From 7fedf3e22ed59090f87af7c1d24837dff7496ac0 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Fri, 9 Oct 2026 11:16:58 +0000
Subject: [PATCH] Document private-use scheme redirect URIs on OAuth client
 endpoints

outline/outline#13945 updated the IsUrlList validator used by the
OAuthClient model so that redirectUris now accept private-use URI
schemes for native applications (RFC 8252), e.g.
com.example.app:/oauth2redirect, in addition to absolute http(s) URLs.
Reflect this in the oauthClients.create and oauthClients.update request
schemas.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P7kukZTvUzQ4JXfuTuGCM5
---
 spec3.json | 10 ++++++----
 spec3.yml  | 18 ++++++++++++++----
 2 files changed, 20 insertions(+), 8 deletions(-)

diff --git a/spec3.json b/spec3.json
index 35f988c..1b7f759 100644
--- a/spec3.json
+++ b/spec3.json
@@ -7931,9 +7931,10 @@
                       "type": "string",
                       "maxLength": 1024
                     },
-                    "description": "List of redirect URIs for the OAuth client.",
+                    "description": "List of redirect URIs for the OAuth client. Each entry must be an absolute URL that includes a scheme, for example `https://example.com/callback`. Private-use URI schemes for native applications are also accepted, for example `com.example.app:/oauth2redirect` (see RFC 8252).",
                     "example": [
-                      "https://example.com/callback"
+                      "https://example.com/callback",
+                      "com.example.app:/oauth2redirect"
                     ]
                   },
                   "published": {
@@ -8038,9 +8039,10 @@
                       "type": "string",
                       "maxLength": 1024
                     },
-                    "description": "List of redirect URIs for the OAuth client.",
+                    "description": "List of redirect URIs for the OAuth client. Each entry must be an absolute URL that includes a scheme, for example `https://example.com/callback`. Private-use URI schemes for native applications are also accepted, for example `com.example.app:/oauth2redirect` (see RFC 8252).",
                     "example": [
-                      "https://example.com/callback"
+                      "https://example.com/callback",
+                      "com.example.app:/oauth2redirect"
                     ]
                   },
                   "published": {
diff --git a/spec3.yml b/spec3.yml
index d47c43b..fe6fbd6 100644
--- a/spec3.yml
+++ b/spec3.yml
@@ -5607,8 +5607,13 @@ paths:
                   items:
                     type: string
                     maxLength: 1024
-                  description: List of redirect URIs for the OAuth client.
-                  example: ["https://example.com/callback"]
+                  description: >-
+                    List of redirect URIs for the OAuth client. Each entry must
+                    be an absolute URL that includes a scheme, for example
+                    `https://example.com/callback`. Private-use URI schemes for
+                    native applications are also accepted, for example
+                    `com.example.app:/oauth2redirect` (see RFC 8252).
+                  example: ["https://example.com/callback", "com.example.app:/oauth2redirect"]
                 published:
                   type: boolean
                   description: Whether the OAuth client is available to other workspaces.
@@ -5683,8 +5688,13 @@ paths:
                   items:
                     type: string
                     maxLength: 1024
-                  description: List of redirect URIs for the OAuth client.
-                  example: ["https://example.com/callback"]
+                  description: >-
+                    List of redirect URIs for the OAuth client. Each entry must
+                    be an absolute URL that includes a scheme, for example
+                    `https://example.com/callback`. Private-use URI schemes for
+                    native applications are also accepted, for example
+                    `com.example.app:/oauth2redirect` (see RFC 8252).
+                  example: ["https://example.com/callback", "com.example.app:/oauth2redirect"]
                 published:
                   type: boolean
                   description: Whether the OAuth client is available to other workspaces.