# PATCH /admin/securityprofiles/{id}/allowclientcredentialsgranttype

> Allow or block the OAuth client credentials grant type for one security profile: send true or false as the JSON body of a PATCH request as the admin user.

- **Product:** DS Server
- **Section:** Documentation
- **Kind:** Endpoint
- **Path:** DS Server > API Reference > Web API > Administration > /securityprofiles/{id}/allowclientcredentialsgranttype > PATCH /admin/securityprofiles/{id}/allowclientcredentialsgranttype
- **550 words**
- **Web URL:** https://docs.textcontrol.com/ds-server/reference/web-api/administration/securityprofiles-id-allowclientcredentialsgranttype/patch/
- **LLMs URL:** https://docs.textcontrol.com/ds-server/reference/web-api/administration/securityprofiles-id-allowclientcredentialsgranttype/patch/llms.txt
- **LLMs-Full URL:** https://docs.textcontrol.com/ds-server/reference/web-api/administration/securityprofiles-id-allowclientcredentialsgranttype/patch/llms-full.txt

---

`PATCH` `https://example.com/admin/securityprofiles/{id}/allowclientcredentialsgranttype`

### Description

Specifies whether the client credentials grant type is activated or not based on a given ID.

### Examples

The following sample allows the client credentials grant type for the security profile with the ID 3.

```bash
# Request:
curl --request PATCH 'https://trial.dsserver.io/admin/securityprofiles/3/allowclientcredentialsgranttype' \
    --header 'Authorization: Basic YWRtaW46YWRtaW5hZG1pbg==' \
    --header 'Content-Type: application/json' \
    --data-raw 'true'

# Response:
HTTP/1.1 200 OK
```

### Authorization

This endpoint supports the Basic authorization method:

#### Basic

| Header field | Description |
|---|---|
| Authorization | The username "admin" and your admin password are combined into a string separated by a colon, e.g.: admin:password. The resulting string is encoded using the RFC2045-MIME variant of Base64, except not limited to 76 char/line. The authorization method and a space i.e. "Basic " is then put before the encoded string. For example: `Authorization: Basic QWxhZGRpbjpPcGVuU2VzYW1l` |

### Request Payload

| Type | Value |
|---|---|
| Boolean | Defines whether it is activated or not, as a JSON value (`application/json`): `true` or `false`. DS Server doesn't check the body: a missing body or any other value, such as the string `"true"`, deactivates the client credentials grant type. |

### Success Response

| Status | Description |
|---|---|
| 200 | On success, the HTTP status code in the response header is 200 (OK). |

### Error Response

| Status | Description |
|---|---|
| 401 | A 401 (Unauthorized) is returned, if the user is not authorized. |
| 404 | A 404 (Not Found) with an empty body is returned, if the given ID doesn't match an existing security profile. |
| 415 | A 415 (Unsupported Media Type) is returned, if the `Content-Type` header isn't `application/json`. |

---

## Nearby

- **Previous:** [/admin/securityprofiles/{id}/allowclientcredentialsgranttype](https://docs.textcontrol.com/ds-server/reference/web-api/administration/securityprofiles-id-allowclientcredentialsgranttype/llms-full.txt)
- **Next:** [/admin/securityprofiles/{id}/expirydate](https://docs.textcontrol.com/ds-server/reference/web-api/administration/securityprofiles-id-expirydate/llms-full.txt)