# Retrieve a CIMD Domain API API documentation for the FusionAuth Retrieve a CIMD Domain API. > For the index of this section of the site, see [llms.txt](https://fusionauth.io/docs/llms.txt) Available since `1.70.0` This API is used to retrieve one or all of the configured [CIMD domains](https://fusionauth.io/docs/get-started/core-concepts/types/cimd-domains.md). Specifying an Id on the URI will retrieve a single CIMD domain. Leaving off the Id will retrieve all of the CIMD domains. Note Unlike most CIMD domain APIs, this operation does not require the CIMD feature to be enabled on your license. You can always read your existing CIMD domain configuration. ## Request [API Key Authentication](https://fusionauth.io/docs/apis/authentication.md#api-key-authentication) Retrieve all of the CIMD Domains `GET /api/cimd/domain` #### Request Headers `X-FusionAuth-TenantId` * Type: `String` * Optional The unique Id of the tenant used to scope this API request. The tenant Id is not required on this request even when more than one tenant has been configured because the tenant can be identified based upon other values in the request or it is otherwise not required. Specify a tenant Id on this request when you want to ensure the request is scoped to a specific tenant. The tenant Id may be provided through this header or by using a tenant locked API key to achieve the same result. See [Making an API request using a Tenant Id](https://fusionauth.io/docs/apis/authentication.md#making-an-api-request-using-a-tenant-id) for additional information. [API Key Authentication](https://fusionauth.io/docs/apis/authentication.md#api-key-authentication) Retrieve a single CIMD Domain by Id `GET /api/cimd/domain/{cimdDomainId}` #### Request Headers `X-FusionAuth-TenantId` * Type: `String` * Optional The unique Id of the tenant used to scope this API request. The tenant Id is not required on this request even when more than one tenant has been configured because the tenant can be identified based upon other values in the request or it is otherwise not required. Specify a tenant Id on this request when you want to ensure the request is scoped to a specific tenant. The tenant Id may be provided through this header or by using a tenant locked API key to achieve the same result. See [Making an API request using a Tenant Id](https://fusionauth.io/docs/apis/authentication.md#making-an-api-request-using-a-tenant-id) for additional information. ### Request Parameters `cimdDomainId` * Type: `UUID` * Optional The Id of the CIMD domain to retrieve. ## Response The response for this API contains either a single CIMD domain or all of the CIMD domains. When you call this API with an Id the response will contain just that CIMD domain. When you call this API without an Id the response will contain all of the CIMD domains. If the request contains an `X-FusionAuth-TenantId` header, or the supplied API key is scoped to a specific Tenant, the request is limited to that Tenant's CIMD domains. Both response types are defined below along with an example JSON response. *Response Codes* | Code | Description | | --- | --- | | 200 | The request was successful. The response will contain a JSON body. | | 400 | The request was invalid and/or malformed. The response will contain an [Errors](https://fusionauth.io/docs/apis/errors.md) JSON Object with the specific errors. This status will also be returned if a paid FusionAuth license is required and is not present. | | 401 | You did not supply a valid Authorization header. The header was omitted or your API key was not valid. The response will be empty. See [Authentication](https://fusionauth.io/docs/apis/authentication.md). | | 404 | The object you requested doesn't exist. The response will be empty. | | 500 | There was an internal error. A stack trace is provided and logged in the FusionAuth log files. The response will be empty. | ### Response Body `domain.allowLocalhostRedirectUris` * Type: `Boolean` Whether CIMD clients on this domain may use a `localhost` redirect URI, such as `http://localhost:3334/callback`. The URI must also appear in the client's metadata document **redirect\_uris**. When `false`, FusionAuth rejects any `localhost` redirect URI, but still accepts loopback IP addresses such as `http://127.0.0.1/callback`. [RFC 8252 Section 7.3](https://datatracker.ietf.org/doc/html/rfc8252#section-7.3) recommends loopback IP addresses over `localhost`, because the name can resolve to an interface other than loopback. Enable this only for CIMD clients that require it. `domain.authorizedResourceUris` * Type: `Array` The resource URIs that clients registered on this CIMD domain may request using the [RFC 8707](https://datatracker.ietf.org/doc/html/rfc8707) `resource` parameter. Every CIMD client must send exactly one `resource` parameter, and FusionAuth rejects the request with `invalid_target` unless it appears in this list. Clients on a domain with an empty list cannot log in. `domain.consentMode` * Type: `String` Controls whether a user is prompted to consent to the OAuth scopes requested by this domain's clients. The possible values are: * `AlwaysPrompt` - Always prompt the user for consent. * `RememberDecision` - Remember previous consents; only prompt if the choice expires or if the requested or required scopes have changed. The duration of this persisted choice is controlled by the Tenant's **externalIdentifierConfiguration.rememberOAuthScopeConsentChoiceTimeToLiveInSeconds** value. `NeverPrompt` is not a valid value for a CIMD domain. CIMD clients are always treated as third-party clients, so consent can never be granted implicitly. `domain.data` * Type: `Object` An object that can hold any information about the CIMD domain that should be persisted. `domain.debug` * Type: `Boolean` Whether FusionAuth writes the standard OAuth debug Event Log entries, such as the authorization code exchange, for this domain's clients. The authorization code exchange entry lists the requested resources. FusionAuth also writes a Debug entry when it creates a client registration, refreshes one after its cache expires, or adds a new resource to an existing one. FusionAuth always writes an Error entry for a failed client registration, whether or not this is enabled. It always writes an Information entry when it rate limits a registration. `domain.domain` * Type: `String` The normalized origin that CIMD clients register from, in the form `scheme://host[:port]`, or the literal `*` to accept registrations from any origin. FusionAuth uses this value to validate the `client_id` URL presented on an OAuth request. `domain.gracePeriodInSeconds` * Type: `Integer` How long, in seconds, FusionAuth will continue to honor an expired cached metadata document when a re-fetch of that document fails. `domain.id` * Type: `UUID` The unique Id of the CIMD domain. `domain.insertInstant` * Type: `Long` The [instant](https://fusionauth.io/docs/reference/data-types.md#instants) that the CIMD domain was added to the FusionAuth database. `domain.jwtPopulateLambdaId` * Type: `UUID` The unique Id of the lambda used to populate the claims of the access token and Id token issued to this domain's clients. `domain.lastUpdateInstant` * Type: `Long` The [instant](https://fusionauth.io/docs/reference/data-types.md#instants) that the CIMD domain was last updated in the FusionAuth database. `domain.maxCacheTtlInSeconds` * Type: `Integer` The ceiling, in seconds, applied to the `Cache-Control: max-age` value returned when fetching a client's metadata document. When the document specifies a smaller value, that smaller value is used. The `Expires` header is not honored. Always at least `900`, the non-configurable 15 minute minimum cache duration. `domain.name` * Type: `String` The name of the CIMD domain, used to identify it in the FusionAuth admin UI. When not provided on create, this defaults to the value of **domain.domain**. `domain.providedScopePolicy.address.enabled` * Type: `Boolean` Whether the `address` OAuth scope provided by FusionAuth is enabled for this CIMD domain. A disabled scope is treated as an unknown scope when requested. `domain.providedScopePolicy.address.required` * Type: `Boolean` Whether consent to the `address` OAuth scope provided by FusionAuth is required for this CIMD domain when present on the OAuth request. `domain.providedScopePolicy.email.enabled` * Type: `Boolean` Whether the `email` OAuth scope provided by FusionAuth is enabled for this CIMD domain. A disabled scope is treated as an unknown scope when requested. `domain.providedScopePolicy.email.required` * Type: `Boolean` Whether consent to the `email` OAuth scope provided by FusionAuth is required for this CIMD domain when present on the OAuth request. `domain.providedScopePolicy.phone.enabled` * Type: `Boolean` Whether the `phone` OAuth scope provided by FusionAuth is enabled for this CIMD domain. A disabled scope is treated as an unknown scope when requested. `domain.providedScopePolicy.phone.required` * Type: `Boolean` Whether consent to the `phone` OAuth scope provided by FusionAuth is required for this CIMD domain when present on the OAuth request. `domain.providedScopePolicy.profile.enabled` * Type: `Boolean` Whether the `profile` OAuth scope provided by FusionAuth is enabled for this CIMD domain. A disabled scope is treated as an unknown scope when requested. `domain.providedScopePolicy.profile.required` * Type: `Boolean` Whether consent to the `profile` OAuth scope provided by FusionAuth is required for this CIMD domain when present on the OAuth request. `domain.registrationLambdaId` * Type: `UUID` The unique Id of the [CIMD Client Registration Lambda](https://fusionauth.io/docs/extend/code/lambdas/cimd-client-registration.md) used to accept, reject, or modify a client registration for this domain. When this is not set, no registration lambda runs. `domain.scopes` * Type: `Array` The custom OAuth scopes defined on this CIMD domain. Manage these using the [CIMD Domain OAuth Scope APIs](https://fusionauth.io/docs/apis/cimd-domain-scopes.md). `domain.scopes[x].data` * Type: `Object` An object that can hold any information about the OAuth scope that should be persisted. `domain.scopes[x].defaultConsentDetail` * Type: `String` The default detail to display on the OAuth consent screen if one cannot be found in the theme. `domain.scopes[x].defaultConsentMessage` * Type: `String` The default message to display on the OAuth consent screen if one cannot be found in the theme. `domain.scopes[x].description` * Type: `String` A description of the OAuth scope for internal use. `domain.scopes[x].id` * Type: `UUID` The unique Id of the OAuth scope. `domain.scopes[x].insertInstant` * Type: `Long` The [instant](https://fusionauth.io/docs/reference/data-types.md#instants) that the OAuth scope was added to the FusionAuth database. `domain.scopes[x].lastUpdateInstant` * Type: `Long` The [instant](https://fusionauth.io/docs/reference/data-types.md#instants) that the OAuth scope was updated in the FusionAuth database. `domain.scopes[x].name` * Type: `String` The name of the OAuth scope. This is the value that will be used to request the scope in OAuth workflows. `domain.scopes[x].required` * Type: `Boolean` Determines if the OAuth scope is required when requested in an OAuth workflow. `domain.tenantId` * Type: `UUID` The unique Id of the Tenant that this CIMD domain belongs to. Example Response JSON ```json { "domain": { "id": "e9fdb985-9173-4e01-9d73-ac2d60d1dc8e", "name": "Claude", "domain": "https://claude.ai", "tenantId": "30663132-6464-6665-3032-326466613934", "allowLocalhostRedirectUris": false, "authorizedResourceUris": [ "https://mcp.example.com" ], "consentMode": "AlwaysPrompt", "debug": false, "gracePeriodInSeconds": 300, "insertInstant": 1595361142909, "lastUpdateInstant": 1595361143101, "maxCacheTtlInSeconds": 86400, "providedScopePolicy": { "address": { "enabled": false, "required": false }, "email": { "enabled": true, "required": true }, "phone": { "enabled": false, "required": false }, "profile": { "enabled": true, "required": false } }, "registrationLambdaId": "b3a4f2d1-8c5e-4a7b-9f16-2d8e5c1a7b34", "scopes": [ { "id": "d7a1c3e5-2b48-4f96-8e07-5c1a9b3d6f82", "name": "reports:read", "defaultConsentMessage": "View your reports", "defaultConsentDetail": "Grants read-only access to your saved reports.", "description": "Read access to the reporting API.", "insertInstant": 1595361143050, "lastUpdateInstant": 1595361143050, "required": false } ] } } ``` ### Response Body `domains[x].allowLocalhostRedirectUris` * Type: `Boolean` Whether CIMD clients on this domain may use a `localhost` redirect URI, such as `http://localhost:3334/callback`. The URI must also appear in the client's metadata document **redirect\_uris**. When `false`, FusionAuth rejects any `localhost` redirect URI, but still accepts loopback IP addresses such as `http://127.0.0.1/callback`. [RFC 8252 Section 7.3](https://datatracker.ietf.org/doc/html/rfc8252#section-7.3) recommends loopback IP addresses over `localhost`, because the name can resolve to an interface other than loopback. Enable this only for CIMD clients that require it. `domains[x].authorizedResourceUris` * Type: `Array` The resource URIs that clients registered on this CIMD domain may request using the [RFC 8707](https://datatracker.ietf.org/doc/html/rfc8707) `resource` parameter. Every CIMD client must send exactly one `resource` parameter, and FusionAuth rejects the request with `invalid_target` unless it appears in this list. Clients on a domain with an empty list cannot log in. `domains[x].consentMode` * Type: `String` Controls whether a user is prompted to consent to the OAuth scopes requested by this domain's clients. The possible values are: * `AlwaysPrompt` - Always prompt the user for consent. * `RememberDecision` - Remember previous consents; only prompt if the choice expires or if the requested or required scopes have changed. The duration of this persisted choice is controlled by the Tenant's **externalIdentifierConfiguration.rememberOAuthScopeConsentChoiceTimeToLiveInSeconds** value. `NeverPrompt` is not a valid value for a CIMD domain. CIMD clients are always treated as third-party clients, so consent can never be granted implicitly. `domains[x].data` * Type: `Object` An object that can hold any information about the CIMD domain that should be persisted. `domains[x].debug` * Type: `Boolean` Whether FusionAuth writes the standard OAuth debug Event Log entries, such as the authorization code exchange, for this domain's clients. The authorization code exchange entry lists the requested resources. FusionAuth also writes a Debug entry when it creates a client registration, refreshes one after its cache expires, or adds a new resource to an existing one. FusionAuth always writes an Error entry for a failed client registration, whether or not this is enabled. It always writes an Information entry when it rate limits a registration. `domains[x].domain` * Type: `String` The normalized origin that CIMD clients register from, in the form `scheme://host[:port]`, or the literal `*` to accept registrations from any origin. FusionAuth uses this value to validate the `client_id` URL presented on an OAuth request. `domains[x].gracePeriodInSeconds` * Type: `Integer` How long, in seconds, FusionAuth will continue to honor an expired cached metadata document when a re-fetch of that document fails. `domains[x].id` * Type: `UUID` The unique Id of the CIMD domain. `domains[x].insertInstant` * Type: `Long` The [instant](https://fusionauth.io/docs/reference/data-types.md#instants) that the CIMD domain was added to the FusionAuth database. `domains[x].jwtPopulateLambdaId` * Type: `UUID` The unique Id of the lambda used to populate the claims of the access token and Id token issued to this domain's clients. `domains[x].lastUpdateInstant` * Type: `Long` The [instant](https://fusionauth.io/docs/reference/data-types.md#instants) that the CIMD domain was last updated in the FusionAuth database. `domains[x].maxCacheTtlInSeconds` * Type: `Integer` The ceiling, in seconds, applied to the `Cache-Control: max-age` value returned when fetching a client's metadata document. When the document specifies a smaller value, that smaller value is used. The `Expires` header is not honored. Always at least `900`, the non-configurable 15 minute minimum cache duration. `domains[x].name` * Type: `String` The name of the CIMD domain, used to identify it in the FusionAuth admin UI. When not provided on create, this defaults to the value of **domains\[x\].domain**. `domains[x].providedScopePolicy.address.enabled` * Type: `Boolean` Whether the `address` OAuth scope provided by FusionAuth is enabled for this CIMD domain. A disabled scope is treated as an unknown scope when requested. `domains[x].providedScopePolicy.address.required` * Type: `Boolean` Whether consent to the `address` OAuth scope provided by FusionAuth is required for this CIMD domain when present on the OAuth request. `domains[x].providedScopePolicy.email.enabled` * Type: `Boolean` Whether the `email` OAuth scope provided by FusionAuth is enabled for this CIMD domain. A disabled scope is treated as an unknown scope when requested. `domains[x].providedScopePolicy.email.required` * Type: `Boolean` Whether consent to the `email` OAuth scope provided by FusionAuth is required for this CIMD domain when present on the OAuth request. `domains[x].providedScopePolicy.phone.enabled` * Type: `Boolean` Whether the `phone` OAuth scope provided by FusionAuth is enabled for this CIMD domain. A disabled scope is treated as an unknown scope when requested. `domains[x].providedScopePolicy.phone.required` * Type: `Boolean` Whether consent to the `phone` OAuth scope provided by FusionAuth is required for this CIMD domain when present on the OAuth request. `domains[x].providedScopePolicy.profile.enabled` * Type: `Boolean` Whether the `profile` OAuth scope provided by FusionAuth is enabled for this CIMD domain. A disabled scope is treated as an unknown scope when requested. `domains[x].providedScopePolicy.profile.required` * Type: `Boolean` Whether consent to the `profile` OAuth scope provided by FusionAuth is required for this CIMD domain when present on the OAuth request. `domains[x].registrationLambdaId` * Type: `UUID` The unique Id of the [CIMD Client Registration Lambda](https://fusionauth.io/docs/extend/code/lambdas/cimd-client-registration.md) used to accept, reject, or modify a client registration for this domain. When this is not set, no registration lambda runs. `domains[x].scopes` * Type: `Array` The custom OAuth scopes defined on this CIMD domain. Manage these using the [CIMD Domain OAuth Scope APIs](https://fusionauth.io/docs/apis/cimd-domain-scopes.md). `domains[x].scopes[x].data` * Type: `Object` An object that can hold any information about the OAuth scope that should be persisted. `domains[x].scopes[x].defaultConsentDetail` * Type: `String` The default detail to display on the OAuth consent screen if one cannot be found in the theme. `domains[x].scopes[x].defaultConsentMessage` * Type: `String` The default message to display on the OAuth consent screen if one cannot be found in the theme. `domains[x].scopes[x].description` * Type: `String` A description of the OAuth scope for internal use. `domains[x].scopes[x].id` * Type: `UUID` The unique Id of the OAuth scope. `domains[x].scopes[x].insertInstant` * Type: `Long` The [instant](https://fusionauth.io/docs/reference/data-types.md#instants) that the OAuth scope was added to the FusionAuth database. `domains[x].scopes[x].lastUpdateInstant` * Type: `Long` The [instant](https://fusionauth.io/docs/reference/data-types.md#instants) that the OAuth scope was updated in the FusionAuth database. `domains[x].scopes[x].name` * Type: `String` The name of the OAuth scope. This is the value that will be used to request the scope in OAuth workflows. `domains[x].scopes[x].required` * Type: `Boolean` Determines if the OAuth scope is required when requested in an OAuth workflow. `domains[x].tenantId` * Type: `UUID` The unique Id of the Tenant that this CIMD domain belongs to. Example Response JSON ```json { "domains": [ { "id": "e9fdb985-9173-4e01-9d73-ac2d60d1dc8e", "name": "Claude", "domain": "https://claude.ai", "tenantId": "30663132-6464-6665-3032-326466613934", "allowLocalhostRedirectUris": false, "authorizedResourceUris": [ "https://mcp.example.com" ], "consentMode": "AlwaysPrompt", "debug": false, "gracePeriodInSeconds": 300, "insertInstant": 1595361142909, "lastUpdateInstant": 1595361143101, "maxCacheTtlInSeconds": 86400, "providedScopePolicy": { "address": { "enabled": false, "required": false }, "email": { "enabled": true, "required": true }, "phone": { "enabled": false, "required": false }, "profile": { "enabled": true, "required": false } }, "registrationLambdaId": "b3a4f2d1-8c5e-4a7b-9f16-2d8e5c1a7b34", "scopes": [] }, { "id": "7c4e1b2a-5d38-4096-b7f1-8a2c6d9e3f45", "name": "ChatGPT", "domain": "https://chatgpt.com", "tenantId": "30663132-6464-6665-3032-326466613934", "allowLocalhostRedirectUris": false, "authorizedResourceUris": [], "consentMode": "RememberDecision", "debug": false, "gracePeriodInSeconds": 0, "insertInstant": 1595361144200, "lastUpdateInstant": 1595361144200, "maxCacheTtlInSeconds": 86400, "providedScopePolicy": { "address": { "enabled": true, "required": false }, "email": { "enabled": true, "required": false }, "phone": { "enabled": true, "required": false }, "profile": { "enabled": true, "required": false } }, "scopes": [] } ] } ``` --- ## Other pages in Cimd Domains > For the full index of this section, see [Apis](https://fusionauth.io/docs/llms-apis.txt). - [Create a CIMD Domain API](https://fusionauth.io/docs/apis/cimd-domains/create-a-cimd-domain.md): API documentation for the FusionAuth Create a CIMD Domain API. - [Delete a CIMD Domain API](https://fusionauth.io/docs/apis/cimd-domains/delete-a-cimd-domain.md): API documentation for the FusionAuth Delete a CIMD Domain API. - [CIMD Domain API](https://fusionauth.io/docs/apis/cimd-domains.md): Learn about the APIs for creating, retrieving, updating and deleting CIMD domains. - [Search for CIMD Domains API](https://fusionauth.io/docs/apis/cimd-domains/search-for-cimd-domains.md): API documentation for the FusionAuth Search for CIMD Domains API. - [Update a CIMD Domain API](https://fusionauth.io/docs/apis/cimd-domains/update-a-cimd-domain.md): API documentation for the FusionAuth Update a CIMD Domain API.