Client Update

Update a client with matching client_id and no nonnull initial_secret; kind, auth method, service account and product are immutable, and disabled clients reject updates. Register the widget as confidential_web with assistant.widget in scopes under its own non-sellable Assistant product. This reserved scope enables host-bound widget authorization; do not grant it to ordinary product clients. GET /authorize requires host_product_id (host product UUID) and assistant.widget in the requested scopes for this client. The host must register an active assistant.chat feature. host_product_id is persisted in authorization_request.requested_audience; issued access-token audience remains the Assistant product. The code transaction binds one current host product_login generation in the same SSO. Missing host admission returns login_required for prompt=none; interactive use must first sign in to the host. Callback URIs are exact environment configuration, locally https://assistant.local.globalbes.sg/widget/callback. No Assistant membership or entitlement is required; no iframe permission is added.

PATCH /internal/control/v1/clients/{client_id}