Variable: BUILT_IN_CLIENTS
constBUILT_IN_CLIENTS:object
Defined in: packages/identity/src/marker.ts:31
The clients a provider ships in every realm or tenant, by client id. They are not ours
and not declared, and the engine never changes them: disableClient refuses them
whatever it is asked, and the setup engine does not report them as undeclared, which on
every run would bury the one that is. assertNoDirectGrants still acts on them, because
a built-in client with the direct grant on is a risk we did not create.
Keycloak's first six are in every realm it creates. The seventh, admin-permissions,
appears when a realm turns on admin permissions (fine-grained admin permissions v2);
Keycloak 26.8.0 created it on 2026-10-11, the moment adminPermissionsEnabled was set
on a fresh realm. WSO2 7.3 puts CONSOLE and MY_ACCOUNT in every tenant (read from a
fresh tenant's application list on 2026-10-11).
Type Declaration
keycloak
readonlykeycloak: readonly ["account","account-console","admin-cli","admin-permissions","broker","realm-management","security-admin-console"]
wso2
readonlywso2: readonly ["CONSOLE","MY_ACCOUNT"]