# coding=utf-8
# *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
# *** Do not edit by hand unless you're certain you know what you are doing! ***

import copy
import warnings
import pulumi
import pulumi.runtime
from typing import Any, Mapping, Optional, Sequence, Union, overload
from .. import _utilities
from . import outputs
from ._inputs import *

__all__ = ['OAuthArgs', 'OAuth']

@pulumi.input_type
class OAuthArgs:
    def __init__(__self__, *,
                 label: pulumi.Input[str],
                 type: pulumi.Input[str],
                 accessibility_error_redirect_url: Optional[pulumi.Input[str]] = None,
                 accessibility_login_redirect_url: Optional[pulumi.Input[str]] = None,
                 accessibility_self_service: Optional[pulumi.Input[bool]] = None,
                 admin_note: Optional[pulumi.Input[str]] = None,
                 app_links_json: Optional[pulumi.Input[str]] = None,
                 app_settings_json: Optional[pulumi.Input[str]] = None,
                 authentication_policy: Optional[pulumi.Input[str]] = None,
                 auto_key_rotation: Optional[pulumi.Input[bool]] = None,
                 auto_submit_toolbar: Optional[pulumi.Input[bool]] = None,
                 client_basic_secret: Optional[pulumi.Input[str]] = None,
                 client_id: Optional[pulumi.Input[str]] = None,
                 client_uri: Optional[pulumi.Input[str]] = None,
                 consent_method: Optional[pulumi.Input[str]] = None,
                 enduser_note: Optional[pulumi.Input[str]] = None,
                 grant_types: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                 groups_claim: Optional[pulumi.Input['OAuthGroupsClaimArgs']] = None,
                 hide_ios: Optional[pulumi.Input[bool]] = None,
                 hide_web: Optional[pulumi.Input[bool]] = None,
                 implicit_assignment: Optional[pulumi.Input[bool]] = None,
                 issuer_mode: Optional[pulumi.Input[str]] = None,
                 jwks: Optional[pulumi.Input[Sequence[pulumi.Input['OAuthJwkArgs']]]] = None,
                 jwks_uri: Optional[pulumi.Input[str]] = None,
                 login_mode: Optional[pulumi.Input[str]] = None,
                 login_scopes: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                 login_uri: Optional[pulumi.Input[str]] = None,
                 logo: Optional[pulumi.Input[str]] = None,
                 logo_uri: Optional[pulumi.Input[str]] = None,
                 omit_secret: Optional[pulumi.Input[bool]] = None,
                 pkce_required: Optional[pulumi.Input[bool]] = None,
                 policy_uri: Optional[pulumi.Input[str]] = None,
                 post_logout_redirect_uris: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                 profile: Optional[pulumi.Input[str]] = None,
                 redirect_uris: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                 refresh_token_leeway: Optional[pulumi.Input[int]] = None,
                 refresh_token_rotation: Optional[pulumi.Input[str]] = None,
                 response_types: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                 status: Optional[pulumi.Input[str]] = None,
                 token_endpoint_auth_method: Optional[pulumi.Input[str]] = None,
                 tos_uri: Optional[pulumi.Input[str]] = None,
                 user_name_template: Optional[pulumi.Input[str]] = None,
                 user_name_template_push_status: Optional[pulumi.Input[str]] = None,
                 user_name_template_suffix: Optional[pulumi.Input[str]] = None,
                 user_name_template_type: Optional[pulumi.Input[str]] = None,
                 wildcard_redirect: Optional[pulumi.Input[str]] = None):
        """
        The set of arguments for constructing a OAuth resource.
        :param pulumi.Input[str] label: The Application's display name.
        :param pulumi.Input[str] type: The type of OAuth application. Valid values: `"web"`, `"native"`, `"browser"`, `"service"`. For SPA apps use `browser`.
        :param pulumi.Input[str] accessibility_error_redirect_url: Custom error page URL.
        :param pulumi.Input[str] accessibility_login_redirect_url: Custom login page for this application.
        :param pulumi.Input[bool] accessibility_self_service: Enable self-service. By default, it is `false`.
        :param pulumi.Input[str] admin_note: Application notes for admins.
        :param pulumi.Input[str] app_links_json: Displays specific appLinks for the app. The value for each application link should be boolean.
        :param pulumi.Input[str] app_settings_json: Application settings in JSON format.
        :param pulumi.Input[str] authentication_policy: The ID of the associated `app_signon_policy`. If this property is removed from the application the `default` sign-on-policy will be associated with this application.
        :param pulumi.Input[bool] auto_key_rotation: Requested key rotation mode.  If
               `auto_key_rotation` isn't specified, the client automatically opts in for Okta's
               key rotation. You can update this property via the API or via the administrator
               UI.
               See: https://developer.okta.com/docs/reference/api/apps/#oauth-credential-object
        :param pulumi.Input[bool] auto_submit_toolbar: Display auto submit toolbar.
        :param pulumi.Input[str] client_basic_secret: The user provided OAuth client secret key value, this can be set when `token_endpoint_auth_method` is `"client_secret_basic"`. This does nothing when `omit_secret` is set to true.
        :param pulumi.Input[str] client_id: OAuth client ID. If set during creation, app is created with this id. See: https://developer.okta.com/docs/reference/api/apps/#oauth-credential-object
        :param pulumi.Input[str] client_uri: URI to a web page providing information about the client.
        :param pulumi.Input[str] consent_method: Indicates whether user consent is required or implicit. Valid values: `"REQUIRED"`, `"TRUSTED"`. Default value is `"TRUSTED"`.
        :param pulumi.Input[str] enduser_note: Application notes for end users.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] grant_types: List of OAuth 2.0 grant types. Conditional validation params found [here](https://developer.okta.com/docs/api/resources/apps#credentials-settings-details).
               Defaults to minimum requirements per app type. Valid values: `"authorization_code"`, `"implicit"`, `"password"`, `"refresh_token"`, `"client_credentials"`,
               `"urn:ietf:params:oauth:grant-type:saml2-bearer"` (*Early Access Property*), `"urn:ietf:params:oauth:grant-type:token-exchange"` (*Early Access Property*),
               `"interaction_code"` (*OIE only*).
        :param pulumi.Input['OAuthGroupsClaimArgs'] groups_claim: Groups claim for an OpenID Connect client application. **IMPORTANT**: this argument is ignored when Okta API authentication is done with OAuth 2.0 credentials
        :param pulumi.Input[bool] hide_ios: Do not display application icon on mobile app.
        :param pulumi.Input[bool] hide_web: Do not display application icon to users.
        :param pulumi.Input[bool] implicit_assignment: *Early Access Property*. Enables [Federation Broker Mode](https://help.okta.com/en/prod/Content/Topics/Apps/apps-fbm-enable.htm). When this mode is enabled, `users` and `groups` arguments are ignored.
        :param pulumi.Input[str] issuer_mode: Indicates whether the Okta Authorization Server uses the original Okta org domain URL or a custom domain URL as the issuer of ID token for this client.
               Valid values: `"CUSTOM_URL"`,`"ORG_URL"` or `"DYNAMIC"`. Default is `"ORG_URL"`.
        :param pulumi.Input[Sequence[pulumi.Input['OAuthJwkArgs']]] jwks: JSON Web Key set. Multiple jwks are supported[Admin Console JWK Reference](https://developer.okta.com/docs/guides/implement-oauth-for-okta-serviceapp/main/#generate-the-jwk-in-the-admin-console). Use kty=RSA e=[value] n=[value] for RSA jwks, and kty=EC x=[value] y=[value] for EC jwks
        :param pulumi.Input[str] jwks_uri: URL of the custom authorization server's JSON Web Key Set document.
        :param pulumi.Input[str] login_mode: The type of Idp-Initiated login that the client supports, if any. Valid values: `"DISABLED"`, `"SPEC"`, `"OKTA"`. Default is `"DISABLED"`.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] login_scopes: List of scopes to use for the request. Valid values: `"openid"`, `"profile"`, `"email"`, `"address"`, `"phone"`. Required when `login_mode` is NOT `DISABLED`.
        :param pulumi.Input[str] login_uri: URI that initiates login. Required when `login_mode` is NOT `DISABLED`.
        :param pulumi.Input[str] logo: Local file path to the logo. The file must be in PNG, JPG, or GIF format, and less than 1 MB in size.
        :param pulumi.Input[str] logo_uri: URI that references a logo for the client.
        :param pulumi.Input[bool] omit_secret: This tells the provider not manage the `client_secret` value in state. When this is false (the default), it will cause the auto-generated `client_secret` to be persisted in the `client_secret` attribute in state. This also means that every time an update to this app is run, this value is also set on the API. If this changes from false => true, the `client_secret` is dropped from state and the secret at the time of the apply is what remains. If this is ever changes from true => false your app will be recreated, due to the need to regenerate a secret we can store in state.
        :param pulumi.Input[bool] pkce_required: Require Proof Key for Code Exchange (PKCE) for
               additional verification.  If `pkce_required` isn't specified when adding a new
               application, Okta sets it to `true` by default for `"browser"` and `"native"`
               application types.
               See https://developer.okta.com/docs/reference/api/apps/#oauth-credential-object
        :param pulumi.Input[str] policy_uri: URI to web page providing client policy document.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] post_logout_redirect_uris: List of URIs for redirection after logout.
        :param pulumi.Input[str] profile: Custom JSON that represents an OAuth application's profile.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] redirect_uris: List of URIs for use in the redirect-based flow. This is required for all application types except service.
        :param pulumi.Input[int] refresh_token_leeway: Grace period for token rotation. Valid values: 0 to 60 seconds.
        :param pulumi.Input[str] refresh_token_rotation: Refresh token rotation behavior. Valid values: `"STATIC"` or `"ROTATE"`.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] response_types: List of OAuth 2.0 response type strings. Array
               values of `"code"`, `"token"`, `"id_token"`. The `grant_types` and `response_types`
               values described are partially orthogonal, as they refer to arguments
               passed to different endpoints in the OAuth 2.0 protocol (opens new window).
               However, they are related in that the `grant_types` available to a client
               influence the `response_types` that the client is allowed to use, and vice versa.
               For instance, a grant_types value that includes authorization_code implies a
               `response_types` value that includes code, as both values are defined as part of
               the OAuth 2.0 authorization code grant.
               See: https://developer.okta.com/docs/reference/api/apps/#add-oauth-2-0-client-application
        :param pulumi.Input[str] status: The status of the application, by default, it is `"ACTIVE"`.
        :param pulumi.Input[str] token_endpoint_auth_method: Requested authentication method for
               the token endpoint. It can be set to `"none"`, `"client_secret_post"`,
               `"client_secret_basic"`, `"client_secret_jwt"`, `"private_key_jwt"`.  Use
               `pkce_required` to require PKCE for your confidential clients using the
               Authorization Code flow. If `"token_endpoint_auth_method"` is `"none"`,
               `pkce_required` needs to be `true`. If `pkce_required` isn't specified when
               adding a new application, Okta sets it to `true` by default for `"browser"` and
               `"native"` application types.
               See https://developer.okta.com/docs/reference/api/apps/#oauth-credential-object
        :param pulumi.Input[str] tos_uri: URI to web page providing client tos (terms of service).
        :param pulumi.Input[str] user_name_template: Username template. Default: `"${source.login}"`
        :param pulumi.Input[str] user_name_template_push_status: Push username on update. Valid values: `"PUSH"` and `"DONT_PUSH"`.
        :param pulumi.Input[str] user_name_template_suffix: Username template suffix.
        :param pulumi.Input[str] user_name_template_type: Username template type. Default: `"BUILT_IN"`.
        :param pulumi.Input[str] wildcard_redirect: *Early Access Property*. Indicates if the client is allowed to use wildcard matching of `redirect_uris`. Valid values: `"DISABLED"`, `"SUBDOMAIN"`. Default value is `"DISABLED"`.
        """
        pulumi.set(__self__, "label", label)
        pulumi.set(__self__, "type", type)
        if accessibility_error_redirect_url is not None:
            pulumi.set(__self__, "accessibility_error_redirect_url", accessibility_error_redirect_url)
        if accessibility_login_redirect_url is not None:
            pulumi.set(__self__, "accessibility_login_redirect_url", accessibility_login_redirect_url)
        if accessibility_self_service is not None:
            pulumi.set(__self__, "accessibility_self_service", accessibility_self_service)
        if admin_note is not None:
            pulumi.set(__self__, "admin_note", admin_note)
        if app_links_json is not None:
            pulumi.set(__self__, "app_links_json", app_links_json)
        if app_settings_json is not None:
            pulumi.set(__self__, "app_settings_json", app_settings_json)
        if authentication_policy is not None:
            pulumi.set(__self__, "authentication_policy", authentication_policy)
        if auto_key_rotation is not None:
            pulumi.set(__self__, "auto_key_rotation", auto_key_rotation)
        if auto_submit_toolbar is not None:
            pulumi.set(__self__, "auto_submit_toolbar", auto_submit_toolbar)
        if client_basic_secret is not None:
            pulumi.set(__self__, "client_basic_secret", client_basic_secret)
        if client_id is not None:
            pulumi.set(__self__, "client_id", client_id)
        if client_uri is not None:
            pulumi.set(__self__, "client_uri", client_uri)
        if consent_method is not None:
            pulumi.set(__self__, "consent_method", consent_method)
        if enduser_note is not None:
            pulumi.set(__self__, "enduser_note", enduser_note)
        if grant_types is not None:
            pulumi.set(__self__, "grant_types", grant_types)
        if groups_claim is not None:
            pulumi.set(__self__, "groups_claim", groups_claim)
        if hide_ios is not None:
            pulumi.set(__self__, "hide_ios", hide_ios)
        if hide_web is not None:
            pulumi.set(__self__, "hide_web", hide_web)
        if implicit_assignment is not None:
            pulumi.set(__self__, "implicit_assignment", implicit_assignment)
        if issuer_mode is not None:
            pulumi.set(__self__, "issuer_mode", issuer_mode)
        if jwks is not None:
            pulumi.set(__self__, "jwks", jwks)
        if jwks_uri is not None:
            pulumi.set(__self__, "jwks_uri", jwks_uri)
        if login_mode is not None:
            pulumi.set(__self__, "login_mode", login_mode)
        if login_scopes is not None:
            pulumi.set(__self__, "login_scopes", login_scopes)
        if login_uri is not None:
            pulumi.set(__self__, "login_uri", login_uri)
        if logo is not None:
            pulumi.set(__self__, "logo", logo)
        if logo_uri is not None:
            pulumi.set(__self__, "logo_uri", logo_uri)
        if omit_secret is not None:
            pulumi.set(__self__, "omit_secret", omit_secret)
        if pkce_required is not None:
            pulumi.set(__self__, "pkce_required", pkce_required)
        if policy_uri is not None:
            pulumi.set(__self__, "policy_uri", policy_uri)
        if post_logout_redirect_uris is not None:
            pulumi.set(__self__, "post_logout_redirect_uris", post_logout_redirect_uris)
        if profile is not None:
            pulumi.set(__self__, "profile", profile)
        if redirect_uris is not None:
            pulumi.set(__self__, "redirect_uris", redirect_uris)
        if refresh_token_leeway is not None:
            pulumi.set(__self__, "refresh_token_leeway", refresh_token_leeway)
        if refresh_token_rotation is not None:
            pulumi.set(__self__, "refresh_token_rotation", refresh_token_rotation)
        if response_types is not None:
            pulumi.set(__self__, "response_types", response_types)
        if status is not None:
            pulumi.set(__self__, "status", status)
        if token_endpoint_auth_method is not None:
            pulumi.set(__self__, "token_endpoint_auth_method", token_endpoint_auth_method)
        if tos_uri is not None:
            pulumi.set(__self__, "tos_uri", tos_uri)
        if user_name_template is not None:
            pulumi.set(__self__, "user_name_template", user_name_template)
        if user_name_template_push_status is not None:
            pulumi.set(__self__, "user_name_template_push_status", user_name_template_push_status)
        if user_name_template_suffix is not None:
            pulumi.set(__self__, "user_name_template_suffix", user_name_template_suffix)
        if user_name_template_type is not None:
            pulumi.set(__self__, "user_name_template_type", user_name_template_type)
        if wildcard_redirect is not None:
            pulumi.set(__self__, "wildcard_redirect", wildcard_redirect)

    @property
    @pulumi.getter
    def label(self) -> pulumi.Input[str]:
        """
        The Application's display name.
        """
        return pulumi.get(self, "label")

    @label.setter
    def label(self, value: pulumi.Input[str]):
        pulumi.set(self, "label", value)

    @property
    @pulumi.getter
    def type(self) -> pulumi.Input[str]:
        """
        The type of OAuth application. Valid values: `"web"`, `"native"`, `"browser"`, `"service"`. For SPA apps use `browser`.
        """
        return pulumi.get(self, "type")

    @type.setter
    def type(self, value: pulumi.Input[str]):
        pulumi.set(self, "type", value)

    @property
    @pulumi.getter(name="accessibilityErrorRedirectUrl")
    def accessibility_error_redirect_url(self) -> Optional[pulumi.Input[str]]:
        """
        Custom error page URL.
        """
        return pulumi.get(self, "accessibility_error_redirect_url")

    @accessibility_error_redirect_url.setter
    def accessibility_error_redirect_url(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "accessibility_error_redirect_url", value)

    @property
    @pulumi.getter(name="accessibilityLoginRedirectUrl")
    def accessibility_login_redirect_url(self) -> Optional[pulumi.Input[str]]:
        """
        Custom login page for this application.
        """
        return pulumi.get(self, "accessibility_login_redirect_url")

    @accessibility_login_redirect_url.setter
    def accessibility_login_redirect_url(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "accessibility_login_redirect_url", value)

    @property
    @pulumi.getter(name="accessibilitySelfService")
    def accessibility_self_service(self) -> Optional[pulumi.Input[bool]]:
        """
        Enable self-service. By default, it is `false`.
        """
        return pulumi.get(self, "accessibility_self_service")

    @accessibility_self_service.setter
    def accessibility_self_service(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "accessibility_self_service", value)

    @property
    @pulumi.getter(name="adminNote")
    def admin_note(self) -> Optional[pulumi.Input[str]]:
        """
        Application notes for admins.
        """
        return pulumi.get(self, "admin_note")

    @admin_note.setter
    def admin_note(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "admin_note", value)

    @property
    @pulumi.getter(name="appLinksJson")
    def app_links_json(self) -> Optional[pulumi.Input[str]]:
        """
        Displays specific appLinks for the app. The value for each application link should be boolean.
        """
        return pulumi.get(self, "app_links_json")

    @app_links_json.setter
    def app_links_json(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "app_links_json", value)

    @property
    @pulumi.getter(name="appSettingsJson")
    def app_settings_json(self) -> Optional[pulumi.Input[str]]:
        """
        Application settings in JSON format.
        """
        return pulumi.get(self, "app_settings_json")

    @app_settings_json.setter
    def app_settings_json(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "app_settings_json", value)

    @property
    @pulumi.getter(name="authenticationPolicy")
    def authentication_policy(self) -> Optional[pulumi.Input[str]]:
        """
        The ID of the associated `app_signon_policy`. If this property is removed from the application the `default` sign-on-policy will be associated with this application.
        """
        return pulumi.get(self, "authentication_policy")

    @authentication_policy.setter
    def authentication_policy(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "authentication_policy", value)

    @property
    @pulumi.getter(name="autoKeyRotation")
    def auto_key_rotation(self) -> Optional[pulumi.Input[bool]]:
        """
        Requested key rotation mode.  If
        `auto_key_rotation` isn't specified, the client automatically opts in for Okta's
        key rotation. You can update this property via the API or via the administrator
        UI.
        See: https://developer.okta.com/docs/reference/api/apps/#oauth-credential-object
        """
        return pulumi.get(self, "auto_key_rotation")

    @auto_key_rotation.setter
    def auto_key_rotation(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "auto_key_rotation", value)

    @property
    @pulumi.getter(name="autoSubmitToolbar")
    def auto_submit_toolbar(self) -> Optional[pulumi.Input[bool]]:
        """
        Display auto submit toolbar.
        """
        return pulumi.get(self, "auto_submit_toolbar")

    @auto_submit_toolbar.setter
    def auto_submit_toolbar(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "auto_submit_toolbar", value)

    @property
    @pulumi.getter(name="clientBasicSecret")
    def client_basic_secret(self) -> Optional[pulumi.Input[str]]:
        """
        The user provided OAuth client secret key value, this can be set when `token_endpoint_auth_method` is `"client_secret_basic"`. This does nothing when `omit_secret` is set to true.
        """
        return pulumi.get(self, "client_basic_secret")

    @client_basic_secret.setter
    def client_basic_secret(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "client_basic_secret", value)

    @property
    @pulumi.getter(name="clientId")
    def client_id(self) -> Optional[pulumi.Input[str]]:
        """
        OAuth client ID. If set during creation, app is created with this id. See: https://developer.okta.com/docs/reference/api/apps/#oauth-credential-object
        """
        return pulumi.get(self, "client_id")

    @client_id.setter
    def client_id(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "client_id", value)

    @property
    @pulumi.getter(name="clientUri")
    def client_uri(self) -> Optional[pulumi.Input[str]]:
        """
        URI to a web page providing information about the client.
        """
        return pulumi.get(self, "client_uri")

    @client_uri.setter
    def client_uri(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "client_uri", value)

    @property
    @pulumi.getter(name="consentMethod")
    def consent_method(self) -> Optional[pulumi.Input[str]]:
        """
        Indicates whether user consent is required or implicit. Valid values: `"REQUIRED"`, `"TRUSTED"`. Default value is `"TRUSTED"`.
        """
        return pulumi.get(self, "consent_method")

    @consent_method.setter
    def consent_method(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "consent_method", value)

    @property
    @pulumi.getter(name="enduserNote")
    def enduser_note(self) -> Optional[pulumi.Input[str]]:
        """
        Application notes for end users.
        """
        return pulumi.get(self, "enduser_note")

    @enduser_note.setter
    def enduser_note(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "enduser_note", value)

    @property
    @pulumi.getter(name="grantTypes")
    def grant_types(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        List of OAuth 2.0 grant types. Conditional validation params found [here](https://developer.okta.com/docs/api/resources/apps#credentials-settings-details).
        Defaults to minimum requirements per app type. Valid values: `"authorization_code"`, `"implicit"`, `"password"`, `"refresh_token"`, `"client_credentials"`,
        `"urn:ietf:params:oauth:grant-type:saml2-bearer"` (*Early Access Property*), `"urn:ietf:params:oauth:grant-type:token-exchange"` (*Early Access Property*),
        `"interaction_code"` (*OIE only*).
        """
        return pulumi.get(self, "grant_types")

    @grant_types.setter
    def grant_types(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "grant_types", value)

    @property
    @pulumi.getter(name="groupsClaim")
    def groups_claim(self) -> Optional[pulumi.Input['OAuthGroupsClaimArgs']]:
        """
        Groups claim for an OpenID Connect client application. **IMPORTANT**: this argument is ignored when Okta API authentication is done with OAuth 2.0 credentials
        """
        return pulumi.get(self, "groups_claim")

    @groups_claim.setter
    def groups_claim(self, value: Optional[pulumi.Input['OAuthGroupsClaimArgs']]):
        pulumi.set(self, "groups_claim", value)

    @property
    @pulumi.getter(name="hideIos")
    def hide_ios(self) -> Optional[pulumi.Input[bool]]:
        """
        Do not display application icon on mobile app.
        """
        return pulumi.get(self, "hide_ios")

    @hide_ios.setter
    def hide_ios(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "hide_ios", value)

    @property
    @pulumi.getter(name="hideWeb")
    def hide_web(self) -> Optional[pulumi.Input[bool]]:
        """
        Do not display application icon to users.
        """
        return pulumi.get(self, "hide_web")

    @hide_web.setter
    def hide_web(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "hide_web", value)

    @property
    @pulumi.getter(name="implicitAssignment")
    def implicit_assignment(self) -> Optional[pulumi.Input[bool]]:
        """
        *Early Access Property*. Enables [Federation Broker Mode](https://help.okta.com/en/prod/Content/Topics/Apps/apps-fbm-enable.htm). When this mode is enabled, `users` and `groups` arguments are ignored.
        """
        return pulumi.get(self, "implicit_assignment")

    @implicit_assignment.setter
    def implicit_assignment(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "implicit_assignment", value)

    @property
    @pulumi.getter(name="issuerMode")
    def issuer_mode(self) -> Optional[pulumi.Input[str]]:
        """
        Indicates whether the Okta Authorization Server uses the original Okta org domain URL or a custom domain URL as the issuer of ID token for this client.
        Valid values: `"CUSTOM_URL"`,`"ORG_URL"` or `"DYNAMIC"`. Default is `"ORG_URL"`.
        """
        return pulumi.get(self, "issuer_mode")

    @issuer_mode.setter
    def issuer_mode(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "issuer_mode", value)

    @property
    @pulumi.getter
    def jwks(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['OAuthJwkArgs']]]]:
        """
        JSON Web Key set. Multiple jwks are supported[Admin Console JWK Reference](https://developer.okta.com/docs/guides/implement-oauth-for-okta-serviceapp/main/#generate-the-jwk-in-the-admin-console). Use kty=RSA e=[value] n=[value] for RSA jwks, and kty=EC x=[value] y=[value] for EC jwks
        """
        return pulumi.get(self, "jwks")

    @jwks.setter
    def jwks(self, value: Optional[pulumi.Input[Sequence[pulumi.Input['OAuthJwkArgs']]]]):
        pulumi.set(self, "jwks", value)

    @property
    @pulumi.getter(name="jwksUri")
    def jwks_uri(self) -> Optional[pulumi.Input[str]]:
        """
        URL of the custom authorization server's JSON Web Key Set document.
        """
        return pulumi.get(self, "jwks_uri")

    @jwks_uri.setter
    def jwks_uri(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "jwks_uri", value)

    @property
    @pulumi.getter(name="loginMode")
    def login_mode(self) -> Optional[pulumi.Input[str]]:
        """
        The type of Idp-Initiated login that the client supports, if any. Valid values: `"DISABLED"`, `"SPEC"`, `"OKTA"`. Default is `"DISABLED"`.
        """
        return pulumi.get(self, "login_mode")

    @login_mode.setter
    def login_mode(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "login_mode", value)

    @property
    @pulumi.getter(name="loginScopes")
    def login_scopes(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        List of scopes to use for the request. Valid values: `"openid"`, `"profile"`, `"email"`, `"address"`, `"phone"`. Required when `login_mode` is NOT `DISABLED`.
        """
        return pulumi.get(self, "login_scopes")

    @login_scopes.setter
    def login_scopes(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "login_scopes", value)

    @property
    @pulumi.getter(name="loginUri")
    def login_uri(self) -> Optional[pulumi.Input[str]]:
        """
        URI that initiates login. Required when `login_mode` is NOT `DISABLED`.
        """
        return pulumi.get(self, "login_uri")

    @login_uri.setter
    def login_uri(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "login_uri", value)

    @property
    @pulumi.getter
    def logo(self) -> Optional[pulumi.Input[str]]:
        """
        Local file path to the logo. The file must be in PNG, JPG, or GIF format, and less than 1 MB in size.
        """
        return pulumi.get(self, "logo")

    @logo.setter
    def logo(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "logo", value)

    @property
    @pulumi.getter(name="logoUri")
    def logo_uri(self) -> Optional[pulumi.Input[str]]:
        """
        URI that references a logo for the client.
        """
        return pulumi.get(self, "logo_uri")

    @logo_uri.setter
    def logo_uri(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "logo_uri", value)

    @property
    @pulumi.getter(name="omitSecret")
    def omit_secret(self) -> Optional[pulumi.Input[bool]]:
        """
        This tells the provider not manage the `client_secret` value in state. When this is false (the default), it will cause the auto-generated `client_secret` to be persisted in the `client_secret` attribute in state. This also means that every time an update to this app is run, this value is also set on the API. If this changes from false => true, the `client_secret` is dropped from state and the secret at the time of the apply is what remains. If this is ever changes from true => false your app will be recreated, due to the need to regenerate a secret we can store in state.
        """
        return pulumi.get(self, "omit_secret")

    @omit_secret.setter
    def omit_secret(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "omit_secret", value)

    @property
    @pulumi.getter(name="pkceRequired")
    def pkce_required(self) -> Optional[pulumi.Input[bool]]:
        """
        Require Proof Key for Code Exchange (PKCE) for
        additional verification.  If `pkce_required` isn't specified when adding a new
        application, Okta sets it to `true` by default for `"browser"` and `"native"`
        application types.
        See https://developer.okta.com/docs/reference/api/apps/#oauth-credential-object
        """
        return pulumi.get(self, "pkce_required")

    @pkce_required.setter
    def pkce_required(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "pkce_required", value)

    @property
    @pulumi.getter(name="policyUri")
    def policy_uri(self) -> Optional[pulumi.Input[str]]:
        """
        URI to web page providing client policy document.
        """
        return pulumi.get(self, "policy_uri")

    @policy_uri.setter
    def policy_uri(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "policy_uri", value)

    @property
    @pulumi.getter(name="postLogoutRedirectUris")
    def post_logout_redirect_uris(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        List of URIs for redirection after logout.
        """
        return pulumi.get(self, "post_logout_redirect_uris")

    @post_logout_redirect_uris.setter
    def post_logout_redirect_uris(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "post_logout_redirect_uris", value)

    @property
    @pulumi.getter
    def profile(self) -> Optional[pulumi.Input[str]]:
        """
        Custom JSON that represents an OAuth application's profile.
        """
        return pulumi.get(self, "profile")

    @profile.setter
    def profile(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "profile", value)

    @property
    @pulumi.getter(name="redirectUris")
    def redirect_uris(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        List of URIs for use in the redirect-based flow. This is required for all application types except service.
        """
        return pulumi.get(self, "redirect_uris")

    @redirect_uris.setter
    def redirect_uris(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "redirect_uris", value)

    @property
    @pulumi.getter(name="refreshTokenLeeway")
    def refresh_token_leeway(self) -> Optional[pulumi.Input[int]]:
        """
        Grace period for token rotation. Valid values: 0 to 60 seconds.
        """
        return pulumi.get(self, "refresh_token_leeway")

    @refresh_token_leeway.setter
    def refresh_token_leeway(self, value: Optional[pulumi.Input[int]]):
        pulumi.set(self, "refresh_token_leeway", value)

    @property
    @pulumi.getter(name="refreshTokenRotation")
    def refresh_token_rotation(self) -> Optional[pulumi.Input[str]]:
        """
        Refresh token rotation behavior. Valid values: `"STATIC"` or `"ROTATE"`.
        """
        return pulumi.get(self, "refresh_token_rotation")

    @refresh_token_rotation.setter
    def refresh_token_rotation(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "refresh_token_rotation", value)

    @property
    @pulumi.getter(name="responseTypes")
    def response_types(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        List of OAuth 2.0 response type strings. Array
        values of `"code"`, `"token"`, `"id_token"`. The `grant_types` and `response_types`
        values described are partially orthogonal, as they refer to arguments
        passed to different endpoints in the OAuth 2.0 protocol (opens new window).
        However, they are related in that the `grant_types` available to a client
        influence the `response_types` that the client is allowed to use, and vice versa.
        For instance, a grant_types value that includes authorization_code implies a
        `response_types` value that includes code, as both values are defined as part of
        the OAuth 2.0 authorization code grant.
        See: https://developer.okta.com/docs/reference/api/apps/#add-oauth-2-0-client-application
        """
        return pulumi.get(self, "response_types")

    @response_types.setter
    def response_types(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "response_types", value)

    @property
    @pulumi.getter
    def status(self) -> Optional[pulumi.Input[str]]:
        """
        The status of the application, by default, it is `"ACTIVE"`.
        """
        return pulumi.get(self, "status")

    @status.setter
    def status(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "status", value)

    @property
    @pulumi.getter(name="tokenEndpointAuthMethod")
    def token_endpoint_auth_method(self) -> Optional[pulumi.Input[str]]:
        """
        Requested authentication method for
        the token endpoint. It can be set to `"none"`, `"client_secret_post"`,
        `"client_secret_basic"`, `"client_secret_jwt"`, `"private_key_jwt"`.  Use
        `pkce_required` to require PKCE for your confidential clients using the
        Authorization Code flow. If `"token_endpoint_auth_method"` is `"none"`,
        `pkce_required` needs to be `true`. If `pkce_required` isn't specified when
        adding a new application, Okta sets it to `true` by default for `"browser"` and
        `"native"` application types.
        See https://developer.okta.com/docs/reference/api/apps/#oauth-credential-object
        """
        return pulumi.get(self, "token_endpoint_auth_method")

    @token_endpoint_auth_method.setter
    def token_endpoint_auth_method(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "token_endpoint_auth_method", value)

    @property
    @pulumi.getter(name="tosUri")
    def tos_uri(self) -> Optional[pulumi.Input[str]]:
        """
        URI to web page providing client tos (terms of service).
        """
        return pulumi.get(self, "tos_uri")

    @tos_uri.setter
    def tos_uri(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "tos_uri", value)

    @property
    @pulumi.getter(name="userNameTemplate")
    def user_name_template(self) -> Optional[pulumi.Input[str]]:
        """
        Username template. Default: `"${source.login}"`
        """
        return pulumi.get(self, "user_name_template")

    @user_name_template.setter
    def user_name_template(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "user_name_template", value)

    @property
    @pulumi.getter(name="userNameTemplatePushStatus")
    def user_name_template_push_status(self) -> Optional[pulumi.Input[str]]:
        """
        Push username on update. Valid values: `"PUSH"` and `"DONT_PUSH"`.
        """
        return pulumi.get(self, "user_name_template_push_status")

    @user_name_template_push_status.setter
    def user_name_template_push_status(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "user_name_template_push_status", value)

    @property
    @pulumi.getter(name="userNameTemplateSuffix")
    def user_name_template_suffix(self) -> Optional[pulumi.Input[str]]:
        """
        Username template suffix.
        """
        return pulumi.get(self, "user_name_template_suffix")

    @user_name_template_suffix.setter
    def user_name_template_suffix(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "user_name_template_suffix", value)

    @property
    @pulumi.getter(name="userNameTemplateType")
    def user_name_template_type(self) -> Optional[pulumi.Input[str]]:
        """
        Username template type. Default: `"BUILT_IN"`.
        """
        return pulumi.get(self, "user_name_template_type")

    @user_name_template_type.setter
    def user_name_template_type(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "user_name_template_type", value)

    @property
    @pulumi.getter(name="wildcardRedirect")
    def wildcard_redirect(self) -> Optional[pulumi.Input[str]]:
        """
        *Early Access Property*. Indicates if the client is allowed to use wildcard matching of `redirect_uris`. Valid values: `"DISABLED"`, `"SUBDOMAIN"`. Default value is `"DISABLED"`.
        """
        return pulumi.get(self, "wildcard_redirect")

    @wildcard_redirect.setter
    def wildcard_redirect(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "wildcard_redirect", value)


@pulumi.input_type
class _OAuthState:
    def __init__(__self__, *,
                 accessibility_error_redirect_url: Optional[pulumi.Input[str]] = None,
                 accessibility_login_redirect_url: Optional[pulumi.Input[str]] = None,
                 accessibility_self_service: Optional[pulumi.Input[bool]] = None,
                 admin_note: Optional[pulumi.Input[str]] = None,
                 app_links_json: Optional[pulumi.Input[str]] = None,
                 app_settings_json: Optional[pulumi.Input[str]] = None,
                 authentication_policy: Optional[pulumi.Input[str]] = None,
                 auto_key_rotation: Optional[pulumi.Input[bool]] = None,
                 auto_submit_toolbar: Optional[pulumi.Input[bool]] = None,
                 client_basic_secret: Optional[pulumi.Input[str]] = None,
                 client_id: Optional[pulumi.Input[str]] = None,
                 client_secret: Optional[pulumi.Input[str]] = None,
                 client_uri: Optional[pulumi.Input[str]] = None,
                 consent_method: Optional[pulumi.Input[str]] = None,
                 enduser_note: Optional[pulumi.Input[str]] = None,
                 grant_types: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                 groups_claim: Optional[pulumi.Input['OAuthGroupsClaimArgs']] = None,
                 hide_ios: Optional[pulumi.Input[bool]] = None,
                 hide_web: Optional[pulumi.Input[bool]] = None,
                 implicit_assignment: Optional[pulumi.Input[bool]] = None,
                 issuer_mode: Optional[pulumi.Input[str]] = None,
                 jwks: Optional[pulumi.Input[Sequence[pulumi.Input['OAuthJwkArgs']]]] = None,
                 jwks_uri: Optional[pulumi.Input[str]] = None,
                 label: Optional[pulumi.Input[str]] = None,
                 login_mode: Optional[pulumi.Input[str]] = None,
                 login_scopes: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                 login_uri: Optional[pulumi.Input[str]] = None,
                 logo: Optional[pulumi.Input[str]] = None,
                 logo_uri: Optional[pulumi.Input[str]] = None,
                 logo_url: Optional[pulumi.Input[str]] = None,
                 name: Optional[pulumi.Input[str]] = None,
                 omit_secret: Optional[pulumi.Input[bool]] = None,
                 pkce_required: Optional[pulumi.Input[bool]] = None,
                 policy_uri: Optional[pulumi.Input[str]] = None,
                 post_logout_redirect_uris: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                 profile: Optional[pulumi.Input[str]] = None,
                 redirect_uris: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                 refresh_token_leeway: Optional[pulumi.Input[int]] = None,
                 refresh_token_rotation: Optional[pulumi.Input[str]] = None,
                 response_types: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                 sign_on_mode: Optional[pulumi.Input[str]] = None,
                 status: Optional[pulumi.Input[str]] = None,
                 token_endpoint_auth_method: Optional[pulumi.Input[str]] = None,
                 tos_uri: Optional[pulumi.Input[str]] = None,
                 type: Optional[pulumi.Input[str]] = None,
                 user_name_template: Optional[pulumi.Input[str]] = None,
                 user_name_template_push_status: Optional[pulumi.Input[str]] = None,
                 user_name_template_suffix: Optional[pulumi.Input[str]] = None,
                 user_name_template_type: Optional[pulumi.Input[str]] = None,
                 wildcard_redirect: Optional[pulumi.Input[str]] = None):
        """
        Input properties used for looking up and filtering OAuth resources.
        :param pulumi.Input[str] accessibility_error_redirect_url: Custom error page URL.
        :param pulumi.Input[str] accessibility_login_redirect_url: Custom login page for this application.
        :param pulumi.Input[bool] accessibility_self_service: Enable self-service. By default, it is `false`.
        :param pulumi.Input[str] admin_note: Application notes for admins.
        :param pulumi.Input[str] app_links_json: Displays specific appLinks for the app. The value for each application link should be boolean.
        :param pulumi.Input[str] app_settings_json: Application settings in JSON format.
        :param pulumi.Input[str] authentication_policy: The ID of the associated `app_signon_policy`. If this property is removed from the application the `default` sign-on-policy will be associated with this application.
        :param pulumi.Input[bool] auto_key_rotation: Requested key rotation mode.  If
               `auto_key_rotation` isn't specified, the client automatically opts in for Okta's
               key rotation. You can update this property via the API or via the administrator
               UI.
               See: https://developer.okta.com/docs/reference/api/apps/#oauth-credential-object
        :param pulumi.Input[bool] auto_submit_toolbar: Display auto submit toolbar.
        :param pulumi.Input[str] client_basic_secret: The user provided OAuth client secret key value, this can be set when `token_endpoint_auth_method` is `"client_secret_basic"`. This does nothing when `omit_secret` is set to true.
        :param pulumi.Input[str] client_id: OAuth client ID. If set during creation, app is created with this id. See: https://developer.okta.com/docs/reference/api/apps/#oauth-credential-object
        :param pulumi.Input[str] client_secret: OAuth client secret value, this is output only. This will be in plain text in your statefile unless you set omit_secret above. See: https://developer.okta.com/docs/reference/api/apps/#oauth-credential-object
        :param pulumi.Input[str] client_uri: URI to a web page providing information about the client.
        :param pulumi.Input[str] consent_method: Indicates whether user consent is required or implicit. Valid values: `"REQUIRED"`, `"TRUSTED"`. Default value is `"TRUSTED"`.
        :param pulumi.Input[str] enduser_note: Application notes for end users.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] grant_types: List of OAuth 2.0 grant types. Conditional validation params found [here](https://developer.okta.com/docs/api/resources/apps#credentials-settings-details).
               Defaults to minimum requirements per app type. Valid values: `"authorization_code"`, `"implicit"`, `"password"`, `"refresh_token"`, `"client_credentials"`,
               `"urn:ietf:params:oauth:grant-type:saml2-bearer"` (*Early Access Property*), `"urn:ietf:params:oauth:grant-type:token-exchange"` (*Early Access Property*),
               `"interaction_code"` (*OIE only*).
        :param pulumi.Input['OAuthGroupsClaimArgs'] groups_claim: Groups claim for an OpenID Connect client application. **IMPORTANT**: this argument is ignored when Okta API authentication is done with OAuth 2.0 credentials
        :param pulumi.Input[bool] hide_ios: Do not display application icon on mobile app.
        :param pulumi.Input[bool] hide_web: Do not display application icon to users.
        :param pulumi.Input[bool] implicit_assignment: *Early Access Property*. Enables [Federation Broker Mode](https://help.okta.com/en/prod/Content/Topics/Apps/apps-fbm-enable.htm). When this mode is enabled, `users` and `groups` arguments are ignored.
        :param pulumi.Input[str] issuer_mode: Indicates whether the Okta Authorization Server uses the original Okta org domain URL or a custom domain URL as the issuer of ID token for this client.
               Valid values: `"CUSTOM_URL"`,`"ORG_URL"` or `"DYNAMIC"`. Default is `"ORG_URL"`.
        :param pulumi.Input[Sequence[pulumi.Input['OAuthJwkArgs']]] jwks: JSON Web Key set. Multiple jwks are supported[Admin Console JWK Reference](https://developer.okta.com/docs/guides/implement-oauth-for-okta-serviceapp/main/#generate-the-jwk-in-the-admin-console). Use kty=RSA e=[value] n=[value] for RSA jwks, and kty=EC x=[value] y=[value] for EC jwks
        :param pulumi.Input[str] jwks_uri: URL of the custom authorization server's JSON Web Key Set document.
        :param pulumi.Input[str] label: The Application's display name.
        :param pulumi.Input[str] login_mode: The type of Idp-Initiated login that the client supports, if any. Valid values: `"DISABLED"`, `"SPEC"`, `"OKTA"`. Default is `"DISABLED"`.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] login_scopes: List of scopes to use for the request. Valid values: `"openid"`, `"profile"`, `"email"`, `"address"`, `"phone"`. Required when `login_mode` is NOT `DISABLED`.
        :param pulumi.Input[str] login_uri: URI that initiates login. Required when `login_mode` is NOT `DISABLED`.
        :param pulumi.Input[str] logo: Local file path to the logo. The file must be in PNG, JPG, or GIF format, and less than 1 MB in size.
        :param pulumi.Input[str] logo_uri: URI that references a logo for the client.
        :param pulumi.Input[str] logo_url: Direct link of application logo.
        :param pulumi.Input[str] name: Name assigned to the application by Okta.
        :param pulumi.Input[bool] omit_secret: This tells the provider not manage the `client_secret` value in state. When this is false (the default), it will cause the auto-generated `client_secret` to be persisted in the `client_secret` attribute in state. This also means that every time an update to this app is run, this value is also set on the API. If this changes from false => true, the `client_secret` is dropped from state and the secret at the time of the apply is what remains. If this is ever changes from true => false your app will be recreated, due to the need to regenerate a secret we can store in state.
        :param pulumi.Input[bool] pkce_required: Require Proof Key for Code Exchange (PKCE) for
               additional verification.  If `pkce_required` isn't specified when adding a new
               application, Okta sets it to `true` by default for `"browser"` and `"native"`
               application types.
               See https://developer.okta.com/docs/reference/api/apps/#oauth-credential-object
        :param pulumi.Input[str] policy_uri: URI to web page providing client policy document.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] post_logout_redirect_uris: List of URIs for redirection after logout.
        :param pulumi.Input[str] profile: Custom JSON that represents an OAuth application's profile.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] redirect_uris: List of URIs for use in the redirect-based flow. This is required for all application types except service.
        :param pulumi.Input[int] refresh_token_leeway: Grace period for token rotation. Valid values: 0 to 60 seconds.
        :param pulumi.Input[str] refresh_token_rotation: Refresh token rotation behavior. Valid values: `"STATIC"` or `"ROTATE"`.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] response_types: List of OAuth 2.0 response type strings. Array
               values of `"code"`, `"token"`, `"id_token"`. The `grant_types` and `response_types`
               values described are partially orthogonal, as they refer to arguments
               passed to different endpoints in the OAuth 2.0 protocol (opens new window).
               However, they are related in that the `grant_types` available to a client
               influence the `response_types` that the client is allowed to use, and vice versa.
               For instance, a grant_types value that includes authorization_code implies a
               `response_types` value that includes code, as both values are defined as part of
               the OAuth 2.0 authorization code grant.
               See: https://developer.okta.com/docs/reference/api/apps/#add-oauth-2-0-client-application
        :param pulumi.Input[str] sign_on_mode: Sign-on mode of application.
        :param pulumi.Input[str] status: The status of the application, by default, it is `"ACTIVE"`.
        :param pulumi.Input[str] token_endpoint_auth_method: Requested authentication method for
               the token endpoint. It can be set to `"none"`, `"client_secret_post"`,
               `"client_secret_basic"`, `"client_secret_jwt"`, `"private_key_jwt"`.  Use
               `pkce_required` to require PKCE for your confidential clients using the
               Authorization Code flow. If `"token_endpoint_auth_method"` is `"none"`,
               `pkce_required` needs to be `true`. If `pkce_required` isn't specified when
               adding a new application, Okta sets it to `true` by default for `"browser"` and
               `"native"` application types.
               See https://developer.okta.com/docs/reference/api/apps/#oauth-credential-object
        :param pulumi.Input[str] tos_uri: URI to web page providing client tos (terms of service).
        :param pulumi.Input[str] type: The type of OAuth application. Valid values: `"web"`, `"native"`, `"browser"`, `"service"`. For SPA apps use `browser`.
        :param pulumi.Input[str] user_name_template: Username template. Default: `"${source.login}"`
        :param pulumi.Input[str] user_name_template_push_status: Push username on update. Valid values: `"PUSH"` and `"DONT_PUSH"`.
        :param pulumi.Input[str] user_name_template_suffix: Username template suffix.
        :param pulumi.Input[str] user_name_template_type: Username template type. Default: `"BUILT_IN"`.
        :param pulumi.Input[str] wildcard_redirect: *Early Access Property*. Indicates if the client is allowed to use wildcard matching of `redirect_uris`. Valid values: `"DISABLED"`, `"SUBDOMAIN"`. Default value is `"DISABLED"`.
        """
        if accessibility_error_redirect_url is not None:
            pulumi.set(__self__, "accessibility_error_redirect_url", accessibility_error_redirect_url)
        if accessibility_login_redirect_url is not None:
            pulumi.set(__self__, "accessibility_login_redirect_url", accessibility_login_redirect_url)
        if accessibility_self_service is not None:
            pulumi.set(__self__, "accessibility_self_service", accessibility_self_service)
        if admin_note is not None:
            pulumi.set(__self__, "admin_note", admin_note)
        if app_links_json is not None:
            pulumi.set(__self__, "app_links_json", app_links_json)
        if app_settings_json is not None:
            pulumi.set(__self__, "app_settings_json", app_settings_json)
        if authentication_policy is not None:
            pulumi.set(__self__, "authentication_policy", authentication_policy)
        if auto_key_rotation is not None:
            pulumi.set(__self__, "auto_key_rotation", auto_key_rotation)
        if auto_submit_toolbar is not None:
            pulumi.set(__self__, "auto_submit_toolbar", auto_submit_toolbar)
        if client_basic_secret is not None:
            pulumi.set(__self__, "client_basic_secret", client_basic_secret)
        if client_id is not None:
            pulumi.set(__self__, "client_id", client_id)
        if client_secret is not None:
            pulumi.set(__self__, "client_secret", client_secret)
        if client_uri is not None:
            pulumi.set(__self__, "client_uri", client_uri)
        if consent_method is not None:
            pulumi.set(__self__, "consent_method", consent_method)
        if enduser_note is not None:
            pulumi.set(__self__, "enduser_note", enduser_note)
        if grant_types is not None:
            pulumi.set(__self__, "grant_types", grant_types)
        if groups_claim is not None:
            pulumi.set(__self__, "groups_claim", groups_claim)
        if hide_ios is not None:
            pulumi.set(__self__, "hide_ios", hide_ios)
        if hide_web is not None:
            pulumi.set(__self__, "hide_web", hide_web)
        if implicit_assignment is not None:
            pulumi.set(__self__, "implicit_assignment", implicit_assignment)
        if issuer_mode is not None:
            pulumi.set(__self__, "issuer_mode", issuer_mode)
        if jwks is not None:
            pulumi.set(__self__, "jwks", jwks)
        if jwks_uri is not None:
            pulumi.set(__self__, "jwks_uri", jwks_uri)
        if label is not None:
            pulumi.set(__self__, "label", label)
        if login_mode is not None:
            pulumi.set(__self__, "login_mode", login_mode)
        if login_scopes is not None:
            pulumi.set(__self__, "login_scopes", login_scopes)
        if login_uri is not None:
            pulumi.set(__self__, "login_uri", login_uri)
        if logo is not None:
            pulumi.set(__self__, "logo", logo)
        if logo_uri is not None:
            pulumi.set(__self__, "logo_uri", logo_uri)
        if logo_url is not None:
            pulumi.set(__self__, "logo_url", logo_url)
        if name is not None:
            pulumi.set(__self__, "name", name)
        if omit_secret is not None:
            pulumi.set(__self__, "omit_secret", omit_secret)
        if pkce_required is not None:
            pulumi.set(__self__, "pkce_required", pkce_required)
        if policy_uri is not None:
            pulumi.set(__self__, "policy_uri", policy_uri)
        if post_logout_redirect_uris is not None:
            pulumi.set(__self__, "post_logout_redirect_uris", post_logout_redirect_uris)
        if profile is not None:
            pulumi.set(__self__, "profile", profile)
        if redirect_uris is not None:
            pulumi.set(__self__, "redirect_uris", redirect_uris)
        if refresh_token_leeway is not None:
            pulumi.set(__self__, "refresh_token_leeway", refresh_token_leeway)
        if refresh_token_rotation is not None:
            pulumi.set(__self__, "refresh_token_rotation", refresh_token_rotation)
        if response_types is not None:
            pulumi.set(__self__, "response_types", response_types)
        if sign_on_mode is not None:
            pulumi.set(__self__, "sign_on_mode", sign_on_mode)
        if status is not None:
            pulumi.set(__self__, "status", status)
        if token_endpoint_auth_method is not None:
            pulumi.set(__self__, "token_endpoint_auth_method", token_endpoint_auth_method)
        if tos_uri is not None:
            pulumi.set(__self__, "tos_uri", tos_uri)
        if type is not None:
            pulumi.set(__self__, "type", type)
        if user_name_template is not None:
            pulumi.set(__self__, "user_name_template", user_name_template)
        if user_name_template_push_status is not None:
            pulumi.set(__self__, "user_name_template_push_status", user_name_template_push_status)
        if user_name_template_suffix is not None:
            pulumi.set(__self__, "user_name_template_suffix", user_name_template_suffix)
        if user_name_template_type is not None:
            pulumi.set(__self__, "user_name_template_type", user_name_template_type)
        if wildcard_redirect is not None:
            pulumi.set(__self__, "wildcard_redirect", wildcard_redirect)

    @property
    @pulumi.getter(name="accessibilityErrorRedirectUrl")
    def accessibility_error_redirect_url(self) -> Optional[pulumi.Input[str]]:
        """
        Custom error page URL.
        """
        return pulumi.get(self, "accessibility_error_redirect_url")

    @accessibility_error_redirect_url.setter
    def accessibility_error_redirect_url(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "accessibility_error_redirect_url", value)

    @property
    @pulumi.getter(name="accessibilityLoginRedirectUrl")
    def accessibility_login_redirect_url(self) -> Optional[pulumi.Input[str]]:
        """
        Custom login page for this application.
        """
        return pulumi.get(self, "accessibility_login_redirect_url")

    @accessibility_login_redirect_url.setter
    def accessibility_login_redirect_url(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "accessibility_login_redirect_url", value)

    @property
    @pulumi.getter(name="accessibilitySelfService")
    def accessibility_self_service(self) -> Optional[pulumi.Input[bool]]:
        """
        Enable self-service. By default, it is `false`.
        """
        return pulumi.get(self, "accessibility_self_service")

    @accessibility_self_service.setter
    def accessibility_self_service(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "accessibility_self_service", value)

    @property
    @pulumi.getter(name="adminNote")
    def admin_note(self) -> Optional[pulumi.Input[str]]:
        """
        Application notes for admins.
        """
        return pulumi.get(self, "admin_note")

    @admin_note.setter
    def admin_note(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "admin_note", value)

    @property
    @pulumi.getter(name="appLinksJson")
    def app_links_json(self) -> Optional[pulumi.Input[str]]:
        """
        Displays specific appLinks for the app. The value for each application link should be boolean.
        """
        return pulumi.get(self, "app_links_json")

    @app_links_json.setter
    def app_links_json(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "app_links_json", value)

    @property
    @pulumi.getter(name="appSettingsJson")
    def app_settings_json(self) -> Optional[pulumi.Input[str]]:
        """
        Application settings in JSON format.
        """
        return pulumi.get(self, "app_settings_json")

    @app_settings_json.setter
    def app_settings_json(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "app_settings_json", value)

    @property
    @pulumi.getter(name="authenticationPolicy")
    def authentication_policy(self) -> Optional[pulumi.Input[str]]:
        """
        The ID of the associated `app_signon_policy`. If this property is removed from the application the `default` sign-on-policy will be associated with this application.
        """
        return pulumi.get(self, "authentication_policy")

    @authentication_policy.setter
    def authentication_policy(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "authentication_policy", value)

    @property
    @pulumi.getter(name="autoKeyRotation")
    def auto_key_rotation(self) -> Optional[pulumi.Input[bool]]:
        """
        Requested key rotation mode.  If
        `auto_key_rotation` isn't specified, the client automatically opts in for Okta's
        key rotation. You can update this property via the API or via the administrator
        UI.
        See: https://developer.okta.com/docs/reference/api/apps/#oauth-credential-object
        """
        return pulumi.get(self, "auto_key_rotation")

    @auto_key_rotation.setter
    def auto_key_rotation(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "auto_key_rotation", value)

    @property
    @pulumi.getter(name="autoSubmitToolbar")
    def auto_submit_toolbar(self) -> Optional[pulumi.Input[bool]]:
        """
        Display auto submit toolbar.
        """
        return pulumi.get(self, "auto_submit_toolbar")

    @auto_submit_toolbar.setter
    def auto_submit_toolbar(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "auto_submit_toolbar", value)

    @property
    @pulumi.getter(name="clientBasicSecret")
    def client_basic_secret(self) -> Optional[pulumi.Input[str]]:
        """
        The user provided OAuth client secret key value, this can be set when `token_endpoint_auth_method` is `"client_secret_basic"`. This does nothing when `omit_secret` is set to true.
        """
        return pulumi.get(self, "client_basic_secret")

    @client_basic_secret.setter
    def client_basic_secret(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "client_basic_secret", value)

    @property
    @pulumi.getter(name="clientId")
    def client_id(self) -> Optional[pulumi.Input[str]]:
        """
        OAuth client ID. If set during creation, app is created with this id. See: https://developer.okta.com/docs/reference/api/apps/#oauth-credential-object
        """
        return pulumi.get(self, "client_id")

    @client_id.setter
    def client_id(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "client_id", value)

    @property
    @pulumi.getter(name="clientSecret")
    def client_secret(self) -> Optional[pulumi.Input[str]]:
        """
        OAuth client secret value, this is output only. This will be in plain text in your statefile unless you set omit_secret above. See: https://developer.okta.com/docs/reference/api/apps/#oauth-credential-object
        """
        return pulumi.get(self, "client_secret")

    @client_secret.setter
    def client_secret(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "client_secret", value)

    @property
    @pulumi.getter(name="clientUri")
    def client_uri(self) -> Optional[pulumi.Input[str]]:
        """
        URI to a web page providing information about the client.
        """
        return pulumi.get(self, "client_uri")

    @client_uri.setter
    def client_uri(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "client_uri", value)

    @property
    @pulumi.getter(name="consentMethod")
    def consent_method(self) -> Optional[pulumi.Input[str]]:
        """
        Indicates whether user consent is required or implicit. Valid values: `"REQUIRED"`, `"TRUSTED"`. Default value is `"TRUSTED"`.
        """
        return pulumi.get(self, "consent_method")

    @consent_method.setter
    def consent_method(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "consent_method", value)

    @property
    @pulumi.getter(name="enduserNote")
    def enduser_note(self) -> Optional[pulumi.Input[str]]:
        """
        Application notes for end users.
        """
        return pulumi.get(self, "enduser_note")

    @enduser_note.setter
    def enduser_note(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "enduser_note", value)

    @property
    @pulumi.getter(name="grantTypes")
    def grant_types(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        List of OAuth 2.0 grant types. Conditional validation params found [here](https://developer.okta.com/docs/api/resources/apps#credentials-settings-details).
        Defaults to minimum requirements per app type. Valid values: `"authorization_code"`, `"implicit"`, `"password"`, `"refresh_token"`, `"client_credentials"`,
        `"urn:ietf:params:oauth:grant-type:saml2-bearer"` (*Early Access Property*), `"urn:ietf:params:oauth:grant-type:token-exchange"` (*Early Access Property*),
        `"interaction_code"` (*OIE only*).
        """
        return pulumi.get(self, "grant_types")

    @grant_types.setter
    def grant_types(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "grant_types", value)

    @property
    @pulumi.getter(name="groupsClaim")
    def groups_claim(self) -> Optional[pulumi.Input['OAuthGroupsClaimArgs']]:
        """
        Groups claim for an OpenID Connect client application. **IMPORTANT**: this argument is ignored when Okta API authentication is done with OAuth 2.0 credentials
        """
        return pulumi.get(self, "groups_claim")

    @groups_claim.setter
    def groups_claim(self, value: Optional[pulumi.Input['OAuthGroupsClaimArgs']]):
        pulumi.set(self, "groups_claim", value)

    @property
    @pulumi.getter(name="hideIos")
    def hide_ios(self) -> Optional[pulumi.Input[bool]]:
        """
        Do not display application icon on mobile app.
        """
        return pulumi.get(self, "hide_ios")

    @hide_ios.setter
    def hide_ios(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "hide_ios", value)

    @property
    @pulumi.getter(name="hideWeb")
    def hide_web(self) -> Optional[pulumi.Input[bool]]:
        """
        Do not display application icon to users.
        """
        return pulumi.get(self, "hide_web")

    @hide_web.setter
    def hide_web(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "hide_web", value)

    @property
    @pulumi.getter(name="implicitAssignment")
    def implicit_assignment(self) -> Optional[pulumi.Input[bool]]:
        """
        *Early Access Property*. Enables [Federation Broker Mode](https://help.okta.com/en/prod/Content/Topics/Apps/apps-fbm-enable.htm). When this mode is enabled, `users` and `groups` arguments are ignored.
        """
        return pulumi.get(self, "implicit_assignment")

    @implicit_assignment.setter
    def implicit_assignment(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "implicit_assignment", value)

    @property
    @pulumi.getter(name="issuerMode")
    def issuer_mode(self) -> Optional[pulumi.Input[str]]:
        """
        Indicates whether the Okta Authorization Server uses the original Okta org domain URL or a custom domain URL as the issuer of ID token for this client.
        Valid values: `"CUSTOM_URL"`,`"ORG_URL"` or `"DYNAMIC"`. Default is `"ORG_URL"`.
        """
        return pulumi.get(self, "issuer_mode")

    @issuer_mode.setter
    def issuer_mode(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "issuer_mode", value)

    @property
    @pulumi.getter
    def jwks(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['OAuthJwkArgs']]]]:
        """
        JSON Web Key set. Multiple jwks are supported[Admin Console JWK Reference](https://developer.okta.com/docs/guides/implement-oauth-for-okta-serviceapp/main/#generate-the-jwk-in-the-admin-console). Use kty=RSA e=[value] n=[value] for RSA jwks, and kty=EC x=[value] y=[value] for EC jwks
        """
        return pulumi.get(self, "jwks")

    @jwks.setter
    def jwks(self, value: Optional[pulumi.Input[Sequence[pulumi.Input['OAuthJwkArgs']]]]):
        pulumi.set(self, "jwks", value)

    @property
    @pulumi.getter(name="jwksUri")
    def jwks_uri(self) -> Optional[pulumi.Input[str]]:
        """
        URL of the custom authorization server's JSON Web Key Set document.
        """
        return pulumi.get(self, "jwks_uri")

    @jwks_uri.setter
    def jwks_uri(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "jwks_uri", value)

    @property
    @pulumi.getter
    def label(self) -> Optional[pulumi.Input[str]]:
        """
        The Application's display name.
        """
        return pulumi.get(self, "label")

    @label.setter
    def label(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "label", value)

    @property
    @pulumi.getter(name="loginMode")
    def login_mode(self) -> Optional[pulumi.Input[str]]:
        """
        The type of Idp-Initiated login that the client supports, if any. Valid values: `"DISABLED"`, `"SPEC"`, `"OKTA"`. Default is `"DISABLED"`.
        """
        return pulumi.get(self, "login_mode")

    @login_mode.setter
    def login_mode(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "login_mode", value)

    @property
    @pulumi.getter(name="loginScopes")
    def login_scopes(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        List of scopes to use for the request. Valid values: `"openid"`, `"profile"`, `"email"`, `"address"`, `"phone"`. Required when `login_mode` is NOT `DISABLED`.
        """
        return pulumi.get(self, "login_scopes")

    @login_scopes.setter
    def login_scopes(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "login_scopes", value)

    @property
    @pulumi.getter(name="loginUri")
    def login_uri(self) -> Optional[pulumi.Input[str]]:
        """
        URI that initiates login. Required when `login_mode` is NOT `DISABLED`.
        """
        return pulumi.get(self, "login_uri")

    @login_uri.setter
    def login_uri(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "login_uri", value)

    @property
    @pulumi.getter
    def logo(self) -> Optional[pulumi.Input[str]]:
        """
        Local file path to the logo. The file must be in PNG, JPG, or GIF format, and less than 1 MB in size.
        """
        return pulumi.get(self, "logo")

    @logo.setter
    def logo(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "logo", value)

    @property
    @pulumi.getter(name="logoUri")
    def logo_uri(self) -> Optional[pulumi.Input[str]]:
        """
        URI that references a logo for the client.
        """
        return pulumi.get(self, "logo_uri")

    @logo_uri.setter
    def logo_uri(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "logo_uri", value)

    @property
    @pulumi.getter(name="logoUrl")
    def logo_url(self) -> Optional[pulumi.Input[str]]:
        """
        Direct link of application logo.
        """
        return pulumi.get(self, "logo_url")

    @logo_url.setter
    def logo_url(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "logo_url", value)

    @property
    @pulumi.getter
    def name(self) -> Optional[pulumi.Input[str]]:
        """
        Name assigned to the application by Okta.
        """
        return pulumi.get(self, "name")

    @name.setter
    def name(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "name", value)

    @property
    @pulumi.getter(name="omitSecret")
    def omit_secret(self) -> Optional[pulumi.Input[bool]]:
        """
        This tells the provider not manage the `client_secret` value in state. When this is false (the default), it will cause the auto-generated `client_secret` to be persisted in the `client_secret` attribute in state. This also means that every time an update to this app is run, this value is also set on the API. If this changes from false => true, the `client_secret` is dropped from state and the secret at the time of the apply is what remains. If this is ever changes from true => false your app will be recreated, due to the need to regenerate a secret we can store in state.
        """
        return pulumi.get(self, "omit_secret")

    @omit_secret.setter
    def omit_secret(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "omit_secret", value)

    @property
    @pulumi.getter(name="pkceRequired")
    def pkce_required(self) -> Optional[pulumi.Input[bool]]:
        """
        Require Proof Key for Code Exchange (PKCE) for
        additional verification.  If `pkce_required` isn't specified when adding a new
        application, Okta sets it to `true` by default for `"browser"` and `"native"`
        application types.
        See https://developer.okta.com/docs/reference/api/apps/#oauth-credential-object
        """
        return pulumi.get(self, "pkce_required")

    @pkce_required.setter
    def pkce_required(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "pkce_required", value)

    @property
    @pulumi.getter(name="policyUri")
    def policy_uri(self) -> Optional[pulumi.Input[str]]:
        """
        URI to web page providing client policy document.
        """
        return pulumi.get(self, "policy_uri")

    @policy_uri.setter
    def policy_uri(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "policy_uri", value)

    @property
    @pulumi.getter(name="postLogoutRedirectUris")
    def post_logout_redirect_uris(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        List of URIs for redirection after logout.
        """
        return pulumi.get(self, "post_logout_redirect_uris")

    @post_logout_redirect_uris.setter
    def post_logout_redirect_uris(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "post_logout_redirect_uris", value)

    @property
    @pulumi.getter
    def profile(self) -> Optional[pulumi.Input[str]]:
        """
        Custom JSON that represents an OAuth application's profile.
        """
        return pulumi.get(self, "profile")

    @profile.setter
    def profile(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "profile", value)

    @property
    @pulumi.getter(name="redirectUris")
    def redirect_uris(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        List of URIs for use in the redirect-based flow. This is required for all application types except service.
        """
        return pulumi.get(self, "redirect_uris")

    @redirect_uris.setter
    def redirect_uris(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "redirect_uris", value)

    @property
    @pulumi.getter(name="refreshTokenLeeway")
    def refresh_token_leeway(self) -> Optional[pulumi.Input[int]]:
        """
        Grace period for token rotation. Valid values: 0 to 60 seconds.
        """
        return pulumi.get(self, "refresh_token_leeway")

    @refresh_token_leeway.setter
    def refresh_token_leeway(self, value: Optional[pulumi.Input[int]]):
        pulumi.set(self, "refresh_token_leeway", value)

    @property
    @pulumi.getter(name="refreshTokenRotation")
    def refresh_token_rotation(self) -> Optional[pulumi.Input[str]]:
        """
        Refresh token rotation behavior. Valid values: `"STATIC"` or `"ROTATE"`.
        """
        return pulumi.get(self, "refresh_token_rotation")

    @refresh_token_rotation.setter
    def refresh_token_rotation(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "refresh_token_rotation", value)

    @property
    @pulumi.getter(name="responseTypes")
    def response_types(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        List of OAuth 2.0 response type strings. Array
        values of `"code"`, `"token"`, `"id_token"`. The `grant_types` and `response_types`
        values described are partially orthogonal, as they refer to arguments
        passed to different endpoints in the OAuth 2.0 protocol (opens new window).
        However, they are related in that the `grant_types` available to a client
        influence the `response_types` that the client is allowed to use, and vice versa.
        For instance, a grant_types value that includes authorization_code implies a
        `response_types` value that includes code, as both values are defined as part of
        the OAuth 2.0 authorization code grant.
        See: https://developer.okta.com/docs/reference/api/apps/#add-oauth-2-0-client-application
        """
        return pulumi.get(self, "response_types")

    @response_types.setter
    def response_types(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "response_types", value)

    @property
    @pulumi.getter(name="signOnMode")
    def sign_on_mode(self) -> Optional[pulumi.Input[str]]:
        """
        Sign-on mode of application.
        """
        return pulumi.get(self, "sign_on_mode")

    @sign_on_mode.setter
    def sign_on_mode(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "sign_on_mode", value)

    @property
    @pulumi.getter
    def status(self) -> Optional[pulumi.Input[str]]:
        """
        The status of the application, by default, it is `"ACTIVE"`.
        """
        return pulumi.get(self, "status")

    @status.setter
    def status(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "status", value)

    @property
    @pulumi.getter(name="tokenEndpointAuthMethod")
    def token_endpoint_auth_method(self) -> Optional[pulumi.Input[str]]:
        """
        Requested authentication method for
        the token endpoint. It can be set to `"none"`, `"client_secret_post"`,
        `"client_secret_basic"`, `"client_secret_jwt"`, `"private_key_jwt"`.  Use
        `pkce_required` to require PKCE for your confidential clients using the
        Authorization Code flow. If `"token_endpoint_auth_method"` is `"none"`,
        `pkce_required` needs to be `true`. If `pkce_required` isn't specified when
        adding a new application, Okta sets it to `true` by default for `"browser"` and
        `"native"` application types.
        See https://developer.okta.com/docs/reference/api/apps/#oauth-credential-object
        """
        return pulumi.get(self, "token_endpoint_auth_method")

    @token_endpoint_auth_method.setter
    def token_endpoint_auth_method(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "token_endpoint_auth_method", value)

    @property
    @pulumi.getter(name="tosUri")
    def tos_uri(self) -> Optional[pulumi.Input[str]]:
        """
        URI to web page providing client tos (terms of service).
        """
        return pulumi.get(self, "tos_uri")

    @tos_uri.setter
    def tos_uri(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "tos_uri", value)

    @property
    @pulumi.getter
    def type(self) -> Optional[pulumi.Input[str]]:
        """
        The type of OAuth application. Valid values: `"web"`, `"native"`, `"browser"`, `"service"`. For SPA apps use `browser`.
        """
        return pulumi.get(self, "type")

    @type.setter
    def type(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "type", value)

    @property
    @pulumi.getter(name="userNameTemplate")
    def user_name_template(self) -> Optional[pulumi.Input[str]]:
        """
        Username template. Default: `"${source.login}"`
        """
        return pulumi.get(self, "user_name_template")

    @user_name_template.setter
    def user_name_template(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "user_name_template", value)

    @property
    @pulumi.getter(name="userNameTemplatePushStatus")
    def user_name_template_push_status(self) -> Optional[pulumi.Input[str]]:
        """
        Push username on update. Valid values: `"PUSH"` and `"DONT_PUSH"`.
        """
        return pulumi.get(self, "user_name_template_push_status")

    @user_name_template_push_status.setter
    def user_name_template_push_status(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "user_name_template_push_status", value)

    @property
    @pulumi.getter(name="userNameTemplateSuffix")
    def user_name_template_suffix(self) -> Optional[pulumi.Input[str]]:
        """
        Username template suffix.
        """
        return pulumi.get(self, "user_name_template_suffix")

    @user_name_template_suffix.setter
    def user_name_template_suffix(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "user_name_template_suffix", value)

    @property
    @pulumi.getter(name="userNameTemplateType")
    def user_name_template_type(self) -> Optional[pulumi.Input[str]]:
        """
        Username template type. Default: `"BUILT_IN"`.
        """
        return pulumi.get(self, "user_name_template_type")

    @user_name_template_type.setter
    def user_name_template_type(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "user_name_template_type", value)

    @property
    @pulumi.getter(name="wildcardRedirect")
    def wildcard_redirect(self) -> Optional[pulumi.Input[str]]:
        """
        *Early Access Property*. Indicates if the client is allowed to use wildcard matching of `redirect_uris`. Valid values: `"DISABLED"`, `"SUBDOMAIN"`. Default value is `"DISABLED"`.
        """
        return pulumi.get(self, "wildcard_redirect")

    @wildcard_redirect.setter
    def wildcard_redirect(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "wildcard_redirect", value)


class OAuth(pulumi.CustomResource):
    @overload
    def __init__(__self__,
                 resource_name: str,
                 opts: Optional[pulumi.ResourceOptions] = None,
                 accessibility_error_redirect_url: Optional[pulumi.Input[str]] = None,
                 accessibility_login_redirect_url: Optional[pulumi.Input[str]] = None,
                 accessibility_self_service: Optional[pulumi.Input[bool]] = None,
                 admin_note: Optional[pulumi.Input[str]] = None,
                 app_links_json: Optional[pulumi.Input[str]] = None,
                 app_settings_json: Optional[pulumi.Input[str]] = None,
                 authentication_policy: Optional[pulumi.Input[str]] = None,
                 auto_key_rotation: Optional[pulumi.Input[bool]] = None,
                 auto_submit_toolbar: Optional[pulumi.Input[bool]] = None,
                 client_basic_secret: Optional[pulumi.Input[str]] = None,
                 client_id: Optional[pulumi.Input[str]] = None,
                 client_uri: Optional[pulumi.Input[str]] = None,
                 consent_method: Optional[pulumi.Input[str]] = None,
                 enduser_note: Optional[pulumi.Input[str]] = None,
                 grant_types: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                 groups_claim: Optional[pulumi.Input[pulumi.InputType['OAuthGroupsClaimArgs']]] = None,
                 hide_ios: Optional[pulumi.Input[bool]] = None,
                 hide_web: Optional[pulumi.Input[bool]] = None,
                 implicit_assignment: Optional[pulumi.Input[bool]] = None,
                 issuer_mode: Optional[pulumi.Input[str]] = None,
                 jwks: Optional[pulumi.Input[Sequence[pulumi.Input[pulumi.InputType['OAuthJwkArgs']]]]] = None,
                 jwks_uri: Optional[pulumi.Input[str]] = None,
                 label: Optional[pulumi.Input[str]] = None,
                 login_mode: Optional[pulumi.Input[str]] = None,
                 login_scopes: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                 login_uri: Optional[pulumi.Input[str]] = None,
                 logo: Optional[pulumi.Input[str]] = None,
                 logo_uri: Optional[pulumi.Input[str]] = None,
                 omit_secret: Optional[pulumi.Input[bool]] = None,
                 pkce_required: Optional[pulumi.Input[bool]] = None,
                 policy_uri: Optional[pulumi.Input[str]] = None,
                 post_logout_redirect_uris: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                 profile: Optional[pulumi.Input[str]] = None,
                 redirect_uris: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                 refresh_token_leeway: Optional[pulumi.Input[int]] = None,
                 refresh_token_rotation: Optional[pulumi.Input[str]] = None,
                 response_types: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                 status: Optional[pulumi.Input[str]] = None,
                 token_endpoint_auth_method: Optional[pulumi.Input[str]] = None,
                 tos_uri: Optional[pulumi.Input[str]] = None,
                 type: Optional[pulumi.Input[str]] = None,
                 user_name_template: Optional[pulumi.Input[str]] = None,
                 user_name_template_push_status: Optional[pulumi.Input[str]] = None,
                 user_name_template_suffix: Optional[pulumi.Input[str]] = None,
                 user_name_template_type: Optional[pulumi.Input[str]] = None,
                 wildcard_redirect: Optional[pulumi.Input[str]] = None,
                 __props__=None):
        """
        This resource allows you to create and configure an OIDC Application.

        > During an apply if there is change in `status` the app will first be
        activated or deactivated in accordance with the `status` change. Then, all
        other arguments that changed will be applied.

        ## Example Usage

        ```python
        import pulumi
        import pulumi_okta as okta

        example = okta.app.OAuth("example",
            label="example",
            type="web",
            grant_types=["authorization_code"],
            redirect_uris=["https://example.com/"],
            response_types=["code"])
        ```

        ### With JWKS value

        See also Advanced PEM secrets and JWKS example.

        ```python
        import pulumi
        import pulumi_okta as okta

        example = okta.app.OAuth("example",
            label="example",
            type="service",
            response_types=["token"],
            grant_types=["client_credentials"],
            token_endpoint_auth_method="private_key_jwt",
            jwks=[
                okta.app.OAuthJwkArgs(
                    kty="RSA",
                    kid="SIGNING_KEY_RSA",
                    e="AQAB",
                    n="xyz",
                ),
                okta.app.OAuthJwkArgs(
                    kty="EC",
                    kid="SIGNING_KEY_EC",
                    x="K37X78mXJHHldZYMzrwipjKR-YZUS2SMye0KindHp6I",
                    y="8IfvsvXWzbFWOZoVOMwgF5p46mUj3kbOVf9Fk0vVVHo",
                ),
            ])
        ```

        ## Etc.

        ### Resetting client secret

        If the client secret needs to be reset run an apply with `omit_secret` set to
        true in the resource. This causes `client_secret` to be set to blank. Remove
        `omit_secret` and run apply again. The resource will set a new `client_secret`
        for the app.

        ### Private Keys

        The private key format that an Okta OAuth app expects is PKCS#8 (unencrypted).
        The operator either uploads their own private key or Okta can generate one in
        the Admin UI Panel under the apps Client Credentials. PKCS#8 format can be
        identified by a header that starts with `-----BEGIN PRIVATE KEY-----`. If the
        operator has a PKCS#1 (unencrypted) format private key (the header starts with
        `-----BEGIN RSA PRIVATE KEY-----`) they can generate a PKCS#8 format
        key with `openssl`:

        ## Import

        An OIDC Application can be imported via the Okta ID.

        ```sh
        $ pulumi import okta:app/oAuth:OAuth example &#60;app id&#62;
        ```

        :param str resource_name: The name of the resource.
        :param pulumi.ResourceOptions opts: Options for the resource.
        :param pulumi.Input[str] accessibility_error_redirect_url: Custom error page URL.
        :param pulumi.Input[str] accessibility_login_redirect_url: Custom login page for this application.
        :param pulumi.Input[bool] accessibility_self_service: Enable self-service. By default, it is `false`.
        :param pulumi.Input[str] admin_note: Application notes for admins.
        :param pulumi.Input[str] app_links_json: Displays specific appLinks for the app. The value for each application link should be boolean.
        :param pulumi.Input[str] app_settings_json: Application settings in JSON format.
        :param pulumi.Input[str] authentication_policy: The ID of the associated `app_signon_policy`. If this property is removed from the application the `default` sign-on-policy will be associated with this application.
        :param pulumi.Input[bool] auto_key_rotation: Requested key rotation mode.  If
               `auto_key_rotation` isn't specified, the client automatically opts in for Okta's
               key rotation. You can update this property via the API or via the administrator
               UI.
               See: https://developer.okta.com/docs/reference/api/apps/#oauth-credential-object
        :param pulumi.Input[bool] auto_submit_toolbar: Display auto submit toolbar.
        :param pulumi.Input[str] client_basic_secret: The user provided OAuth client secret key value, this can be set when `token_endpoint_auth_method` is `"client_secret_basic"`. This does nothing when `omit_secret` is set to true.
        :param pulumi.Input[str] client_id: OAuth client ID. If set during creation, app is created with this id. See: https://developer.okta.com/docs/reference/api/apps/#oauth-credential-object
        :param pulumi.Input[str] client_uri: URI to a web page providing information about the client.
        :param pulumi.Input[str] consent_method: Indicates whether user consent is required or implicit. Valid values: `"REQUIRED"`, `"TRUSTED"`. Default value is `"TRUSTED"`.
        :param pulumi.Input[str] enduser_note: Application notes for end users.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] grant_types: List of OAuth 2.0 grant types. Conditional validation params found [here](https://developer.okta.com/docs/api/resources/apps#credentials-settings-details).
               Defaults to minimum requirements per app type. Valid values: `"authorization_code"`, `"implicit"`, `"password"`, `"refresh_token"`, `"client_credentials"`,
               `"urn:ietf:params:oauth:grant-type:saml2-bearer"` (*Early Access Property*), `"urn:ietf:params:oauth:grant-type:token-exchange"` (*Early Access Property*),
               `"interaction_code"` (*OIE only*).
        :param pulumi.Input[pulumi.InputType['OAuthGroupsClaimArgs']] groups_claim: Groups claim for an OpenID Connect client application. **IMPORTANT**: this argument is ignored when Okta API authentication is done with OAuth 2.0 credentials
        :param pulumi.Input[bool] hide_ios: Do not display application icon on mobile app.
        :param pulumi.Input[bool] hide_web: Do not display application icon to users.
        :param pulumi.Input[bool] implicit_assignment: *Early Access Property*. Enables [Federation Broker Mode](https://help.okta.com/en/prod/Content/Topics/Apps/apps-fbm-enable.htm). When this mode is enabled, `users` and `groups` arguments are ignored.
        :param pulumi.Input[str] issuer_mode: Indicates whether the Okta Authorization Server uses the original Okta org domain URL or a custom domain URL as the issuer of ID token for this client.
               Valid values: `"CUSTOM_URL"`,`"ORG_URL"` or `"DYNAMIC"`. Default is `"ORG_URL"`.
        :param pulumi.Input[Sequence[pulumi.Input[pulumi.InputType['OAuthJwkArgs']]]] jwks: JSON Web Key set. Multiple jwks are supported[Admin Console JWK Reference](https://developer.okta.com/docs/guides/implement-oauth-for-okta-serviceapp/main/#generate-the-jwk-in-the-admin-console). Use kty=RSA e=[value] n=[value] for RSA jwks, and kty=EC x=[value] y=[value] for EC jwks
        :param pulumi.Input[str] jwks_uri: URL of the custom authorization server's JSON Web Key Set document.
        :param pulumi.Input[str] label: The Application's display name.
        :param pulumi.Input[str] login_mode: The type of Idp-Initiated login that the client supports, if any. Valid values: `"DISABLED"`, `"SPEC"`, `"OKTA"`. Default is `"DISABLED"`.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] login_scopes: List of scopes to use for the request. Valid values: `"openid"`, `"profile"`, `"email"`, `"address"`, `"phone"`. Required when `login_mode` is NOT `DISABLED`.
        :param pulumi.Input[str] login_uri: URI that initiates login. Required when `login_mode` is NOT `DISABLED`.
        :param pulumi.Input[str] logo: Local file path to the logo. The file must be in PNG, JPG, or GIF format, and less than 1 MB in size.
        :param pulumi.Input[str] logo_uri: URI that references a logo for the client.
        :param pulumi.Input[bool] omit_secret: This tells the provider not manage the `client_secret` value in state. When this is false (the default), it will cause the auto-generated `client_secret` to be persisted in the `client_secret` attribute in state. This also means that every time an update to this app is run, this value is also set on the API. If this changes from false => true, the `client_secret` is dropped from state and the secret at the time of the apply is what remains. If this is ever changes from true => false your app will be recreated, due to the need to regenerate a secret we can store in state.
        :param pulumi.Input[bool] pkce_required: Require Proof Key for Code Exchange (PKCE) for
               additional verification.  If `pkce_required` isn't specified when adding a new
               application, Okta sets it to `true` by default for `"browser"` and `"native"`
               application types.
               See https://developer.okta.com/docs/reference/api/apps/#oauth-credential-object
        :param pulumi.Input[str] policy_uri: URI to web page providing client policy document.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] post_logout_redirect_uris: List of URIs for redirection after logout.
        :param pulumi.Input[str] profile: Custom JSON that represents an OAuth application's profile.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] redirect_uris: List of URIs for use in the redirect-based flow. This is required for all application types except service.
        :param pulumi.Input[int] refresh_token_leeway: Grace period for token rotation. Valid values: 0 to 60 seconds.
        :param pulumi.Input[str] refresh_token_rotation: Refresh token rotation behavior. Valid values: `"STATIC"` or `"ROTATE"`.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] response_types: List of OAuth 2.0 response type strings. Array
               values of `"code"`, `"token"`, `"id_token"`. The `grant_types` and `response_types`
               values described are partially orthogonal, as they refer to arguments
               passed to different endpoints in the OAuth 2.0 protocol (opens new window).
               However, they are related in that the `grant_types` available to a client
               influence the `response_types` that the client is allowed to use, and vice versa.
               For instance, a grant_types value that includes authorization_code implies a
               `response_types` value that includes code, as both values are defined as part of
               the OAuth 2.0 authorization code grant.
               See: https://developer.okta.com/docs/reference/api/apps/#add-oauth-2-0-client-application
        :param pulumi.Input[str] status: The status of the application, by default, it is `"ACTIVE"`.
        :param pulumi.Input[str] token_endpoint_auth_method: Requested authentication method for
               the token endpoint. It can be set to `"none"`, `"client_secret_post"`,
               `"client_secret_basic"`, `"client_secret_jwt"`, `"private_key_jwt"`.  Use
               `pkce_required` to require PKCE for your confidential clients using the
               Authorization Code flow. If `"token_endpoint_auth_method"` is `"none"`,
               `pkce_required` needs to be `true`. If `pkce_required` isn't specified when
               adding a new application, Okta sets it to `true` by default for `"browser"` and
               `"native"` application types.
               See https://developer.okta.com/docs/reference/api/apps/#oauth-credential-object
        :param pulumi.Input[str] tos_uri: URI to web page providing client tos (terms of service).
        :param pulumi.Input[str] type: The type of OAuth application. Valid values: `"web"`, `"native"`, `"browser"`, `"service"`. For SPA apps use `browser`.
        :param pulumi.Input[str] user_name_template: Username template. Default: `"${source.login}"`
        :param pulumi.Input[str] user_name_template_push_status: Push username on update. Valid values: `"PUSH"` and `"DONT_PUSH"`.
        :param pulumi.Input[str] user_name_template_suffix: Username template suffix.
        :param pulumi.Input[str] user_name_template_type: Username template type. Default: `"BUILT_IN"`.
        :param pulumi.Input[str] wildcard_redirect: *Early Access Property*. Indicates if the client is allowed to use wildcard matching of `redirect_uris`. Valid values: `"DISABLED"`, `"SUBDOMAIN"`. Default value is `"DISABLED"`.
        """
        ...
    @overload
    def __init__(__self__,
                 resource_name: str,
                 args: OAuthArgs,
                 opts: Optional[pulumi.ResourceOptions] = None):
        """
        This resource allows you to create and configure an OIDC Application.

        > During an apply if there is change in `status` the app will first be
        activated or deactivated in accordance with the `status` change. Then, all
        other arguments that changed will be applied.

        ## Example Usage

        ```python
        import pulumi
        import pulumi_okta as okta

        example = okta.app.OAuth("example",
            label="example",
            type="web",
            grant_types=["authorization_code"],
            redirect_uris=["https://example.com/"],
            response_types=["code"])
        ```

        ### With JWKS value

        See also Advanced PEM secrets and JWKS example.

        ```python
        import pulumi
        import pulumi_okta as okta

        example = okta.app.OAuth("example",
            label="example",
            type="service",
            response_types=["token"],
            grant_types=["client_credentials"],
            token_endpoint_auth_method="private_key_jwt",
            jwks=[
                okta.app.OAuthJwkArgs(
                    kty="RSA",
                    kid="SIGNING_KEY_RSA",
                    e="AQAB",
                    n="xyz",
                ),
                okta.app.OAuthJwkArgs(
                    kty="EC",
                    kid="SIGNING_KEY_EC",
                    x="K37X78mXJHHldZYMzrwipjKR-YZUS2SMye0KindHp6I",
                    y="8IfvsvXWzbFWOZoVOMwgF5p46mUj3kbOVf9Fk0vVVHo",
                ),
            ])
        ```

        ## Etc.

        ### Resetting client secret

        If the client secret needs to be reset run an apply with `omit_secret` set to
        true in the resource. This causes `client_secret` to be set to blank. Remove
        `omit_secret` and run apply again. The resource will set a new `client_secret`
        for the app.

        ### Private Keys

        The private key format that an Okta OAuth app expects is PKCS#8 (unencrypted).
        The operator either uploads their own private key or Okta can generate one in
        the Admin UI Panel under the apps Client Credentials. PKCS#8 format can be
        identified by a header that starts with `-----BEGIN PRIVATE KEY-----`. If the
        operator has a PKCS#1 (unencrypted) format private key (the header starts with
        `-----BEGIN RSA PRIVATE KEY-----`) they can generate a PKCS#8 format
        key with `openssl`:

        ## Import

        An OIDC Application can be imported via the Okta ID.

        ```sh
        $ pulumi import okta:app/oAuth:OAuth example &#60;app id&#62;
        ```

        :param str resource_name: The name of the resource.
        :param OAuthArgs args: The arguments to use to populate this resource's properties.
        :param pulumi.ResourceOptions opts: Options for the resource.
        """
        ...
    def __init__(__self__, resource_name: str, *args, **kwargs):
        resource_args, opts = _utilities.get_resource_args_opts(OAuthArgs, pulumi.ResourceOptions, *args, **kwargs)
        if resource_args is not None:
            __self__._internal_init(resource_name, opts, **resource_args.__dict__)
        else:
            __self__._internal_init(resource_name, *args, **kwargs)

    def _internal_init(__self__,
                 resource_name: str,
                 opts: Optional[pulumi.ResourceOptions] = None,
                 accessibility_error_redirect_url: Optional[pulumi.Input[str]] = None,
                 accessibility_login_redirect_url: Optional[pulumi.Input[str]] = None,
                 accessibility_self_service: Optional[pulumi.Input[bool]] = None,
                 admin_note: Optional[pulumi.Input[str]] = None,
                 app_links_json: Optional[pulumi.Input[str]] = None,
                 app_settings_json: Optional[pulumi.Input[str]] = None,
                 authentication_policy: Optional[pulumi.Input[str]] = None,
                 auto_key_rotation: Optional[pulumi.Input[bool]] = None,
                 auto_submit_toolbar: Optional[pulumi.Input[bool]] = None,
                 client_basic_secret: Optional[pulumi.Input[str]] = None,
                 client_id: Optional[pulumi.Input[str]] = None,
                 client_uri: Optional[pulumi.Input[str]] = None,
                 consent_method: Optional[pulumi.Input[str]] = None,
                 enduser_note: Optional[pulumi.Input[str]] = None,
                 grant_types: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                 groups_claim: Optional[pulumi.Input[pulumi.InputType['OAuthGroupsClaimArgs']]] = None,
                 hide_ios: Optional[pulumi.Input[bool]] = None,
                 hide_web: Optional[pulumi.Input[bool]] = None,
                 implicit_assignment: Optional[pulumi.Input[bool]] = None,
                 issuer_mode: Optional[pulumi.Input[str]] = None,
                 jwks: Optional[pulumi.Input[Sequence[pulumi.Input[pulumi.InputType['OAuthJwkArgs']]]]] = None,
                 jwks_uri: Optional[pulumi.Input[str]] = None,
                 label: Optional[pulumi.Input[str]] = None,
                 login_mode: Optional[pulumi.Input[str]] = None,
                 login_scopes: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                 login_uri: Optional[pulumi.Input[str]] = None,
                 logo: Optional[pulumi.Input[str]] = None,
                 logo_uri: Optional[pulumi.Input[str]] = None,
                 omit_secret: Optional[pulumi.Input[bool]] = None,
                 pkce_required: Optional[pulumi.Input[bool]] = None,
                 policy_uri: Optional[pulumi.Input[str]] = None,
                 post_logout_redirect_uris: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                 profile: Optional[pulumi.Input[str]] = None,
                 redirect_uris: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                 refresh_token_leeway: Optional[pulumi.Input[int]] = None,
                 refresh_token_rotation: Optional[pulumi.Input[str]] = None,
                 response_types: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                 status: Optional[pulumi.Input[str]] = None,
                 token_endpoint_auth_method: Optional[pulumi.Input[str]] = None,
                 tos_uri: Optional[pulumi.Input[str]] = None,
                 type: Optional[pulumi.Input[str]] = None,
                 user_name_template: Optional[pulumi.Input[str]] = None,
                 user_name_template_push_status: Optional[pulumi.Input[str]] = None,
                 user_name_template_suffix: Optional[pulumi.Input[str]] = None,
                 user_name_template_type: Optional[pulumi.Input[str]] = None,
                 wildcard_redirect: Optional[pulumi.Input[str]] = None,
                 __props__=None):
        opts = pulumi.ResourceOptions.merge(_utilities.get_resource_opts_defaults(), opts)
        if not isinstance(opts, pulumi.ResourceOptions):
            raise TypeError('Expected resource options to be a ResourceOptions instance')
        if opts.id is None:
            if __props__ is not None:
                raise TypeError('__props__ is only valid when passed in combination with a valid opts.id to get an existing resource')
            __props__ = OAuthArgs.__new__(OAuthArgs)

            __props__.__dict__["accessibility_error_redirect_url"] = accessibility_error_redirect_url
            __props__.__dict__["accessibility_login_redirect_url"] = accessibility_login_redirect_url
            __props__.__dict__["accessibility_self_service"] = accessibility_self_service
            __props__.__dict__["admin_note"] = admin_note
            __props__.__dict__["app_links_json"] = app_links_json
            __props__.__dict__["app_settings_json"] = app_settings_json
            __props__.__dict__["authentication_policy"] = authentication_policy
            __props__.__dict__["auto_key_rotation"] = auto_key_rotation
            __props__.__dict__["auto_submit_toolbar"] = auto_submit_toolbar
            __props__.__dict__["client_basic_secret"] = None if client_basic_secret is None else pulumi.Output.secret(client_basic_secret)
            __props__.__dict__["client_id"] = client_id
            __props__.__dict__["client_uri"] = client_uri
            __props__.__dict__["consent_method"] = consent_method
            __props__.__dict__["enduser_note"] = enduser_note
            __props__.__dict__["grant_types"] = grant_types
            __props__.__dict__["groups_claim"] = groups_claim
            __props__.__dict__["hide_ios"] = hide_ios
            __props__.__dict__["hide_web"] = hide_web
            __props__.__dict__["implicit_assignment"] = implicit_assignment
            __props__.__dict__["issuer_mode"] = issuer_mode
            __props__.__dict__["jwks"] = jwks
            __props__.__dict__["jwks_uri"] = jwks_uri
            if label is None and not opts.urn:
                raise TypeError("Missing required property 'label'")
            __props__.__dict__["label"] = label
            __props__.__dict__["login_mode"] = login_mode
            __props__.__dict__["login_scopes"] = login_scopes
            __props__.__dict__["login_uri"] = login_uri
            __props__.__dict__["logo"] = logo
            __props__.__dict__["logo_uri"] = logo_uri
            __props__.__dict__["omit_secret"] = omit_secret
            __props__.__dict__["pkce_required"] = pkce_required
            __props__.__dict__["policy_uri"] = policy_uri
            __props__.__dict__["post_logout_redirect_uris"] = post_logout_redirect_uris
            __props__.__dict__["profile"] = profile
            __props__.__dict__["redirect_uris"] = redirect_uris
            __props__.__dict__["refresh_token_leeway"] = refresh_token_leeway
            __props__.__dict__["refresh_token_rotation"] = refresh_token_rotation
            __props__.__dict__["response_types"] = response_types
            __props__.__dict__["status"] = status
            __props__.__dict__["token_endpoint_auth_method"] = token_endpoint_auth_method
            __props__.__dict__["tos_uri"] = tos_uri
            if type is None and not opts.urn:
                raise TypeError("Missing required property 'type'")
            __props__.__dict__["type"] = type
            __props__.__dict__["user_name_template"] = user_name_template
            __props__.__dict__["user_name_template_push_status"] = user_name_template_push_status
            __props__.__dict__["user_name_template_suffix"] = user_name_template_suffix
            __props__.__dict__["user_name_template_type"] = user_name_template_type
            __props__.__dict__["wildcard_redirect"] = wildcard_redirect
            __props__.__dict__["client_secret"] = None
            __props__.__dict__["logo_url"] = None
            __props__.__dict__["name"] = None
            __props__.__dict__["sign_on_mode"] = None
        secret_opts = pulumi.ResourceOptions(additional_secret_outputs=["clientBasicSecret", "clientSecret"])
        opts = pulumi.ResourceOptions.merge(opts, secret_opts)
        super(OAuth, __self__).__init__(
            'okta:app/oAuth:OAuth',
            resource_name,
            __props__,
            opts)

    @staticmethod
    def get(resource_name: str,
            id: pulumi.Input[str],
            opts: Optional[pulumi.ResourceOptions] = None,
            accessibility_error_redirect_url: Optional[pulumi.Input[str]] = None,
            accessibility_login_redirect_url: Optional[pulumi.Input[str]] = None,
            accessibility_self_service: Optional[pulumi.Input[bool]] = None,
            admin_note: Optional[pulumi.Input[str]] = None,
            app_links_json: Optional[pulumi.Input[str]] = None,
            app_settings_json: Optional[pulumi.Input[str]] = None,
            authentication_policy: Optional[pulumi.Input[str]] = None,
            auto_key_rotation: Optional[pulumi.Input[bool]] = None,
            auto_submit_toolbar: Optional[pulumi.Input[bool]] = None,
            client_basic_secret: Optional[pulumi.Input[str]] = None,
            client_id: Optional[pulumi.Input[str]] = None,
            client_secret: Optional[pulumi.Input[str]] = None,
            client_uri: Optional[pulumi.Input[str]] = None,
            consent_method: Optional[pulumi.Input[str]] = None,
            enduser_note: Optional[pulumi.Input[str]] = None,
            grant_types: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
            groups_claim: Optional[pulumi.Input[pulumi.InputType['OAuthGroupsClaimArgs']]] = None,
            hide_ios: Optional[pulumi.Input[bool]] = None,
            hide_web: Optional[pulumi.Input[bool]] = None,
            implicit_assignment: Optional[pulumi.Input[bool]] = None,
            issuer_mode: Optional[pulumi.Input[str]] = None,
            jwks: Optional[pulumi.Input[Sequence[pulumi.Input[pulumi.InputType['OAuthJwkArgs']]]]] = None,
            jwks_uri: Optional[pulumi.Input[str]] = None,
            label: Optional[pulumi.Input[str]] = None,
            login_mode: Optional[pulumi.Input[str]] = None,
            login_scopes: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
            login_uri: Optional[pulumi.Input[str]] = None,
            logo: Optional[pulumi.Input[str]] = None,
            logo_uri: Optional[pulumi.Input[str]] = None,
            logo_url: Optional[pulumi.Input[str]] = None,
            name: Optional[pulumi.Input[str]] = None,
            omit_secret: Optional[pulumi.Input[bool]] = None,
            pkce_required: Optional[pulumi.Input[bool]] = None,
            policy_uri: Optional[pulumi.Input[str]] = None,
            post_logout_redirect_uris: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
            profile: Optional[pulumi.Input[str]] = None,
            redirect_uris: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
            refresh_token_leeway: Optional[pulumi.Input[int]] = None,
            refresh_token_rotation: Optional[pulumi.Input[str]] = None,
            response_types: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
            sign_on_mode: Optional[pulumi.Input[str]] = None,
            status: Optional[pulumi.Input[str]] = None,
            token_endpoint_auth_method: Optional[pulumi.Input[str]] = None,
            tos_uri: Optional[pulumi.Input[str]] = None,
            type: Optional[pulumi.Input[str]] = None,
            user_name_template: Optional[pulumi.Input[str]] = None,
            user_name_template_push_status: Optional[pulumi.Input[str]] = None,
            user_name_template_suffix: Optional[pulumi.Input[str]] = None,
            user_name_template_type: Optional[pulumi.Input[str]] = None,
            wildcard_redirect: Optional[pulumi.Input[str]] = None) -> 'OAuth':
        """
        Get an existing OAuth resource's state with the given name, id, and optional extra
        properties used to qualify the lookup.

        :param str resource_name: The unique name of the resulting resource.
        :param pulumi.Input[str] id: The unique provider ID of the resource to lookup.
        :param pulumi.ResourceOptions opts: Options for the resource.
        :param pulumi.Input[str] accessibility_error_redirect_url: Custom error page URL.
        :param pulumi.Input[str] accessibility_login_redirect_url: Custom login page for this application.
        :param pulumi.Input[bool] accessibility_self_service: Enable self-service. By default, it is `false`.
        :param pulumi.Input[str] admin_note: Application notes for admins.
        :param pulumi.Input[str] app_links_json: Displays specific appLinks for the app. The value for each application link should be boolean.
        :param pulumi.Input[str] app_settings_json: Application settings in JSON format.
        :param pulumi.Input[str] authentication_policy: The ID of the associated `app_signon_policy`. If this property is removed from the application the `default` sign-on-policy will be associated with this application.
        :param pulumi.Input[bool] auto_key_rotation: Requested key rotation mode.  If
               `auto_key_rotation` isn't specified, the client automatically opts in for Okta's
               key rotation. You can update this property via the API or via the administrator
               UI.
               See: https://developer.okta.com/docs/reference/api/apps/#oauth-credential-object
        :param pulumi.Input[bool] auto_submit_toolbar: Display auto submit toolbar.
        :param pulumi.Input[str] client_basic_secret: The user provided OAuth client secret key value, this can be set when `token_endpoint_auth_method` is `"client_secret_basic"`. This does nothing when `omit_secret` is set to true.
        :param pulumi.Input[str] client_id: OAuth client ID. If set during creation, app is created with this id. See: https://developer.okta.com/docs/reference/api/apps/#oauth-credential-object
        :param pulumi.Input[str] client_secret: OAuth client secret value, this is output only. This will be in plain text in your statefile unless you set omit_secret above. See: https://developer.okta.com/docs/reference/api/apps/#oauth-credential-object
        :param pulumi.Input[str] client_uri: URI to a web page providing information about the client.
        :param pulumi.Input[str] consent_method: Indicates whether user consent is required or implicit. Valid values: `"REQUIRED"`, `"TRUSTED"`. Default value is `"TRUSTED"`.
        :param pulumi.Input[str] enduser_note: Application notes for end users.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] grant_types: List of OAuth 2.0 grant types. Conditional validation params found [here](https://developer.okta.com/docs/api/resources/apps#credentials-settings-details).
               Defaults to minimum requirements per app type. Valid values: `"authorization_code"`, `"implicit"`, `"password"`, `"refresh_token"`, `"client_credentials"`,
               `"urn:ietf:params:oauth:grant-type:saml2-bearer"` (*Early Access Property*), `"urn:ietf:params:oauth:grant-type:token-exchange"` (*Early Access Property*),
               `"interaction_code"` (*OIE only*).
        :param pulumi.Input[pulumi.InputType['OAuthGroupsClaimArgs']] groups_claim: Groups claim for an OpenID Connect client application. **IMPORTANT**: this argument is ignored when Okta API authentication is done with OAuth 2.0 credentials
        :param pulumi.Input[bool] hide_ios: Do not display application icon on mobile app.
        :param pulumi.Input[bool] hide_web: Do not display application icon to users.
        :param pulumi.Input[bool] implicit_assignment: *Early Access Property*. Enables [Federation Broker Mode](https://help.okta.com/en/prod/Content/Topics/Apps/apps-fbm-enable.htm). When this mode is enabled, `users` and `groups` arguments are ignored.
        :param pulumi.Input[str] issuer_mode: Indicates whether the Okta Authorization Server uses the original Okta org domain URL or a custom domain URL as the issuer of ID token for this client.
               Valid values: `"CUSTOM_URL"`,`"ORG_URL"` or `"DYNAMIC"`. Default is `"ORG_URL"`.
        :param pulumi.Input[Sequence[pulumi.Input[pulumi.InputType['OAuthJwkArgs']]]] jwks: JSON Web Key set. Multiple jwks are supported[Admin Console JWK Reference](https://developer.okta.com/docs/guides/implement-oauth-for-okta-serviceapp/main/#generate-the-jwk-in-the-admin-console). Use kty=RSA e=[value] n=[value] for RSA jwks, and kty=EC x=[value] y=[value] for EC jwks
        :param pulumi.Input[str] jwks_uri: URL of the custom authorization server's JSON Web Key Set document.
        :param pulumi.Input[str] label: The Application's display name.
        :param pulumi.Input[str] login_mode: The type of Idp-Initiated login that the client supports, if any. Valid values: `"DISABLED"`, `"SPEC"`, `"OKTA"`. Default is `"DISABLED"`.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] login_scopes: List of scopes to use for the request. Valid values: `"openid"`, `"profile"`, `"email"`, `"address"`, `"phone"`. Required when `login_mode` is NOT `DISABLED`.
        :param pulumi.Input[str] login_uri: URI that initiates login. Required when `login_mode` is NOT `DISABLED`.
        :param pulumi.Input[str] logo: Local file path to the logo. The file must be in PNG, JPG, or GIF format, and less than 1 MB in size.
        :param pulumi.Input[str] logo_uri: URI that references a logo for the client.
        :param pulumi.Input[str] logo_url: Direct link of application logo.
        :param pulumi.Input[str] name: Name assigned to the application by Okta.
        :param pulumi.Input[bool] omit_secret: This tells the provider not manage the `client_secret` value in state. When this is false (the default), it will cause the auto-generated `client_secret` to be persisted in the `client_secret` attribute in state. This also means that every time an update to this app is run, this value is also set on the API. If this changes from false => true, the `client_secret` is dropped from state and the secret at the time of the apply is what remains. If this is ever changes from true => false your app will be recreated, due to the need to regenerate a secret we can store in state.
        :param pulumi.Input[bool] pkce_required: Require Proof Key for Code Exchange (PKCE) for
               additional verification.  If `pkce_required` isn't specified when adding a new
               application, Okta sets it to `true` by default for `"browser"` and `"native"`
               application types.
               See https://developer.okta.com/docs/reference/api/apps/#oauth-credential-object
        :param pulumi.Input[str] policy_uri: URI to web page providing client policy document.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] post_logout_redirect_uris: List of URIs for redirection after logout.
        :param pulumi.Input[str] profile: Custom JSON that represents an OAuth application's profile.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] redirect_uris: List of URIs for use in the redirect-based flow. This is required for all application types except service.
        :param pulumi.Input[int] refresh_token_leeway: Grace period for token rotation. Valid values: 0 to 60 seconds.
        :param pulumi.Input[str] refresh_token_rotation: Refresh token rotation behavior. Valid values: `"STATIC"` or `"ROTATE"`.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] response_types: List of OAuth 2.0 response type strings. Array
               values of `"code"`, `"token"`, `"id_token"`. The `grant_types` and `response_types`
               values described are partially orthogonal, as they refer to arguments
               passed to different endpoints in the OAuth 2.0 protocol (opens new window).
               However, they are related in that the `grant_types` available to a client
               influence the `response_types` that the client is allowed to use, and vice versa.
               For instance, a grant_types value that includes authorization_code implies a
               `response_types` value that includes code, as both values are defined as part of
               the OAuth 2.0 authorization code grant.
               See: https://developer.okta.com/docs/reference/api/apps/#add-oauth-2-0-client-application
        :param pulumi.Input[str] sign_on_mode: Sign-on mode of application.
        :param pulumi.Input[str] status: The status of the application, by default, it is `"ACTIVE"`.
        :param pulumi.Input[str] token_endpoint_auth_method: Requested authentication method for
               the token endpoint. It can be set to `"none"`, `"client_secret_post"`,
               `"client_secret_basic"`, `"client_secret_jwt"`, `"private_key_jwt"`.  Use
               `pkce_required` to require PKCE for your confidential clients using the
               Authorization Code flow. If `"token_endpoint_auth_method"` is `"none"`,
               `pkce_required` needs to be `true`. If `pkce_required` isn't specified when
               adding a new application, Okta sets it to `true` by default for `"browser"` and
               `"native"` application types.
               See https://developer.okta.com/docs/reference/api/apps/#oauth-credential-object
        :param pulumi.Input[str] tos_uri: URI to web page providing client tos (terms of service).
        :param pulumi.Input[str] type: The type of OAuth application. Valid values: `"web"`, `"native"`, `"browser"`, `"service"`. For SPA apps use `browser`.
        :param pulumi.Input[str] user_name_template: Username template. Default: `"${source.login}"`
        :param pulumi.Input[str] user_name_template_push_status: Push username on update. Valid values: `"PUSH"` and `"DONT_PUSH"`.
        :param pulumi.Input[str] user_name_template_suffix: Username template suffix.
        :param pulumi.Input[str] user_name_template_type: Username template type. Default: `"BUILT_IN"`.
        :param pulumi.Input[str] wildcard_redirect: *Early Access Property*. Indicates if the client is allowed to use wildcard matching of `redirect_uris`. Valid values: `"DISABLED"`, `"SUBDOMAIN"`. Default value is `"DISABLED"`.
        """
        opts = pulumi.ResourceOptions.merge(opts, pulumi.ResourceOptions(id=id))

        __props__ = _OAuthState.__new__(_OAuthState)

        __props__.__dict__["accessibility_error_redirect_url"] = accessibility_error_redirect_url
        __props__.__dict__["accessibility_login_redirect_url"] = accessibility_login_redirect_url
        __props__.__dict__["accessibility_self_service"] = accessibility_self_service
        __props__.__dict__["admin_note"] = admin_note
        __props__.__dict__["app_links_json"] = app_links_json
        __props__.__dict__["app_settings_json"] = app_settings_json
        __props__.__dict__["authentication_policy"] = authentication_policy
        __props__.__dict__["auto_key_rotation"] = auto_key_rotation
        __props__.__dict__["auto_submit_toolbar"] = auto_submit_toolbar
        __props__.__dict__["client_basic_secret"] = client_basic_secret
        __props__.__dict__["client_id"] = client_id
        __props__.__dict__["client_secret"] = client_secret
        __props__.__dict__["client_uri"] = client_uri
        __props__.__dict__["consent_method"] = consent_method
        __props__.__dict__["enduser_note"] = enduser_note
        __props__.__dict__["grant_types"] = grant_types
        __props__.__dict__["groups_claim"] = groups_claim
        __props__.__dict__["hide_ios"] = hide_ios
        __props__.__dict__["hide_web"] = hide_web
        __props__.__dict__["implicit_assignment"] = implicit_assignment
        __props__.__dict__["issuer_mode"] = issuer_mode
        __props__.__dict__["jwks"] = jwks
        __props__.__dict__["jwks_uri"] = jwks_uri
        __props__.__dict__["label"] = label
        __props__.__dict__["login_mode"] = login_mode
        __props__.__dict__["login_scopes"] = login_scopes
        __props__.__dict__["login_uri"] = login_uri
        __props__.__dict__["logo"] = logo
        __props__.__dict__["logo_uri"] = logo_uri
        __props__.__dict__["logo_url"] = logo_url
        __props__.__dict__["name"] = name
        __props__.__dict__["omit_secret"] = omit_secret
        __props__.__dict__["pkce_required"] = pkce_required
        __props__.__dict__["policy_uri"] = policy_uri
        __props__.__dict__["post_logout_redirect_uris"] = post_logout_redirect_uris
        __props__.__dict__["profile"] = profile
        __props__.__dict__["redirect_uris"] = redirect_uris
        __props__.__dict__["refresh_token_leeway"] = refresh_token_leeway
        __props__.__dict__["refresh_token_rotation"] = refresh_token_rotation
        __props__.__dict__["response_types"] = response_types
        __props__.__dict__["sign_on_mode"] = sign_on_mode
        __props__.__dict__["status"] = status
        __props__.__dict__["token_endpoint_auth_method"] = token_endpoint_auth_method
        __props__.__dict__["tos_uri"] = tos_uri
        __props__.__dict__["type"] = type
        __props__.__dict__["user_name_template"] = user_name_template
        __props__.__dict__["user_name_template_push_status"] = user_name_template_push_status
        __props__.__dict__["user_name_template_suffix"] = user_name_template_suffix
        __props__.__dict__["user_name_template_type"] = user_name_template_type
        __props__.__dict__["wildcard_redirect"] = wildcard_redirect
        return OAuth(resource_name, opts=opts, __props__=__props__)

    @property
    @pulumi.getter(name="accessibilityErrorRedirectUrl")
    def accessibility_error_redirect_url(self) -> pulumi.Output[Optional[str]]:
        """
        Custom error page URL.
        """
        return pulumi.get(self, "accessibility_error_redirect_url")

    @property
    @pulumi.getter(name="accessibilityLoginRedirectUrl")
    def accessibility_login_redirect_url(self) -> pulumi.Output[Optional[str]]:
        """
        Custom login page for this application.
        """
        return pulumi.get(self, "accessibility_login_redirect_url")

    @property
    @pulumi.getter(name="accessibilitySelfService")
    def accessibility_self_service(self) -> pulumi.Output[Optional[bool]]:
        """
        Enable self-service. By default, it is `false`.
        """
        return pulumi.get(self, "accessibility_self_service")

    @property
    @pulumi.getter(name="adminNote")
    def admin_note(self) -> pulumi.Output[Optional[str]]:
        """
        Application notes for admins.
        """
        return pulumi.get(self, "admin_note")

    @property
    @pulumi.getter(name="appLinksJson")
    def app_links_json(self) -> pulumi.Output[Optional[str]]:
        """
        Displays specific appLinks for the app. The value for each application link should be boolean.
        """
        return pulumi.get(self, "app_links_json")

    @property
    @pulumi.getter(name="appSettingsJson")
    def app_settings_json(self) -> pulumi.Output[Optional[str]]:
        """
        Application settings in JSON format.
        """
        return pulumi.get(self, "app_settings_json")

    @property
    @pulumi.getter(name="authenticationPolicy")
    def authentication_policy(self) -> pulumi.Output[Optional[str]]:
        """
        The ID of the associated `app_signon_policy`. If this property is removed from the application the `default` sign-on-policy will be associated with this application.
        """
        return pulumi.get(self, "authentication_policy")

    @property
    @pulumi.getter(name="autoKeyRotation")
    def auto_key_rotation(self) -> pulumi.Output[Optional[bool]]:
        """
        Requested key rotation mode.  If
        `auto_key_rotation` isn't specified, the client automatically opts in for Okta's
        key rotation. You can update this property via the API or via the administrator
        UI.
        See: https://developer.okta.com/docs/reference/api/apps/#oauth-credential-object
        """
        return pulumi.get(self, "auto_key_rotation")

    @property
    @pulumi.getter(name="autoSubmitToolbar")
    def auto_submit_toolbar(self) -> pulumi.Output[Optional[bool]]:
        """
        Display auto submit toolbar.
        """
        return pulumi.get(self, "auto_submit_toolbar")

    @property
    @pulumi.getter(name="clientBasicSecret")
    def client_basic_secret(self) -> pulumi.Output[Optional[str]]:
        """
        The user provided OAuth client secret key value, this can be set when `token_endpoint_auth_method` is `"client_secret_basic"`. This does nothing when `omit_secret` is set to true.
        """
        return pulumi.get(self, "client_basic_secret")

    @property
    @pulumi.getter(name="clientId")
    def client_id(self) -> pulumi.Output[str]:
        """
        OAuth client ID. If set during creation, app is created with this id. See: https://developer.okta.com/docs/reference/api/apps/#oauth-credential-object
        """
        return pulumi.get(self, "client_id")

    @property
    @pulumi.getter(name="clientSecret")
    def client_secret(self) -> pulumi.Output[str]:
        """
        OAuth client secret value, this is output only. This will be in plain text in your statefile unless you set omit_secret above. See: https://developer.okta.com/docs/reference/api/apps/#oauth-credential-object
        """
        return pulumi.get(self, "client_secret")

    @property
    @pulumi.getter(name="clientUri")
    def client_uri(self) -> pulumi.Output[Optional[str]]:
        """
        URI to a web page providing information about the client.
        """
        return pulumi.get(self, "client_uri")

    @property
    @pulumi.getter(name="consentMethod")
    def consent_method(self) -> pulumi.Output[Optional[str]]:
        """
        Indicates whether user consent is required or implicit. Valid values: `"REQUIRED"`, `"TRUSTED"`. Default value is `"TRUSTED"`.
        """
        return pulumi.get(self, "consent_method")

    @property
    @pulumi.getter(name="enduserNote")
    def enduser_note(self) -> pulumi.Output[Optional[str]]:
        """
        Application notes for end users.
        """
        return pulumi.get(self, "enduser_note")

    @property
    @pulumi.getter(name="grantTypes")
    def grant_types(self) -> pulumi.Output[Optional[Sequence[str]]]:
        """
        List of OAuth 2.0 grant types. Conditional validation params found [here](https://developer.okta.com/docs/api/resources/apps#credentials-settings-details).
        Defaults to minimum requirements per app type. Valid values: `"authorization_code"`, `"implicit"`, `"password"`, `"refresh_token"`, `"client_credentials"`,
        `"urn:ietf:params:oauth:grant-type:saml2-bearer"` (*Early Access Property*), `"urn:ietf:params:oauth:grant-type:token-exchange"` (*Early Access Property*),
        `"interaction_code"` (*OIE only*).
        """
        return pulumi.get(self, "grant_types")

    @property
    @pulumi.getter(name="groupsClaim")
    def groups_claim(self) -> pulumi.Output[Optional['outputs.OAuthGroupsClaim']]:
        """
        Groups claim for an OpenID Connect client application. **IMPORTANT**: this argument is ignored when Okta API authentication is done with OAuth 2.0 credentials
        """
        return pulumi.get(self, "groups_claim")

    @property
    @pulumi.getter(name="hideIos")
    def hide_ios(self) -> pulumi.Output[Optional[bool]]:
        """
        Do not display application icon on mobile app.
        """
        return pulumi.get(self, "hide_ios")

    @property
    @pulumi.getter(name="hideWeb")
    def hide_web(self) -> pulumi.Output[Optional[bool]]:
        """
        Do not display application icon to users.
        """
        return pulumi.get(self, "hide_web")

    @property
    @pulumi.getter(name="implicitAssignment")
    def implicit_assignment(self) -> pulumi.Output[Optional[bool]]:
        """
        *Early Access Property*. Enables [Federation Broker Mode](https://help.okta.com/en/prod/Content/Topics/Apps/apps-fbm-enable.htm). When this mode is enabled, `users` and `groups` arguments are ignored.
        """
        return pulumi.get(self, "implicit_assignment")

    @property
    @pulumi.getter(name="issuerMode")
    def issuer_mode(self) -> pulumi.Output[Optional[str]]:
        """
        Indicates whether the Okta Authorization Server uses the original Okta org domain URL or a custom domain URL as the issuer of ID token for this client.
        Valid values: `"CUSTOM_URL"`,`"ORG_URL"` or `"DYNAMIC"`. Default is `"ORG_URL"`.
        """
        return pulumi.get(self, "issuer_mode")

    @property
    @pulumi.getter
    def jwks(self) -> pulumi.Output[Optional[Sequence['outputs.OAuthJwk']]]:
        """
        JSON Web Key set. Multiple jwks are supported[Admin Console JWK Reference](https://developer.okta.com/docs/guides/implement-oauth-for-okta-serviceapp/main/#generate-the-jwk-in-the-admin-console). Use kty=RSA e=[value] n=[value] for RSA jwks, and kty=EC x=[value] y=[value] for EC jwks
        """
        return pulumi.get(self, "jwks")

    @property
    @pulumi.getter(name="jwksUri")
    def jwks_uri(self) -> pulumi.Output[Optional[str]]:
        """
        URL of the custom authorization server's JSON Web Key Set document.
        """
        return pulumi.get(self, "jwks_uri")

    @property
    @pulumi.getter
    def label(self) -> pulumi.Output[str]:
        """
        The Application's display name.
        """
        return pulumi.get(self, "label")

    @property
    @pulumi.getter(name="loginMode")
    def login_mode(self) -> pulumi.Output[Optional[str]]:
        """
        The type of Idp-Initiated login that the client supports, if any. Valid values: `"DISABLED"`, `"SPEC"`, `"OKTA"`. Default is `"DISABLED"`.
        """
        return pulumi.get(self, "login_mode")

    @property
    @pulumi.getter(name="loginScopes")
    def login_scopes(self) -> pulumi.Output[Optional[Sequence[str]]]:
        """
        List of scopes to use for the request. Valid values: `"openid"`, `"profile"`, `"email"`, `"address"`, `"phone"`. Required when `login_mode` is NOT `DISABLED`.
        """
        return pulumi.get(self, "login_scopes")

    @property
    @pulumi.getter(name="loginUri")
    def login_uri(self) -> pulumi.Output[Optional[str]]:
        """
        URI that initiates login. Required when `login_mode` is NOT `DISABLED`.
        """
        return pulumi.get(self, "login_uri")

    @property
    @pulumi.getter
    def logo(self) -> pulumi.Output[Optional[str]]:
        """
        Local file path to the logo. The file must be in PNG, JPG, or GIF format, and less than 1 MB in size.
        """
        return pulumi.get(self, "logo")

    @property
    @pulumi.getter(name="logoUri")
    def logo_uri(self) -> pulumi.Output[Optional[str]]:
        """
        URI that references a logo for the client.
        """
        return pulumi.get(self, "logo_uri")

    @property
    @pulumi.getter(name="logoUrl")
    def logo_url(self) -> pulumi.Output[str]:
        """
        Direct link of application logo.
        """
        return pulumi.get(self, "logo_url")

    @property
    @pulumi.getter
    def name(self) -> pulumi.Output[str]:
        """
        Name assigned to the application by Okta.
        """
        return pulumi.get(self, "name")

    @property
    @pulumi.getter(name="omitSecret")
    def omit_secret(self) -> pulumi.Output[Optional[bool]]:
        """
        This tells the provider not manage the `client_secret` value in state. When this is false (the default), it will cause the auto-generated `client_secret` to be persisted in the `client_secret` attribute in state. This also means that every time an update to this app is run, this value is also set on the API. If this changes from false => true, the `client_secret` is dropped from state and the secret at the time of the apply is what remains. If this is ever changes from true => false your app will be recreated, due to the need to regenerate a secret we can store in state.
        """
        return pulumi.get(self, "omit_secret")

    @property
    @pulumi.getter(name="pkceRequired")
    def pkce_required(self) -> pulumi.Output[bool]:
        """
        Require Proof Key for Code Exchange (PKCE) for
        additional verification.  If `pkce_required` isn't specified when adding a new
        application, Okta sets it to `true` by default for `"browser"` and `"native"`
        application types.
        See https://developer.okta.com/docs/reference/api/apps/#oauth-credential-object
        """
        return pulumi.get(self, "pkce_required")

    @property
    @pulumi.getter(name="policyUri")
    def policy_uri(self) -> pulumi.Output[Optional[str]]:
        """
        URI to web page providing client policy document.
        """
        return pulumi.get(self, "policy_uri")

    @property
    @pulumi.getter(name="postLogoutRedirectUris")
    def post_logout_redirect_uris(self) -> pulumi.Output[Optional[Sequence[str]]]:
        """
        List of URIs for redirection after logout.
        """
        return pulumi.get(self, "post_logout_redirect_uris")

    @property
    @pulumi.getter
    def profile(self) -> pulumi.Output[Optional[str]]:
        """
        Custom JSON that represents an OAuth application's profile.
        """
        return pulumi.get(self, "profile")

    @property
    @pulumi.getter(name="redirectUris")
    def redirect_uris(self) -> pulumi.Output[Optional[Sequence[str]]]:
        """
        List of URIs for use in the redirect-based flow. This is required for all application types except service.
        """
        return pulumi.get(self, "redirect_uris")

    @property
    @pulumi.getter(name="refreshTokenLeeway")
    def refresh_token_leeway(self) -> pulumi.Output[Optional[int]]:
        """
        Grace period for token rotation. Valid values: 0 to 60 seconds.
        """
        return pulumi.get(self, "refresh_token_leeway")

    @property
    @pulumi.getter(name="refreshTokenRotation")
    def refresh_token_rotation(self) -> pulumi.Output[Optional[str]]:
        """
        Refresh token rotation behavior. Valid values: `"STATIC"` or `"ROTATE"`.
        """
        return pulumi.get(self, "refresh_token_rotation")

    @property
    @pulumi.getter(name="responseTypes")
    def response_types(self) -> pulumi.Output[Optional[Sequence[str]]]:
        """
        List of OAuth 2.0 response type strings. Array
        values of `"code"`, `"token"`, `"id_token"`. The `grant_types` and `response_types`
        values described are partially orthogonal, as they refer to arguments
        passed to different endpoints in the OAuth 2.0 protocol (opens new window).
        However, they are related in that the `grant_types` available to a client
        influence the `response_types` that the client is allowed to use, and vice versa.
        For instance, a grant_types value that includes authorization_code implies a
        `response_types` value that includes code, as both values are defined as part of
        the OAuth 2.0 authorization code grant.
        See: https://developer.okta.com/docs/reference/api/apps/#add-oauth-2-0-client-application
        """
        return pulumi.get(self, "response_types")

    @property
    @pulumi.getter(name="signOnMode")
    def sign_on_mode(self) -> pulumi.Output[str]:
        """
        Sign-on mode of application.
        """
        return pulumi.get(self, "sign_on_mode")

    @property
    @pulumi.getter
    def status(self) -> pulumi.Output[Optional[str]]:
        """
        The status of the application, by default, it is `"ACTIVE"`.
        """
        return pulumi.get(self, "status")

    @property
    @pulumi.getter(name="tokenEndpointAuthMethod")
    def token_endpoint_auth_method(self) -> pulumi.Output[Optional[str]]:
        """
        Requested authentication method for
        the token endpoint. It can be set to `"none"`, `"client_secret_post"`,
        `"client_secret_basic"`, `"client_secret_jwt"`, `"private_key_jwt"`.  Use
        `pkce_required` to require PKCE for your confidential clients using the
        Authorization Code flow. If `"token_endpoint_auth_method"` is `"none"`,
        `pkce_required` needs to be `true`. If `pkce_required` isn't specified when
        adding a new application, Okta sets it to `true` by default for `"browser"` and
        `"native"` application types.
        See https://developer.okta.com/docs/reference/api/apps/#oauth-credential-object
        """
        return pulumi.get(self, "token_endpoint_auth_method")

    @property
    @pulumi.getter(name="tosUri")
    def tos_uri(self) -> pulumi.Output[Optional[str]]:
        """
        URI to web page providing client tos (terms of service).
        """
        return pulumi.get(self, "tos_uri")

    @property
    @pulumi.getter
    def type(self) -> pulumi.Output[str]:
        """
        The type of OAuth application. Valid values: `"web"`, `"native"`, `"browser"`, `"service"`. For SPA apps use `browser`.
        """
        return pulumi.get(self, "type")

    @property
    @pulumi.getter(name="userNameTemplate")
    def user_name_template(self) -> pulumi.Output[Optional[str]]:
        """
        Username template. Default: `"${source.login}"`
        """
        return pulumi.get(self, "user_name_template")

    @property
    @pulumi.getter(name="userNameTemplatePushStatus")
    def user_name_template_push_status(self) -> pulumi.Output[Optional[str]]:
        """
        Push username on update. Valid values: `"PUSH"` and `"DONT_PUSH"`.
        """
        return pulumi.get(self, "user_name_template_push_status")

    @property
    @pulumi.getter(name="userNameTemplateSuffix")
    def user_name_template_suffix(self) -> pulumi.Output[Optional[str]]:
        """
        Username template suffix.
        """
        return pulumi.get(self, "user_name_template_suffix")

    @property
    @pulumi.getter(name="userNameTemplateType")
    def user_name_template_type(self) -> pulumi.Output[Optional[str]]:
        """
        Username template type. Default: `"BUILT_IN"`.
        """
        return pulumi.get(self, "user_name_template_type")

    @property
    @pulumi.getter(name="wildcardRedirect")
    def wildcard_redirect(self) -> pulumi.Output[Optional[str]]:
        """
        *Early Access Property*. Indicates if the client is allowed to use wildcard matching of `redirect_uris`. Valid values: `"DISABLED"`, `"SUBDOMAIN"`. Default value is `"DISABLED"`.
        """
        return pulumi.get(self, "wildcard_redirect")

