-7610-7771-b4f6-196dec347e98`
va.baloise.de | `01a1c468-8213-7020-90d4-cd644ff036d2` | `01a1c468-82a2-718c-b372-959c5c8f4458`

The route is represented through read-only method discovery and the existing unsuccessful handler response; no successful registration operation was performed.