// Package gocloak is a golang keycloak adaptor.
package gocloak

import (
	
	
	
	
	
	
	
	
	

	
	
	
	
	

	
)

// GoCloak provides functionalities to talk to Keycloak.
type GoCloak struct {
	basePath    string
	certsCache  sync.Map
	certsLock   sync.Mutex
	restyClient *resty.Client
	Config      struct {
		CertsInvalidateTime time.Duration
		authAdminRealms     string
		authRealms          string
		tokenEndpoint       string
		revokeEndpoint      string
		logoutEndpoint      string
		openIDConnect       string
		attackDetection     string
	}
}

const (
	adminClientID string = "admin-cli"
	urlSeparator  string = "/"
)

func makeURL( ...string) string {
	return strings.Join(, urlSeparator)
}

// GetRequest returns a request for calling endpoints.
func ( *GoCloak) ( context.Context) *resty.Request {
	var  HTTPErrorResponse
	return injectTracingHeaders(
		, .restyClient.R().
			SetContext().
			SetError(&),
	)
}

// GetRequestWithBearerAuthNoCache returns a JSON base request configured with an auth token and no-cache header.
func ( *GoCloak) ( context.Context,  string) *resty.Request {
	return .GetRequest().
		SetAuthToken().
		SetHeader("Content-Type", "application/json").
		SetHeader("Cache-Control", "no-cache")
}

// GetRequestWithBearerAuth returns a JSON base request configured with an auth token.
func ( *GoCloak) ( context.Context,  string) *resty.Request {
	return .GetRequest().
		SetAuthToken().
		SetHeader("Content-Type", "application/json")
}

// GetRequestWithBearerAuthXMLHeader returns an XML base request configured with an auth token.
func ( *GoCloak) ( context.Context,  string) *resty.Request {
	return .GetRequest().
		SetAuthToken().
		SetHeader("Content-Type", "application/xml;charset=UTF-8")
}

// GetRequestWithBasicAuth returns a form data base request configured with basic auth.
func ( *GoCloak) ( context.Context, ,  string) *resty.Request {
	 := .GetRequest().
		SetHeader("Content-Type", "application/x-www-form-urlencoded")
	// Public client doesn't require Basic Auth
	if len() > 0 && len() > 0 {
		 := base64.StdEncoding.EncodeToString([]byte( + ":" + ))
		.SetHeader("Authorization", "Basic "+)
	}

	return 
}

func ( *GoCloak) ( context.Context,  string,  string,  RequestingPartyTokenOptions,  interface{}) (*resty.Response, error) {
	return .GetRequestWithBearerAuth(, ).
		SetFormData(.FormData()).
		SetFormDataFromValues(url.Values{"permission": PStringSlice(.Permissions)}).
		SetResult(&).
		Post(.getRealmURL(, .Config.tokenEndpoint))
}

func checkForError( *resty.Response,  error,  string) error {
	if  != nil {
		return &APIError{
			Code:    0,
			Message: errors.Wrap(, ).Error(),
			Type:    ParseAPIErrType(),
		}
	}

	if  == nil {
		return &APIError{
			Message: "empty response",
			Type:    ParseAPIErrType(),
		}
	}

	if .IsError() {
		var  string

		if ,  := .Error().(*HTTPErrorResponse);  && .NotEmpty() {
			 = fmt.Sprintf("%s: %s", .Status(), )
		} else {
			 = .Status()
		}

		return &APIError{
			Code:    .StatusCode(),
			Message: ,
			Type:    ParseAPIErrType(),
		}
	}

	return nil
}

func getID( *resty.Response) string {
	 := .Header().Get("Location")
	 := strings.Split(, urlSeparator)

	return [len()-1]
}

func findUsedKey( string,  []CertResponseKey) *CertResponseKey {
	for ,  := range  {
		if *(.Kid) ==  {
			return &
		}
	}

	return nil
}

func injectTracingHeaders( context.Context,  *resty.Request) *resty.Request {
	// look for span in context, do nothing if span is not found
	 := opentracing.SpanFromContext()
	if  == nil {
		return 
	}

	// look for tracer in context, use global tracer if not found
	,  := .Value(tracerContextKey).(opentracing.Tracer)
	if ! ||  == nil {
		 = opentracing.GlobalTracer()
	}

	// inject tracing header into request
	 := .Inject(.Context(), opentracing.HTTPHeaders, opentracing.HTTPHeadersCarrier(.Header))
	if  != nil {
		return 
	}

	return 
}

// ===============
// Keycloak client
// ===============

// NewClient creates a new Client
func ( string,  ...func(*GoCloak)) *GoCloak {
	 := GoCloak{
		basePath:    strings.TrimRight(, urlSeparator),
		restyClient: resty.New(),
	}

	.Config.CertsInvalidateTime = 10 * time.Minute
	.Config.authAdminRealms = makeURL("admin", "realms")
	.Config.authRealms = makeURL("realms")
	.Config.tokenEndpoint = makeURL("protocol", "openid-connect", "token")
	.Config.logoutEndpoint = makeURL("protocol", "openid-connect", "logout")
	.Config.revokeEndpoint = makeURL("protocol", "openid-connect", "revoke")
	.Config.openIDConnect = makeURL("protocol", "openid-connect")
	.Config.attackDetection = makeURL("attack-detection", "brute-force")

	for ,  := range  {
		(&)
	}

	return &
}

// RestyClient returns the internal resty g.
// This can be used to configure the g.
func ( *GoCloak) () *resty.Client {
	return .restyClient
}

// SetRestyClient overwrites the internal resty g.
func ( *GoCloak) ( *resty.Client) {
	.restyClient = 
}

func ( *GoCloak) ( string,  ...string) string {
	 = append([]string{.basePath, .Config.authRealms, }, ...)
	return makeURL(...)
}

func ( *GoCloak) ( string,  ...string) string {
	 = append([]string{.basePath, .Config.authAdminRealms, }, ...)
	return makeURL(...)
}

func ( *GoCloak) ( string,  string,  ...string) string {
	 = append([]string{.basePath, .Config.authAdminRealms, , .Config.attackDetection, }, ...)
	return makeURL(...)
}

// ==== Functional Options ===

// SetLegacyWildFlySupport maintain legacy WildFly support.
func () func( *GoCloak) {
	return func( *GoCloak) {
		.Config.authAdminRealms = makeURL("auth", "admin", "realms")
		.Config.authRealms = makeURL("auth", "realms")
	}
}

// SetAuthRealms sets the auth realm
func ( string) func( *GoCloak) {
	return func( *GoCloak) {
		.Config.authRealms = 
	}
}

// SetAuthAdminRealms sets the auth admin realm
func ( string) func( *GoCloak) {
	return func( *GoCloak) {
		.Config.authAdminRealms = 
	}
}

// SetTokenEndpoint sets the token endpoint
func ( string) func( *GoCloak) {
	return func( *GoCloak) {
		.Config.tokenEndpoint = 
	}
}

// SetRevokeEndpoint sets the revoke endpoint
func ( string) func( *GoCloak) {
	return func( *GoCloak) {
		.Config.revokeEndpoint = 
	}
}

// SetLogoutEndpoint sets the logout
func ( string) func( *GoCloak) {
	return func( *GoCloak) {
		.Config.logoutEndpoint = 
	}
}

// SetOpenIDConnectEndpoint sets the logout
func ( string) func( *GoCloak) {
	return func( *GoCloak) {
		.Config.openIDConnect = 
	}
}

// SetCertCacheInvalidationTime sets the logout
func ( time.Duration) func( *GoCloak) {
	return func( *GoCloak) {
		.Config.CertsInvalidateTime = 
	}
}

// GetServerInfo fetches the server info.
func ( *GoCloak) ( context.Context,  string) (*ServerInfoRepresentation, error) {
	 := "could not get server info"
	var  *ServerInfoRepresentation

	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		Get(makeURL(.basePath, "admin", "serverinfo"))

	if  := checkForError(, , );  != nil {
		return nil, 
	}

	return , nil
}

// GetUserInfo calls the UserInfo endpoint
func ( *GoCloak) ( context.Context, ,  string) (*UserInfo, error) {
	const  = "could not get user info"

	var  UserInfo
	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		Get(.getRealmURL(, .Config.openIDConnect, "userinfo"))

	if  := checkForError(, , );  != nil {
		return nil, 
	}

	return &, nil
}

// GetRawUserInfo calls the UserInfo endpoint and returns a raw json object
func ( *GoCloak) ( context.Context, ,  string) (map[string]interface{}, error) {
	const  = "could not get user info"

	var  map[string]interface{}
	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		Get(.getRealmURL(, .Config.openIDConnect, "userinfo"))

	if  := checkForError(, , );  != nil {
		return nil, 
	}

	return , nil
}

func ( *GoCloak) ( context.Context,  string) (*CertResponse, error) {
	const  = "could not get newCerts"

	var  CertResponse
	,  := .GetRequest().
		SetResult(&).
		Get(.getRealmURL(, .Config.openIDConnect, "certs"))

	if  := checkForError(, , );  != nil {
		return nil, 
	}

	return &, nil
}

// GetCerts fetches certificates for the given realm from the public /open-id-connect/certs endpoint
func ( *GoCloak) ( context.Context,  string) (*CertResponse, error) {
	const  = "could not get certs"

	if ,  := .certsCache.Load();  {
		return .(*CertResponse), nil
	}

	.certsLock.Lock()
	defer .certsLock.Unlock()

	if ,  := .certsCache.Load();  {
		return .(*CertResponse), nil
	}

	,  := .getNewCerts(, )
	if  != nil {
		return nil, errors.Wrap(, )
	}

	.certsCache.Store(, )
	time.AfterFunc(.Config.CertsInvalidateTime, func() {
		.certsCache.Delete()
	})

	return , nil
}

// GetIssuer gets the issuer of the given realm
func ( *GoCloak) ( context.Context,  string) (*IssuerResponse, error) {
	const  = "could not get issuer"

	var  IssuerResponse
	,  := .GetRequest().
		SetResult(&).
		Get(.getRealmURL())

	if  := checkForError(, , );  != nil {
		return nil, 
	}

	return &, nil
}

// RetrospectToken calls the openid-connect introspect endpoint
func ( *GoCloak) ( context.Context, , , ,  string) (*IntroSpectTokenResult, error) {
	const  = "could not introspect requesting party token"

	var  IntroSpectTokenResult
	,  := .GetRequestWithBasicAuth(, , ).
		SetFormData(map[string]string{
			"token_type_hint": "requesting_party_token",
			"token":           ,
		}).
		SetResult(&).
		Post(.getRealmURL(, .Config.tokenEndpoint, "introspect"))

	if  := checkForError(, , );  != nil {
		return nil, 
	}

	return &, nil
}

func ( *GoCloak) ( context.Context, ,  string,  jwt.Claims) (*jwt.Token, error) {
	const  = "could not decode access token"
	 = strings.Replace(, "Bearer ", "", 1)

	,  := jwx.DecodeAccessTokenHeader()
	if  != nil {
		return nil, errors.Wrap(, )
	}

	,  := .GetCerts(, )
	if  != nil {
		return nil, errors.Wrap(, )
	}
	if .Keys == nil {
		return nil, errors.Wrap(errors.New("there is no keys to decode the token"), )
	}
	 := findUsedKey(.Kid, *.Keys)
	if  == nil {
		return nil, errors.Wrap(errors.New("cannot find a key to decode the token"), )
	}

	if strings.HasPrefix(.Alg, "ES") {
		return jwx.DecodeAccessTokenECDSACustomClaims(, .X, .Y, .Crv, )
	} else if strings.HasPrefix(.Alg, "RS") {
		return jwx.DecodeAccessTokenRSACustomClaims(, .E, .N, )
	}
	return nil, fmt.Errorf("unsupported algorithm")
}

// DecodeAccessToken decodes the accessToken
func ( *GoCloak) ( context.Context, ,  string) (*jwt.Token, *jwt.MapClaims, error) {
	 := jwt.MapClaims{}
	,  := .decodeAccessTokenWithClaims(, , , )
	if  != nil {
		return nil, nil, 
	}
	return , &, nil
}

// DecodeAccessTokenCustomClaims decodes the accessToken and writes claims into the given claims
func ( *GoCloak) ( context.Context, ,  string,  jwt.Claims) (*jwt.Token, error) {
	return .decodeAccessTokenWithClaims(, , , )
}

// GetToken uses TokenOptions to fetch a token.
func ( *GoCloak) ( context.Context,  string,  TokenOptions) (*JWT, error) {
	const  = "could not get token"

	var  JWT
	var  *resty.Request

	if !NilOrEmpty(.ClientSecret) {
		 = .GetRequestWithBasicAuth(, *.ClientID, *.ClientSecret)
	} else {
		 = .GetRequest()
	}

	,  := .SetFormData(.FormData()).
		SetResult(&).
		Post(.getRealmURL(, .Config.tokenEndpoint))

	if  := checkForError(, , );  != nil {
		return nil, 
	}

	return &, nil
}

// GetRequestingPartyToken returns a requesting party token with permissions granted by the server
func ( *GoCloak) ( context.Context, ,  string,  RequestingPartyTokenOptions) (*JWT, error) {
	const  = "could not get requesting party token"

	var  JWT

	,  := .getRequestingParty(, , , , &)
	if  := checkForError(, , );  != nil {
		return nil, 
	}

	return &, nil
}

// GetRequestingPartyPermissions returns a requesting party permissions granted by the server
func ( *GoCloak) ( context.Context, ,  string,  RequestingPartyTokenOptions) (*[]RequestingPartyPermission, error) {
	const  = "could not get requesting party token"

	var  []RequestingPartyPermission

	.ResponseMode = StringP("permissions")

	,  := .getRequestingParty(, , , , &)
	if  := checkForError(, , );  != nil {
		return nil, 
	}

	return &, nil
}

// GetRequestingPartyPermissionDecision returns a requesting party permission decision granted by the server
func ( *GoCloak) ( context.Context, ,  string,  RequestingPartyTokenOptions) (*RequestingPartyPermissionDecision, error) {
	const  = "could not get requesting party token"

	var  RequestingPartyPermissionDecision

	.ResponseMode = StringP("decision")

	,  := .getRequestingParty(, , , , &)
	if  := checkForError(, , );  != nil {
		return nil, 
	}

	return &, nil
}

// RefreshToken refreshes the given token.
// May return a *APIError with further details about the issue.
func ( *GoCloak) ( context.Context, , , ,  string) (*JWT, error) {
	return .GetToken(, , TokenOptions{
		ClientID:     &,
		ClientSecret: &,
		GrantType:    StringP("refresh_token"),
		RefreshToken: &,
	})
}

// LoginAdmin performs a login with Admin client
func ( *GoCloak) ( context.Context, , ,  string) (*JWT, error) {
	return .GetToken(, , TokenOptions{
		ClientID:  StringP(adminClientID),
		GrantType: StringP("password"),
		Username:  &,
		Password:  &,
	})
}

// LoginClient performs a login with client credentials
func ( *GoCloak) ( context.Context, , ,  string,  ...string) (*JWT, error) {
	 := TokenOptions{
		ClientID:     &,
		ClientSecret: &,
		GrantType:    StringP("client_credentials"),
	}

	if len() > 0 {
		.Scope = &[0]
	}

	return .GetToken(, , )
}

// LoginClientTokenExchange will exchange the presented token for a user's token
// Requires Token-Exchange is enabled: https://www.keycloak.org/docs/latest/securing_apps/index.html#_token-exchange
func ( *GoCloak) ( context.Context, , , , , ,  string) (*JWT, error) {
	 := TokenOptions{
		ClientID:           &,
		ClientSecret:       &,
		GrantType:          StringP("urn:ietf:params:oauth:grant-type:token-exchange"),
		SubjectToken:       &,
		RequestedTokenType: StringP("urn:ietf:params:oauth:token-type:refresh_token"),
		Audience:           &,
	}
	if  != "" {
		.RequestedSubject = &
	}
	return .GetToken(, , )
}

// LoginClientSignedJWT performs a login with client credentials and signed jwt claims
func ( *GoCloak) (
	 context.Context,
	,
	 string,
	 interface{},
	 jwt.SigningMethod,
	 *jwt.NumericDate,
) (*JWT, error) {
	 := jwt.RegisteredClaims{
		ExpiresAt: ,
		Issuer:    ,
		Subject:   ,
		ID:        ksuid.New().String(),
		Audience: jwt.ClaimStrings{
			.getRealmURL(),
		},
	}
	,  := jwx.SignClaims(, , )
	if  != nil {
		return nil, 
	}

	return .GetToken(, , TokenOptions{
		ClientID:            &,
		GrantType:           StringP("client_credentials"),
		ClientAssertionType: StringP("urn:ietf:params:oauth:client-assertion-type:jwt-bearer"),
		ClientAssertion:     &,
	})
}

// Login performs a login with user credentials and a client
func ( *GoCloak) ( context.Context, , , , ,  string) (*JWT, error) {
	return .GetToken(, , TokenOptions{
		ClientID:     &,
		ClientSecret: &,
		GrantType:    StringP("password"),
		Username:     &,
		Password:     &,
		Scope:        StringP("openid"),
	})
}

// LoginOtp performs a login with user credentials and otp token
func ( *GoCloak) ( context.Context, , , , , ,  string) (*JWT, error) {
	return .GetToken(, , TokenOptions{
		ClientID:     &,
		ClientSecret: &,
		GrantType:    StringP("password"),
		Username:     &,
		Password:     &,
		Totp:         &,
	})
}

// Logout logs out users with refresh token
func ( *GoCloak) ( context.Context, , , ,  string) error {
	const  = "could not logout"

	,  := .GetRequestWithBasicAuth(, , ).
		SetFormData(map[string]string{
			"client_id":     ,
			"refresh_token": ,
		}).
		Post(.getRealmURL(, .Config.logoutEndpoint))

	return checkForError(, , )
}

// LogoutPublicClient performs a logout using a public client and the accessToken.
func ( *GoCloak) ( context.Context, , , ,  string) error {
	const  = "could not logout public client"

	,  := .GetRequestWithBearerAuth(, ).
		SetFormData(map[string]string{
			"client_id":     ,
			"refresh_token": ,
		}).
		Post(.getRealmURL(, .Config.logoutEndpoint))

	return checkForError(, , )
}

// LogoutAllSessions logs out all sessions of a user given an id.
func ( *GoCloak) ( context.Context, , ,  string) error {
	const  = "could not logout"

	,  := .GetRequestWithBearerAuth(, ).
		Post(.getAdminRealmURL(, "users", , "logout"))

	return checkForError(, , )
}

// RevokeUserConsents revokes the given user consent.
func ( *GoCloak) ( context.Context, , , ,  string) error {
	const  = "could not revoke consents"

	,  := .GetRequestWithBearerAuth(, ).
		Delete(.getAdminRealmURL(, "users", , "consents", ))

	return checkForError(, , )
}

// LogoutUserSession logs out a single sessions of a user given a session id
func ( *GoCloak) ( context.Context, , ,  string) error {
	const  = "could not logout"

	,  := .GetRequestWithBearerAuth(, ).
		Delete(.getAdminRealmURL(, "sessions", ))

	return checkForError(, , )
}

// ExecuteActionsEmail executes an actions email
func ( *GoCloak) ( context.Context, ,  string,  ExecuteActionsEmail) error {
	const  = "could not execute actions email"

	,  := GetQueryParams()
	if  != nil {
		return errors.Wrap(, )
	}

	,  := .GetRequestWithBearerAuth(, ).
		SetBody(.Actions).
		SetQueryParams().
		Put(.getAdminRealmURL(, "users", *(.UserID), "execute-actions-email"))

	return checkForError(, , )
}

// SendVerifyEmail sends a verification e-mail to a user.
func ( *GoCloak) ( context.Context, , ,  string,  ...SendVerificationMailParams) error {
	const  = "could not execute actions email"

	 := map[string]string{}
	if  != nil {
		if [0].ClientID != nil {
			["client_id"] = *[0].ClientID
		}

		if [0].RedirectURI != nil {
			["redirect_uri"] = *[0].RedirectURI
		}
	}

	,  := .GetRequestWithBearerAuth(, ).
		SetQueryParams().
		Put(.getAdminRealmURL(, "users", , "send-verify-email"))

	return checkForError(, , )
}

// CreateGroup creates a new group.
func ( *GoCloak) ( context.Context, ,  string,  Group) (string, error) {
	const  = "could not create group"

	,  := .GetRequestWithBearerAuth(, ).
		SetBody().
		Post(.getAdminRealmURL(, "groups"))

	if  := checkForError(, , );  != nil {
		return "", 
	}
	return getID(), nil
}

// CreateChildGroup creates a new child group
func ( *GoCloak) ( context.Context, , ,  string,  Group) (string, error) {
	const  = "could not create child group"

	,  := .GetRequestWithBearerAuth(, ).
		SetBody().
		Post(.getAdminRealmURL(, "groups", , "children"))

	if  := checkForError(, , );  != nil {
		return "", 
	}

	return getID(), nil
}

// CreateComponent creates the given component.
func ( *GoCloak) ( context.Context, ,  string,  Component) (string, error) {
	const  = "could not create component"

	,  := .GetRequestWithBearerAuth(, ).
		SetBody().
		Post(.getAdminRealmURL(, "components"))

	if  := checkForError(, , );  != nil {
		return "", 
	}

	return getID(), nil
}

// CreateClient creates the given g.
func ( *GoCloak) ( context.Context, ,  string,  Client) (string, error) {
	const  = "could not create client"

	,  := .GetRequestWithBearerAuth(, ).
		SetBody().
		Post(.getAdminRealmURL(, "clients"))

	if  := checkForError(, , );  != nil {
		return "", 
	}

	return getID(), nil
}

// CreateClientRepresentation creates a new client representation
func ( *GoCloak) ( context.Context, ,  string,  Client) (*Client, error) {
	const  = "could not create client representation"

	var  Client

	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		SetBody().
		Post(.getRealmURL(, "clients-registrations", "default"))

	if  := checkForError(, , );  != nil {
		return nil, 
	}

	return &, nil
}

// CreateClientRole creates a new role for a client
func ( *GoCloak) ( context.Context, , ,  string,  Role) (string, error) {
	const  = "could not create client role"

	,  := .GetRequestWithBearerAuth(, ).
		SetBody().
		Post(.getAdminRealmURL(, "clients", , "roles"))

	if  := checkForError(, , );  != nil {
		return "", 
	}

	return getID(), nil
}

// CreateClientScope creates a new client scope
func ( *GoCloak) ( context.Context, ,  string,  ClientScope) (string, error) {
	const  = "could not create client scope"

	,  := .GetRequestWithBearerAuth(, ).
		SetBody().
		Post(.getAdminRealmURL(, "client-scopes"))

	if  := checkForError(, , );  != nil {
		return "", 
	}

	return getID(), nil
}

// CreateClientScopeProtocolMapper creates a new protocolMapper under the given client scope
func ( *GoCloak) ( context.Context, , ,  string,  ProtocolMappers) (string, error) {
	const  = "could not create client scope protocol mapper"

	,  := .GetRequestWithBearerAuth(, ).
		SetBody().
		Post(.getAdminRealmURL(, "client-scopes", , "protocol-mappers", "models"))

	if  := checkForError(, , );  != nil {
		return "", 
	}

	return getID(), nil
}

// UpdateGroup updates the given group.
func ( *GoCloak) ( context.Context, ,  string,  Group) error {
	const  = "could not update group"

	if NilOrEmpty(.ID) {
		return errors.Wrap(errors.New("ID of a group required"), )
	}
	,  := .GetRequestWithBearerAuth(, ).
		SetBody().
		Put(.getAdminRealmURL(, "groups", PString(.ID)))

	return checkForError(, , )
}

// UpdateGroupManagementPermissions updates the given group management permissions
func ( *GoCloak) ( context.Context, ,  string,  string,  ManagementPermissionRepresentation) (*ManagementPermissionRepresentation, error) {
	const  = "could not update group management permissions"

	var  ManagementPermissionRepresentation

	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		SetBody().
		Put(.getAdminRealmURL(, "groups", , "management", "permissions"))

	if  := checkForError(, , );  != nil {
		return nil, 
	}

	return &, nil
}

// UpdateClient updates the given Client
func ( *GoCloak) ( context.Context, ,  string,  Client) error {
	const  = "could not update client"

	if NilOrEmpty(.ID) {
		return errors.Wrap(errors.New("ID of a client required"), )
	}

	,  := .GetRequestWithBearerAuth(, ).
		SetBody().
		Put(.getAdminRealmURL(, "clients", PString(.ID)))

	return checkForError(, , )
}

// UpdateClientRepresentation updates the given client representation
func ( *GoCloak) ( context.Context, ,  string,  Client) (*Client, error) {
	const  = "could not update client representation"

	if NilOrEmpty(.ID) {
		return nil, errors.Wrap(errors.New("ID of a client required"), )
	}

	var  Client

	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		SetBody().
		Put(.getRealmURL(, "clients-registrations", "default", PString(.ClientID)))

	if  := checkForError(, , );  != nil {
		return nil, 
	}

	return &, nil
}

// UpdateClientManagementPermissions updates the given client management permissions
func ( *GoCloak) ( context.Context, ,  string,  string,  ManagementPermissionRepresentation) (*ManagementPermissionRepresentation, error) {
	const  = "could not update client management permissions"

	var  ManagementPermissionRepresentation

	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		SetBody().
		Put(.getAdminRealmURL(, "clients", , "management", "permissions"))

	if  := checkForError(, , );  != nil {
		return nil, 
	}

	return &, nil
}

// UpdateRole updates the given role.
func ( *GoCloak) ( context.Context, , ,  string,  Role) error {
	const  = "could not update role"

	,  := .GetRequestWithBearerAuth(, ).
		SetBody().
		Put(.getAdminRealmURL(, "clients", , "roles", PString(.Name)))

	return checkForError(, , )
}

// UpdateClientScope updates the given client scope.
func ( *GoCloak) ( context.Context, ,  string,  ClientScope) error {
	const  = "could not update client scope"

	,  := .GetRequestWithBearerAuth(, ).
		SetBody().
		Put(.getAdminRealmURL(, "client-scopes", PString(.ID)))

	return checkForError(, , )
}

// UpdateClientScopeProtocolMapper updates the given protocol mapper for a client scope
func ( *GoCloak) ( context.Context, , ,  string,  ProtocolMappers) error {
	const  = "could not update client scope"

	,  := .GetRequestWithBearerAuth(, ).
		SetBody().
		Put(.getAdminRealmURL(, "client-scopes", , "protocol-mappers", "models", PString(.ID)))

	return checkForError(, , )
}

// DeleteGroup deletes the group with the given groupID.
func ( *GoCloak) ( context.Context, , ,  string) error {
	const  = "could not delete group"

	,  := .GetRequestWithBearerAuth(, ).
		Delete(.getAdminRealmURL(, "groups", ))

	return checkForError(, , )
}

// DeleteClient deletes a given client
func ( *GoCloak) ( context.Context, , ,  string) error {
	const  = "could not delete client"

	,  := .GetRequestWithBearerAuth(, ).
		Delete(.getAdminRealmURL(, "clients", ))

	return checkForError(, , )
}

// DeleteComponent deletes the component with the given id.
func ( *GoCloak) ( context.Context, , ,  string) error {
	const  = "could not delete component"

	,  := .GetRequestWithBearerAuth(, ).
		Delete(.getAdminRealmURL(, "components", ))

	return checkForError(, , )
}

// DeleteClientRepresentation deletes a given client representation.
func ( *GoCloak) ( context.Context, , ,  string) error {
	const  = "could not delete client representation"

	,  := .GetRequestWithBearerAuth(, ).
		Delete(.getRealmURL(, "clients-registrations", "default", ))

	return checkForError(, , )
}

// DeleteClientRole deletes a given role.
func ( *GoCloak) ( context.Context, , , ,  string) error {
	const  = "could not delete client role"

	,  := .GetRequestWithBearerAuth(, ).
		Delete(.getAdminRealmURL(, "clients", , "roles", ))

	return checkForError(, , )
}

// DeleteClientScope deletes the scope with the given id.
func ( *GoCloak) ( context.Context, , ,  string) error {
	const  = "could not delete client scope"

	,  := .GetRequestWithBearerAuth(, ).
		Delete(.getAdminRealmURL(, "client-scopes", ))

	return checkForError(, , )
}

// DeleteClientScopeProtocolMapper deletes the given protocol mapper from the client scope
func ( *GoCloak) ( context.Context, , , ,  string) error {
	const  = "could not delete client scope"

	,  := .GetRequestWithBearerAuth(, ).
		Delete(.getAdminRealmURL(, "client-scopes", , "protocol-mappers", "models", ))

	return checkForError(, , )
}

// GetClient returns a client
func ( *GoCloak) ( context.Context, , ,  string) (*Client, error) {
	const  = "could not get client"

	var  Client

	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		Get(.getAdminRealmURL(, "clients", ))

	if  := checkForError(, , );  != nil {
		return nil, 
	}

	return &, nil
}

// GetClientRepresentation returns a client representation
func ( *GoCloak) ( context.Context, , ,  string) (*Client, error) {
	const  = "could not get client representation"

	var  Client

	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		Get(.getRealmURL(, "clients-registrations", "default", ))

	if  := checkForError(, , );  != nil {
		return nil, 
	}

	return &, nil
}

// GetAdapterConfiguration returns a adapter configuration
func ( *GoCloak) ( context.Context, , ,  string) (*AdapterConfiguration, error) {
	const  = "could not get adapter configuration"

	var  AdapterConfiguration

	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		Get(.getRealmURL(, "clients-registrations", "install", ))

	if  := checkForError(, , );  != nil {
		return nil, 
	}

	return &, nil
}

// GetClientsDefaultScopes returns a list of the client's default scopes
func ( *GoCloak) ( context.Context, , ,  string) ([]*ClientScope, error) {
	const  = "could not get clients default scopes"

	var  []*ClientScope

	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		Get(.getAdminRealmURL(, "clients", , "default-client-scopes"))

	if  := checkForError(, , );  != nil {
		return nil, 
	}

	return , nil
}

// AddDefaultScopeToClient adds a client scope to the list of client's default scopes
func ( *GoCloak) ( context.Context, , , ,  string) error {
	const  = "could not add default scope to client"

	,  := .GetRequestWithBearerAuth(, ).
		Put(.getAdminRealmURL(, "clients", , "default-client-scopes", ))

	return checkForError(, , )
}

// RemoveDefaultScopeFromClient removes a client scope from the list of client's default scopes
func ( *GoCloak) ( context.Context, , , ,  string) error {
	const  = "could not remove default scope from client"

	,  := .GetRequestWithBearerAuth(, ).
		Delete(.getAdminRealmURL(, "clients", , "default-client-scopes", ))

	return checkForError(, , )
}

// GetClientsOptionalScopes returns a list of the client's optional scopes
func ( *GoCloak) ( context.Context, , ,  string) ([]*ClientScope, error) {
	const  = "could not get clients optional scopes"

	var  []*ClientScope

	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		Get(.getAdminRealmURL(, "clients", , "optional-client-scopes"))

	if  := checkForError(, , );  != nil {
		return nil, 
	}

	return , nil
}

// AddOptionalScopeToClient adds a client scope to the list of client's optional scopes
func ( *GoCloak) ( context.Context, , , ,  string) error {
	const  = "could not add optional scope to client"

	,  := .GetRequestWithBearerAuth(, ).
		Put(.getAdminRealmURL(, "clients", , "optional-client-scopes", ))

	return checkForError(, , )
}

// RemoveOptionalScopeFromClient deletes a client scope from the list of client's optional scopes
func ( *GoCloak) ( context.Context, , , ,  string) error {
	const  = "could not remove optional scope from client"

	,  := .GetRequestWithBearerAuth(, ).
		Delete(.getAdminRealmURL(, "clients", , "optional-client-scopes", ))

	return checkForError(, , )
}

// GetDefaultOptionalClientScopes returns a list of default realm optional scopes
func ( *GoCloak) ( context.Context, ,  string) ([]*ClientScope, error) {
	const  = "could not get default optional client scopes"

	var  []*ClientScope

	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		Get(.getAdminRealmURL(, "default-optional-client-scopes"))

	if  := checkForError(, , );  != nil {
		return nil, 
	}

	return , nil
}

// GetDefaultDefaultClientScopes returns a list of default realm default scopes
func ( *GoCloak) ( context.Context, ,  string) ([]*ClientScope, error) {
	const  = "could not get default client scopes"

	var  []*ClientScope

	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		Get(.getAdminRealmURL(, "default-default-client-scopes"))

	if  := checkForError(, , );  != nil {
		return nil, 
	}

	return , nil
}

// GetClientScope returns a clientscope
func ( *GoCloak) ( context.Context, , ,  string) (*ClientScope, error) {
	const  = "could not get client scope"

	var  ClientScope

	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		Get(.getAdminRealmURL(, "client-scopes", ))

	if  := checkForError(, , );  != nil {
		return nil, 
	}

	return &, nil
}

// GetClientScopes returns all client scopes
func ( *GoCloak) ( context.Context, ,  string) ([]*ClientScope, error) {
	const  = "could not get client scopes"

	var  []*ClientScope

	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		Get(.getAdminRealmURL(, "client-scopes"))

	if  := checkForError(, , );  != nil {
		return nil, 
	}

	return , nil
}

// GetClientScopeProtocolMappers returns all protocol mappers of a client scope
func ( *GoCloak) ( context.Context, , ,  string) ([]*ProtocolMappers, error) {
	const  = "could not get client scope protocol mappers"

	var  []*ProtocolMappers

	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		Get(.getAdminRealmURL(, "client-scopes", , "protocol-mappers", "models"))

	if  := checkForError(, , );  != nil {
		return nil, 
	}

	return , nil
}

// GetClientScopeProtocolMapper returns a protocol mapper of a client scope
func ( *GoCloak) ( context.Context, , , ,  string) (*ProtocolMappers, error) {
	const  = "could not get client scope protocol mappers"

	var  *ProtocolMappers

	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		Get(.getAdminRealmURL(, "client-scopes", , "protocol-mappers", "models", ))

	if  := checkForError(, , );  != nil {
		return nil, 
	}

	return , nil
}

// GetClientScopeMappings returns all scope mappings for the client
func ( *GoCloak) ( context.Context, , ,  string) (*MappingsRepresentation, error) {
	const  = "could not get all scope mappings for the client"

	var  *MappingsRepresentation

	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		Get(.getAdminRealmURL(, "clients", , "scope-mappings"))

	if  := checkForError(, , );  != nil {
		return nil, 
	}

	return , nil
}

// GetClientScopeMappingsRealmRoles returns realm-level roles associated with the client’s scope
func ( *GoCloak) ( context.Context, , ,  string) ([]*Role, error) {
	const  = "could not get realm-level roles with the client’s scope"

	var  []*Role

	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		Get(.getAdminRealmURL(, "clients", , "scope-mappings", "realm"))

	if  := checkForError(, , );  != nil {
		return nil, 
	}

	return , nil
}

// GetClientScopeMappingsRealmRolesAvailable returns realm-level roles that are available to attach to this client’s scope
func ( *GoCloak) ( context.Context, , ,  string) ([]*Role, error) {
	const  = "could not get available realm-level roles with the client’s scope"

	var  []*Role

	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		Get(.getAdminRealmURL(, "clients", , "scope-mappings", "realm", "available"))

	if  := checkForError(, , );  != nil {
		return nil, 
	}

	return , nil
}

// CreateClientScopeMappingsRealmRoles create realm-level roles to the client’s scope
func ( *GoCloak) ( context.Context, , ,  string,  []Role) error {
	const  = "could not create realm-level roles to the client’s scope"

	,  := .GetRequestWithBearerAuth(, ).
		SetBody().
		Post(.getAdminRealmURL(, "clients", , "scope-mappings", "realm"))

	return checkForError(, , )
}

// DeleteClientScopeMappingsRealmRoles deletes realm-level roles from the client’s scope
func ( *GoCloak) ( context.Context, , ,  string,  []Role) error {
	const  = "could not delete realm-level roles from the client’s scope"

	,  := .GetRequestWithBearerAuth(, ).
		SetBody().
		Delete(.getAdminRealmURL(, "clients", , "scope-mappings", "realm"))

	return checkForError(, , )
}

// GetClientScopeMappingsClientRoles returns roles associated with a client’s scope
func ( *GoCloak) ( context.Context, , , ,  string) ([]*Role, error) {
	const  = "could not get roles associated with a client’s scope"

	var  []*Role

	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		Get(.getAdminRealmURL(, "clients", , "scope-mappings", "clients", ))

	if  := checkForError(, , );  != nil {
		return nil, 
	}

	return , nil
}

// GetClientScopeMappingsClientRolesAvailable returns available roles associated with a client’s scope
func ( *GoCloak) ( context.Context, , , ,  string) ([]*Role, error) {
	const  = "could not get available roles associated with a client’s scope"

	var  []*Role

	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		Get(.getAdminRealmURL(, "clients", , "scope-mappings", "clients", , "available"))

	if  := checkForError(, , );  != nil {
		return nil, 
	}

	return , nil
}

// CreateClientScopeMappingsClientRoles creates client-level roles from the client’s scope
func ( *GoCloak) ( context.Context, , , ,  string,  []Role) error {
	const  = "could not create client-level roles from the client’s scope"

	,  := .GetRequestWithBearerAuth(, ).
		SetBody().
		Post(.getAdminRealmURL(, "clients", , "scope-mappings", "clients", ))

	return checkForError(, , )
}

// DeleteClientScopeMappingsClientRoles deletes client-level roles from the client’s scope
func ( *GoCloak) ( context.Context, , , ,  string,  []Role) error {
	const  = "could not delete client-level roles from the client’s scope"

	,  := .GetRequestWithBearerAuth(, ).
		SetBody().
		Delete(.getAdminRealmURL(, "clients", , "scope-mappings", "clients", ))

	return checkForError(, , )
}

// GetClientSecret returns a client's secret
func ( *GoCloak) ( context.Context, , ,  string) (*CredentialRepresentation, error) {
	const  = "could not get client secret"

	var  CredentialRepresentation

	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		Get(.getAdminRealmURL(, "clients", , "client-secret"))

	if  := checkForError(, , );  != nil {
		return nil, 
	}

	return &, nil
}

// GetClientServiceAccount retrieves the service account "user" for a client if enabled
func ( *GoCloak) ( context.Context, , ,  string) (*User, error) {
	const  = "could not get client service account"

	var  User
	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		Get(.getAdminRealmURL(, "clients", , "service-account-user"))

	if  := checkForError(, , );  != nil {
		return nil, 
	}

	return &, nil
}

// RegenerateClientSecret triggers the creation of the new client secret.
func ( *GoCloak) ( context.Context, , ,  string) (*CredentialRepresentation, error) {
	const  = "could not regenerate client secret"

	var  CredentialRepresentation
	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		Post(.getAdminRealmURL(, "clients", , "client-secret"))

	if  := checkForError(, , );  != nil {
		return nil, 
	}

	return &, nil
}

// GetClientOfflineSessions returns offline sessions associated with the client
func ( *GoCloak) ( context.Context, , ,  string,  ...GetClientUserSessionsParams) ([]*UserSessionRepresentation, error) {
	const  = "could not get client offline sessions"
	var  []*UserSessionRepresentation

	 := map[string]string{}
	if  != nil && len() > 0 {
		var  error

		,  = GetQueryParams([0])
		if  != nil {
			return nil, errors.Wrap(, )
		}
	}

	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		SetQueryParams().
		Get(.getAdminRealmURL(, "clients", , "offline-sessions"))

	if  := checkForError(, , );  != nil {
		return nil, 
	}

	return , nil
}

// GetClientUserSessions returns user sessions associated with the client
func ( *GoCloak) ( context.Context, , ,  string,  ...GetClientUserSessionsParams) ([]*UserSessionRepresentation, error) {
	const  = "could not get client user sessions"
	var  []*UserSessionRepresentation

	 := map[string]string{}
	if  != nil && len() > 0 {
		var  error

		,  = GetQueryParams([0])
		if  != nil {
			return nil, errors.Wrap(, )
		}
	}

	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		SetQueryParams().
		Get(.getAdminRealmURL(, "clients", , "user-sessions"))

	if  := checkForError(, , );  != nil {
		return nil, 
	}

	return , nil
}

// CreateClientProtocolMapper creates a protocol mapper in client scope
func ( *GoCloak) ( context.Context, , ,  string,  ProtocolMapperRepresentation) (string, error) {
	const  = "could not create client protocol mapper"

	,  := .GetRequestWithBearerAuth(, ).
		SetBody().
		Post(.getAdminRealmURL(, "clients", , "protocol-mappers", "models"))

	if  := checkForError(, , );  != nil {
		return "", 
	}

	return getID(), nil
}

// UpdateClientProtocolMapper updates a protocol mapper in client scope
func ( *GoCloak) ( context.Context, , , ,  string,  ProtocolMapperRepresentation) error {
	const  = "could not update client protocol mapper"

	,  := .GetRequestWithBearerAuth(, ).
		SetBody().
		Put(.getAdminRealmURL(, "clients", , "protocol-mappers", "models", ))

	return checkForError(, , )
}

// DeleteClientProtocolMapper deletes a protocol mapper in client scope
func ( *GoCloak) ( context.Context, , , ,  string) error {
	const  = "could not delete client protocol mapper"

	,  := .GetRequestWithBearerAuth(, ).
		Delete(.getAdminRealmURL(, "clients", , "protocol-mappers", "models", ))

	return checkForError(, , )
}

// GetKeyStoreConfig get keystoreconfig of the realm
func ( *GoCloak) ( context.Context, ,  string) (*KeyStoreConfig, error) {
	const  = "could not get key store config"

	var  KeyStoreConfig
	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		Get(.getAdminRealmURL(, "keys"))

	if  := checkForError(, , );  != nil {
		return nil, 
	}

	return &, nil
}

// GetComponents get all components in realm
func ( *GoCloak) ( context.Context, ,  string) ([]*Component, error) {
	const  = "could not get components"

	var  []*Component
	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		Get(.getAdminRealmURL(, "components"))

	if  := checkForError(, , );  != nil {
		return nil, 
	}

	return , nil
}

// GetComponentsWithParams get all components in realm with query params
func ( *GoCloak) ( context.Context, ,  string,  GetComponentsParams) ([]*Component, error) {
	const  = "could not get components"
	var  []*Component

	,  := GetQueryParams()
	if  != nil {
		return nil, errors.Wrap(, )
	}
	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		SetQueryParams().
		Get(.getAdminRealmURL(, "components"))

	if  := checkForError(, , );  != nil {
		return nil, 
	}

	return , nil
}

// GetComponent get exactly one component by ID
func ( *GoCloak) ( context.Context, ,  string,  string) (*Component, error) {
	const  = "could not get components"
	var  *Component

	 := fmt.Sprintf("components/%s", )

	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		Get(.getAdminRealmURL(, ))

	if  := checkForError(, , );  != nil {
		return nil, 
	}

	return , nil
}

// UpdateComponent updates the given component
func ( *GoCloak) ( context.Context, ,  string,  Component) error {
	const  = "could not update component"

	,  := .GetRequestWithBearerAuth(, ).
		SetBody().
		Put(.getAdminRealmURL(, "components", PString(.ID)))

	return checkForError(, , )
}

// GetDefaultGroups returns a list of default groups
func ( *GoCloak) ( context.Context, ,  string) ([]*Group, error) {
	const  = "could not get default groups"

	var  []*Group

	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		Get(.getAdminRealmURL(, "default-groups"))

	if  := checkForError(, , );  != nil {
		return nil, 
	}

	return , nil
}

// AddDefaultGroup adds group to the list of default groups
func ( *GoCloak) ( context.Context, , ,  string) error {
	const  = "could not add default group"

	,  := .GetRequestWithBearerAuth(, ).
		Put(.getAdminRealmURL(, "default-groups", ))

	return checkForError(, , )
}

// RemoveDefaultGroup removes group from the list of default groups
func ( *GoCloak) ( context.Context, , ,  string) error {
	const  = "could not remove default group"

	,  := .GetRequestWithBearerAuth(, ).
		Delete(.getAdminRealmURL(, "default-groups", ))

	return checkForError(, , )
}

func ( *GoCloak) ( context.Context, , , ,  string) (*MappingsRepresentation, error) {
	const  = "could not get role mappings"

	var  MappingsRepresentation
	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		Get(.getAdminRealmURL(, , , "role-mappings"))

	if  := checkForError(, , );  != nil {
		return nil, 
	}

	return &, nil
}

// GetRoleMappingByGroupID gets the role mappings by group
func ( *GoCloak) ( context.Context, , ,  string) (*MappingsRepresentation, error) {
	return .getRoleMappings(, , , "groups", )
}

// GetRoleMappingByUserID gets the role mappings by user
func ( *GoCloak) ( context.Context, , ,  string) (*MappingsRepresentation, error) {
	return .getRoleMappings(, , , "users", )
}

// GetGroup get group with id in realm
func ( *GoCloak) ( context.Context, , ,  string) (*Group, error) {
	const  = "could not get group"

	var  Group

	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		Get(.getAdminRealmURL(, "groups", ))

	if  := checkForError(, , );  != nil {
		return nil, 
	}

	return &, nil
}

// GetGroupByPath get group with path in realm
func ( *GoCloak) ( context.Context, , ,  string) (*Group, error) {
	const  = "could not get group"

	var  Group

	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		Get(.getAdminRealmURL(, "group-by-path", ))

	if  := checkForError(, , );  != nil {
		return nil, 
	}

	return &, nil
}

// GetGroups get all groups in realm
func ( *GoCloak) ( context.Context, ,  string,  GetGroupsParams) ([]*Group, error) {
	const  = "could not get groups"

	var  []*Group
	,  := GetQueryParams()
	if  != nil {
		return nil, errors.Wrap(, )
	}

	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		SetQueryParams().
		Get(.getAdminRealmURL(, "groups"))

	if  := checkForError(, , );  != nil {
		return nil, 
	}

	return , nil
}

// GetGroupManagementPermissions returns whether group Authorization permissions have been initialized or not and a reference
// to the managed permissions
func ( *GoCloak) ( context.Context, ,  string,  string) (*ManagementPermissionRepresentation, error) {
	const  = "could not get management permissions"

	var  ManagementPermissionRepresentation
	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		Get(.getAdminRealmURL(, "groups", , "management", "permissions"))

	if  := checkForError(, , );  != nil {
		return nil, 
	}

	return &, nil
}

// GetGroupsByRole gets groups assigned with a specific role of a realm
func ( *GoCloak) ( context.Context, ,  string,  string) ([]*Group, error) {
	const  = "could not get groups"

	var  []*Group
	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		Get(.getAdminRealmURL(, "roles", , "groups"))

	if  := checkForError(, , );  != nil {
		return nil, 
	}

	return , nil
}

// GetGroupsByClientRole gets groups with specified roles assigned of given client within a realm
func ( *GoCloak) ( context.Context, ,  string,  string,  string) ([]*Group, error) {
	const  = "could not get groups"

	var  []*Group
	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		Get(.getAdminRealmURL(, "clients", , "roles", , "groups"))

	if  := checkForError(, , );  != nil {
		return nil, 
	}

	return , nil
}

// GetGroupsCount gets the groups count in the realm
func ( *GoCloak) ( context.Context, ,  string,  GetGroupsParams) (int, error) {
	const  = "could not get groups count"

	var  GroupsCount
	,  := GetQueryParams()
	if  != nil {
		return 0, errors.Wrap(, )
	}
	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		SetQueryParams().
		Get(.getAdminRealmURL(, "groups", "count"))

	if  := checkForError(, , );  != nil {
		return -1, errors.Wrap(, )
	}

	return .Count, nil
}

// GetGroupMembers get a list of users of group with id in realm
func ( *GoCloak) ( context.Context, , ,  string,  GetGroupsParams) ([]*User, error) {
	const  = "could not get group members"

	var  []*User
	,  := GetQueryParams()
	if  != nil {
		return nil, errors.Wrap(, )
	}

	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		SetQueryParams().
		Get(.getAdminRealmURL(, "groups", , "members"))

	if  := checkForError(, , );  != nil {
		return nil, 
	}

	return , nil
}

// GetClientRoles get all roles for the given client in realm
func ( *GoCloak) ( context.Context, , ,  string,  GetRoleParams) ([]*Role, error) {
	const  = "could not get client roles"

	var  []*Role
	,  := GetQueryParams()
	if  != nil {
		return nil, errors.Wrap(, )
	}

	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		SetQueryParams().
		Get(.getAdminRealmURL(, "clients", , "roles"))

	if  := checkForError(, , );  != nil {
		return nil, 
	}

	return , nil
}

// GetClientRoleByID gets role for the given client in realm using role ID
func ( *GoCloak) ( context.Context, , ,  string) (*Role, error) {
	const  = "could not get client role"

	var  Role
	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		Get(.getAdminRealmURL(, "roles-by-id", ))

	if  := checkForError(, , );  != nil {
		return nil, 
	}

	return &, nil
}

// GetClientRolesByUserID returns all client roles assigned to the given user
func ( *GoCloak) ( context.Context, , , ,  string) ([]*Role, error) {
	const  = "could not client roles by user id"

	var  []*Role
	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		Get(.getAdminRealmURL(, "users", , "role-mappings", "clients", ))

	if  = checkForError(, , );  != nil {
		return nil, 
	}

	return , nil
}

// GetClientRolesByGroupID returns all client roles assigned to the given group
func ( *GoCloak) ( context.Context, , , ,  string) ([]*Role, error) {
	const  = "could not get client roles by group id"

	var  []*Role
	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		Get(.getAdminRealmURL(, "groups", , "role-mappings", "clients", ))

	if  = checkForError(, , );  != nil {
		return nil, 
	}

	return , nil
}

// GetCompositeClientRolesByRoleID returns all client composite roles associated with the given client role
func ( *GoCloak) ( context.Context, , , ,  string) ([]*Role, error) {
	const  = "could not get composite client roles by role id"

	var  []*Role
	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		Get(.getAdminRealmURL(, "roles-by-id", , "composites", "clients", ))

	if  = checkForError(, , );  != nil {
		return nil, 
	}

	return , nil
}

// GetCompositeClientRolesByUserID returns all client roles and composite roles assigned to the given user
func ( *GoCloak) ( context.Context, , , ,  string) ([]*Role, error) {
	const  = "could not get composite client roles by user id"

	var  []*Role
	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		Get(.getAdminRealmURL(, "users", , "role-mappings", "clients", , "composite"))

	if  = checkForError(, , );  != nil {
		return nil, 
	}

	return , nil
}

// GetAvailableClientRolesByUserID returns all available client roles to the given user
func ( *GoCloak) ( context.Context, , , ,  string) ([]*Role, error) {
	const  = "could not get available client roles by user id"

	var  []*Role
	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		Get(.getAdminRealmURL(, "users", , "role-mappings", "clients", , "available"))

	if  = checkForError(, , );  != nil {
		return nil, 
	}

	return , nil
}

// GetAvailableClientRolesByGroupID returns all available roles to the given group
func ( *GoCloak) ( context.Context, , , ,  string) ([]*Role, error) {
	const  = "could not get available client roles by user id"

	var  []*Role
	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		Get(.getAdminRealmURL(, "groups", , "role-mappings", "clients", , "available"))

	if  = checkForError(, , );  != nil {
		return nil, 
	}

	return , nil
}

// GetCompositeClientRolesByGroupID returns all client roles and composite roles assigned to the given group
func ( *GoCloak) ( context.Context, , , ,  string) ([]*Role, error) {
	const  = "could not get composite client roles by group id"

	var  []*Role
	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		Get(.getAdminRealmURL(, "groups", , "role-mappings", "clients", , "composite"))

	if  = checkForError(, , );  != nil {
		return nil, 
	}

	return , nil
}

// GetClientRole get a role for the given client in a realm by role name
func ( *GoCloak) ( context.Context, , , ,  string) (*Role, error) {
	const  = "could not get client role"

	var  Role
	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		Get(.getAdminRealmURL(, "clients", , "roles", ))

	if  := checkForError(, , );  != nil {
		return nil, 
	}

	return &, nil
}

// GetClients gets all clients in realm
func ( *GoCloak) ( context.Context, ,  string,  GetClientsParams) ([]*Client, error) {
	const  = "could not get clients"

	var  []*Client
	,  := GetQueryParams()
	if  != nil {
		return nil, errors.Wrap(, )
	}
	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		SetQueryParams().
		Get(.getAdminRealmURL(, "clients"))

	if  := checkForError(, , );  != nil {
		return nil, 
	}

	return , nil
}

// GetClientManagementPermissions returns whether client Authorization permissions have been initialized or not and a reference
// to the managed permissions
func ( *GoCloak) ( context.Context, ,  string,  string) (*ManagementPermissionRepresentation, error) {
	const  = "could not get management permissions"

	var  ManagementPermissionRepresentation
	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		Get(.getAdminRealmURL(, "clients", , "management", "permissions"))

	if  := checkForError(, , );  != nil {
		return nil, 
	}

	return &, nil
}

// UserAttributeContains checks if the given attribute value is set
func ( map[string][]string, ,  string) bool {
	for ,  := range [] {
		if  ==  {
			return true
		}
	}
	return false
}

// -----------
// Realm Roles
// -----------

// CreateRealmRole creates a role in a realm
func ( *GoCloak) ( context.Context,  string,  string,  Role) (string, error) {
	const  = "could not create realm role"

	,  := .GetRequestWithBearerAuth(, ).
		SetBody().
		Post(.getAdminRealmURL(, "roles"))

	if  := checkForError(, , );  != nil {
		return "", 
	}

	return getID(), nil
}

// GetRealmRole returns a role from a realm by role's name
func ( *GoCloak) ( context.Context, , ,  string) (*Role, error) {
	const  = "could not get realm role"

	var  Role

	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		Get(.getAdminRealmURL(, "roles", ))

	if  = checkForError(, , );  != nil {
		return nil, 
	}

	return &, nil
}

// GetRealmRoleByID returns a role from a realm by role's ID
func ( *GoCloak) ( context.Context, , ,  string) (*Role, error) {
	const  = "could not get realm role"

	var  Role
	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		Get(.getAdminRealmURL(, "roles-by-id", ))

	if  := checkForError(, , );  != nil {
		return nil, 
	}

	return &, nil
}

// GetRealmRoles get all roles of the given realm.
func ( *GoCloak) ( context.Context, ,  string,  GetRoleParams) ([]*Role, error) {
	const  = "could not get realm roles"

	var  []*Role
	,  := GetQueryParams()
	if  != nil {
		return nil, errors.Wrap(, )
	}

	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		SetQueryParams().
		Get(.getAdminRealmURL(, "roles"))

	if  := checkForError(, , );  != nil {
		return nil, 
	}

	return , nil
}

// GetRealmRolesByUserID returns all roles assigned to the given user
func ( *GoCloak) ( context.Context, , ,  string) ([]*Role, error) {
	const  = "could not get realm roles by user id"

	var  []*Role
	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		Get(.getAdminRealmURL(, "users", , "role-mappings", "realm"))

	if  = checkForError(, , );  != nil {
		return nil, 
	}

	return , nil
}

// GetRealmRolesByGroupID returns all roles assigned to the given group
func ( *GoCloak) ( context.Context, , ,  string) ([]*Role, error) {
	const  = "could not get realm roles by group id"

	var  []*Role
	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		Get(.getAdminRealmURL(, "groups", , "role-mappings", "realm"))

	if  = checkForError(, , );  != nil {
		return nil, 
	}

	return , nil
}

// UpdateRealmRole updates a role in a realm
func ( *GoCloak) ( context.Context, , ,  string,  Role) error {
	const  = "could not update realm role"

	,  := .GetRequestWithBearerAuth(, ).
		SetBody().
		Put(.getAdminRealmURL(, "roles", ))

	return checkForError(, , )
}

// UpdateRealmRoleByID updates a role in a realm by role's ID
func ( *GoCloak) ( context.Context, , ,  string,  Role) error {
	const  = "could not update realm role"

	,  := .GetRequestWithBearerAuth(, ).
		SetBody().
		Put(.getAdminRealmURL(, "roles-by-id", ))

	return checkForError(, , )
}

// DeleteRealmRole deletes a role in a realm by role's name
func ( *GoCloak) ( context.Context, , ,  string) error {
	const  = "could not delete realm role"

	,  := .GetRequestWithBearerAuth(, ).
		Delete(.getAdminRealmURL(, "roles", ))

	return checkForError(, , )
}

// AddRealmRoleToUser adds realm-level role mappings
func ( *GoCloak) ( context.Context, , ,  string,  []Role) error {
	const  = "could not add realm role to user"

	,  := .GetRequestWithBearerAuth(, ).
		SetBody().
		Post(.getAdminRealmURL(, "users", , "role-mappings", "realm"))

	return checkForError(, , )
}

// DeleteRealmRoleFromUser deletes realm-level role mappings
func ( *GoCloak) ( context.Context, , ,  string,  []Role) error {
	const  = "could not delete realm role from user"

	,  := .GetRequestWithBearerAuth(, ).
		SetBody().
		Delete(.getAdminRealmURL(, "users", , "role-mappings", "realm"))

	return checkForError(, , )
}

// AddRealmRoleToGroup adds realm-level role mappings
func ( *GoCloak) ( context.Context, , ,  string,  []Role) error {
	const  = "could not add realm role to group"

	,  := .GetRequestWithBearerAuth(, ).
		SetBody().
		Post(.getAdminRealmURL(, "groups", , "role-mappings", "realm"))

	return checkForError(, , )
}

// DeleteRealmRoleFromGroup deletes realm-level role mappings
func ( *GoCloak) ( context.Context, , ,  string,  []Role) error {
	const  = "could not delete realm role from group"

	,  := .GetRequestWithBearerAuth(, ).
		SetBody().
		Delete(.getAdminRealmURL(, "groups", , "role-mappings", "realm"))

	return checkForError(, , )
}

// AddRealmRoleComposite adds a role to the composite.
func ( *GoCloak) ( context.Context, , ,  string,  []Role) error {
	const  = "could not add realm role composite"

	,  := .GetRequestWithBearerAuth(, ).
		SetBody().
		Post(.getAdminRealmURL(, "roles", , "composites"))

	return checkForError(, , )
}

// DeleteRealmRoleComposite deletes a role from the composite.
func ( *GoCloak) ( context.Context, , ,  string,  []Role) error {
	const  = "could not delete realm role composite"

	,  := .GetRequestWithBearerAuth(, ).
		SetBody().
		Delete(.getAdminRealmURL(, "roles", , "composites"))

	return checkForError(, , )
}

// GetCompositeRealmRoles returns all realm composite roles associated with the given realm role
func ( *GoCloak) ( context.Context, , ,  string) ([]*Role, error) {
	const  = "could not get composite realm roles by role"

	var  []*Role
	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		Get(.getAdminRealmURL(, "roles", , "composites"))

	if  = checkForError(, , );  != nil {
		return nil, 
	}

	return , nil
}

// GetCompositeRolesByRoleID returns all realm composite roles associated with the given client role
func ( *GoCloak) ( context.Context, , ,  string) ([]*Role, error) {
	const  = "could not get composite client roles by role id"

	var  []*Role
	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		Get(.getAdminRealmURL(, "roles-by-id", , "composites"))

	if  = checkForError(, , );  != nil {
		return nil, 
	}

	return , nil
}

// GetCompositeRealmRolesByRoleID returns all realm composite roles associated with the given client role
func ( *GoCloak) ( context.Context, , ,  string) ([]*Role, error) {
	const  = "could not get composite client roles by role id"

	var  []*Role
	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		Get(.getAdminRealmURL(, "roles-by-id", , "composites", "realm"))

	if  = checkForError(, , );  != nil {
		return nil, 
	}

	return , nil
}

// GetCompositeRealmRolesByUserID returns all realm roles and composite roles assigned to the given user
func ( *GoCloak) ( context.Context, , ,  string) ([]*Role, error) {
	const  = "could not get composite client roles by user id"

	var  []*Role
	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		Get(.getAdminRealmURL(, "users", , "role-mappings", "realm", "composite"))

	if  = checkForError(, , );  != nil {
		return nil, 
	}

	return , nil
}

// GetCompositeRealmRolesByGroupID returns all realm roles and composite roles assigned to the given group
func ( *GoCloak) ( context.Context, , ,  string) ([]*Role, error) {
	const  = "could not get composite client roles by user id"

	var  []*Role
	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		Get(.getAdminRealmURL(, "groups", , "role-mappings", "realm", "composite"))

	if  = checkForError(, , );  != nil {
		return nil, 
	}

	return , nil
}

// GetAvailableRealmRolesByUserID returns all available realm roles to the given user
func ( *GoCloak) ( context.Context, , ,  string) ([]*Role, error) {
	const  = "could not get available client roles by user id"

	var  []*Role
	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		Get(.getAdminRealmURL(, "users", , "role-mappings", "realm", "available"))

	if  = checkForError(, , );  != nil {
		return nil, 
	}

	return , nil
}

// GetAvailableRealmRolesByGroupID returns all available realm roles to the given group
func ( *GoCloak) ( context.Context, , ,  string) ([]*Role, error) {
	const  = "could not get available client roles by user id"

	var  []*Role
	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		Get(.getAdminRealmURL(, "groups", , "role-mappings", "realm", "available"))

	if  = checkForError(, , );  != nil {
		return nil, 
	}

	return , nil
}

// -----
// Realm
// -----

// GetRealm returns top-level representation of the realm
func ( *GoCloak) ( context.Context, ,  string) (*RealmRepresentation, error) {
	const  = "could not get realm"

	var  RealmRepresentation
	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		Get(.getAdminRealmURL())

	if  = checkForError(, , );  != nil {
		return nil, 
	}

	return &, nil
}

// GetRealms returns top-level representation of all realms
func ( *GoCloak) ( context.Context,  string) ([]*RealmRepresentation, error) {
	const  = "could not get realms"

	var  []*RealmRepresentation
	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		Get(.getAdminRealmURL(""))

	if  = checkForError(, , );  != nil {
		return nil, 
	}

	return , nil
}

// CreateRealm creates a realm
func ( *GoCloak) ( context.Context,  string,  RealmRepresentation) (string, error) {
	const  = "could not create realm"

	,  := .GetRequestWithBearerAuth(, ).
		SetBody(&).
		Post(.getAdminRealmURL(""))

	if  := checkForError(, , );  != nil {
		return "", 
	}
	return getID(), nil
}

// UpdateRealm updates a given realm
func ( *GoCloak) ( context.Context,  string,  RealmRepresentation) error {
	const  = "could not update realm"

	,  := .GetRequestWithBearerAuth(, ).
		SetBody().
		Put(.getAdminRealmURL(PString(.Realm)))

	return checkForError(, , )
}

// DeleteRealm removes a realm
func ( *GoCloak) ( context.Context, ,  string) error {
	const  = "could not delete realm"

	,  := .GetRequestWithBearerAuth(, ).
		Delete(.getAdminRealmURL())

	return checkForError(, , )
}

// ClearRealmCache clears realm cache
func ( *GoCloak) ( context.Context, ,  string) error {
	const  = "could not clear realm cache"

	,  := .GetRequestWithBearerAuth(, ).
		Post(.getAdminRealmURL(, "clear-realm-cache"))

	return checkForError(, , )
}

// ClearUserCache clears realm cache
func ( *GoCloak) ( context.Context, ,  string) error {
	const  = "could not clear user cache"

	,  := .GetRequestWithBearerAuth(, ).
		Post(.getAdminRealmURL(, "clear-user-cache"))

	return checkForError(, , )
}

// ClearKeysCache clears realm cache
func ( *GoCloak) ( context.Context, ,  string) error {
	const  = "could not clear keys cache"

	,  := .GetRequestWithBearerAuth(, ).
		Post(.getAdminRealmURL(, "clear-keys-cache"))

	return checkForError(, , )
}

// GetAuthenticationFlows get all authentication flows from a realm
func ( *GoCloak) ( context.Context, ,  string) ([]*AuthenticationFlowRepresentation, error) {
	const  = "could not retrieve authentication flows"
	var  []*AuthenticationFlowRepresentation
	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		Get(.getAdminRealmURL(, "authentication", "flows"))

	if  := checkForError(, , );  != nil {
		return nil, 
	}
	return , nil
}

// GetAuthenticationFlow get an authentication flow with the given ID
func ( *GoCloak) ( context.Context, ,  string,  string) (*AuthenticationFlowRepresentation, error) {
	const  = "could not retrieve authentication flows"
	var  *AuthenticationFlowRepresentation
	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		Get(.getAdminRealmURL(, "authentication", "flows", ))

	if  := checkForError(, , );  != nil {
		return nil, 
	}
	return , nil
}

// CreateAuthenticationFlow creates a new Authentication flow in a realm
func ( *GoCloak) ( context.Context, ,  string,  AuthenticationFlowRepresentation) error {
	const  = "could not create authentication flows"
	var  []*AuthenticationFlowRepresentation
	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).SetBody().
		Post(.getAdminRealmURL(, "authentication", "flows"))

	return checkForError(, , )
}

// UpdateAuthenticationFlow a given Authentication Flow
func ( *GoCloak) ( context.Context, ,  string,  AuthenticationFlowRepresentation,  string) (*AuthenticationFlowRepresentation, error) {
	const  = "could not create authentication flows"
	var  *AuthenticationFlowRepresentation
	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).SetBody().
		Put(.getAdminRealmURL(, "authentication", "flows", ))

	if  = checkForError(, , );  != nil {
		return nil, 
	}
	return , nil
}

// DeleteAuthenticationFlow deletes a flow in a realm with the given ID
func ( *GoCloak) ( context.Context, , ,  string) error {
	const  = "could not delete authentication flows"
	,  := .GetRequestWithBearerAuth(, ).
		Delete(.getAdminRealmURL(, "authentication", "flows", ))

	return checkForError(, , )
}

// GetAuthenticationExecutions retrieves all executions of a given flow
func ( *GoCloak) ( context.Context, , ,  string) ([]*ModifyAuthenticationExecutionRepresentation, error) {
	const  = "could not retrieve authentication flows"
	var  []*ModifyAuthenticationExecutionRepresentation
	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		Get(.getAdminRealmURL(, "authentication", "flows", , "executions"))

	if  := checkForError(, , );  != nil {
		return nil, 
	}
	return , nil
}

// CreateAuthenticationExecution creates a new execution for the given flow name in the given realm
func ( *GoCloak) ( context.Context, , ,  string,  CreateAuthenticationExecutionRepresentation) error {
	const  = "could not create authentication execution"
	,  := .GetRequestWithBearerAuth(, ).SetBody().
		Post(.getAdminRealmURL(, "authentication", "flows", , "executions", "execution"))

	return checkForError(, , )
}

// UpdateAuthenticationExecution updates an authentication execution for the given flow in the given realm
func ( *GoCloak) ( context.Context, , ,  string,  ModifyAuthenticationExecutionRepresentation) error {
	const  = "could not update authentication execution"
	,  := .GetRequestWithBearerAuth(, ).SetBody().
		Put(.getAdminRealmURL(, "authentication", "flows", , "executions"))

	return checkForError(, , )
}

// DeleteAuthenticationExecution delete a single execution with the given ID
func ( *GoCloak) ( context.Context, , ,  string) error {
	const  = "could not delete authentication execution"
	,  := .GetRequestWithBearerAuth(, ).
		Delete(.getAdminRealmURL(, "authentication", "executions", ))

	return checkForError(, , )
}

// CreateAuthenticationExecutionFlow creates a new execution for the given flow name in the given realm
func ( *GoCloak) ( context.Context, , ,  string,  CreateAuthenticationExecutionFlowRepresentation) error {
	const  = "could not create authentication execution flow"
	,  := .GetRequestWithBearerAuth(, ).SetBody().
		Post(.getAdminRealmURL(, "authentication", "flows", , "executions", "flow"))

	return checkForError(, , )
}

// -----
// Users
// -----

// CreateUser creates the given user in the given realm and returns it's userID
// Note: Keycloak has not documented what members of the User object are actually being accepted, when creating a user.
// Things like RealmRoles must be attached using followup calls to the respective functions.
func ( *GoCloak) ( context.Context, ,  string,  User) (string, error) {
	const  = "could not create user"

	,  := .GetRequestWithBearerAuth(, ).
		SetBody().
		Post(.getAdminRealmURL(, "users"))

	if  := checkForError(, , );  != nil {
		return "", 
	}

	return getID(), nil
}

// DeleteUser delete a given user
func ( *GoCloak) ( context.Context, , ,  string) error {
	const  = "could not delete user"

	,  := .GetRequestWithBearerAuth(, ).
		Delete(.getAdminRealmURL(, "users", ))

	return checkForError(, , )
}

// GetUserByID fetches a user from the given realm with the given userID
func ( *GoCloak) ( context.Context, , ,  string) (*User, error) {
	const  = "could not get user by id"

	if  == "" {
		return nil, errors.Wrap(errors.New("userID shall not be empty"), )
	}

	var  User
	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		Get(.getAdminRealmURL(, "users", ))

	if  := checkForError(, , );  != nil {
		return nil, 
	}

	return &, nil
}

// GetUserCount gets the user count in the realm
func ( *GoCloak) ( context.Context,  string,  string,  GetUsersParams) (int, error) {
	const  = "could not get user count"

	var  int
	,  := GetQueryParams()
	if  != nil {
		return 0, errors.Wrap(, )
	}

	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		SetQueryParams().
		Get(.getAdminRealmURL(, "users", "count"))

	if  := checkForError(, , );  != nil {
		return -1, errors.Wrap(, )
	}

	return , nil
}

// GetUserGroups get all groups for user
func ( *GoCloak) ( context.Context, , ,  string,  GetGroupsParams) ([]*Group, error) {
	const  = "could not get user groups"

	var  []*Group
	,  := GetQueryParams()
	if  != nil {
		return nil, errors.Wrap(, )
	}

	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		SetQueryParams().
		Get(.getAdminRealmURL(, "users", , "groups"))

	if  := checkForError(, , );  != nil {
		return nil, 
	}

	return , nil
}

// GetUsers get all users in realm
func ( *GoCloak) ( context.Context, ,  string,  GetUsersParams) ([]*User, error) {
	const  = "could not get users"

	var  []*User
	,  := GetQueryParams()
	if  != nil {
		return nil, errors.Wrap(, )
	}

	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		SetQueryParams().
		Get(.getAdminRealmURL(, "users"))

	if  := checkForError(, , );  != nil {
		return nil, 
	}

	return , nil
}

// GetUsersByRoleName returns all users have a given role
func ( *GoCloak) ( context.Context, , ,  string,  GetUsersByRoleParams) ([]*User, error) {
	const  = "could not get users by role name"

	var  []*User
	,  := GetQueryParams()
	if  != nil {
		return nil, errors.Wrap(, )
	}

	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		SetQueryParams().
		Get(.getAdminRealmURL(, "roles", , "users"))

	if  := checkForError(, , );  != nil {
		return nil, 
	}

	return , nil
}

// GetUsersByClientRoleName returns all users have a given client role
func ( *GoCloak) ( context.Context, , , ,  string,  GetUsersByRoleParams) ([]*User, error) {
	const  = "could not get users by client role name"

	var  []*User
	,  := GetQueryParams()
	if  != nil {
		return nil, 
	}

	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		SetQueryParams().
		Get(.getAdminRealmURL(, "clients", , "roles", , "users"))

	if  := checkForError(, , );  != nil {
		return nil, 
	}

	return , nil
}

// SetPassword sets a new password for the user with the given id. Needs elevated privileges
func ( *GoCloak) ( context.Context, , , ,  string,  bool) error {
	const  = "could not set password"

	 := SetPasswordRequest{Password: &, Temporary: &, Type: StringP("password")}
	,  := .GetRequestWithBearerAuth(, ).
		SetBody().
		Put(.getAdminRealmURL(, "users", , "reset-password"))

	return checkForError(, , )
}

// UpdateUser updates a given user
func ( *GoCloak) ( context.Context, ,  string,  User) error {
	const  = "could not update user"

	,  := .GetRequestWithBearerAuth(, ).
		SetBody().
		Put(.getAdminRealmURL(, "users", PString(.ID)))

	return checkForError(, , )
}

// AddUserToGroup puts given user to given group
func ( *GoCloak) ( context.Context, , , ,  string) error {
	const  = "could not add user to group"

	,  := .GetRequestWithBearerAuth(, ).
		Put(.getAdminRealmURL(, "users", , "groups", ))

	return checkForError(, , )
}

// DeleteUserFromGroup deletes given user from given group
func ( *GoCloak) ( context.Context, , , ,  string) error {
	const  = "could not delete user from group"

	,  := .GetRequestWithBearerAuth(, ).
		Delete(.getAdminRealmURL(, "users", , "groups", ))

	return checkForError(, , )
}

// GetUserSessions returns user sessions associated with the user
func ( *GoCloak) ( context.Context, , ,  string) ([]*UserSessionRepresentation, error) {
	const  = "could not get user sessions"

	var  []*UserSessionRepresentation
	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		Get(.getAdminRealmURL(, "users", , "sessions"))

	if  := checkForError(, , );  != nil {
		return nil, 
	}

	return , nil
}

// GetUserOfflineSessionsForClient returns offline sessions associated with the user and client
func ( *GoCloak) ( context.Context, , , ,  string) ([]*UserSessionRepresentation, error) {
	const  = "could not get user offline sessions for client"

	var  []*UserSessionRepresentation
	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		Get(.getAdminRealmURL(, "users", , "offline-sessions", ))

	if  := checkForError(, , );  != nil {
		return nil, 
	}

	return , nil
}

// AddClientRolesToUser adds client-level role mappings
func ( *GoCloak) ( context.Context, , , ,  string,  []Role) error {
	const  = "could not add client role to user"

	,  := .GetRequestWithBearerAuth(, ).
		SetBody().
		Post(.getAdminRealmURL(, "users", , "role-mappings", "clients", ))

	return checkForError(, , )
}

// AddClientRoleToUser adds client-level role mappings
//
// Deprecated: replaced by AddClientRolesToUser
func ( *GoCloak) ( context.Context, , , ,  string,  []Role) error {
	return .AddClientRolesToUser(, , , , , )
}

// AddClientRolesToGroup adds a client role to the group
func ( *GoCloak) ( context.Context, , , ,  string,  []Role) error {
	const  = "could not add client role to group"

	,  := .GetRequestWithBearerAuth(, ).
		SetBody().
		Post(.getAdminRealmURL(, "groups", , "role-mappings", "clients", ))

	return checkForError(, , )
}

// AddClientRoleToGroup adds a client role to the group
//
// Deprecated: replaced by AddClientRolesToGroup
func ( *GoCloak) ( context.Context, , , ,  string,  []Role) error {
	return .AddClientRolesToGroup(, , , , , )
}

// DeleteClientRolesFromUser adds client-level role mappings
func ( *GoCloak) ( context.Context, , , ,  string,  []Role) error {
	const  = "could not delete client role from user"

	,  := .GetRequestWithBearerAuth(, ).
		SetBody().
		Delete(.getAdminRealmURL(, "users", , "role-mappings", "clients", ))

	return checkForError(, , )
}

// DeleteClientRoleFromUser adds client-level role mappings
//
// Deprecated: replaced by DeleteClientRolesFrom
func ( *GoCloak) ( context.Context, , , ,  string,  []Role) error {
	return .DeleteClientRolesFromUser(, , , , , )
}

// DeleteClientRoleFromGroup removes a client role from from the group
func ( *GoCloak) ( context.Context, , , ,  string,  []Role) error {
	const  = "could not client role from group"

	,  := .GetRequestWithBearerAuth(, ).
		SetBody().
		Delete(.getAdminRealmURL(, "groups", , "role-mappings", "clients", ))

	return checkForError(, , )
}

// AddClientRoleComposite adds roles as composite
func ( *GoCloak) ( context.Context, , ,  string,  []Role) error {
	const  = "could not add client role composite"

	,  := .GetRequestWithBearerAuth(, ).
		SetBody().
		Post(.getAdminRealmURL(, "roles-by-id", , "composites"))

	return checkForError(, , )
}

// DeleteClientRoleComposite deletes composites from a role
func ( *GoCloak) ( context.Context, , ,  string,  []Role) error {
	const  = "could not delete client role composite"

	,  := .GetRequestWithBearerAuth(, ).
		SetBody().
		Delete(.getAdminRealmURL(, "roles-by-id", , "composites"))

	return checkForError(, , )
}

// GetUserFederatedIdentities gets all user federated identities
func ( *GoCloak) ( context.Context, , ,  string) ([]*FederatedIdentityRepresentation, error) {
	const  = "could not get user federated identities"

	var  []*FederatedIdentityRepresentation
	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		Get(.getAdminRealmURL(, "users", , "federated-identity"))

	if  := checkForError(, , );  != nil {
		return nil, 
	}

	return , 
}

// CreateUserFederatedIdentity creates an user federated identity
func ( *GoCloak) ( context.Context, , , ,  string,  FederatedIdentityRepresentation) error {
	const  = "could not create user federeated identity"

	,  := .GetRequestWithBearerAuth(, ).
		SetBody().
		Post(.getAdminRealmURL(, "users", , "federated-identity", ))

	return checkForError(, , )
}

// DeleteUserFederatedIdentity deletes an user federated identity
func ( *GoCloak) ( context.Context, , , ,  string) error {
	const  = "could not delete user federeated identity"

	,  := .GetRequestWithBearerAuth(, ).
		Delete(.getAdminRealmURL(, "users", , "federated-identity", ))

	return checkForError(, , )
}

// GetUserBruteForceDetectionStatus fetches a user status regarding brute force protection
func ( *GoCloak) ( context.Context, , ,  string) (*BruteForceStatus, error) {
	const  = "could not brute force detection Status"
	var  BruteForceStatus

	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		Get(.getAttackDetectionURL(, "users", ))

	if  := checkForError(, , );  != nil {
		return nil, 
	}

	return &, nil
}

// ------------------
// Identity Providers
// ------------------

// CreateIdentityProvider creates an identity provider in a realm
func ( *GoCloak) ( context.Context,  string,  string,  IdentityProviderRepresentation) (string, error) {
	const  = "could not create identity provider"

	,  := .GetRequestWithBearerAuth(, ).
		SetBody().
		Post(.getAdminRealmURL(, "identity-provider", "instances"))

	if  := checkForError(, , );  != nil {
		return "", 
	}

	return getID(), nil
}

// GetIdentityProviders returns list of identity providers in a realm
func ( *GoCloak) ( context.Context, ,  string) ([]*IdentityProviderRepresentation, error) {
	const  = "could not get identity providers"

	var  []*IdentityProviderRepresentation
	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		Get(.getAdminRealmURL(, "identity-provider", "instances"))

	if  := checkForError(, , );  != nil {
		return nil, 
	}

	return , nil
}

// GetIdentityProvider gets the identity provider in a realm
func ( *GoCloak) ( context.Context, , ,  string) (*IdentityProviderRepresentation, error) {
	const  = "could not get identity provider"

	var  IdentityProviderRepresentation
	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		Get(.getAdminRealmURL(, "identity-provider", "instances", ))

	if  := checkForError(, , );  != nil {
		return nil, 
	}

	return &, nil
}

// UpdateIdentityProvider updates the identity provider in a realm
func ( *GoCloak) ( context.Context, , ,  string,  IdentityProviderRepresentation) error {
	const  = "could not update identity provider"

	,  := .GetRequestWithBearerAuth(, ).
		SetBody().
		Put(.getAdminRealmURL(, "identity-provider", "instances", ))

	return checkForError(, , )
}

// DeleteIdentityProvider deletes the identity provider in a realm
func ( *GoCloak) ( context.Context, , ,  string) error {
	const  = "could not delete identity provider"

	,  := .GetRequestWithBearerAuth(, ).
		Delete(.getAdminRealmURL(, "identity-provider", "instances", ))

	return checkForError(, , )
}

// ExportIDPPublicBrokerConfig exports the broker config for a given alias
func ( *GoCloak) ( context.Context, , ,  string) (*string, error) {
	const  = "could not get public identity provider configuration"

	,  := .GetRequestWithBearerAuthXMLHeader(, ).
		Get(.getAdminRealmURL(, "identity-provider", "instances", , "export"))

	if  := checkForError(, , );  != nil {
		return nil, 
	}

	 := .String()
	return &, nil
}

// ImportIdentityProviderConfig parses and returns the identity provider config at a given URL
func ( *GoCloak) ( context.Context, , , ,  string) (map[string]string, error) {
	const  = "could not import config"

	 := make(map[string]string)
	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		SetBody(map[string]string{
			"fromUrl":    ,
			"providerId": ,
		}).
		Post(.getAdminRealmURL(, "identity-provider", "import-config"))

	if  := checkForError(, , );  != nil {
		return nil, 
	}

	return , nil
}

// ImportIdentityProviderConfigFromFile parses and returns the identity provider config from a given file
func ( *GoCloak) ( context.Context, , , ,  string,  io.Reader) (map[string]string, error) {
	const  = "could not import config"

	 := make(map[string]string)
	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		SetFileReader("file", , ).
		SetFormData(map[string]string{
			"providerId": ,
		}).
		Post(.getAdminRealmURL(, "identity-provider", "import-config"))

	if  := checkForError(, , );  != nil {
		return nil, 
	}

	return , nil
}

// CreateIdentityProviderMapper creates an instance of an identity provider mapper associated with the given alias
func ( *GoCloak) ( context.Context, , ,  string,  IdentityProviderMapper) (string, error) {
	const  = "could not create mapper for identity provider"

	,  := .GetRequestWithBearerAuth(, ).
		SetBody().
		Post(.getAdminRealmURL(, "identity-provider", "instances", , "mappers"))

	if  := checkForError(, , );  != nil {
		return "", 
	}

	return getID(), nil
}

// GetIdentityProviderMapper gets the mapper by id for the given identity provider alias in a realm
func ( *GoCloak) ( context.Context,  string,  string,  string,  string) (*IdentityProviderMapper, error) {
	const  = "could not get identity provider mapper"

	 := IdentityProviderMapper{}
	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		Get(.getAdminRealmURL(, "identity-provider", "instances", , "mappers", ))

	if  := checkForError(, , );  != nil {
		return nil, 
	}

	return &, nil
}

// DeleteIdentityProviderMapper deletes an instance of an identity provider mapper associated with the given alias and mapper ID
func ( *GoCloak) ( context.Context, , , ,  string) error {
	const  = "could not delete mapper for identity provider"

	,  := .GetRequestWithBearerAuth(, ).
		Delete(.getAdminRealmURL(, "identity-provider", "instances", , "mappers", ))

	return checkForError(, , )
}

// GetIdentityProviderMappers returns list of mappers associated with an identity provider
func ( *GoCloak) ( context.Context, , ,  string) ([]*IdentityProviderMapper, error) {
	const  = "could not get identity provider mappers"

	var  []*IdentityProviderMapper
	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		Get(.getAdminRealmURL(, "identity-provider", "instances", , "mappers"))

	if  := checkForError(, , );  != nil {
		return nil, 
	}

	return , nil
}

// GetIdentityProviderMapperByID gets the mapper of an identity provider
func ( *GoCloak) ( context.Context, , , ,  string) (*IdentityProviderMapper, error) {
	const  = "could not get identity provider mappers"

	var  IdentityProviderMapper
	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		Get(.getAdminRealmURL(, "identity-provider", "instances", , "mappers", ))

	if  := checkForError(, , );  != nil {
		return nil, 
	}

	return &, nil
}

// UpdateIdentityProviderMapper updates mapper of an identity provider
func ( *GoCloak) ( context.Context, , ,  string,  IdentityProviderMapper) error {
	const  = "could not update identity provider mapper"

	,  := .GetRequestWithBearerAuth(, ).
		SetBody().
		Put(.getAdminRealmURL(, "identity-provider", "instances", , "mappers", PString(.ID)))

	return checkForError(, , )
}

// ------------------
// Protection API
// ------------------

// GetResource returns a client's resource with the given id, using access token from admin
func ( *GoCloak) ( context.Context, , , ,  string) (*ResourceRepresentation, error) {
	const  = "could not get resource"

	var  ResourceRepresentation
	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		Get(.getAdminRealmURL(, "clients", , "authz", "resource-server", "resource", ))

	if  := checkForError(, , );  != nil {
		return nil, 
	}

	return &, nil
}

// GetResourceClient returns a client's resource with the given id, using access token from client
func ( *GoCloak) ( context.Context, , ,  string) (*ResourceRepresentation, error) {
	const  = "could not get resource"

	var  ResourceRepresentation
	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		Get(.getRealmURL(, "authz", "protection", "resource_set", ))

	// http://${host}:${port}/auth/realms/${realm_name}/authz/protection/resource_set/{resource_id}

	if  := checkForError(, , );  != nil {
		return nil, 
	}

	return &, nil
}

// GetResources returns resources associated with the client, using access token from admin
func ( *GoCloak) ( context.Context, , ,  string,  GetResourceParams) ([]*ResourceRepresentation, error) {
	const  = "could not get resources"

	,  := GetQueryParams()
	if  != nil {
		return nil, 
	}

	var  []*ResourceRepresentation
	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		SetQueryParams().
		Get(.getAdminRealmURL(, "clients", , "authz", "resource-server", "resource"))

	if  := checkForError(, , );  != nil {
		return nil, 
	}

	return , nil
}

// GetResourcesClient returns resources associated with the client, using access token from client
func ( *GoCloak) ( context.Context, ,  string,  GetResourceParams) ([]*ResourceRepresentation, error) {
	const  = "could not get resources"

	,  := GetQueryParams()
	if  != nil {
		return nil, 
	}

	var  []*ResourceRepresentation
	var  []string
	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		SetQueryParams().
		Get(.getRealmURL(, "authz", "protection", "resource_set"))

	if  := checkForError(, , );  != nil {
		return nil, 
	}

	for ,  := range  {
		,  := .GetResourceClient(, , , )
		if  == nil {
			 = append(, )
		}
	}

	return , nil
}

// GetResourceServer returns resource server settings.
// The access token must have the realm view_clients role on its service
// account to be allowed to call this endpoint.
func ( *GoCloak) ( context.Context, , ,  string) (*ResourceServerRepresentation, error) {
	const  = "could not get resource server settings"

	var  *ResourceServerRepresentation
	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		Get(.getAdminRealmURL(, "clients", , "authz", "resource-server", "settings"))

	if  := checkForError(, , );  != nil {
		return nil, 
	}

	return , nil
}

// UpdateResource updates a resource associated with the client, using access token from admin
func ( *GoCloak) ( context.Context, , ,  string,  ResourceRepresentation) error {
	const  = "could not update resource"

	if NilOrEmpty(.ID) {
		return errors.New("ID of a resource required")
	}

	,  := .GetRequestWithBearerAuth(, ).
		SetBody().
		Put(.getAdminRealmURL(, "clients", , "authz", "resource-server", "resource", *(.ID)))

	return checkForError(, , )
}

// UpdateResourceClient updates a resource associated with the client, using access token from client
func ( *GoCloak) ( context.Context, ,  string,  ResourceRepresentation) error {
	const  = "could not update resource"

	if NilOrEmpty(.ID) {
		return errors.New("ID of a resource required")
	}

	,  := .GetRequestWithBearerAuth(, ).
		SetBody().
		Put(.getRealmURL(, "authz", "protection", "resource_set", *(.ID)))

	return checkForError(, , )
}

// CreateResource creates a resource associated with the client, using access token from admin
func ( *GoCloak) ( context.Context, ,  string,  string,  ResourceRepresentation) (*ResourceRepresentation, error) {
	const  = "could not create resource"

	var  ResourceRepresentation
	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		SetBody().
		Post(.getAdminRealmURL(, "clients", , "authz", "resource-server", "resource"))

	if  := checkForError(, , );  != nil {
		return nil, 
	}

	return &, nil
}

// CreateResourceClient creates a resource associated with the client, using access token from client
func ( *GoCloak) ( context.Context, ,  string,  ResourceRepresentation) (*ResourceRepresentation, error) {
	const  = "could not create resource"

	var  ResourceRepresentation
	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		SetBody().
		Post(.getRealmURL(, "authz", "protection", "resource_set"))

	if  := checkForError(, , );  != nil {
		return nil, 
	}

	return &, nil
}

// DeleteResource deletes a resource associated with the client (using an admin token)
func ( *GoCloak) ( context.Context, , , ,  string) error {
	const  = "could not delete resource"

	,  := .GetRequestWithBearerAuth(, ).
		Delete(.getAdminRealmURL(, "clients", , "authz", "resource-server", "resource", ))

	return checkForError(, , )
}

// DeleteResourceClient deletes a resource associated with the client (using a client token)
func ( *GoCloak) ( context.Context, , ,  string) error {
	const  = "could not delete resource"

	,  := .GetRequestWithBearerAuth(, ).
		Delete(.getRealmURL(, "authz", "protection", "resource_set", ))

	return checkForError(, , )
}

// GetScope returns a client's scope with the given id
func ( *GoCloak) ( context.Context, , , ,  string) (*ScopeRepresentation, error) {
	const  = "could not get scope"

	var  ScopeRepresentation
	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		Get(.getAdminRealmURL(, "clients", , "authz", "resource-server", "scope", ))

	if  := checkForError(, , );  != nil {
		return nil, 
	}

	return &, nil
}

// GetScopes returns scopes associated with the client
func ( *GoCloak) ( context.Context, , ,  string,  GetScopeParams) ([]*ScopeRepresentation, error) {
	const  = "could not get scopes"

	,  := GetQueryParams()
	if  != nil {
		return nil, 
	}
	var  []*ScopeRepresentation
	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		SetQueryParams().
		Get(.getAdminRealmURL(, "clients", , "authz", "resource-server", "scope"))

	if  := checkForError(, , );  != nil {
		return nil, 
	}

	return , nil
}

// CreateScope creates a scope associated with the client
func ( *GoCloak) ( context.Context, , ,  string,  ScopeRepresentation) (*ScopeRepresentation, error) {
	const  = "could not create scope"

	var  ScopeRepresentation
	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		SetBody().
		Post(.getAdminRealmURL(, "clients", , "authz", "resource-server", "scope"))

	if  := checkForError(, , );  != nil {
		return nil, 
	}

	return &, nil
}

// GetPermissionScope gets the permission scope associated with the client
func ( *GoCloak) ( context.Context, , ,  string,  string) (*PolicyRepresentation, error) {
	const  = "could not get permission scope"

	var  PolicyRepresentation
	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		SetBody().
		Get(.getAdminRealmURL(, "clients", , "authz", "resource-server", "permission", "scope", ))

	if  := checkForError(, , );  != nil {
		return nil, 
	}

	return &, nil
}

// UpdatePermissionScope updates a permission scope associated with the client
func ( *GoCloak) ( context.Context, , ,  string,  string,  PolicyRepresentation) error {
	const  = "could not create permission scope"

	,  := .GetRequestWithBearerAuth(, ).
		SetBody().
		Put(.getAdminRealmURL(, "clients", , "authz", "resource-server", "permission", "scope", ))

	return checkForError(, , )
}

// UpdateScope updates a scope associated with the client
func ( *GoCloak) ( context.Context, , ,  string,  ScopeRepresentation) error {
	const  = "could not update scope"

	if NilOrEmpty(.ID) {
		return errors.New("ID of a scope required")
	}

	,  := .GetRequestWithBearerAuth(, ).
		SetBody().
		Put(.getAdminRealmURL(, "clients", , "authz", "resource-server", "scope", *(.ID)))

	return checkForError(, , )
}

// DeleteScope deletes a scope associated with the client
func ( *GoCloak) ( context.Context, , , ,  string) error {
	const  = "could not delete scope"

	,  := .GetRequestWithBearerAuth(, ).
		Delete(.getAdminRealmURL(, "clients", , "authz", "resource-server", "scope", ))

	return checkForError(, , )
}

// GetPolicy returns a client's policy with the given id
func ( *GoCloak) ( context.Context, , , ,  string) (*PolicyRepresentation, error) {
	const  = "could not get policy"

	var  PolicyRepresentation
	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		Get(.getAdminRealmURL(, "clients", , "authz", "resource-server", "policy", ))

	if  := checkForError(, , );  != nil {
		return nil, 
	}

	return &, nil
}

// GetPolicies returns policies associated with the client
func ( *GoCloak) ( context.Context, , ,  string,  GetPolicyParams) ([]*PolicyRepresentation, error) {
	const  = "could not get policies"

	,  := GetQueryParams()
	if  != nil {
		return nil, errors.Wrap(, )
	}

	 := []string{"clients", , "authz", "resource-server", "policy"}
	if !NilOrEmpty(.Type) {
		 = append(, *.Type)
	}

	var  []*PolicyRepresentation
	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		SetQueryParams().
		Get(.getAdminRealmURL(, ...))

	if  := checkForError(, , );  != nil {
		return nil, 
	}

	return , nil
}

// CreatePolicy creates a policy associated with the client
func ( *GoCloak) ( context.Context, , ,  string,  PolicyRepresentation) (*PolicyRepresentation, error) {
	const  = "could not create policy"

	if NilOrEmpty(.Type) {
		return nil, errors.New("type of a policy required")
	}

	var  PolicyRepresentation
	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		SetBody().
		Post(.getAdminRealmURL(, "clients", , "authz", "resource-server", "policy", *(.Type)))

	if  := checkForError(, , );  != nil {
		return nil, 
	}

	return &, nil
}

// UpdatePolicy updates a policy associated with the client
func ( *GoCloak) ( context.Context, , ,  string,  PolicyRepresentation) error {
	const  = "could not update policy"

	if NilOrEmpty(.ID) {
		return errors.New("ID of a policy required")
	}

	,  := .GetRequestWithBearerAuth(, ).
		SetBody().
		Put(.getAdminRealmURL(, "clients", , "authz", "resource-server", "policy", *(.Type), *(.ID)))

	return checkForError(, , )
}

// DeletePolicy deletes a policy associated with the client
func ( *GoCloak) ( context.Context, , , ,  string) error {
	const  = "could not delete policy"

	,  := .GetRequestWithBearerAuth(, ).
		Delete(.getAdminRealmURL(, "clients", , "authz", "resource-server", "policy", ))

	return checkForError(, , )
}

// GetAuthorizationPolicyAssociatedPolicies returns a client's associated policies of specific policy with the given policy id, using access token from admin
func ( *GoCloak) ( context.Context, , , ,  string) ([]*PolicyRepresentation, error) {
	const  = "could not get policy associated policies"

	var  []*PolicyRepresentation
	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		Get(.getAdminRealmURL(, "clients", , "authz", "resource-server", "policy", , "associatedPolicies"))

	if  := checkForError(, , );  != nil {
		return nil, 
	}

	return , nil
}

// GetAuthorizationPolicyResources returns a client's resources of specific policy with the given policy id, using access token from admin
func ( *GoCloak) ( context.Context, , , ,  string) ([]*PolicyResourceRepresentation, error) {
	const  = "could not get policy resources"

	var  []*PolicyResourceRepresentation
	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		Get(.getAdminRealmURL(, "clients", , "authz", "resource-server", "policy", , "resources"))

	if  := checkForError(, , );  != nil {
		return nil, 
	}

	return , nil
}

// GetAuthorizationPolicyScopes returns a client's scopes of specific policy with the given policy id, using access token from admin
func ( *GoCloak) ( context.Context, , , ,  string) ([]*PolicyScopeRepresentation, error) {
	const  = "could not get policy scopes"

	var  []*PolicyScopeRepresentation
	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		Get(.getAdminRealmURL(, "clients", , "authz", "resource-server", "policy", , "scopes"))

	if  := checkForError(, , );  != nil {
		return nil, 
	}

	return , nil
}

// GetResourcePolicy updates a permission for a specific resource, using token obtained by Resource Owner Password Credentials Grant or Token exchange
func ( *GoCloak) ( context.Context, , ,  string) (*ResourcePolicyRepresentation, error) {
	const  = "could not get resource policy"

	var  ResourcePolicyRepresentation
	,  := .GetRequestWithBearerAuthNoCache(, ).
		SetResult(&).
		Get(.getRealmURL(, "authz", "protection", "uma-policy", ))

	if  := checkForError(, , );  != nil {
		return nil, 
	}

	return &, nil
}

// GetResourcePolicies returns resources associated with the client, using token obtained by Resource Owner Password Credentials Grant or Token exchange
func ( *GoCloak) ( context.Context, ,  string,  GetResourcePoliciesParams) ([]*ResourcePolicyRepresentation, error) {
	const  = "could not get resource policies"

	,  := GetQueryParams()
	if  != nil {
		return nil, 
	}

	var  []*ResourcePolicyRepresentation
	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		SetQueryParams().
		Get(.getRealmURL(, "authz", "protection", "uma-policy"))

	if  := checkForError(, , );  != nil {
		return nil, 
	}

	return , nil
}

// CreateResourcePolicy associates a permission with a specific resource, using token obtained by Resource Owner Password Credentials Grant or Token exchange
func ( *GoCloak) ( context.Context, , ,  string,  ResourcePolicyRepresentation) (*ResourcePolicyRepresentation, error) {
	const  = "could not create resource policy"

	var  ResourcePolicyRepresentation
	,  := .GetRequestWithBearerAuthNoCache(, ).
		SetResult(&).
		SetBody().
		Post(.getRealmURL(, "authz", "protection", "uma-policy", ))

	if  := checkForError(, , );  != nil {
		return nil, 
	}

	return &, nil
}

// UpdateResourcePolicy updates a permission for a specific resource, using token obtained by Resource Owner Password Credentials Grant or Token exchange
func ( *GoCloak) ( context.Context, , ,  string,  ResourcePolicyRepresentation) error {
	const  = "could not update resource policy"

	,  := .GetRequestWithBearerAuthNoCache(, ).
		SetBody().
		Put(.getRealmURL(, "authz", "protection", "uma-policy", ))

	return checkForError(, , )
}

// DeleteResourcePolicy deletes a permission for a specific resource, using token obtained by Resource Owner Password Credentials Grant or Token exchange
func ( *GoCloak) ( context.Context, , ,  string) error {
	const  = "could not  delete resource policy"

	,  := .GetRequestWithBearerAuth(, ).
		Delete(.getRealmURL(, "authz", "protection", "uma-policy", ))

	return checkForError(, , )
}

// GetPermission returns a client's permission with the given id
func ( *GoCloak) ( context.Context, , , ,  string) (*PermissionRepresentation, error) {
	const  = "could not get permission"

	var  PermissionRepresentation
	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		Get(.getAdminRealmURL(, "clients", , "authz", "resource-server", "permission", ))

	if  := checkForError(, , );  != nil {
		return nil, 
	}

	return &, nil
}

// GetDependentPermissions returns a client's permission with the given policy id
func ( *GoCloak) ( context.Context, , , ,  string) ([]*PermissionRepresentation, error) {
	const  = "could not get permission"

	var  []*PermissionRepresentation
	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		Get(.getAdminRealmURL(, "clients", , "authz", "resource-server", "policy", , "dependentPolicies"))

	if  := checkForError(, , );  != nil {
		return nil, 
	}

	return , nil
}

// GetPermissionResources returns a client's resource attached for the given permission id
func ( *GoCloak) ( context.Context, , , ,  string) ([]*PermissionResource, error) {
	const  = "could not get permission resource"

	var  []*PermissionResource
	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		Get(.getAdminRealmURL(, "clients", , "authz", "resource-server", "permission", , "resources"))

	if  := checkForError(, , );  != nil {
		return nil, 
	}

	return , nil
}

// GetPermissionScopes returns a client's scopes configured for the given permission id
func ( *GoCloak) ( context.Context, , , ,  string) ([]*PermissionScope, error) {
	const  = "could not get permission scopes"

	var  []*PermissionScope
	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		Get(.getAdminRealmURL(, "clients", , "authz", "resource-server", "permission", , "scopes"))

	if  := checkForError(, , );  != nil {
		return nil, 
	}

	return , nil
}

// GetPermissions returns permissions associated with the client
func ( *GoCloak) ( context.Context, , ,  string,  GetPermissionParams) ([]*PermissionRepresentation, error) {
	const  = "could not get permissions"

	,  := GetQueryParams()
	if  != nil {
		return nil, errors.Wrap(, )
	}

	 := []string{"clients", , "authz", "resource-server", "permission"}
	if !NilOrEmpty(.Type) {
		 = append(, *.Type)
	}

	var  []*PermissionRepresentation
	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		SetQueryParams().
		Get(.getAdminRealmURL(, ...))

	if  := checkForError(, , );  != nil {
		return nil, 
	}

	return , nil
}

// checkPermissionTicketParams checks that mandatory fields are present
func checkPermissionTicketParams( []CreatePermissionTicketParams) error {
	if len() == 0 {
		return errors.New("at least one permission ticket must be requested")
	}

	for ,  := range  {

		if NilOrEmpty(.ResourceID) {
			return errors.New("resourceID required for permission ticket")
		}
		if NilOrEmptyArray(.ResourceScopes) {
			return errors.New("at least one resourceScope required for permission ticket")
		}
	}

	return nil
}

// CreatePermissionTicket creates a permission ticket, using access token from client
func ( *GoCloak) ( context.Context, ,  string,  []CreatePermissionTicketParams) (*PermissionTicketResponseRepresentation, error) {
	const  = "could not create permission ticket"

	 := checkPermissionTicketParams()
	if  != nil {
		return nil, 
	}

	var  PermissionTicketResponseRepresentation
	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		SetBody().
		Post(.getRealmURL(, "authz", "protection", "permission"))

	if  := checkForError(, , );  != nil {
		return nil, 
	}

	return &, nil
}

// checkPermissionGrantParams checks for mandatory fields
func checkPermissionGrantParams( PermissionGrantParams) error {
	if NilOrEmpty(.RequesterID) {
		return errors.New("requesterID required to grant user permission")
	}
	if NilOrEmpty(.ResourceID) {
		return errors.New("resourceID required to grant user permission")
	}
	if NilOrEmpty(.ScopeName) {
		return errors.New("scopeName required to grant user permission")
	}

	return nil
}

// GrantUserPermission lets resource owner grant permission for specific resource ID to specific user ID
func ( *GoCloak) ( context.Context, ,  string,  PermissionGrantParams) (*PermissionGrantResponseRepresentation, error) {
	const  = "could not grant user permission"

	 := checkPermissionGrantParams()
	if  != nil {
		return nil, 
	}

	.Granted = BoolP(true)

	var  PermissionGrantResponseRepresentation

	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		SetBody().
		Post(.getRealmURL(, "authz", "protection", "permission", "ticket"))

	if  := checkForError(, , );  != nil {
		return nil, 
	}

	return &, nil
}

// checkPermissionUpdateParams
func checkPermissionUpdateParams( PermissionGrantParams) error {
	 := checkPermissionGrantParams()
	if  != nil {
		return 
	}

	if .Granted == nil {
		return errors.New("granted required to update user permission")
	}
	return nil
}

// UpdateUserPermission updates user permissions.
func ( *GoCloak) ( context.Context, ,  string,  PermissionGrantParams) (*PermissionGrantResponseRepresentation, error) {
	const  = "could not update user permission"

	 := checkPermissionUpdateParams()
	if  != nil {
		return nil, 
	}

	var  PermissionGrantResponseRepresentation

	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		SetBody().
		Put(.getRealmURL(, "authz", "protection", "permission", "ticket"))

	if  := checkForError(, , );  != nil {
		return nil, 
	}

	if .StatusCode() == http.StatusNoContent { // permission updated to 'not granted' removes permission
		return nil, nil
	}

	return &, nil
}

// GetUserPermissions gets granted permissions according query parameters
func ( *GoCloak) ( context.Context, ,  string,  GetUserPermissionParams) ([]*PermissionGrantResponseRepresentation, error) {
	const  = "could not get user permissions"

	,  := GetQueryParams()
	if  != nil {
		return nil, 
	}

	var  []*PermissionGrantResponseRepresentation
	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		SetQueryParams().
		Get(.getRealmURL(, "authz", "protection", "permission", "ticket"))

	if  := checkForError(, , );  != nil {
		return nil, 
	}

	return , nil
}

// DeleteUserPermission revokes permissions according query parameters
func ( *GoCloak) ( context.Context, , ,  string) error {
	const  = "could not delete user permission"

	,  := .GetRequestWithBearerAuth(, ).
		Delete(.getRealmURL(, "authz", "protection", "permission", "ticket", ))

	return checkForError(, , )
}

// CreatePermission creates a permission associated with the client
func ( *GoCloak) ( context.Context, , ,  string,  PermissionRepresentation) (*PermissionRepresentation, error) {
	const  = "could not create permission"

	if NilOrEmpty(.Type) {
		return nil, errors.New("type of a permission required")
	}

	var  PermissionRepresentation
	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		SetBody().
		Post(.getAdminRealmURL(, "clients", , "authz", "resource-server", "permission", *(.Type)))

	if  := checkForError(, , );  != nil {
		return nil, 
	}

	return &, nil
}

// UpdatePermission updates a permission associated with the client
func ( *GoCloak) ( context.Context, , ,  string,  PermissionRepresentation) error {
	const  = "could not update permission"

	if NilOrEmpty(.ID) {
		return errors.New("ID of a permission required")
	}
	,  := .GetRequestWithBearerAuth(, ).
		SetBody().
		Put(.getAdminRealmURL(, "clients", , "authz", "resource-server", "permission", *.Type, *.ID))

	return checkForError(, , )
}

// DeletePermission deletes a policy associated with the client
func ( *GoCloak) ( context.Context, , , ,  string) error {
	const  = "could not delete permission"

	,  := .GetRequestWithBearerAuth(, ).
		Delete(.getAdminRealmURL(, "clients", , "authz", "resource-server", "permission", ))

	return checkForError(, , )
}

// ---------------
// Credentials API
// ---------------

// GetCredentialRegistrators returns credentials registrators
func ( *GoCloak) ( context.Context, ,  string) ([]string, error) {
	const  = "could not get user credential registrators"

	var  []string
	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		Get(.getAdminRealmURL(, "credential-registrators"))

	if  := checkForError(, , );  != nil {
		return nil, 
	}

	return , nil
}

// GetConfiguredUserStorageCredentialTypes returns credential types, which are provided by the user storage where user is stored
func ( *GoCloak) ( context.Context, , ,  string) ([]string, error) {
	const  = "could not get user credential registrators"

	var  []string
	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		Get(.getAdminRealmURL(, "users", , "configured-user-storage-credential-types"))

	if  := checkForError(, , );  != nil {
		return nil, 
	}

	return , nil
}

// GetCredentials returns credentials available for a given user
func ( *GoCloak) ( context.Context, , ,  string) ([]*CredentialRepresentation, error) {
	const  = "could not get user credentials"

	var  []*CredentialRepresentation
	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		Get(.getAdminRealmURL(, "users", , "credentials"))

	if  := checkForError(, , );  != nil {
		return nil, 
	}

	return , nil
}

// DeleteCredentials deletes the given credential for a given user
func ( *GoCloak) ( context.Context, , , ,  string) error {
	const  = "could not delete user credentials"

	,  := .GetRequestWithBearerAuth(, ).
		Delete(.getAdminRealmURL(, "users", , "credentials", ))

	return checkForError(, , )
}

// UpdateCredentialUserLabel updates label for the given credential for the given user
func ( *GoCloak) ( context.Context, , , , ,  string) error {
	const  = "could not update credential label for a user"

	,  := .GetRequestWithBearerAuth(, ).
		SetHeader("Content-Type", "text/plain").
		SetBody().
		Put(.getAdminRealmURL(, "users", , "credentials", , "userLabel"))

	return checkForError(, , )
}

// DisableAllCredentialsByType disables all credentials for a user of a specific type
func ( *GoCloak) ( context.Context, , ,  string,  []string) error {
	const  = "could not update disable credentials"

	,  := .GetRequestWithBearerAuth(, ).
		SetBody().
		Put(.getAdminRealmURL(, "users", , "disable-credential-types"))

	return checkForError(, , )
}

// MoveCredentialBehind move a credential to a position behind another credential
func ( *GoCloak) ( context.Context, , , , ,  string) error {
	const  = "could not move credential"

	,  := .GetRequestWithBearerAuth(, ).
		Post(.getAdminRealmURL(, "users", , "credentials", , "moveAfter", ))

	return checkForError(, , )
}

// MoveCredentialToFirst move a credential to a first position in the credentials list of the user
func ( *GoCloak) ( context.Context, , , ,  string) error {
	const  = "could not move credential"

	,  := .GetRequestWithBearerAuth(, ).
		Post(.getAdminRealmURL(, "users", , "credentials", , "moveToFirst"))

	return checkForError(, , )
}

// GetEvents returns events
func ( *GoCloak) ( context.Context,  string,  string,  GetEventsParams) ([]*EventRepresentation, error) {
	const  = "could not get events"

	,  := GetQueryParams()
	if  != nil {
		return nil, errors.Wrap(, )
	}

	var  []*EventRepresentation
	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		SetQueryParams().
		Get(.getAdminRealmURL(, "events"))

	if  := checkForError(, , );  != nil {
		return nil, 
	}

	return , nil
}

// GetClientScopesScopeMappingsRealmRolesAvailable returns realm-level roles that are available to attach to this client scope
func ( *GoCloak) ( context.Context, , ,  string) ([]*Role, error) {
	const  = "could not get available realm-level roles with the client-scope"

	var  []*Role

	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		Get(.getAdminRealmURL(, "client-scopes", , "scope-mappings", "realm", "available"))

	if  := checkForError(, , );  != nil {
		return nil, 
	}

	return , nil
}

// GetClientScopesScopeMappingsRealmRoles returns roles associated with a client-scope
func ( *GoCloak) ( context.Context, , ,  string) ([]*Role, error) {
	const  = "could not get realm-level roles with the client-scope"

	var  []*Role

	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		Get(.getAdminRealmURL(, "client-scopes", , "scope-mappings", "realm"))

	if  := checkForError(, , );  != nil {
		return nil, 
	}

	return , nil
}

// DeleteClientScopesScopeMappingsRealmRoles deletes realm-level roles from the client-scope
func ( *GoCloak) ( context.Context, , ,  string,  []Role) error {
	const  = "could not delete realm-level roles from the client-scope"

	,  := .GetRequestWithBearerAuth(, ).
		SetBody().
		Delete(.getAdminRealmURL(, "client-scopes", , "scope-mappings", "realm"))

	return checkForError(, , )
}

// CreateClientScopesScopeMappingsRealmRoles creates realm-level roles to the client scope
func ( *GoCloak) ( context.Context, , ,  string,  []Role) error {
	const  = "could not create realm-level roles to the client-scope"

	,  := .GetRequestWithBearerAuth(, ).
		SetBody().
		Post(.getAdminRealmURL(, "client-scopes", , "scope-mappings", "realm"))

	return checkForError(, , )
}

// RegisterRequiredAction creates a required action for a given realm
func ( *GoCloak) ( context.Context,  string,  string,  RequiredActionProviderRepresentation) error {
	const  = "could not create required action"

	,  := .GetRequestWithBearerAuth(, ).
		SetBody().
		Post(.getAdminRealmURL(, "authentication", "register-required-action"))

	if  := checkForError(, , );  != nil {
		return 
	}

	return 
}

// GetRequiredActions gets a list of required actions for a given realm
func ( *GoCloak) ( context.Context,  string,  string) ([]*RequiredActionProviderRepresentation, error) {
	const  = "could not get required actions"
	var  []*RequiredActionProviderRepresentation

	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		Get(.getAdminRealmURL(, "authentication", "required-actions"))

	if  := checkForError(, , );  != nil {
		return nil, 
	}

	return , 
}

// GetRequiredAction gets a required action for a given realm
func ( *GoCloak) ( context.Context,  string,  string,  string) (*RequiredActionProviderRepresentation, error) {
	const  = "could not get required action"
	var  RequiredActionProviderRepresentation

	if  == "" {
		return nil, errors.New("alias is required for getting a required action")
	}

	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		Get(.getAdminRealmURL(, "authentication", "required-actions", ))

	if  := checkForError(, , );  != nil {
		return nil, 
	}

	return &, 
}

// UpdateRequiredAction updates a required action for a given realm
func ( *GoCloak) ( context.Context,  string,  string,  RequiredActionProviderRepresentation) error {
	const  = "could not update required action"

	if NilOrEmpty(.ProviderID) {
		return errors.New("providerId is required for updating a required action")
	}
	,  := .GetRequestWithBearerAuth(, ).
		SetBody().
		Put(.getAdminRealmURL(, "authentication", "required-actions", *.ProviderID))

	return checkForError(, , )
}

// DeleteRequiredAction updates a required action for a given realm
func ( *GoCloak) ( context.Context,  string,  string,  string) error {
	const  = "could not delete required action"

	if  == "" {
		return errors.New("alias is required for deleting a required action")
	}
	,  := .GetRequestWithBearerAuth(, ).
		Delete(.getAdminRealmURL(, "authentication", "required-actions", ))

	if  := checkForError(, , );  != nil {
		return 
	}

	return 
}

// CreateClientScopesScopeMappingsClientRoles attaches a client role to a client scope (not client's scope)
func ( *GoCloak) (
	 context.Context, , , ,  string,  []Role,
) error {
	const  = "could not create client-level roles to the client-scope"

	,  := .GetRequestWithBearerAuth(, ).
		SetBody().
		Post(.getAdminRealmURL(, "client-scopes", , "scope-mappings", "clients", ))

	return checkForError(, , )
}

// GetClientScopesScopeMappingsClientRolesAvailable returns available (i.e. not attached via
// CreateClientScopesScopeMappingsClientRoles) client roles for a specific client, for a client scope
// (not client's scope).
func ( *GoCloak) ( context.Context, , , ,  string) ([]*Role, error) {
	const  = "could not get available client-level roles with the client-scope"

	var  []*Role

	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		Get(.getAdminRealmURL(, "client-scopes", , "scope-mappings", "clients", , "available"))

	if  := checkForError(, , );  != nil {
		return nil, 
	}

	return , nil
}

// GetClientScopesScopeMappingsClientRoles returns attached client roles for a specific client, for a client scope
// (not client's scope).
func ( *GoCloak) ( context.Context, , , ,  string) ([]*Role, error) {
	const  = "could not get client-level roles with the client-scope"

	var  []*Role

	,  := .GetRequestWithBearerAuth(, ).
		SetResult(&).
		Get(.getAdminRealmURL(, "client-scopes", , "scope-mappings", "clients", ))

	if  := checkForError(, , );  != nil {
		return nil, 
	}

	return , nil
}

// DeleteClientScopesScopeMappingsClientRoles removes attachment of client roles from a client scope
// (not client's scope).
func ( *GoCloak) ( context.Context, , , ,  string,  []Role) error {
	const  = "could not delete client-level roles from the client-scope"

	,  := .GetRequestWithBearerAuth(, ).
		SetBody().
		Delete(.getAdminRealmURL(, "client-scopes", , "scope-mappings", "clients", ))

	return checkForError(, , )
}

// RevokeToken revokes the passed token. The token can either be an access or refresh token.
func ( *GoCloak) ( context.Context, , , ,  string) error {
	const  = "could not revoke token"

	,  := .GetRequestWithBasicAuth(, , ).
		SetFormData(map[string]string{
			"client_id":     ,
			"client_secret": ,
			"token":         ,
		}).
		Post(.getRealmURL(, .Config.revokeEndpoint))

	return checkForError(, , )
}