From d6d3d88a05f728400c868acfc6436ae47be83115 Mon Sep 17 00:00:00 2001
From: vimukthiRajapaksha <reachvimukthi@gmail.com>
Date: Thu, 14 Nov 2024 09:32:45 +0530
Subject: [PATCH] Add integration tests to cover RAR functionalities

---
 .../src/main/webapp/WEB-INF/beans.xml         |   1 +
 modules/distribution/pom.xml                  |   4 +
 modules/distribution/src/assembly/bin.xml     |   7 +
 ...thorizationRequestsGrantTypesTestCase.java | 833 ++++++++++++++++++
 ...uth2RichAuthorizationRequestsTestCase.java | 250 ++++++
 .../v1/model/APIResourcePatchModel.java       | 246 ++++++
 .../v1/model/APIResourceResponse.java         |  26 +
 .../v1/model/AuthorizationDetailsType.java    | 202 +++++
 .../v1/model/AuthorizedAPICreationModel.java  |  25 +-
 .../v1/model/AuthorizedAPIPatchModel.java     | 200 +++++
 .../v1/model/AuthorizedAPIResponse.java       |  44 +-
 .../test/restclients/OAuth2RestClient.java    | 238 +++++
 .../test/utils/OAuth2Constant.java            |   1 +
 .../utils/RichAuthorizationRequestsUtils.java | 162 ++++
 .../src/test/resources/testng.xml             |   2 +
 pom.xml                                       |  14 +-
 16 files changed, 2249 insertions(+), 6 deletions(-)
 create mode 100644 modules/integration/tests-integration/tests-backend/src/test/java/org/wso2/identity/integration/test/oauth2/OAuth2RichAuthorizationRequestsGrantTypesTestCase.java
 create mode 100644 modules/integration/tests-integration/tests-backend/src/test/java/org/wso2/identity/integration/test/oauth2/OAuth2RichAuthorizationRequestsTestCase.java
 create mode 100644 modules/integration/tests-integration/tests-backend/src/test/java/org/wso2/identity/integration/test/rest/api/server/api/resource/v1/model/APIResourcePatchModel.java
 create mode 100644 modules/integration/tests-integration/tests-backend/src/test/java/org/wso2/identity/integration/test/rest/api/server/api/resource/v1/model/AuthorizationDetailsType.java
 create mode 100644 modules/integration/tests-integration/tests-backend/src/test/java/org/wso2/identity/integration/test/rest/api/server/application/management/v1/model/AuthorizedAPIPatchModel.java
 create mode 100644 modules/integration/tests-integration/tests-backend/src/test/java/org/wso2/identity/integration/test/utils/RichAuthorizationRequestsUtils.java

diff --git a/modules/api-resources/api-resources-full/src/main/webapp/WEB-INF/beans.xml b/modules/api-resources/api-resources-full/src/main/webapp/WEB-INF/beans.xml
index d0a76acd922..66efce94cb2 100644
--- a/modules/api-resources/api-resources-full/src/main/webapp/WEB-INF/beans.xml
+++ b/modules/api-resources/api-resources-full/src/main/webapp/WEB-INF/beans.xml
@@ -147,6 +147,7 @@
             <bean class="org.wso2.carbon.identity.api.server.organization.selfservice.v1.SelfServiceApi"/>
             <bean class="org.wso2.carbon.identity.api.server.api.resource.v1.MetaApi"/>
             <bean class="org.wso2.carbon.identity.api.server.action.management.v1.ActionsApi"/>
+            <bean class="org.wso2.carbon.identity.api.server.api.resource.v1.AuthorizationDetailsTypesApi"/>
         </jaxrs:serviceBeans>
         <jaxrs:providers>
             <bean class="com.fasterxml.jackson.jaxrs.json.JacksonJsonProvider">
diff --git a/modules/distribution/pom.xml b/modules/distribution/pom.xml
index a7d623a3773..71dce3b4c36 100755
--- a/modules/distribution/pom.xml
+++ b/modules/distribution/pom.xml
@@ -58,6 +58,10 @@
             <groupId>org.slf4j</groupId>
             <artifactId>slf4j-simple</artifactId>
         </dependency>
+        <dependency>
+            <groupId>io.vertx</groupId>
+            <artifactId>vertx-json-schema</artifactId>
+        </dependency>
         <!--
               dependency> <groupId>org.wso2.carbon</groupId>
               <artifactId>com.wso2.carbon.multitenancy.tenant.mgt</artifactId>
diff --git a/modules/distribution/src/assembly/bin.xml b/modules/distribution/src/assembly/bin.xml
index 65218c78949..bc82aae590d 100644
--- a/modules/distribution/src/assembly/bin.xml
+++ b/modules/distribution/src/assembly/bin.xml
@@ -1111,6 +1111,13 @@
             <outputDirectory>${pom.artifactId}-${pom.version}/lib/</outputDirectory>
             <includes>
                 <include>org.slf4j:slf4j-simple</include>
+                <include>io.netty:netty-handler</include>
+                <include>io.netty:netty-common</include>
+                <include>io.netty:netty-buffer</include>
+                <include>io.netty:netty-transport</include>
+                <include>io.netty:netty-resolver</include>
+                <include>io.vertx:vertx-core</include>
+                <include>io.vertx:vertx-json-schema</include>
             </includes>
         </dependencySet>
     </dependencySets>
diff --git a/modules/integration/tests-integration/tests-backend/src/test/java/org/wso2/identity/integration/test/oauth2/OAuth2RichAuthorizationRequestsGrantTypesTestCase.java b/modules/integration/tests-integration/tests-backend/src/test/java/org/wso2/identity/integration/test/oauth2/OAuth2RichAuthorizationRequestsGrantTypesTestCase.java
new file mode 100644
index 00000000000..76a95f962f7
--- /dev/null
+++ b/modules/integration/tests-integration/tests-backend/src/test/java/org/wso2/identity/integration/test/oauth2/OAuth2RichAuthorizationRequestsGrantTypesTestCase.java
@@ -0,0 +1,833 @@
+/*
+ * Copyright (c) 2024, WSO2 Inc. (http://www.wso2.org) All Rights Reserved.
+ *
+ * WSO2 Inc. licenses this file to you under the Apache License,
+ * Version 2.0 (the "License"); you may not use this file except
+ * in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.wso2.identity.integration.test.oauth2;
+
+import org.apache.commons.lang3.StringUtils;
+import org.apache.http.Header;
+import org.apache.http.HttpResponse;
+import org.apache.http.NameValuePair;
+import org.apache.http.client.HttpClient;
+import org.apache.http.client.config.CookieSpecs;
+import org.apache.http.client.config.RequestConfig;
+import org.apache.http.client.entity.UrlEncodedFormEntity;
+import org.apache.http.client.methods.HttpPost;
+import org.apache.http.config.RegistryBuilder;
+import org.apache.http.cookie.CookieSpecProvider;
+import org.apache.http.impl.client.CloseableHttpClient;
+import org.apache.http.impl.client.HttpClientBuilder;
+import org.apache.http.impl.cookie.RFC6265CookieSpecProvider;
+import org.apache.http.message.BasicNameValuePair;
+import org.apache.http.util.EntityUtils;
+import org.json.JSONArray;
+import org.json.JSONException;
+import org.json.JSONObject;
+import org.testng.annotations.AfterClass;
+import org.testng.annotations.BeforeClass;
+import org.testng.annotations.DataProvider;
+import org.testng.annotations.Test;
+import org.wso2.carbon.automation.engine.context.TestUserMode;
+import org.wso2.identity.integration.test.rest.api.server.application.management.v1.model.AccessTokenConfiguration;
+import org.wso2.identity.integration.test.rest.api.server.application.management.v1.model.ApplicationModel;
+import org.wso2.identity.integration.test.rest.api.server.application.management.v1.model.AuthorizedAPICreationModel;
+import org.wso2.identity.integration.test.rest.api.server.application.management.v1.model.HybridFlowConfiguration;
+import org.wso2.identity.integration.test.rest.api.server.application.management.v1.model.InboundProtocols;
+import org.wso2.identity.integration.test.rest.api.server.application.management.v1.model.OpenIDConnectConfiguration;
+import org.wso2.identity.integration.test.rest.api.user.common.model.Email;
+import org.wso2.identity.integration.test.rest.api.user.common.model.ListObject;
+import org.wso2.identity.integration.test.rest.api.user.common.model.PatchOperationRequestObject;
+import org.wso2.identity.integration.test.rest.api.user.common.model.RoleItemAddGroupobj;
+import org.wso2.identity.integration.test.rest.api.user.common.model.UserObject;
+import org.wso2.identity.integration.test.restclients.SCIM2RestClient;
+import org.wso2.identity.integration.test.utils.DataExtractUtil;
+import org.wso2.identity.integration.test.utils.OAuth2Constant;
+
+import java.io.IOException;
+import java.io.UnsupportedEncodingException;
+import java.lang.reflect.Method;
+import java.net.URLDecoder;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.Base64;
+import java.util.Collections;
+import java.util.List;
+import java.util.UUID;
+
+import javax.servlet.http.HttpServletResponse;
+
+import static java.nio.charset.StandardCharsets.UTF_8;
+import static org.testng.Assert.assertEquals;
+import static org.testng.Assert.assertNotNull;
+import static org.testng.Assert.assertTrue;
+import static org.wso2.identity.integration.test.utils.OAuth2Constant.COMMON_AUTH_URL;
+import static org.wso2.identity.integration.test.utils.OAuth2Constant.OAUTH2_SCOPE_OPENID_WITH_INTERNAL_LOGIN;
+import static org.wso2.identity.integration.test.utils.RichAuthorizationRequestsUtils.ERROR;
+import static org.wso2.identity.integration.test.utils.RichAuthorizationRequestsUtils.INVALID_AUTHORIZATION_DETAILS;
+import static org.wso2.identity.integration.test.utils.RichAuthorizationRequestsUtils.TEST_TYPE_1;
+import static org.wso2.identity.integration.test.utils.RichAuthorizationRequestsUtils.TEST_TYPE_2;
+import static org.wso2.identity.integration.test.utils.RichAuthorizationRequestsUtils.TEST_TYPE_3;
+import static org.wso2.identity.integration.test.utils.RichAuthorizationRequestsUtils.createTestAPIResource;
+import static org.wso2.identity.integration.test.utils.RichAuthorizationRequestsUtils.getDoubleTestAuthorizationDetails;
+import static org.wso2.identity.integration.test.utils.RichAuthorizationRequestsUtils.getInvalidAuthorizationDetails;
+import static org.wso2.identity.integration.test.utils.RichAuthorizationRequestsUtils.getSingleTestAuthorizationDetail;
+import static org.wso2.identity.integration.test.utils.RichAuthorizationRequestsUtils.getTestAuthorizationDetailsType;
+import static org.wso2.identity.integration.test.utils.RichAuthorizationRequestsUtils.getTripleTestAuthorizationDetails;
+import static org.wso2.identity.integration.test.utils.RichAuthorizationRequestsUtils.getUnknownAuthorizationDetails;
+import static org.wso2.identity.integration.test.utils.RichAuthorizationRequestsUtils.isRequestTypesMatchResponseTypes;
+
+/**
+ * Integration test class for testing the OAuth2 grant flows with authorization details.
+ */
+public class OAuth2RichAuthorizationRequestsGrantTypesTestCase extends OAuth2ServiceAbstractIntegrationTest {
+
+    private static final String USERS_PATH = "users";
+    private static final String USER_EMAIL = "rar_user@wso2.com";
+    private static final String USERNAME = "richAuthorizationRequestsUser";
+    private static final String PASSWORD = "Pass@123";
+    private static final String RESPONSE_TYPE_CODE_ID_TOKEN_TOKEN = "code id_token token";
+
+    private CloseableHttpClient client;
+    private SCIM2RestClient scim2RestClient;
+    private OpenIDConnectConfiguration opaqueOidcConfig;
+    private OpenIDConnectConfiguration jwtOidcConfig;
+    private String opaqueAppId;
+    private String jwtAppId;
+    private String apiResourceId;
+
+    @BeforeClass(alwaysRun = true)
+    public void testInit() throws Exception {
+
+        super.init(TestUserMode.SUPER_TENANT_USER);
+        super.setSystemproperties();
+        this.scim2RestClient = new SCIM2RestClient(super.serverURL, super.tenantInfo);
+        this.client = HttpClientBuilder.create()
+                .disableRedirectHandling()
+                .setDefaultRequestConfig(RequestConfig.custom()
+                        .setCookieSpec(CookieSpecs.DEFAULT)
+                        .build())
+                .setDefaultCookieSpecRegistry(RegistryBuilder.<CookieSpecProvider>create()
+                        .register(CookieSpecs.DEFAULT, new RFC6265CookieSpecProvider())
+                        .build())
+                .build();
+
+        this.opaqueAppId = super.addApplication(this.getApplicationWithOpaqueTokens());
+        this.jwtAppId = super.addApplication(this.getApplicationWithJWTTokens());
+        assertNotNull(this.opaqueAppId, "OAuth App creation failed");
+        assertNotNull(this.jwtAppId, "OAuth App creation failed");
+
+        this.opaqueOidcConfig = super.restClient.getOIDCInboundDetails(this.opaqueAppId);
+        this.jwtOidcConfig = super.restClient.getOIDCInboundDetails(this.jwtAppId);
+        assertNotNull(this.opaqueOidcConfig, "Application creation failed.");
+        assertNotNull(this.jwtOidcConfig, "Application creation failed.");
+
+        this.apiResourceId = createTestAPIResourceWithThreeTypes();
+        this.addAPIAuthorization(this.apiResourceId, this.opaqueAppId);
+        this.addAPIAuthorization(this.apiResourceId, this.jwtAppId);
+        this.addRARUser();
+    }
+
+    @AfterClass(alwaysRun = true)
+    public void atEnd() throws Exception {
+
+        super.restClient.deleteAPIResource(this.apiResourceId);
+        super.deleteApp(this.opaqueAppId);
+        super.deleteApp(this.jwtAppId);
+        super.restClient.closeHttpClient();
+        this.scim2RestClient.closeHttpClient();
+        this.client.close();
+    }
+
+    private Asserter buildOpaqueTokenAsserter(JSONArray expectedAuthorizationDetails, String expectedScopes) {
+
+        return new OpaqueTokenAsserter(this.opaqueOidcConfig.getClientId(), this.opaqueOidcConfig.getClientSecret(),
+                expectedAuthorizationDetails, expectedScopes);
+    }
+
+    private Asserter buildJwtTokenAsserter(JSONArray expectedAuthorizationDetails, String expectedScopes) {
+
+        return new JwtTokenAsserter(this.jwtOidcConfig.getClientId(), this.jwtOidcConfig.getClientSecret(),
+                expectedAuthorizationDetails, expectedScopes);
+    }
+
+    @DataProvider(name = "authorizationDetailsProvider")
+    public Object[][] authorizationDetailsProvider(Method testMethod) throws JSONException {
+
+        switch (testMethod.getName()) {
+            case "testAuthorizationCodeGrantFlowWithAuthorizationDetails":
+            case "testAccessTokenRequestWithoutAuthorizationDetails":
+            case "testClientCredentialsGrantFlowWithAuthorizationDetails":
+            case "testPasswordGrantFlowWithAuthorizationDetails":
+            case "testImplicitGrantFlowWithAuthorizationDetails":
+                return new Object[][]{
+                        {buildOpaqueTokenAsserter(null, OAUTH2_SCOPE_OPENID_WITH_INTERNAL_LOGIN)},
+                        {buildJwtTokenAsserter(null, OAUTH2_SCOPE_OPENID_WITH_INTERNAL_LOGIN)},
+                        {buildOpaqueTokenAsserter(getSingleTestAuthorizationDetail(), null)},
+                        {buildJwtTokenAsserter(getSingleTestAuthorizationDetail(), null)},
+                        {buildOpaqueTokenAsserter(getSingleTestAuthorizationDetail(), OAUTH2_SCOPE_OPENID_WITH_INTERNAL_LOGIN)},
+                        {buildJwtTokenAsserter(getSingleTestAuthorizationDetail(), OAUTH2_SCOPE_OPENID_WITH_INTERNAL_LOGIN)},
+                        {buildOpaqueTokenAsserter(getDoubleTestAuthorizationDetails(), null)},
+                        {buildJwtTokenAsserter(getDoubleTestAuthorizationDetails(), null)},
+                        {buildOpaqueTokenAsserter(getDoubleTestAuthorizationDetails(), OAUTH2_SCOPE_OPENID_WITH_INTERNAL_LOGIN)},
+                        {buildJwtTokenAsserter(getDoubleTestAuthorizationDetails(), OAUTH2_SCOPE_OPENID_WITH_INTERNAL_LOGIN)}
+                };
+            case "testHybridFlowsWithAuthorizationDetails":
+                return new Object[][]{
+                        {buildOpaqueTokenAsserter(getSingleTestAuthorizationDetail(), OAUTH2_SCOPE_OPENID_WITH_INTERNAL_LOGIN)},
+                        {buildJwtTokenAsserter(getSingleTestAuthorizationDetail(), OAUTH2_SCOPE_OPENID_WITH_INTERNAL_LOGIN)},
+                        {buildOpaqueTokenAsserter(getDoubleTestAuthorizationDetails(), OAUTH2_SCOPE_OPENID_WITH_INTERNAL_LOGIN)},
+                        {buildJwtTokenAsserter(getDoubleTestAuthorizationDetails(), OAUTH2_SCOPE_OPENID_WITH_INTERNAL_LOGIN)}
+                };
+            case "testAuthorizationCodeGrantFlowWithInvalidAuthorizationDetails":
+                return new Object[][]{
+                        {buildOpaqueTokenAsserter(getUnknownAuthorizationDetails(), null)},
+                        {buildJwtTokenAsserter(getUnknownAuthorizationDetails(), null)},
+                        {buildOpaqueTokenAsserter(getUnknownAuthorizationDetails(), OAUTH2_SCOPE_OPENID_WITH_INTERNAL_LOGIN)},
+                        {buildJwtTokenAsserter(getUnknownAuthorizationDetails(), OAUTH2_SCOPE_OPENID_WITH_INTERNAL_LOGIN)},
+                        {buildOpaqueTokenAsserter(getInvalidAuthorizationDetails(), null)},
+                        {buildJwtTokenAsserter(getInvalidAuthorizationDetails(), null)},
+                        {buildOpaqueTokenAsserter(getTripleTestAuthorizationDetails(), null)}
+                };
+        }
+        return null;
+    }
+
+    /**
+     * Tests the authorization code grant flow with authorization details included.
+     * This method performs the following actions:
+     * <ul>
+     *     <li>Sends an authorization request with authorization details for the authorization code grant type.</li>
+     *     <li>Perform access token request with authorization details and validates.</li>
+     *     <li>Refreshes the access token and validates the refreshed token response.</li>
+     *     <li>Introspect the token and validates.</li>
+     *     <li>Revokes the access token at the end of the flow.</li>
+     * </ul>
+     *
+     * @param asserter The assertion utility used for validating responses in the test flow.
+     * @throws Exception If an error occurs during the flow.
+     */
+    @Test(groups = "wso2.is", dataProvider = "authorizationDetailsProvider",
+            description = "Test authorization code grant flow with authorization details")
+    public void testAuthorizationCodeGrantFlowWithAuthorizationDetails(Asserter asserter) throws Exception {
+
+        // sending authorize request with authorization_details parameter
+        final String sessionDataKeyConsent = this.sendAuthCodeGrantAuthRequestPost(getAuthzRequestParams(asserter));
+        final String authorizationCode = this.sendAuthCodeGrantApprovalPost(sessionDataKeyConsent);
+
+        // retrieving a new access token
+        JSONObject tokenResponse =
+                this.sendTokenRequestPost(asserter, this.getAccessTokenRequestParams(asserter, authorizationCode));
+        asserter.assertTokenResponse(tokenResponse);
+
+        // refreshing the access token
+        final String refreshToken = tokenResponse.getString(OAuth2Constant.REFRESH_TOKEN);
+        tokenResponse = this.sendTokenRequestPost(asserter, this.getRefreshTokenRequestParams(asserter, refreshToken));
+        asserter.assertTokenResponse(tokenResponse);
+
+        // revoking the access token
+        final String accessToken = tokenResponse.getString(OAuth2Constant.ACCESS_TOKEN);
+        sendTokenRevokeRequestPost(asserter, accessToken);
+    }
+
+    /**
+     * Tests the authorization code grant flow with authorization details included.
+     * This method performs the following actions:
+     * <ul>
+     *     <li>Sends an authorization request with authorization details for the authorization code grant type.</li>
+     *     <li>Perform access token request without authorization details and validates.</li>
+     *     <li>Refreshes the access token and validates the refreshed token response.</li>
+     *     <li>Introspect the token and validates.</li>
+     *     <li>Revokes the access token at the end of the flow.</li>
+     * </ul>
+     *
+     * @param asserter The assertion utility used for validating responses in the test flow.
+     * @throws Exception If an error occurs during the flow.
+     */
+    @Test(groups = "wso2.is", dataProvider = "authorizationDetailsProvider",
+            description = "Test access token request without authorization details")
+    public void testAccessTokenRequestWithoutAuthorizationDetails(Asserter asserter) throws Exception {
+
+        final List<NameValuePair> authzRequestParams = getAuthzRequestParams(asserter);
+        // sending authorize request with authorization_details parameter
+        final String sessionDataKeyConsent = this.sendAuthCodeGrantAuthRequestPost(authzRequestParams);
+        final String authorizationCode = this.sendAuthCodeGrantApprovalPost(sessionDataKeyConsent);
+
+        // retrieving a new access token
+        JSONObject tokenResponse =
+                this.sendTokenRequestPost(asserter, this.getAccessTokenRequestParams(asserter, authorizationCode));
+        asserter.assertTokenResponse(tokenResponse);
+
+        // refreshing the access token
+        final String refreshToken = tokenResponse.getString(OAuth2Constant.REFRESH_TOKEN);
+        tokenResponse = this.sendTokenRequestPost(asserter, this.getRefreshTokenRequestParams(asserter, refreshToken));
+        asserter.assertTokenResponse(tokenResponse);
+
+        // revoking the access token
+        final String accessToken = tokenResponse.getString(OAuth2Constant.ACCESS_TOKEN);
+        sendTokenRevokeRequestPost(asserter, accessToken);
+    }
+
+    /**
+     * Tests the authorization code grant flow with invalid authorization details included.
+     * This method performs the following actions:
+     * <ul>
+     *     <li>Sends an authorization request with invalid authorization details.</li>
+     *     <li>Assert the error response.</li>
+     * </ul>
+     *
+     * @param asserter The assertion utility used for validating responses in the test flow.
+     * @throws Exception If an error occurs during the flow.
+     */
+    @Test(groups = "wso2.is", dataProvider = "authorizationDetailsProvider",
+            dependsOnMethods = {"testAuthorizationCodeGrantFlowWithAuthorizationDetails"},
+            description = "Test authorization code grant flow with invalid authorization details")
+    public void testAuthorizationCodeGrantFlowWithInvalidAuthorizationDetails(Asserter asserter) throws Exception {
+
+        final HttpResponse response = super.sendPostRequestWithParameters(this.client,
+                this.getAuthzRequestParams(asserter), OAuth2Constant.AUTHORIZE_ENDPOINT_URL);
+        final Header locationHeader = response.getFirstHeader(OAuth2Constant.HTTP_RESPONSE_HEADER_LOCATION);
+
+        assertEquals(DataExtractUtil.getParamFromURIString(locationHeader.getValue(), ERROR),
+                INVALID_AUTHORIZATION_DETAILS);
+    }
+
+    /**
+     * Tests the client credentials grant flow with authorization details included.
+     * This method performs the following actions:
+     * <ul>
+     *     <li>Perform access token request with authorization details and validates.</li>
+     *     <li>Revokes the access token at the end of the flow.</li>
+     * </ul>
+     *
+     * @param asserter The assertion utility used for validating responses in the test flow.
+     * @throws Exception If an error occurs during the flow.
+     */
+    @Test(groups = "wso2.is", dataProvider = "authorizationDetailsProvider",
+            description = "Test client credentials grant flow with authorization details")
+    public void testClientCredentialsGrantFlowWithAuthorizationDetails(Asserter asserter) throws Exception {
+
+        final List<NameValuePair> urlParameters = this.getDefaultNameValuePairs(asserter);
+        urlParameters.add(new BasicNameValuePair(OAuth2Constant.GRANT_TYPE_NAME,
+                OAuth2Constant.OAUTH2_GRANT_TYPE_CLIENT_CREDENTIALS));
+
+        final JSONObject tokenResponse = this.sendTokenRequestPost(asserter, urlParameters);
+        final String accessToken = tokenResponse.optString(OAuth2Constant.ACCESS_TOKEN);
+
+        asserter.assertAccessToken(accessToken);
+        asserter.assertAuthorizationDetails(tokenResponse
+                .optString(OAuth2Constant.OAUTH2_AUTHORIZATION_DETAILS), false);
+        sendTokenRevokeRequestPost(asserter, accessToken);
+    }
+
+    /**
+     * Tests the password grant flow with authorization details included.
+     * This method performs the following actions:
+     * <ul>
+     *     <li>Perform access token request with authorization details and validates.</li>
+     *     <li>Refreshes the access token and validates the refreshed token response.</li>
+     *     <li>Introspect the token and validates.</li>
+     *     <li>Revokes the access token at the end of the flow.</li>
+     * </ul>
+     *
+     * @param asserter The assertion utility used for validating responses in the test flow.
+     * @throws Exception If an error occurs during the flow.
+     */
+    @Test(groups = "wso2.is", dataProvider = "authorizationDetailsProvider",
+            description = "Test password grant flow with authorization details")
+    public void testPasswordGrantFlowWithAuthorizationDetails(Asserter asserter) throws Exception {
+
+        final List<NameValuePair> urlParameters = this.getDefaultNameValuePairs(asserter);
+        urlParameters.add(new BasicNameValuePair("username", USERNAME));
+        urlParameters.add(new BasicNameValuePair("password", PASSWORD));
+        urlParameters.add(new BasicNameValuePair(OAuth2Constant.GRANT_TYPE_NAME,
+                OAuth2Constant.OAUTH2_GRANT_TYPE_RESOURCE_OWNER));
+
+        JSONObject tokenResponse = this.sendTokenRequestPost(asserter, urlParameters);
+        asserter.assertTokenResponse(tokenResponse);
+
+        // refreshing the access token
+        final String refreshToken = tokenResponse.getString(OAuth2Constant.REFRESH_TOKEN);
+        tokenResponse = this.sendTokenRequestPost(asserter, this.getRefreshTokenRequestParams(asserter, refreshToken));
+        asserter.assertTokenResponse(tokenResponse);
+
+        final String accessToken = tokenResponse.getString(OAuth2Constant.ACCESS_TOKEN);
+        sendTokenRevokeRequestPost(asserter, accessToken);
+    }
+
+    /**
+     * Tests the <code>token</code> implicit grant flow with authorization details included.
+     * This method performs the following actions:
+     * <ul>
+     *     <li>Sends an authorization request with authorization details for the implicit grant type.</li>
+     *     <li>Introspect the token and validates.</li>
+     *     <li>Revokes the access token at the end of the flow.</li>
+     * </ul>
+     *
+     * @param asserter The assertion utility used for validating responses in the test flow.
+     * @throws Exception If an error occurs during the flow.
+     */
+    @Test(groups = "wso2.is", dataProvider = "authorizationDetailsProvider",
+            description = "Test implicit grant flow with authorization details")
+    public void testImplicitGrantFlowWithAuthorizationDetails(Asserter asserter) throws Exception {
+
+        final List<NameValuePair> urlParameters = this.getDefaultNameValuePairs(asserter);
+        urlParameters.add(new BasicNameValuePair(OAuth2Constant.OAUTH2_RESPONSE_TYPE,
+                OAuth2Constant.OAUTH2_GRANT_TYPE_IMPLICIT));
+        urlParameters.add(new BasicNameValuePair(OAuth2Constant.OAUTH2_CLIENT_ID, asserter.getClientId()));
+        urlParameters.add(new BasicNameValuePair(OAuth2Constant.OAUTH2_REDIRECT_URI, OAuth2Constant.CALLBACK_URL));
+
+        final String sessionDataKeyConsent = this.sendAuthCodeGrantAuthRequestPost(urlParameters);
+        final HttpResponse response = sendApprovalPost(this.client, sessionDataKeyConsent);
+        final Header locationHeader = response.getFirstHeader(OAuth2Constant.HTTP_RESPONSE_HEADER_LOCATION);
+        final String accessToken = DataExtractUtil.extractParamFromURIFragment(locationHeader.getValue(),
+                OAuth2Constant.ACCESS_TOKEN);
+
+        asserter.assertHttpResponse(response);
+        sendTokenRevokeRequestPost(asserter, accessToken);
+    }
+
+    /**
+     * Tests the <code>code id_token token</code> hybrid flow with authorization details included.
+     * This method performs the following actions:
+     * <ul>
+     *     <li>Sends an authorization request with authorization details for the authorization code grant type.</li>
+     *     <li>Perform access token request without authorization details and validates.</li>
+     *     <li>Refreshes the access token and validates the refreshed token response.</li>
+     *     <li>Introspect the token and validates.</li>
+     *     <li>Revokes the access token at the end of the flow.</li>
+     * </ul>
+     *
+     * @param asserter The assertion utility used for validating responses in the test flow.
+     * @throws Exception If an error occurs during the flow.
+     */
+    @Test(groups = "wso2.is", dataProvider = "authorizationDetailsProvider",
+            description = "Test hybrid flow with authorization details")
+    public void testHybridFlowsWithAuthorizationDetails(Asserter asserter) throws Exception {
+
+        final String sessionDataKeyConsent =
+                this.sendAuthCodeGrantAuthRequestPost(this.getHybridRequestParams(asserter));
+        final HttpResponse response = sendApprovalPost(this.client, sessionDataKeyConsent);
+        final Header locationHeader = response.getFirstHeader(OAuth2Constant.HTTP_RESPONSE_HEADER_LOCATION);
+        final String authorizationCode = DataExtractUtil
+                .extractParamFromURIFragment(locationHeader.getValue(), OAuth2Constant.AUTHORIZATION_CODE_NAME);
+
+        asserter.assertHttpResponse(response);
+
+        JSONObject tokenResponse =
+                this.sendTokenRequestPost(asserter, this.getAccessTokenRequestParams(asserter, authorizationCode));
+        asserter.assertTokenResponse(tokenResponse);
+
+        final String accessToken = tokenResponse.getString(OAuth2Constant.ACCESS_TOKEN);
+        sendTokenRevokeRequestPost(asserter, accessToken);
+    }
+
+    private String createTestAPIResourceWithThreeTypes() throws IOException {
+
+        return createTestAPIResource(super.restClient, Arrays.asList(getTestAuthorizationDetailsType(TEST_TYPE_1),
+                getTestAuthorizationDetailsType(TEST_TYPE_2), getTestAuthorizationDetailsType(TEST_TYPE_3)));
+    }
+
+    private void addAPIAuthorization(final String apiResourceId, final String appId) throws IOException {
+        final AuthorizedAPICreationModel authorizedAPICreationModel = new AuthorizedAPICreationModel();
+        authorizedAPICreationModel.setId(apiResourceId);
+        authorizedAPICreationModel.addAuthorizationDetailsTypesItem(TEST_TYPE_1);
+        authorizedAPICreationModel.addAuthorizationDetailsTypesItem(TEST_TYPE_2);
+
+        final int statusCode = super.restClient.addAPIAuthorizationToApplication(appId, authorizedAPICreationModel);
+        assertEquals(statusCode, HttpServletResponse.SC_OK,
+                "Failed to add API authorization to the application");
+    }
+
+    private void addRARUser() throws Exception {
+
+        UserObject userInfo = new UserObject();
+        userInfo.setUserName(USERNAME);
+        userInfo.setPassword(PASSWORD);
+        userInfo.addEmail(new Email().value(USER_EMAIL));
+
+        final String userId = this.scim2RestClient.createUser(userInfo);
+        String roleId = this.scim2RestClient.getRoleIdByName("admin");
+
+        RoleItemAddGroupobj patchRoleItem = new RoleItemAddGroupobj();
+        patchRoleItem.setOp(RoleItemAddGroupobj.OpEnum.ADD);
+        patchRoleItem.setPath(USERS_PATH);
+        patchRoleItem.addValue(new ListObject().value(userId));
+
+        this.scim2RestClient.updateUserRole(new PatchOperationRequestObject().addOperations(patchRoleItem), roleId);
+    }
+
+    public JSONObject sendTokenRequestPost(Asserter asserter, List<NameValuePair> urlParameters) throws Exception {
+
+        final HttpPost httpPost = getDefaultHttpPost(asserter, OAuth2Constant.ACCESS_TOKEN_ENDPOINT, urlParameters);
+        final HttpResponse response = this.client.execute(httpPost);
+
+        JSONObject tokenResponse = new JSONObject(EntityUtils.toString(response.getEntity(), UTF_8));
+        EntityUtils.consume(response.getEntity());
+        assertNotNull(tokenResponse, "Token response is null");
+
+        return tokenResponse;
+    }
+
+    private void sendTokenRevokeRequestPost(Asserter asserter, String accessToken) throws IOException {
+
+        final List<NameValuePair> urlParameters = new ArrayList<>();
+        urlParameters.add(new BasicNameValuePair("token_type_hint", OAuth2Constant.ACCESS_TOKEN));
+        urlParameters.add(new BasicNameValuePair(OAuth2Constant.OAUTH2_RESPONSE_TYPE_TOKEN, accessToken));
+
+        final HttpPost httpPost = getDefaultHttpPost(asserter, OAuth2Constant.TOKEN_REVOKE_ENDPOINT, urlParameters);
+        final HttpResponse response = this.client.execute(httpPost);
+        assertEquals(response.getStatusLine().getStatusCode(), HttpServletResponse.SC_OK);
+    }
+
+    private HttpPost getDefaultHttpPost(Asserter asserter, String url, List<NameValuePair> urlParameters)
+            throws UnsupportedEncodingException {
+
+        final HttpPost httpPost = new HttpPost(url);
+        httpPost.setHeader(OAuth2Constant.AUTHORIZATION_HEADER, "Basic " +
+                getBase64EncodedString(asserter.getClientId(), asserter.getClientSecret()));
+        httpPost.setHeader("Content-Type", "application/x-www-form-urlencoded");
+        httpPost.setEntity(new UrlEncodedFormEntity(urlParameters));
+
+        return httpPost;
+    }
+
+    /**
+     * Initiates an authorization request to IS and obtain session data key.
+     */
+    private String sendAuthCodeGrantAuthRequestPost(final List<NameValuePair> urlParameters) throws Exception {
+
+        final HttpResponse response = super.sendPostRequestWithParameters(this.client, urlParameters,
+                OAuth2Constant.AUTHORIZE_ENDPOINT_URL);
+        final Header locationHeader = response.getFirstHeader(OAuth2Constant.HTTP_RESPONSE_HEADER_LOCATION);
+        String sessionDataKey = DataExtractUtil.getParamFromURIString(locationHeader.getValue(),
+                OAuth2Constant.SESSION_DATA_KEY);
+        EntityUtils.consume(response.getEntity());
+        if (StringUtils.isBlank(sessionDataKey)) {
+            // A user session might already available - try retrieving session data key consent
+            return DataExtractUtil.getParamFromURIString(locationHeader.getValue(),
+                    OAuth2Constant.SESSION_DATA_KEY_CONSENT);
+        } else {
+            return this.sendAuthCodeGrantAuthenticatePost(sessionDataKey);
+        }
+    }
+
+    /**
+     * Provide user credentials and authenticate to the system.
+     */
+    private String sendAuthCodeGrantAuthenticatePost(String sessionDataKey) throws Exception {
+
+        HttpResponse response = sendLoginPost(this.client, sessionDataKey);
+        Header locationHeader = response.getFirstHeader(OAuth2Constant.HTTP_RESPONSE_HEADER_LOCATION);
+        EntityUtils.consume(response.getEntity());
+
+        response = sendGetRequest(this.client, locationHeader.getValue());
+        locationHeader = response.getFirstHeader(OAuth2Constant.HTTP_RESPONSE_HEADER_LOCATION);
+
+        return DataExtractUtil.getParamFromURIString(locationHeader.getValue(),
+                OAuth2Constant.SESSION_DATA_KEY_CONSENT);
+    }
+
+    private String sendAuthCodeGrantApprovalPost(String sessionDataKeyConsent) throws Exception {
+
+        final HttpResponse response = sendApprovalPost(this.client, sessionDataKeyConsent);
+        final Header locationHeader = response.getFirstHeader(OAuth2Constant.HTTP_RESPONSE_HEADER_LOCATION);
+        EntityUtils.consume(response.getEntity());
+
+        return DataExtractUtil.getParamFromURIString(locationHeader.getValue(), OAuth2Constant.AUTHORIZATION_CODE_NAME);
+    }
+
+    @Override
+    public HttpResponse sendLoginPost(HttpClient client, String sessionDataKey) throws IOException {
+
+        List<NameValuePair> urlParameters = new ArrayList<>();
+        urlParameters.add(new BasicNameValuePair("username", USERNAME));
+        urlParameters.add(new BasicNameValuePair("password", PASSWORD));
+        urlParameters.add(new BasicNameValuePair(OAuth2Constant.SESSION_DATA_KEY, sessionDataKey));
+
+        return sendPostRequestWithParameters(client, urlParameters,
+                getTenantQualifiedURL(COMMON_AUTH_URL, super.tenantInfo.getDomain()));
+    }
+
+    private List<NameValuePair> getAuthzRequestParams(Asserter asserter) {
+
+        final List<NameValuePair> urlParameters = this.getDefaultNameValuePairs(asserter);
+        urlParameters.add(new BasicNameValuePair(OAuth2Constant.OAUTH2_RESPONSE_TYPE,
+                OAuth2Constant.OAUTH2_GRANT_TYPE_CODE));
+        urlParameters.add(new BasicNameValuePair(OAuth2Constant.OAUTH2_CLIENT_ID, asserter.getClientId()));
+        urlParameters.add(new BasicNameValuePair(OAuth2Constant.OAUTH2_REDIRECT_URI, OAuth2Constant.CALLBACK_URL));
+
+        return urlParameters;
+    }
+
+    private List<NameValuePair> getAccessTokenRequestParams(Asserter asserter, String authorizationCode) {
+
+        final List<NameValuePair> urlParameters = this.getDefaultNameValuePairs(asserter);
+        urlParameters.add(new BasicNameValuePair(OAuth2Constant.GRANT_TYPE_NAME,
+                OAuth2Constant.OAUTH2_GRANT_TYPE_AUTHORIZATION_CODE));
+        urlParameters.add(new BasicNameValuePair(OAuth2Constant.OAUTH2_REDIRECT_URI, OAuth2Constant.CALLBACK_URL));
+        urlParameters.add(new BasicNameValuePair(OAuth2Constant.AUTHORIZATION_CODE_NAME, authorizationCode));
+        return urlParameters;
+    }
+
+    private List<NameValuePair> getRefreshTokenRequestParams(Asserter asserter, String refreshToken) {
+
+        final List<NameValuePair> urlParameters = this.getDefaultNameValuePairs(asserter);
+        urlParameters.add(new BasicNameValuePair(OAuth2Constant.GRANT_TYPE_NAME,
+                OAuth2Constant.OAUTH2_GRANT_TYPE_REFRESH_TOKEN));
+        urlParameters.add(new BasicNameValuePair(OAuth2Constant.REFRESH_TOKEN, refreshToken));
+        return urlParameters;
+    }
+
+    private List<NameValuePair> getHybridRequestParams(Asserter asserter) {
+
+        final List<NameValuePair> urlParameters = this.getDefaultNameValuePairs(asserter);
+        urlParameters.add(new BasicNameValuePair(OAuth2Constant.OAUTH2_RESPONSE_TYPE,
+                RESPONSE_TYPE_CODE_ID_TOKEN_TOKEN));
+        urlParameters.add(new BasicNameValuePair(OAuth2Constant.OAUTH2_CLIENT_ID, asserter.getClientId()));
+        urlParameters.add(new BasicNameValuePair(OAuth2Constant.OAUTH2_REDIRECT_URI, OAuth2Constant.CALLBACK_URL));
+        urlParameters.add(new BasicNameValuePair(OAuth2Constant.OAUTH2_NONCE, UUID.randomUUID().toString()));
+        return urlParameters;
+    }
+
+    private List<NameValuePair> getDefaultNameValuePairs(Asserter asserter) {
+        final List<NameValuePair> urlParameters = new ArrayList<>();
+        if (asserter.getExpectedAuthorizationDetails() != null) {
+            urlParameters.add(new BasicNameValuePair(OAuth2Constant.OAUTH2_AUTHORIZATION_DETAILS,
+                    asserter.getExpectedAuthorizationDetails().toString()));
+        }
+        if (StringUtils.isNotEmpty(asserter.getExpectedScopes())) {
+            urlParameters.add(new BasicNameValuePair(OAuth2Constant.OAUTH2_SCOPE, asserter.getExpectedScopes()));
+        }
+        return urlParameters;
+    }
+
+    private ApplicationModel getApplicationWithOpaqueTokens() {
+
+        final ApplicationModel application = new ApplicationModel();
+
+        HybridFlowConfiguration hybridFlow = new HybridFlowConfiguration();
+        hybridFlow.setEnable(true);
+        hybridFlow.setResponseType(RESPONSE_TYPE_CODE_ID_TOKEN_TOKEN);
+
+        OpenIDConnectConfiguration oidcConfig = new OpenIDConnectConfiguration();
+        oidcConfig.setHybridFlow(hybridFlow);
+        oidcConfig.setGrantTypes(Arrays.asList("authorization_code", "implicit", "password",
+                "client_credentials", "refresh_token"));
+        oidcConfig.setCallbackURLs(Collections.singletonList(OAuth2Constant.CALLBACK_URL));
+
+        InboundProtocols inboundProtocolsConfig = new InboundProtocols();
+        inboundProtocolsConfig.setOidc(oidcConfig);
+
+        application.setInboundProtocolConfiguration(inboundProtocolsConfig);
+        application.setName("RarServiceProvider1");
+        application.setDescription(SERVICE_PROVIDER_DESC);
+        application.setIsManagementApp(true);
+        application.setClaimConfiguration(super.setApplicationClaimConfig());
+
+        return application;
+    }
+
+    private ApplicationModel getApplicationWithJWTTokens() {
+
+        ApplicationModel application = this.getApplicationWithOpaqueTokens();
+
+        AccessTokenConfiguration accessTokenConfig = new AccessTokenConfiguration();
+        accessTokenConfig.type("JWT");
+        accessTokenConfig.setUserAccessTokenExpiryInSeconds(3600L);
+        accessTokenConfig.setApplicationAccessTokenExpiryInSeconds(3600L);
+
+        InboundProtocols inboundProtocolConfiguration = application.getInboundProtocolConfiguration();
+        OpenIDConnectConfiguration oidc = inboundProtocolConfiguration.getOidc();
+        oidc.setAccessToken(accessTokenConfig);
+        inboundProtocolConfiguration.setOidc(oidc);
+
+        application.setInboundProtocolConfiguration(inboundProtocolConfiguration);
+        application.setName("RarServiceProvider2");
+
+        return application;
+    }
+
+    public static class Asserter {
+
+        private final String clientId;
+        private final String clientSecret;
+        private final JSONArray expectedAuthorizationDetails;
+        private final String expectedScopes;
+
+        Asserter(String clientId, String clientSecret, JSONArray expectedAuthorizationDetails, String expectedScopes) {
+
+            this.clientId = clientId;
+            this.clientSecret = clientSecret;
+            this.expectedAuthorizationDetails = expectedAuthorizationDetails;
+            this.expectedScopes = expectedScopes;
+        }
+
+        String getClientId() {
+            return this.clientId;
+        }
+
+        String getClientSecret() {
+            return this.clientSecret;
+        }
+
+        JSONArray getExpectedAuthorizationDetails() {
+            return this.expectedAuthorizationDetails;
+        }
+
+        String getExpectedScopes() {
+            return this.expectedScopes;
+        }
+
+        void assertTokenResponse(JSONObject tokenResponse) throws Exception {
+
+            this.assertAccessToken(tokenResponse.optString(OAuth2Constant.ACCESS_TOKEN));
+            this.assertRefreshToken(tokenResponse.optString(OAuth2Constant.REFRESH_TOKEN));
+            this.assertAuthorizationDetails(tokenResponse
+                    .optString(OAuth2Constant.OAUTH2_AUTHORIZATION_DETAILS), false);
+            this.assertScopes(tokenResponse.optString(OAuth2Constant.OAUTH2_SCOPE), false);
+        }
+
+        void assertHttpResponse(HttpResponse httpResponse) throws Exception {
+
+            Header locationHeader = httpResponse.getFirstHeader(OAuth2Constant.HTTP_RESPONSE_HEADER_LOCATION);
+            EntityUtils.consume(httpResponse.getEntity());
+
+            this.assertAccessToken(DataExtractUtil.extractParamFromURIFragment(locationHeader.getValue(),
+                    OAuth2Constant.ACCESS_TOKEN));
+            this.assertAuthorizationDetails(DataExtractUtil.extractParamFromURIFragment(locationHeader.getValue(),
+                    OAuth2Constant.OAUTH2_AUTHORIZATION_DETAILS), true);
+            this.assertScopes(DataExtractUtil.extractParamFromURIFragment(locationHeader.getValue(),
+                    OAuth2Constant.OAUTH2_SCOPE), true);
+        }
+
+        void assertAuthorizationDetails(String authorizationDetails, boolean isUrlEncoded) throws JSONException {
+
+            if (expectedAuthorizationDetails == null) {
+                assertTrue(StringUtils.isEmpty(authorizationDetails));
+                return;
+            }
+
+            if (isUrlEncoded) {
+                authorizationDetails = URLDecoder.decode(authorizationDetails, UTF_8);
+            }
+
+            final JSONArray actualAuthorizationDetails = new JSONArray(authorizationDetails);
+            assertEquals(actualAuthorizationDetails.length(), expectedAuthorizationDetails.length());
+            assertTrue(isRequestTypesMatchResponseTypes(expectedAuthorizationDetails, actualAuthorizationDetails));
+        }
+
+        void assertAccessToken(String accessToken) {
+
+            assertNotNull(accessToken, "Access token is null");
+        }
+
+        void assertRefreshToken(String refreshToken) {
+
+            assertNotNull(refreshToken, "Refresh token is null");
+        }
+
+        void assertScopes(String actualScopes, boolean isUrlEncoded) {
+
+            if (StringUtils.isNotEmpty(expectedScopes)) {
+                if (isUrlEncoded) {
+                    actualScopes = URLDecoder.decode(actualScopes, UTF_8).replaceAll("\\+", " ");
+                }
+                assertNotNull(actualScopes);
+                assertTrue(Arrays.asList(expectedScopes.split("\\s+"))
+                        .containsAll(Arrays.asList(actualScopes.split("\\s+"))));
+            }
+        }
+    }
+
+    class OpaqueTokenAsserter extends Asserter {
+
+        OpaqueTokenAsserter(String clientId, String clientSecret, JSONArray expectedAuthorizationDetails,
+                            String expectedScopes) {
+
+            super(clientId, clientSecret, expectedAuthorizationDetails, expectedScopes);
+        }
+
+        @Override
+        public void assertTokenResponse(JSONObject tokenResponse) throws Exception {
+
+            super.assertTokenResponse(tokenResponse);
+            final org.json.simple.JSONObject introspectJson =
+                    introspectTokenWithTenant(
+                            client,
+                            tokenResponse.getString(OAuth2Constant.ACCESS_TOKEN),
+                            OAuth2Constant.INTRO_SPEC_ENDPOINT,
+                            USERNAME, PASSWORD
+                    );
+            JSONObject introspectResponse = new JSONObject(introspectJson.toJSONString());
+            super.assertAuthorizationDetails(introspectResponse
+                    .optString(OAuth2Constant.OAUTH2_AUTHORIZATION_DETAILS), false);
+            super.assertScopes(introspectResponse.optString(OAuth2Constant.OAUTH2_SCOPE), false);
+        }
+
+        @Override
+        void assertHttpResponse(HttpResponse httpResponse) throws Exception {
+
+            Header locationHeader = httpResponse.getFirstHeader(OAuth2Constant.HTTP_RESPONSE_HEADER_LOCATION);
+            final String accessToken =
+                    DataExtractUtil.extractParamFromURIFragment(locationHeader.getValue(), OAuth2Constant.ACCESS_TOKEN);
+            super.assertHttpResponse(httpResponse);
+
+            final org.json.simple.JSONObject introspectJson = introspectTokenWithTenant(client, accessToken,
+                    OAuth2Constant.INTRO_SPEC_ENDPOINT, USERNAME, PASSWORD);
+            JSONObject introspectResponse = new JSONObject(introspectJson.toJSONString());
+            super.assertAuthorizationDetails(introspectResponse
+                    .optString(OAuth2Constant.OAUTH2_AUTHORIZATION_DETAILS), false);
+            super.assertScopes(introspectResponse.optString(OAuth2Constant.OAUTH2_SCOPE), false);
+        }
+    }
+
+    static class JwtTokenAsserter extends Asserter {
+
+        JwtTokenAsserter(String clientId, String clientSecret, JSONArray expectedAuthorizationDetails,
+                         String expectedScopes) {
+
+            super(clientId, clientSecret, expectedAuthorizationDetails, expectedScopes);
+        }
+
+        @Override
+        public void assertTokenResponse(JSONObject tokenResponse) throws Exception {
+
+            super.assertAccessToken(tokenResponse.optString(OAuth2Constant.ACCESS_TOKEN));
+            super.assertRefreshToken(tokenResponse.optString(OAuth2Constant.REFRESH_TOKEN));
+
+            final String jwtAccessToken = tokenResponse.optString(OAuth2Constant.ACCESS_TOKEN);
+            JSONObject jsonAccessToken =
+                    new JSONObject(new String(Base64.getDecoder().decode(jwtAccessToken.split("\\.")[1])));
+
+            super.assertAuthorizationDetails(jsonAccessToken
+                    .optString(OAuth2Constant.OAUTH2_AUTHORIZATION_DETAILS), false);
+
+            if (this.getExpectedAuthorizationDetails() != null) {
+
+                JSONArray claimAuthorizationDetails =
+                        tokenResponse.getJSONArray(OAuth2Constant.OAUTH2_AUTHORIZATION_DETAILS);
+                JSONArray responseAuthorizationDetails =
+                        jsonAccessToken.getJSONArray(OAuth2Constant.OAUTH2_AUTHORIZATION_DETAILS);
+
+                assertEquals(claimAuthorizationDetails.length(), responseAuthorizationDetails.length());
+                isRequestTypesMatchResponseTypes(claimAuthorizationDetails, responseAuthorizationDetails);
+            }
+
+            super.assertScopes(jsonAccessToken.optString(OAuth2Constant.OAUTH2_SCOPE), false);
+        }
+    }
+}
diff --git a/modules/integration/tests-integration/tests-backend/src/test/java/org/wso2/identity/integration/test/oauth2/OAuth2RichAuthorizationRequestsTestCase.java b/modules/integration/tests-integration/tests-backend/src/test/java/org/wso2/identity/integration/test/oauth2/OAuth2RichAuthorizationRequestsTestCase.java
new file mode 100644
index 00000000000..bf7b71bfe6a
--- /dev/null
+++ b/modules/integration/tests-integration/tests-backend/src/test/java/org/wso2/identity/integration/test/oauth2/OAuth2RichAuthorizationRequestsTestCase.java
@@ -0,0 +1,250 @@
+/*
+ * Copyright (c) 2024, WSO2 Inc. (http://www.wso2.org) All Rights Reserved.
+ *
+ * WSO2 Inc. licenses this file to you under the Apache License,
+ * Version 2.0 (the "License"); you may not use this file except
+ * in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.wso2.identity.integration.test.oauth2;
+
+import org.apache.http.HttpResponse;
+import org.json.JSONArray;
+import org.json.JSONException;
+import org.json.JSONObject;
+import org.testng.Assert;
+import org.testng.annotations.AfterClass;
+import org.testng.annotations.BeforeClass;
+import org.testng.annotations.Test;
+import org.wso2.carbon.automation.engine.context.TestUserMode;
+import org.wso2.identity.integration.test.rest.api.server.api.resource.v1.model.APIResourcePatchModel;
+import org.wso2.identity.integration.test.rest.api.server.api.resource.v1.model.AuthorizationDetailsType;
+import org.wso2.identity.integration.test.rest.api.server.application.management.v1.model.ApplicationResponseModel;
+import org.wso2.identity.integration.test.rest.api.server.application.management.v1.model.AuthorizedAPICreationModel;
+import org.wso2.identity.integration.test.rest.api.server.application.management.v1.model.AuthorizedAPIPatchModel;
+import org.wso2.identity.integration.test.rest.api.server.application.management.v1.model.AuthorizedAPIResponse;
+import org.wso2.identity.integration.test.utils.DataExtractUtil;
+
+import java.io.IOException;
+import java.util.Arrays;
+import java.util.Collections;
+import java.util.List;
+
+import javax.servlet.http.HttpServletResponse;
+
+import static org.wso2.identity.integration.test.utils.RichAuthorizationRequestsUtils.TEST_TYPE_INVALID;
+import static org.wso2.identity.integration.test.utils.RichAuthorizationRequestsUtils.createTestAPIResource;
+import static org.wso2.identity.integration.test.utils.RichAuthorizationRequestsUtils.getTestAuthorizationDetailsSchema;
+import static org.wso2.identity.integration.test.utils.RichAuthorizationRequestsUtils.getTestAuthorizationDetailsType;
+
+/**
+ * Integration test class for testing the API resource flows and API authorization flows in applications.
+ */
+public class OAuth2RichAuthorizationRequestsTestCase extends OAuth2ServiceAbstractIntegrationTest {
+
+    public static final String TEST_TYPE_1 = "type_1";
+    public static final String TEST_TYPE_2 = "type_2";
+    public static final String TEST_TYPE_3 = "type_3";
+    public static final List<AuthorizationDetailsType> TEST_AUTHORIZATION_DETAILS_TYPES = Arrays
+            .asList(getTestAuthorizationDetailsType(TEST_TYPE_1), getTestAuthorizationDetailsType(TEST_TYPE_2));
+
+    private String applicationId;
+    private String apiResourceId;
+    private String authorizedApiResourceId;
+
+    @BeforeClass(alwaysRun = true)
+    public void testInit() throws Exception {
+
+        super.init(TestUserMode.SUPER_TENANT_USER);
+        super.setSystemproperties();
+
+        this.apiResourceId = createTestAPIResource(super.restClient, TEST_AUTHORIZATION_DETAILS_TYPES);
+
+        ApplicationResponseModel application = super.addApplication();
+        Assert.assertNotNull(application, "OAuth App creation failed.");
+        this.applicationId = application.getId();
+    }
+
+    @AfterClass(alwaysRun = true)
+    public void atEnd() throws Exception {
+
+        super.restClient.deleteAPIResource(this.apiResourceId);
+        super.deleteApp(this.applicationId);
+        super.restClient.closeHttpClient();
+    }
+
+    @Test(groups = "wso2.is", description = "Checks api resource registration with authorization details types")
+    public void testRegisterApiResourceWithAuthorizationDetails() throws IOException {
+
+        final List<AuthorizationDetailsType> types =
+                super.restClient.getAPIResourceAuthorizationDetailsTypes(apiResourceId);
+        Assert.assertNotNull(types);
+        Assert.assertEquals(types.size(), TEST_AUTHORIZATION_DETAILS_TYPES.size());
+    }
+
+    @Test(groups = "wso2.is", description = "Checks metadata endpoint contains supported authorization details types",
+            dependsOnMethods = {"testRegisterApiResourceWithAuthorizationDetails"})
+    public void testOIDCMetadataResponseContent() throws IOException, JSONException {
+        HttpResponse httpResponse = sendGetRequest(super.restClient.client, "https://localhost:9853/oauth2/token/.well-known/openid-configuration");
+        String content = DataExtractUtil.getContentData(httpResponse);
+        Assert.assertNotNull(content, "Response content is not received");
+
+        JSONObject oidcMetadataEndpoints = new JSONObject(content);
+        JSONArray authorizationDetailsTypesSupported = oidcMetadataEndpoints.getJSONArray("authorization_details_types_supported");
+        Assert.assertNotNull(authorizationDetailsTypesSupported);
+        TEST_AUTHORIZATION_DETAILS_TYPES.stream().map(AuthorizationDetailsType::getType)
+                .forEach(type -> Assert.assertTrue(authorizationDetailsTypesSupported.toString().contains(type)));
+    }
+
+    @Test(groups = "wso2.is", description = "Checks api resource update with authorization details types",
+            dependsOnMethods = {"testRegisterApiResourceWithAuthorizationDetails"})
+    private void testUpdateApiResourceWithAuthorizationDetails() throws IOException {
+
+        APIResourcePatchModel patchModel = new APIResourcePatchModel()
+                .addRemovedAuthorizationDetailsTypesItem(TEST_TYPE_2);
+        super.restClient.updateAPIResource(apiResourceId, patchModel);
+
+        List<AuthorizationDetailsType> types = super.restClient.getAPIResourceAuthorizationDetailsTypes(apiResourceId);
+        Assert.assertNotNull(types);
+        Assert.assertEquals(types.size(), 1);
+        Assert.assertEquals(types.get(0).getType(), TEST_TYPE_1);
+
+        patchModel = new APIResourcePatchModel()
+                .addAddedAuthorizationDetailsTypesItem(getTestAuthorizationDetailsType(TEST_TYPE_2));
+        super.restClient.updateAPIResource(apiResourceId, patchModel);
+
+        types = super.restClient.getAPIResourceAuthorizationDetailsTypes(apiResourceId);
+        Assert.assertNotNull(types);
+        Assert.assertEquals(types.size(), 2);
+    }
+
+    @Test(groups = "wso2.is", description = "Test authorization details type CRUD flows",
+            dependsOnMethods = {"testUpdateApiResourceWithAuthorizationDetails"})
+    public void testAuthorizationDetailsTypes() throws IOException {
+
+        Assert.assertNull(super.restClient.getAuthorizationDetailsType(apiResourceId, "invalid_type_id"));
+
+        List<AuthorizationDetailsType> types = super.restClient.addAuthorizationDetailsTypes(apiResourceId,
+                Collections.singletonList(getTestAuthorizationDetailsType(TEST_TYPE_3)));
+        Assert.assertNotNull(types);
+        Assert.assertFalse(types.isEmpty());
+        types.forEach(type -> {
+            Assert.assertNotNull(type.getId());
+            Assert.assertEquals(type.getType(), TEST_TYPE_3);
+            Assert.assertNotNull(type.getName());
+        });
+
+        final String typeId = types.get(0).getId();
+        AuthorizationDetailsType type = restClient.getAuthorizationDetailsType(apiResourceId, typeId);
+
+        Assert.assertNotNull(type);
+        Assert.assertEquals(type.getType(), TEST_TYPE_3);
+        Assert.assertTrue(type.getName().contains(TEST_TYPE_3));
+
+        final String type4 = "test_type_4";
+        type.setId(null);
+        type.setType(type4);
+        type.setSchema(getTestAuthorizationDetailsSchema(type4));
+
+        super.restClient.updateAuthorizationDetailsType(apiResourceId, typeId, type);
+        AuthorizationDetailsType updatedType = super.restClient.getAuthorizationDetailsType(apiResourceId, typeId);
+
+        Assert.assertNotNull(updatedType);
+        Assert.assertEquals(type.getType(), type4);
+        Assert.assertTrue(type.getName().contains(TEST_TYPE_3));
+        Assert.assertTrue(type.getSchema().get("properties").toString().contains(type4));
+
+        super.restClient.deleteAuthorizationDetailsType(apiResourceId, typeId);
+        Assert.assertNull(super.restClient.getAuthorizationDetailsType(apiResourceId, typeId));
+    }
+
+    @Test(groups = "wso2.is", description = "Check authorization details types authorization",
+            dependsOnMethods = {"testUpdateApiResourceWithAuthorizationDetails"})
+    public void testAddAuthorizedAuthorizationDetailsTypes() throws IOException {
+
+        AuthorizedAPICreationModel authorizedAPICreationModel = new AuthorizedAPICreationModel();
+        authorizedAPICreationModel.setId(apiResourceId);
+        authorizedAPICreationModel.addAuthorizationDetailsTypesItem(TEST_TYPE_1);
+
+        int response = super.restClient.addAPIAuthorizationToApplication(applicationId, authorizedAPICreationModel);
+        Assert.assertEquals(response, HttpServletResponse.SC_OK, "Failed to add API authorization to the application");
+
+        List<AuthorizedAPIResponse> apiResponses = super.restClient.getAPIAuthorizationsFromApplication(applicationId);
+
+        Assert.assertNotNull(apiResponses);
+        apiResponses.forEach(apiResponse -> Assert.assertNotNull(apiResponse.getAuthorizedAuthorizationDetailsTypes()));
+        apiResponses.forEach(apiResponse ->
+                Assert.assertEquals(apiResponse.getAuthorizedAuthorizationDetailsTypes().size(), 1));
+        apiResponses.forEach(apiResponse ->
+                apiResponse.getAuthorizedAuthorizationDetailsTypes().forEach(type -> {
+                    Assert.assertNotNull(type.getId());
+                    Assert.assertEquals(type.getType(), TEST_TYPE_1);
+                    Assert.assertNotNull(type.getName());
+                })
+        );
+
+        this.authorizedApiResourceId = apiResponses.get(0).getId();
+    }
+
+    @Test(groups = "wso2.is", description = "Check authorization details types authorization update",
+            dependsOnMethods = {"testAddAuthorizedAuthorizationDetailsTypes"})
+    public void testUpdateAuthorizedAuthorizationDetailsTypes() throws IOException {
+
+        AuthorizedAPIPatchModel patchModel = new AuthorizedAPIPatchModel();
+        patchModel.addAddedAuthorizationDetailsTypesItem(TEST_TYPE_2);
+        patchModel.addRemovedAuthorizationDetailsTypesItem(TEST_TYPE_1);
+
+        int response = super.restClient
+                .updateAPIAuthorizationsFromApplication(applicationId, authorizedApiResourceId, patchModel);
+        Assert.assertEquals(response, HttpServletResponse.SC_OK, "Authorized API resource update failed");
+        List<AuthorizedAPIResponse> apiResponses = super.restClient.getAPIAuthorizationsFromApplication(applicationId);
+
+        Assert.assertNotNull(apiResponses);
+        apiResponses.forEach(apiResponse -> Assert.assertNotNull(apiResponse.getAuthorizedAuthorizationDetailsTypes()));
+        apiResponses.forEach(apiResponse ->
+                Assert.assertEquals(apiResponse.getAuthorizedAuthorizationDetailsTypes().size(), 1));
+        apiResponses.forEach(apiResponse ->
+                apiResponse.getAuthorizedAuthorizationDetailsTypes().forEach(type -> {
+                    Assert.assertNotNull(type.getId());
+                    Assert.assertEquals(type.getType(), TEST_TYPE_2);
+                    Assert.assertNotNull(type.getName());
+                })
+        );
+
+        patchModel.addAddedAuthorizationDetailsTypesItem(TEST_TYPE_INVALID);
+        response = super.restClient
+                .updateAPIAuthorizationsFromApplication(applicationId, authorizedApiResourceId, patchModel);
+        Assert.assertEquals(response, HttpServletResponse.SC_BAD_REQUEST);
+    }
+
+    @Test(groups = "wso2.is", description = "Check authorization details types authorization delete",
+            dependsOnMethods = {"testUpdateAuthorizedAuthorizationDetailsTypes"})
+    public void testDeleteAuthorizedAuthorizationDetailsTypes() throws IOException {
+
+        super.restClient.deleteAPIAuthorizationsFromApplication(applicationId, authorizedApiResourceId);
+        List<AuthorizedAPIResponse> apiResponses = super.restClient.getAPIAuthorizationsFromApplication(applicationId);
+
+        Assert.assertTrue(apiResponses.isEmpty());
+    }
+
+    @Test(groups = "wso2.is", description = "Checks api resource deletion with authorization details types",
+            dependsOnMethods = {"testDeleteAuthorizedAuthorizationDetailsTypes"})
+    public void testDeleteApiResourceWithAuthorizationDetails() throws IOException {
+
+        super.restClient.deleteAPIResource(apiResourceId);
+        final List<AuthorizationDetailsType> types =
+                super.restClient.getAPIResourceAuthorizationDetailsTypes(apiResourceId);
+
+        Assert.assertNull(types);
+    }
+}
diff --git a/modules/integration/tests-integration/tests-backend/src/test/java/org/wso2/identity/integration/test/rest/api/server/api/resource/v1/model/APIResourcePatchModel.java b/modules/integration/tests-integration/tests-backend/src/test/java/org/wso2/identity/integration/test/rest/api/server/api/resource/v1/model/APIResourcePatchModel.java
new file mode 100644
index 00000000000..3d7e746ac75
--- /dev/null
+++ b/modules/integration/tests-integration/tests-backend/src/test/java/org/wso2/identity/integration/test/rest/api/server/api/resource/v1/model/APIResourcePatchModel.java
@@ -0,0 +1,246 @@
+/*
+ * Copyright (c) 2024, WSO2 LLC. (http://www.wso2.com).
+ *
+ * WSO2 LLC. licenses this file to you under the Apache License,
+ * Version 2.0 (the "License"); you may not use this file except
+ * in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.wso2.identity.integration.test.rest.api.server.api.resource.v1.model;
+
+import com.fasterxml.jackson.annotation.JsonProperty;
+import io.swagger.annotations.ApiModelProperty;
+
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Objects;
+
+import javax.validation.Valid;
+
+public class APIResourcePatchModel {
+
+    private String name;
+    private String description;
+    private List<ScopeGetModel> addedScopes = null;
+
+    private List<String> removedScopes = null;
+
+    private List<AuthorizationDetailsType> addedAuthorizationDetailsTypes = null;
+
+    private List<String> removedAuthorizationDetailsTypes = null;
+
+
+    /**
+     *
+     **/
+    public APIResourcePatchModel name(String name) {
+
+        this.name = name;
+        return this;
+    }
+
+    @ApiModelProperty(example = "Greetings API", value = "")
+    @JsonProperty("name")
+    @Valid
+    public String getName() {
+        return name;
+    }
+
+    public void setName(String name) {
+        this.name = name;
+    }
+
+    /**
+     *
+     **/
+    public APIResourcePatchModel description(String description) {
+
+        this.description = description;
+        return this;
+    }
+
+    @ApiModelProperty(example = "Greetings API representation", value = "")
+    @JsonProperty("description")
+    @Valid
+    public String getDescription() {
+        return description;
+    }
+
+    public void setDescription(String description) {
+        this.description = description;
+    }
+
+    /**
+     *
+     **/
+    public APIResourcePatchModel addedScopes(List<ScopeGetModel> addedScopes) {
+
+        this.addedScopes = addedScopes;
+        return this;
+    }
+
+    @ApiModelProperty(value = "")
+    @JsonProperty("addedScopes")
+    @Valid
+    public List<ScopeGetModel> getAddedScopes() {
+        return addedScopes;
+    }
+
+    public void setAddedScopes(List<ScopeGetModel> addedScopes) {
+        this.addedScopes = addedScopes;
+    }
+
+    public APIResourcePatchModel addAddedScopesItem(ScopeGetModel addedScopesItem) {
+        if (this.addedScopes == null) {
+            this.addedScopes = new ArrayList<ScopeGetModel>();
+        }
+        this.addedScopes.add(addedScopesItem);
+        return this;
+    }
+
+    /**
+     * This field is not supported yet.
+     **/
+    public APIResourcePatchModel removedScopes(List<String> removedScopes) {
+
+        this.removedScopes = removedScopes;
+        return this;
+    }
+
+    @ApiModelProperty(value = "This field is not supported yet.")
+    @JsonProperty("removedScopes")
+    @Valid
+    public List<String> getRemovedScopes() {
+        return removedScopes;
+    }
+
+    public void setRemovedScopes(List<String> removedScopes) {
+        this.removedScopes = removedScopes;
+    }
+
+    public APIResourcePatchModel addRemovedScopesItem(String removedScopesItem) {
+        if (this.removedScopes == null) {
+            this.removedScopes = new ArrayList<String>();
+        }
+        this.removedScopes.add(removedScopesItem);
+        return this;
+    }
+
+    /**
+     *
+     **/
+    public APIResourcePatchModel addedAuthorizationDetailsTypes(List<AuthorizationDetailsType> addedAuthorizationDetailsTypes) {
+
+        this.addedAuthorizationDetailsTypes = addedAuthorizationDetailsTypes;
+        return this;
+    }
+
+    @ApiModelProperty(value = "")
+    @JsonProperty("addedAuthorizationDetailsTypes")
+    @Valid
+    public List<AuthorizationDetailsType> getAddedAuthorizationDetailsTypes() {
+        return addedAuthorizationDetailsTypes;
+    }
+
+    public void setAddedAuthorizationDetailsTypes(List<AuthorizationDetailsType> addedAuthorizationDetailsTypes) {
+        this.addedAuthorizationDetailsTypes = addedAuthorizationDetailsTypes;
+    }
+
+    public APIResourcePatchModel addAddedAuthorizationDetailsTypesItem(AuthorizationDetailsType addedAuthorizationDetailsTypesItem) {
+        if (this.addedAuthorizationDetailsTypes == null) {
+            this.addedAuthorizationDetailsTypes = new ArrayList<AuthorizationDetailsType>();
+        }
+        this.addedAuthorizationDetailsTypes.add(addedAuthorizationDetailsTypesItem);
+        return this;
+    }
+
+    /**
+     *
+     **/
+    public APIResourcePatchModel removedAuthorizationDetailsTypes(List<String> removedAuthorizationDetailsTypes) {
+
+        this.removedAuthorizationDetailsTypes = removedAuthorizationDetailsTypes;
+        return this;
+    }
+
+    @ApiModelProperty(value = "")
+    @JsonProperty("removedAuthorizationDetailsTypes")
+    @Valid
+    public List<String> getRemovedAuthorizationDetailsTypes() {
+        return removedAuthorizationDetailsTypes;
+    }
+
+    public void setRemovedAuthorizationDetailsTypes(List<String> removedAuthorizationDetailsTypes) {
+        this.removedAuthorizationDetailsTypes = removedAuthorizationDetailsTypes;
+    }
+
+    public APIResourcePatchModel addRemovedAuthorizationDetailsTypesItem(String removedAuthorizationDetailsTypesItem) {
+        if (this.removedAuthorizationDetailsTypes == null) {
+            this.removedAuthorizationDetailsTypes = new ArrayList<String>();
+        }
+        this.removedAuthorizationDetailsTypes.add(removedAuthorizationDetailsTypesItem);
+        return this;
+    }
+
+
+    @Override
+    public boolean equals(Object o) {
+
+        if (this == o) {
+            return true;
+        }
+        if (o == null || getClass() != o.getClass()) {
+            return false;
+        }
+        APIResourcePatchModel apIResourcePatchModel = (APIResourcePatchModel) o;
+        return Objects.equals(this.name, apIResourcePatchModel.name) &&
+                Objects.equals(this.description, apIResourcePatchModel.description) &&
+                Objects.equals(this.addedScopes, apIResourcePatchModel.addedScopes) &&
+                Objects.equals(this.removedScopes, apIResourcePatchModel.removedScopes) &&
+                Objects.equals(this.addedAuthorizationDetailsTypes, apIResourcePatchModel.addedAuthorizationDetailsTypes) &&
+                Objects.equals(this.removedAuthorizationDetailsTypes, apIResourcePatchModel.removedAuthorizationDetailsTypes);
+    }
+
+    @Override
+    public int hashCode() {
+        return Objects.hash(name, description, addedScopes, removedScopes, addedAuthorizationDetailsTypes, removedAuthorizationDetailsTypes);
+    }
+
+    @Override
+    public String toString() {
+
+        StringBuilder sb = new StringBuilder();
+        sb.append("class APIResourcePatchModel {\n");
+
+        sb.append("    name: ").append(toIndentedString(name)).append("\n");
+        sb.append("    description: ").append(toIndentedString(description)).append("\n");
+        sb.append("    addedScopes: ").append(toIndentedString(addedScopes)).append("\n");
+        sb.append("    removedScopes: ").append(toIndentedString(removedScopes)).append("\n");
+        sb.append("    addedAuthorizationDetailsTypes: ").append(toIndentedString(addedAuthorizationDetailsTypes)).append("\n");
+        sb.append("    removedAuthorizationDetailsTypes: ").append(toIndentedString(removedAuthorizationDetailsTypes)).append("\n");
+        sb.append("}");
+        return sb.toString();
+    }
+
+    /**
+     * Convert the given object to string with each line indented by 4 spaces
+     * (except the first line).
+     */
+    private String toIndentedString(Object o) {
+
+        if (o == null) {
+            return "null";
+        }
+        return o.toString().replace("\n", "\n");
+    }
+}
diff --git a/modules/integration/tests-integration/tests-backend/src/test/java/org/wso2/identity/integration/test/rest/api/server/api/resource/v1/model/APIResourceResponse.java b/modules/integration/tests-integration/tests-backend/src/test/java/org/wso2/identity/integration/test/rest/api/server/api/resource/v1/model/APIResourceResponse.java
index df05962caba..af87c3a755e 100644
--- a/modules/integration/tests-integration/tests-backend/src/test/java/org/wso2/identity/integration/test/rest/api/server/api/resource/v1/model/APIResourceResponse.java
+++ b/modules/integration/tests-integration/tests-backend/src/test/java/org/wso2/identity/integration/test/rest/api/server/api/resource/v1/model/APIResourceResponse.java
@@ -44,6 +44,8 @@ public class APIResourceResponse {
 
     private String self;
 
+    private List<AuthorizationDetailsType> authorizationDetailsTypes = null;
+
     /**
      **/
     public APIResourceResponse id(String id) {
@@ -256,7 +258,30 @@ public void setSelf(String self) {
         this.self = self;
     }
 
+    public APIResourceResponse authorizationDetailsTypes(List<AuthorizationDetailsType> authorizationDetailsTypes) {
+
+        this.authorizationDetailsTypes = authorizationDetailsTypes;
+        return this;
+    }
 
+    @ApiModelProperty(value = "")
+    @JsonProperty("authorizationDetailsTypes")
+    @Valid
+    public List<AuthorizationDetailsType> getAuthorizationDetailsTypes() {
+        return authorizationDetailsTypes;
+    }
+
+    public void setAuthorizationDetailsTypes(List<AuthorizationDetailsType> authorizationDetailsTypes) {
+        this.authorizationDetailsTypes = authorizationDetailsTypes;
+    }
+
+    public APIResourceResponse addAuthorizationDetailsTypesItem(AuthorizationDetailsType authorizationDetailsTypeItem) {
+        if (this.authorizationDetailsTypes == null) {
+            this.authorizationDetailsTypes = new ArrayList<AuthorizationDetailsType>();
+        }
+        this.authorizationDetailsTypes.add(authorizationDetailsTypeItem);
+        return this;
+    }
 
     @Override
     public boolean equals(java.lang.Object o) {
@@ -301,6 +326,7 @@ public String toString() {
         sb.append("    subscribedApplications: ").append(toIndentedString(subscribedApplications)).append("\n");
         sb.append("    properties: ").append(toIndentedString(properties)).append("\n");
         sb.append("    self: ").append(toIndentedString(self)).append("\n");
+        sb.append("    authorizationDetailsTypes: ").append(toIndentedString(authorizationDetailsTypes)).append("\n");
         sb.append("}");
         return sb.toString();
     }
diff --git a/modules/integration/tests-integration/tests-backend/src/test/java/org/wso2/identity/integration/test/rest/api/server/api/resource/v1/model/AuthorizationDetailsType.java b/modules/integration/tests-integration/tests-backend/src/test/java/org/wso2/identity/integration/test/rest/api/server/api/resource/v1/model/AuthorizationDetailsType.java
new file mode 100644
index 00000000000..0dbe805f4fc
--- /dev/null
+++ b/modules/integration/tests-integration/tests-backend/src/test/java/org/wso2/identity/integration/test/rest/api/server/api/resource/v1/model/AuthorizationDetailsType.java
@@ -0,0 +1,202 @@
+/*
+ * Copyright (c) 2024, WSO2 LLC. (http://www.wso2.com).
+ *
+ * WSO2 LLC. licenses this file to you under the Apache License,
+ * Version 2.0 (the "License"); you may not use this file except
+ * in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.wso2.identity.integration.test.rest.api.server.api.resource.v1.model;
+
+import com.fasterxml.jackson.annotation.JsonProperty;
+import io.swagger.annotations.ApiModelProperty;
+
+import java.util.HashMap;
+import java.util.Map;
+import java.util.Objects;
+
+import javax.validation.Valid;
+import javax.validation.constraints.NotNull;
+import javax.validation.constraints.Size;
+
+public class AuthorizationDetailsType {
+
+    private String id;
+    private String type;
+    private String name;
+    private String description;
+    private Map<String, Object> schema = new HashMap<>();
+
+    public AuthorizationDetailsType id(String id) {
+
+        this.id = id;
+        return this;
+    }
+
+    @ApiModelProperty(example = "sf23-fg34-fy53-hj23", required = true, value = "")
+    @JsonProperty("id")
+    @Valid
+    @NotNull(message = "Property id cannot be null.")
+
+    public String getId() {
+
+        return id;
+    }
+
+    public void setId(String id) {
+
+        this.id = id;
+    }
+
+    /**
+     * an unique type of the authorization details type
+     **/
+    public AuthorizationDetailsType type(String type) {
+
+        this.type = type;
+        return this;
+    }
+
+    @ApiModelProperty(example = "payment_initiation", required = true, value = "an unique type of the authorization details type")
+    @JsonProperty("type")
+    @Valid
+    @NotNull(message = "Property type cannot be null.")
+    @Size(min = 1, max = 255)
+    public String getType() {
+        return type;
+    }
+
+    public void setType(String type) {
+        this.type = type;
+    }
+
+    /**
+     * display name of the authorization details type
+     **/
+    public AuthorizationDetailsType name(String name) {
+
+        this.name = name;
+        return this;
+    }
+
+    @ApiModelProperty(example = "Payment Initiation", required = true, value = "display name of the authorization details type")
+    @JsonProperty("name")
+    @Valid
+    @NotNull(message = "Property name cannot be null.")
+    @Size(min = 3, max = 255)
+    public String getName() {
+        return name;
+    }
+
+    public void setName(String name) {
+        this.name = name;
+    }
+
+    /**
+     * description of the authorization details type
+     **/
+    public AuthorizationDetailsType description(String description) {
+
+        this.description = description;
+        return this;
+    }
+
+    @ApiModelProperty(example = "Payment initiation authorization details type", required = true, value = "description of the authorization details type")
+    @JsonProperty("description")
+    @Valid
+    @NotNull(message = "Property description cannot be null.")
+
+    public String getDescription() {
+        return description;
+    }
+
+    public void setDescription(String description) {
+        this.description = description;
+    }
+
+    /**
+     * Accepts the [JSON Schema document](https://json-schema.org/draft/2020-12/json-schema-core#name-json-schema-documents) of the authorization details type
+     **/
+    public AuthorizationDetailsType schema(Map<String, Object> schema) {
+
+        this.schema = schema;
+        return this;
+    }
+
+    @ApiModelProperty(example = "{\"type\":\"object\",\"required\":[\"type\",\"actions\",\"locations\",\"instructedAmount\"],\"properties\":{\"type\":{\"type\":\"string\",\"enum\":[\"payment_initiation\"]},\"actions\":{\"type\":\"array\",\"items\":{\"type\":\"string\",\"enum\":[\"initiate\",\"cancel\"]}},\"locations\":{\"type\":\"array\",\"items\":{\"type\":\"string\",\"format\":\"uri\"}},\"instructedAmount\":{\"type\":\"object\",\"properties\":{\"currency\":{\"type\":\"string\",\"minLength\":3},\"amount\":{\"type\":\"string\"}}},\"creditorName\":\"string\",\"creditorAccount\":{\"type\":\"object\"}}}", required = true, value = "Accepts the [JSON Schema document](https://json-schema.org/draft/2020-12/json-schema-core#name-json-schema-documents) of the authorization details type")
+    @JsonProperty("schema")
+    @Valid
+    @NotNull(message = "Property schema cannot be null.")
+
+    public Map<String, Object> getSchema() {
+        return schema;
+    }
+
+    public void setSchema(Map<String, Object> schema) {
+        this.schema = schema;
+    }
+
+
+    public AuthorizationDetailsType putSchemaItem(String key, Object schemaItem) {
+        this.schema.put(key, schemaItem);
+        return this;
+    }
+
+
+    @Override
+    public boolean equals(Object o) {
+
+        if (this == o) {
+            return true;
+        }
+        if (o == null || getClass() != o.getClass()) {
+            return false;
+        }
+        AuthorizationDetailsType authorizationDetailsType = (AuthorizationDetailsType) o;
+        return Objects.equals(this.type, authorizationDetailsType.type) &&
+                Objects.equals(this.name, authorizationDetailsType.name) &&
+                Objects.equals(this.description, authorizationDetailsType.description) &&
+                Objects.equals(this.schema, authorizationDetailsType.schema);
+    }
+
+    @Override
+    public int hashCode() {
+        return Objects.hash(type, name, description, schema);
+    }
+
+    @Override
+    public String toString() {
+
+        StringBuilder sb = new StringBuilder();
+        sb.append("class AuthorizationDetailsType {\n");
+
+        sb.append("    type: ").append(toIndentedString(type)).append("\n");
+        sb.append("    name: ").append(toIndentedString(name)).append("\n");
+        sb.append("    description: ").append(toIndentedString(description)).append("\n");
+        sb.append("    schema: ").append(toIndentedString(schema)).append("\n");
+        sb.append("}");
+        return sb.toString();
+    }
+
+    /**
+     * Convert the given object to string with each line indented by 4 spaces
+     * (except the first line).
+     */
+    private String toIndentedString(Object o) {
+
+        if (o == null) {
+            return "null";
+        }
+        return o.toString().replace("\n", "\n");
+    }
+}
diff --git a/modules/integration/tests-integration/tests-backend/src/test/java/org/wso2/identity/integration/test/rest/api/server/application/management/v1/model/AuthorizedAPICreationModel.java b/modules/integration/tests-integration/tests-backend/src/test/java/org/wso2/identity/integration/test/rest/api/server/application/management/v1/model/AuthorizedAPICreationModel.java
index 8dc99f871ae..f9dd92694dc 100644
--- a/modules/integration/tests-integration/tests-backend/src/test/java/org/wso2/identity/integration/test/rest/api/server/application/management/v1/model/AuthorizedAPICreationModel.java
+++ b/modules/integration/tests-integration/tests-backend/src/test/java/org/wso2/identity/integration/test/rest/api/server/application/management/v1/model/AuthorizedAPICreationModel.java
@@ -32,7 +32,7 @@ public class AuthorizedAPICreationModel {
     private String id;
     private String policyIdentifier;
     private List<String> scopes = null;
-
+    private List<String> authorizationDetailsTypes = null;
 
     /**
      **/
@@ -96,7 +96,29 @@ public AuthorizedAPICreationModel addScopesItem(String scopesItem) {
         return this;
     }
 
+    public AuthorizedAPICreationModel authorizationDetailsTypes(List<String> authorizationDetailsTypes) {
+
+        this.authorizationDetailsTypes = authorizationDetailsTypes;
+        return this;
+    }
+
+    @ApiModelProperty(value = "")
+    @JsonProperty("authorizationDetailsTypes")
+    @Valid
+    public List<String> getAuthorizationDetailsTypes() {
+        return authorizationDetailsTypes;
+    }
+    public void setAuthorizationDetailsTypes(List<String> authorizationDetailsTypes) {
+        this.authorizationDetailsTypes = authorizationDetailsTypes;
+    }
 
+    public AuthorizedAPICreationModel addAuthorizationDetailsTypesItem(String authorizationDetailsTypesItem) {
+        if (this.authorizationDetailsTypes == null) {
+            this.authorizationDetailsTypes = new ArrayList<>();
+        }
+        this.authorizationDetailsTypes.add(authorizationDetailsTypesItem);
+        return this;
+    }
 
     @Override
     public boolean equals(java.lang.Object o) {
@@ -127,6 +149,7 @@ public String toString() {
         sb.append("    id: ").append(toIndentedString(id)).append("\n");
         sb.append("    policyIdentifier: ").append(toIndentedString(policyIdentifier)).append("\n");
         sb.append("    scopes: ").append(toIndentedString(scopes)).append("\n");
+        sb.append("    authorizationDetailsTypes: ").append(toIndentedString(authorizationDetailsTypes)).append("\n");
         sb.append("}");
         return sb.toString();
     }
diff --git a/modules/integration/tests-integration/tests-backend/src/test/java/org/wso2/identity/integration/test/rest/api/server/application/management/v1/model/AuthorizedAPIPatchModel.java b/modules/integration/tests-integration/tests-backend/src/test/java/org/wso2/identity/integration/test/rest/api/server/application/management/v1/model/AuthorizedAPIPatchModel.java
new file mode 100644
index 00000000000..f87f967b447
--- /dev/null
+++ b/modules/integration/tests-integration/tests-backend/src/test/java/org/wso2/identity/integration/test/rest/api/server/application/management/v1/model/AuthorizedAPIPatchModel.java
@@ -0,0 +1,200 @@
+/*
+ * Copyright (c) 2024, WSO2 LLC. (http://www.wso2.com).
+ *
+ * WSO2 LLC. licenses this file to you under the Apache License,
+ * Version 2.0 (the "License"); you may not use this file except
+ * in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.wso2.identity.integration.test.rest.api.server.application.management.v1.model;
+
+import com.fasterxml.jackson.annotation.JsonProperty;
+import io.swagger.annotations.ApiModelProperty;
+
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Objects;
+
+import javax.validation.Valid;
+
+public class AuthorizedAPIPatchModel {
+
+    private List<String> addedScopes = null;
+
+    private List<String> removedScopes = null;
+
+    private List<String> addedAuthorizationDetailsTypes = null;
+
+    private List<String> removedAuthorizationDetailsTypes = null;
+
+
+    /**
+     *
+     **/
+    public AuthorizedAPIPatchModel addedScopes(List<String> addedScopes) {
+
+        this.addedScopes = addedScopes;
+        return this;
+    }
+
+    @ApiModelProperty(value = "")
+    @JsonProperty("addedScopes")
+    @Valid
+    public List<String> getAddedScopes() {
+        return addedScopes;
+    }
+
+    public void setAddedScopes(List<String> addedScopes) {
+        this.addedScopes = addedScopes;
+    }
+
+    public AuthorizedAPIPatchModel addAddedScopesItem(String addedScopesItem) {
+        if (this.addedScopes == null) {
+            this.addedScopes = new ArrayList<>();
+        }
+        this.addedScopes.add(addedScopesItem);
+        return this;
+    }
+
+    /**
+     *
+     **/
+    public AuthorizedAPIPatchModel removedScopes(List<String> removedScopes) {
+
+        this.removedScopes = removedScopes;
+        return this;
+    }
+
+    @ApiModelProperty(value = "")
+    @JsonProperty("removedScopes")
+    @Valid
+    public List<String> getRemovedScopes() {
+        return removedScopes;
+    }
+
+    public void setRemovedScopes(List<String> removedScopes) {
+        this.removedScopes = removedScopes;
+    }
+
+    public AuthorizedAPIPatchModel addRemovedScopesItem(String removedScopesItem) {
+        if (this.removedScopes == null) {
+            this.removedScopes = new ArrayList<>();
+        }
+        this.removedScopes.add(removedScopesItem);
+        return this;
+    }
+
+    /**
+     *
+     **/
+    public AuthorizedAPIPatchModel addedAuthorizationDetailsTypes(List<String> addedAuthorizationDetailsTypes) {
+
+        this.addedAuthorizationDetailsTypes = addedAuthorizationDetailsTypes;
+        return this;
+    }
+
+    @ApiModelProperty(value = "")
+    @JsonProperty("addedAuthorizationDetailsTypes")
+    @Valid
+    public List<String> getAddedAuthorizationDetailsTypes() {
+        return addedAuthorizationDetailsTypes;
+    }
+
+    public void setAddedAuthorizationDetailsTypes(List<String> addedAuthorizationDetailsTypes) {
+        this.addedAuthorizationDetailsTypes = addedAuthorizationDetailsTypes;
+    }
+
+    public AuthorizedAPIPatchModel addAddedAuthorizationDetailsTypesItem(String addedAuthorizationDetailsTypesItem) {
+        if (this.addedAuthorizationDetailsTypes == null) {
+            this.addedAuthorizationDetailsTypes = new ArrayList<>();
+        }
+        this.addedAuthorizationDetailsTypes.add(addedAuthorizationDetailsTypesItem);
+        return this;
+    }
+
+    /**
+     *
+     **/
+    public AuthorizedAPIPatchModel removedAuthorizationDetailsTypes(List<String> removedAuthorizationDetailsTypes) {
+
+        this.removedAuthorizationDetailsTypes = removedAuthorizationDetailsTypes;
+        return this;
+    }
+
+    @ApiModelProperty(value = "")
+    @JsonProperty("removedAuthorizationDetailsTypes")
+    @Valid
+    public List<String> getRemovedAuthorizationDetailsTypes() {
+        return removedAuthorizationDetailsTypes;
+    }
+
+    public void setRemovedAuthorizationDetailsTypes(List<String> removedAuthorizationDetailsTypes) {
+        this.removedAuthorizationDetailsTypes = removedAuthorizationDetailsTypes;
+    }
+
+    public AuthorizedAPIPatchModel addRemovedAuthorizationDetailsTypesItem(String removedAuthorizationDetailsTypesItem) {
+        if (this.removedAuthorizationDetailsTypes == null) {
+            this.removedAuthorizationDetailsTypes = new ArrayList<>();
+        }
+        this.removedAuthorizationDetailsTypes.add(removedAuthorizationDetailsTypesItem);
+        return this;
+    }
+
+
+    @Override
+    public boolean equals(Object o) {
+
+        if (this == o) {
+            return true;
+        }
+        if (o == null || getClass() != o.getClass()) {
+            return false;
+        }
+        AuthorizedAPIPatchModel authorizedAPIPatchModel = (AuthorizedAPIPatchModel) o;
+        return Objects.equals(this.addedScopes, authorizedAPIPatchModel.addedScopes) &&
+                Objects.equals(this.removedScopes, authorizedAPIPatchModel.removedScopes) &&
+                Objects.equals(this.addedAuthorizationDetailsTypes, authorizedAPIPatchModel.addedAuthorizationDetailsTypes) &&
+                Objects.equals(this.removedAuthorizationDetailsTypes, authorizedAPIPatchModel.removedAuthorizationDetailsTypes);
+    }
+
+    @Override
+    public int hashCode() {
+        return Objects.hash(addedScopes, removedScopes, addedAuthorizationDetailsTypes, removedAuthorizationDetailsTypes);
+    }
+
+    @Override
+    public String toString() {
+
+        StringBuilder sb = new StringBuilder();
+        sb.append("class AuthorizedAPIPatchModel {\n");
+
+        sb.append("    addedScopes: ").append(toIndentedString(addedScopes)).append("\n");
+        sb.append("    removedScopes: ").append(toIndentedString(removedScopes)).append("\n");
+        sb.append("    addedAuthorizationDetailsTypes: ").append(toIndentedString(addedAuthorizationDetailsTypes)).append("\n");
+        sb.append("    removedAuthorizationDetailsTypes: ").append(toIndentedString(removedAuthorizationDetailsTypes)).append("\n");
+        sb.append("}");
+        return sb.toString();
+    }
+
+    /**
+     * Convert the given object to string with each line indented by 4 spaces
+     * (except the first line).
+     */
+    private String toIndentedString(Object o) {
+
+        if (o == null) {
+            return "null";
+        }
+        return o.toString().replace("\n", "\n");
+    }
+}
diff --git a/modules/integration/tests-integration/tests-backend/src/test/java/org/wso2/identity/integration/test/rest/api/server/application/management/v1/model/AuthorizedAPIResponse.java b/modules/integration/tests-integration/tests-backend/src/test/java/org/wso2/identity/integration/test/rest/api/server/application/management/v1/model/AuthorizedAPIResponse.java
index 6f8b239209f..5daeb278a17 100644
--- a/modules/integration/tests-integration/tests-backend/src/test/java/org/wso2/identity/integration/test/rest/api/server/application/management/v1/model/AuthorizedAPIResponse.java
+++ b/modules/integration/tests-integration/tests-backend/src/test/java/org/wso2/identity/integration/test/rest/api/server/application/management/v1/model/AuthorizedAPIResponse.java
@@ -20,6 +20,7 @@
 
 import com.fasterxml.jackson.annotation.JsonProperty;
 import io.swagger.annotations.ApiModelProperty;
+import org.wso2.identity.integration.test.rest.api.server.api.resource.v1.model.AuthorizationDetailsType;
 
 import java.util.ArrayList;
 import java.util.List;
@@ -33,8 +34,9 @@ public class AuthorizedAPIResponse {
     private String identifier;
     private String displayName;
     private String policyId;
+    private String type;
     private List<AuthorizedScope> authorizedScopes = null;
-
+    private List<AuthorizationDetailsType> authorizedAuthorizationDetailsTypes = null;
 
     /**
      **/
@@ -108,6 +110,22 @@ public void setPolicyId(String policyId) {
         this.policyId = policyId;
     }
 
+    public AuthorizedAPIResponse type(String type) {
+
+        this.type = type;
+        return this;
+    }
+
+    @ApiModelProperty(value = "")
+    @JsonProperty("type")
+    @Valid
+    public String getType() {
+        return type;
+    }
+    public void setType(String type) {
+        this.type = type;
+    }
+
     /**
      **/
     public AuthorizedAPIResponse authorizedScopes(List<AuthorizedScope> authorizedScopes) {
@@ -134,6 +152,30 @@ public AuthorizedAPIResponse addAuthorizedScopesItem(AuthorizedScope authorizedS
         return this;
     }
 
+    public AuthorizedAPIResponse authorizedAuthorizationDetailsTypes(List<AuthorizationDetailsType> authorizedAuthorizationDetailsTypes) {
+
+        this.authorizedAuthorizationDetailsTypes = authorizedAuthorizationDetailsTypes;
+        return this;
+    }
+
+    @ApiModelProperty(value = "")
+    @JsonProperty("authorizedAuthorizationDetailsTypes")
+    @Valid
+    public List<AuthorizationDetailsType> getAuthorizedAuthorizationDetailsTypes() {
+        return authorizedAuthorizationDetailsTypes;
+    }
+    public void setAuthorizedAuthorizationDetailsTypes(List<AuthorizationDetailsType> authorizedAuthorizationDetailsTypes) {
+        this.authorizedAuthorizationDetailsTypes = authorizedAuthorizationDetailsTypes;
+    }
+
+    public AuthorizedAPIResponse addAuthorizedAuthorizationDetailsTypesItem(AuthorizationDetailsType authorizedAuthorizationDetailsTypesItem) {
+        if (this.authorizedAuthorizationDetailsTypes == null) {
+            this.authorizedAuthorizationDetailsTypes = new ArrayList<>();
+        }
+        this.authorizedAuthorizationDetailsTypes.add(authorizedAuthorizationDetailsTypesItem);
+        return this;
+    }
+
     @Override
     public boolean equals(java.lang.Object o) {
 
diff --git a/modules/integration/tests-integration/tests-backend/src/test/java/org/wso2/identity/integration/test/restclients/OAuth2RestClient.java b/modules/integration/tests-integration/tests-backend/src/test/java/org/wso2/identity/integration/test/restclients/OAuth2RestClient.java
index 914083d0ca9..503c9f4a3b7 100644
--- a/modules/integration/tests-integration/tests-backend/src/test/java/org/wso2/identity/integration/test/restclients/OAuth2RestClient.java
+++ b/modules/integration/tests-integration/tests-backend/src/test/java/org/wso2/identity/integration/test/restclients/OAuth2RestClient.java
@@ -34,11 +34,15 @@
 import org.wso2.carbon.utils.multitenancy.MultitenantConstants;
 import org.wso2.identity.integration.test.rest.api.server.api.resource.v1.model.APIResourceListItem;
 import org.wso2.identity.integration.test.rest.api.server.api.resource.v1.model.APIResourceListResponse;
+import org.wso2.identity.integration.test.rest.api.server.api.resource.v1.model.APIResourcePatchModel;
 import org.wso2.identity.integration.test.rest.api.server.api.resource.v1.model.APIResourceResponse;
+import org.wso2.identity.integration.test.rest.api.server.api.resource.v1.model.AuthorizationDetailsType;
 import org.wso2.identity.integration.test.rest.api.server.api.resource.v1.model.ScopeGetModel;
 import org.wso2.identity.integration.test.rest.api.server.application.management.v1.model.ApplicationListItem;
 import org.wso2.identity.integration.test.rest.api.server.application.management.v1.model.ApplicationListResponse;
 import org.wso2.identity.integration.test.rest.api.server.application.management.v1.model.ApplicationModel;
+import org.wso2.identity.integration.test.rest.api.server.application.management.v1.model.AuthorizedAPIPatchModel;
+import org.wso2.identity.integration.test.rest.api.server.application.management.v1.model.AuthorizedAPIResponse;
 import org.wso2.identity.integration.test.rest.api.server.application.management.v1.model.DomainAPICreationModel;
 import org.wso2.identity.integration.test.rest.api.server.application.management.v1.model.ApplicationPatchModel;
 import org.wso2.identity.integration.test.rest.api.server.application.management.v1.model.ApplicationResponseModel;
@@ -70,6 +74,7 @@ public class OAuth2RestClient extends RestBaseClient {
     private static final String AUTHORIZED_API_BASE_PATH = "/authorized-apis";
     private static final String SCIM_BASE_PATH = "scim2";
     private static final String ROLE_V2_BASE_PATH = "/v2/Roles";
+    private static final String AUTHORIZATION_DETAILS_TYPES_PATH = "/authorization-details-types";
     private final String applicationManagementApiBasePath;
     private final String subOrgApplicationManagementApiBasePath;
     private final String apiResourceManagementApiBasePath;
@@ -595,6 +600,239 @@ public void shareApplication(String appId, ApplicationSharePOSTRequest applicati
         }
     }
 
+
+    /**
+     * To create API Resources.
+     *
+     * @param apiResource an instance of APIResource
+     * @return the api resource ID
+     * @throws IOException throws if an error occurs while creating the api resource.
+     */
+    public String createAPIResource(APIResourceResponse apiResource) throws IOException {
+
+        String jsonRequest = toJSONString(apiResource);
+        try (CloseableHttpResponse response = getResponseOfHttpPost(apiResourceManagementApiBasePath, jsonRequest,
+                getHeaders())) {
+            String[] locationElements = response.getHeaders(LOCATION_HEADER)[0].toString().split(PATH_SEPARATOR);
+            return locationElements[locationElements.length - 1];
+        }
+    }
+
+    /**
+     * Delete API Resources.
+     *
+     * @param apiId API resource id.
+     * @throws IOException If an error occurred while deleting an application.
+     */
+    public void deleteAPIResource(String apiId) throws IOException {
+
+        String endpointUrl = apiResourceManagementApiBasePath + PATH_SEPARATOR + apiId;
+
+        try (CloseableHttpResponse response = getResponseOfHttpDelete(endpointUrl, getHeaders())) {
+            Assert.assertEquals(response.getStatusLine().getStatusCode(), HttpServletResponse.SC_NO_CONTENT,
+                    "API resource deletion failed");
+        }
+    }
+
+    /**
+     * Update an existing API resource.
+     *
+     * @param apiId       API resource id.
+     * @param apiResource an instance of APIResource to be updated
+     * @throws IOException If an error occurred while updating an API resource.
+     */
+    public void updateAPIResource(String apiId, APIResourcePatchModel apiResource)
+            throws IOException {
+
+        String endPointUrl = apiResourceManagementApiBasePath + PATH_SEPARATOR + apiId;
+
+        try (CloseableHttpResponse response =
+                     getResponseOfHttpPatch(endPointUrl, toJSONString(apiResource), getHeaders())) {
+            Assert.assertEquals(response.getStatusLine().getStatusCode(), HttpServletResponse.SC_NO_CONTENT,
+                    "API resource update failed");
+        }
+    }
+
+    /**
+     * Get API resource authorization details types.
+     *
+     * @param apiIdentifier API identifier.
+     * @return List of API resource authorization details types.
+     * @throws IOException Error when getting the authorization details types.
+     */
+    public List<AuthorizationDetailsType> getAPIResourceAuthorizationDetailsTypes(String apiIdentifier)
+            throws IOException {
+
+        String endPointUrl = apiResourceManagementApiBasePath + PATH_SEPARATOR + apiIdentifier;
+        try (CloseableHttpResponse response = getResponseOfHttpGet(endPointUrl, getHeaders())) {
+
+            if (HttpServletResponse.SC_NOT_FOUND == response.getStatusLine().getStatusCode()) {
+                return null;
+            }
+
+            String responseBody = EntityUtils.toString(response.getEntity());
+            ObjectMapper jsonWriter = new ObjectMapper(new JsonFactory());
+            APIResourceResponse apiResourceResponse = jsonWriter.readValue(responseBody, APIResourceResponse.class);
+            return apiResourceResponse.getAuthorizationDetailsTypes();
+        }
+    }
+
+    /**
+     * Get API authorizations to an application.
+     *
+     * @param appId Application id.
+     * @return Authorized API response.
+     * @throws IOException Error when getting the response.
+     */
+    public List<AuthorizedAPIResponse> getAPIAuthorizationsFromApplication(String appId) throws IOException {
+
+        final String endPointUrl = applicationManagementApiBasePath + PATH_SEPARATOR + appId + AUTHORIZED_API_BASE_PATH;
+
+        try (CloseableHttpResponse response = getResponseOfHttpGet(endPointUrl, getHeaders())) {
+
+            if (HttpServletResponse.SC_NOT_FOUND == response.getStatusLine().getStatusCode()) {
+                return null;
+            }
+
+            String responseBody = EntityUtils.toString(response.getEntity());
+            ObjectMapper jsonWriter = new ObjectMapper(new JsonFactory());
+            return jsonWriter.readValue(responseBody,
+                    jsonWriter.getTypeFactory().constructCollectionType(List.class, AuthorizedAPIResponse.class));
+        }
+    }
+
+    /**
+     * Update an existing authorized API resource.
+     *
+     * @param appId                   Application id.
+     * @param authorizedApiId         API identifier.
+     * @param authorizedAPIPatchModel an instance of Authorized APIResource to be updated
+     * @throws IOException If an error occurred while updating an API resource.
+     */
+    public int updateAPIAuthorizationsFromApplication(String appId, String authorizedApiId,
+                                                      AuthorizedAPIPatchModel authorizedAPIPatchModel)
+            throws IOException {
+
+        String jsonRequest = toJSONString(authorizedAPIPatchModel);
+        final String endPointUrl = applicationManagementApiBasePath + PATH_SEPARATOR + appId +
+                AUTHORIZED_API_BASE_PATH + PATH_SEPARATOR + authorizedApiId;
+
+        try (CloseableHttpResponse response = getResponseOfHttpPatch(endPointUrl, jsonRequest, getHeaders())) {
+            return response.getStatusLine().getStatusCode();
+        }
+    }
+
+    /**
+     * Delete an existing authorized API resource.
+     *
+     * @param appId           Application id.
+     * @param authorizedApiId API identifier.
+     * @throws IOException If an error occurred while updating an API resource.
+     */
+    public void deleteAPIAuthorizationsFromApplication(String appId, String authorizedApiId)
+            throws IOException {
+
+        final String endpointUrl = applicationManagementApiBasePath + PATH_SEPARATOR + appId +
+                AUTHORIZED_API_BASE_PATH + PATH_SEPARATOR + authorizedApiId;
+
+        try (CloseableHttpResponse response = getResponseOfHttpDelete(endpointUrl, getHeaders())) {
+            Assert.assertEquals(response.getStatusLine().getStatusCode(), HttpServletResponse.SC_NO_CONTENT,
+                    "Authorized API resource deletion failed");
+        }
+    }
+
+    /**
+     * To create authorization details type.
+     *
+     * @param apiId       API resource id.
+     * @param detailTypes authorization details types to be added
+     * @return a list of authorization details type IDs
+     * @throws IOException throws if an error occurs while creating the api resource.
+     */
+    public List<AuthorizationDetailsType> addAuthorizationDetailsTypes(
+            String apiId, List<AuthorizationDetailsType> detailTypes) throws IOException {
+
+        final String endPointUrl = apiResourceManagementApiBasePath + PATH_SEPARATOR + apiId +
+                AUTHORIZATION_DETAILS_TYPES_PATH;
+        String jsonRequest = toJSONString(detailTypes);
+        try (CloseableHttpResponse response = getResponseOfHttpPut(endPointUrl, jsonRequest, getHeaders())) {
+
+            Assert.assertEquals(response.getStatusLine().getStatusCode(), HttpServletResponse.SC_OK,
+                    "Authorization details type addition failed");
+
+            String responseBody = EntityUtils.toString(response.getEntity());
+            ObjectMapper jsonWriter = new ObjectMapper(new JsonFactory());
+            return jsonWriter.readValue(responseBody,
+                    jsonWriter.getTypeFactory().constructCollectionType(List.class, AuthorizationDetailsType.class));
+        }
+    }
+
+    /**
+     * Get authorization details type.
+     *
+     * @param apiId       API resource id.
+     * @param typeId       Authorization details type id.
+     * @return Authorization Details Type response.
+     * @throws IOException Error when getting the response.
+     */
+    public AuthorizationDetailsType getAuthorizationDetailsType(String apiId, String typeId) throws IOException {
+
+        final String endPointUrl = apiResourceManagementApiBasePath + PATH_SEPARATOR + apiId +
+                AUTHORIZATION_DETAILS_TYPES_PATH + PATH_SEPARATOR + typeId;
+
+        try (CloseableHttpResponse response = getResponseOfHttpGet(endPointUrl, getHeaders())) {
+
+            if (HttpServletResponse.SC_NOT_FOUND == response.getStatusLine().getStatusCode()) {
+                return null;
+            }
+
+            String responseBody = EntityUtils.toString(response.getEntity());
+            ObjectMapper jsonWriter = new ObjectMapper(new JsonFactory());
+            return jsonWriter.readValue(responseBody, AuthorizationDetailsType.class);
+        }
+    }
+
+    /**
+     * Update authorization details type.
+     *
+     * @param apiId       API resource id.
+     * @param typeId       Authorization details type id.
+     * @param detailTypes authorization details types to be updated
+     * @throws IOException Error when getting the response.
+     */
+    public void updateAuthorizationDetailsType(String apiId, String typeId, AuthorizationDetailsType detailTypes)
+            throws IOException {
+
+        final String endPointUrl = apiResourceManagementApiBasePath + PATH_SEPARATOR + apiId +
+                AUTHORIZATION_DETAILS_TYPES_PATH + PATH_SEPARATOR + typeId;
+
+        String jsonRequest = toJSONString(detailTypes);
+        try (CloseableHttpResponse response = getResponseOfHttpPatch(endPointUrl, jsonRequest, getHeaders())) {
+
+            Assert.assertEquals(response.getStatusLine().getStatusCode(), HttpServletResponse.SC_NO_CONTENT,
+                    "Authorization details type update failed");
+        }
+    }
+
+    /**
+     * Delete authorization details type.
+     *
+     * @param apiId       API resource id.
+     * @param typeId       Authorization details type id.
+     * @throws IOException Error when getting the response.
+     */
+    public void deleteAuthorizationDetailsType(String apiId, String typeId)
+            throws IOException {
+
+        final String endpointUrl = apiResourceManagementApiBasePath + PATH_SEPARATOR + apiId +
+                AUTHORIZATION_DETAILS_TYPES_PATH + PATH_SEPARATOR + typeId;
+
+        try (CloseableHttpResponse response = getResponseOfHttpDelete(endpointUrl, getHeaders())) {
+            Assert.assertEquals(response.getStatusLine().getStatusCode(), HttpServletResponse.SC_NO_CONTENT,
+                    "Authorization details type deletion failed");
+        }
+    }
+
     /**
      * Close the HTTP client.
      *
diff --git a/modules/integration/tests-integration/tests-backend/src/test/java/org/wso2/identity/integration/test/utils/OAuth2Constant.java b/modules/integration/tests-integration/tests-backend/src/test/java/org/wso2/identity/integration/test/utils/OAuth2Constant.java
index 125b2b484a3..9fe04eef018 100644
--- a/modules/integration/tests-integration/tests-backend/src/test/java/org/wso2/identity/integration/test/utils/OAuth2Constant.java
+++ b/modules/integration/tests-integration/tests-backend/src/test/java/org/wso2/identity/integration/test/utils/OAuth2Constant.java
@@ -119,6 +119,7 @@ public final class OAuth2Constant {
     public static final String RESPONSE_MODE_FRAGMENT_JWT = "fragment.jwt";
 
     public static final String RESPONSE_TYPE_CODE_ID_TOKEN = "code id_token";
+    public static final String OAUTH2_AUTHORIZATION_DETAILS = "authorization_details";
 
     // Tenanted urls.
     public final static String TENANT_PLACEHOLDER = "<TENANT_PLACEHOLDER>";
diff --git a/modules/integration/tests-integration/tests-backend/src/test/java/org/wso2/identity/integration/test/utils/RichAuthorizationRequestsUtils.java b/modules/integration/tests-integration/tests-backend/src/test/java/org/wso2/identity/integration/test/utils/RichAuthorizationRequestsUtils.java
new file mode 100644
index 00000000000..22afdc8cd7c
--- /dev/null
+++ b/modules/integration/tests-integration/tests-backend/src/test/java/org/wso2/identity/integration/test/utils/RichAuthorizationRequestsUtils.java
@@ -0,0 +1,162 @@
+/*
+ * Copyright (c) 2024, WSO2 Inc. (http://www.wso2.org) All Rights Reserved.
+ *
+ * WSO2 Inc. licenses this file to you under the Apache License,
+ * Version 2.0 (the "License"); you may not use this file except
+ * in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.wso2.identity.integration.test.utils;
+
+import org.json.JSONArray;
+import org.json.JSONException;
+import org.json.JSONObject;
+import org.wso2.identity.integration.test.rest.api.server.api.resource.v1.model.APIResourceResponse;
+import org.wso2.identity.integration.test.rest.api.server.api.resource.v1.model.AuthorizationDetailsType;
+import org.wso2.identity.integration.test.restclients.OAuth2RestClient;
+
+import java.io.IOException;
+import java.util.Arrays;
+import java.util.Collections;
+import java.util.HashMap;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+import java.util.UUID;
+
+/**
+ * Utility class for rich authorization requests.
+ */
+public class RichAuthorizationRequestsUtils {
+
+    public static final String TYPE = "type";
+    public static final String ERROR = "error";
+    public static final String INVALID_AUTHORIZATION_DETAILS = "invalid_authorization_details";
+    public static final String TEST_TYPE_1 = "https://example.com/rar_authorization_details_type_1";
+    public static final String TEST_TYPE_2 = "rar_authorization_details_type_2";
+    public static final String TEST_TYPE_3 = "rar_authorization_details_type_3";
+    public static final String TEST_TYPE_INVALID = "rar_authorization_details_type_invalid";
+    public static final List<AuthorizationDetailsType> TEST_AUTHORIZATION_DETAILS_TYPES = Arrays
+            .asList(getTestAuthorizationDetailsType(TEST_TYPE_1), getTestAuthorizationDetailsType(TEST_TYPE_2));
+
+    public static String createTestAPIResource(OAuth2RestClient restClient) throws IOException {
+
+        return createTestAPIResource(restClient, TEST_AUTHORIZATION_DETAILS_TYPES);
+    }
+
+    public static String createTestAPIResource(OAuth2RestClient restClient,
+                                               List<AuthorizationDetailsType> authorizationDetailsTypes)
+            throws IOException {
+
+        final UUID uuid = UUID.randomUUID();
+        final APIResourceResponse apiResource = new APIResourceResponse()
+                .name("rar api resource " + uuid)
+                .identifier("rar_api_resource_" + uuid)
+                .requiresAuthorization(true)
+                .authorizationDetailsTypes(authorizationDetailsTypes);
+
+        return restClient.createAPIResource(apiResource);
+    }
+
+    public static AuthorizationDetailsType getTestAuthorizationDetailsType(final String type) {
+        return new AuthorizationDetailsType()
+                .type(type)
+                .name(type + " name")
+                .description(type + " description")
+                .schema(getTestAuthorizationDetailsSchema(type));
+    }
+
+    public static JSONObject getTestAuthorizationDetail(final String type) throws JSONException {
+
+        JSONObject authorizationDetail = new JSONObject();
+        authorizationDetail.put(TYPE, type);
+        return authorizationDetail;
+    }
+
+    public static JSONArray getSingleTestAuthorizationDetail() throws JSONException {
+
+        final JSONArray authorizationDetails = new JSONArray();
+        authorizationDetails.put(getTestAuthorizationDetail(TEST_TYPE_1));
+        return authorizationDetails;
+    }
+
+    public static JSONArray getDoubleTestAuthorizationDetails() throws JSONException {
+
+        final JSONArray authorizationDetails = new JSONArray();
+        authorizationDetails.put(getTestAuthorizationDetail(TEST_TYPE_1));
+        authorizationDetails.put(getTestAuthorizationDetail(TEST_TYPE_2));
+        return authorizationDetails;
+    }
+
+    public static JSONArray getTripleTestAuthorizationDetails() throws JSONException {
+
+        final JSONArray authorizationDetails = new JSONArray();
+        authorizationDetails.put(getTestAuthorizationDetail(TEST_TYPE_1));
+        authorizationDetails.put(getTestAuthorizationDetail(TEST_TYPE_2));
+        authorizationDetails.put(getTestAuthorizationDetail(TEST_TYPE_3));
+        return authorizationDetails;
+    }
+
+    public static JSONArray getUnknownAuthorizationDetails() throws JSONException {
+
+        JSONObject unknownAuthorizationDetail = getTestAuthorizationDetail(TEST_TYPE_INVALID);
+        JSONArray unknownAuthorizationDetails = new JSONArray();
+        unknownAuthorizationDetails.put(unknownAuthorizationDetail);
+
+        return unknownAuthorizationDetails;
+    }
+
+    public static JSONArray getInvalidAuthorizationDetails() throws JSONException {
+
+        JSONObject invalidAuthorizationDetail = getTestAuthorizationDetail(TEST_TYPE_1);
+        invalidAuthorizationDetail.put("invalid_key", "invalid_value");
+        JSONArray invalidAuthorizationDetails = new JSONArray();
+        invalidAuthorizationDetails.put(invalidAuthorizationDetail);
+
+        return invalidAuthorizationDetails;
+    }
+
+    public static Map<String, Object> getTestAuthorizationDetailsSchema(final String type) {
+        final Map<String, Object> types = new HashMap<>();
+        types.put(TYPE, "string");
+        types.put("enum", Collections.singletonList(type));
+
+        final Map<String, Object> properties = new HashMap<>();
+        properties.put(TYPE, types);
+
+        final Map<String, Object> schema = new HashMap<>();
+        schema.put(TYPE, "object");
+        schema.put("required", Collections.singletonList(TYPE));
+        schema.put("properties", properties);
+
+        return schema;
+    }
+
+    public static boolean isRequestTypesMatchResponseTypes(JSONArray expectedAuthorizationDetails,
+                                                           JSONArray actualAuthorizationDetails)
+            throws JSONException {
+
+        Set<String> actual = new HashSet<>();
+        for (int n = 0; n < actualAuthorizationDetails.length(); n++) {
+            actual.add(actualAuthorizationDetails.getJSONObject(n).getString(TYPE));
+        }
+
+        for (int i = 0; i < expectedAuthorizationDetails.length(); i++) {
+            if (!actual.contains(expectedAuthorizationDetails.getJSONObject(i).getString(TYPE))) {
+                return false;
+            }
+        }
+        return true;
+    }
+}
diff --git a/modules/integration/tests-integration/tests-backend/src/test/resources/testng.xml b/modules/integration/tests-integration/tests-backend/src/test/resources/testng.xml
index cb14206aa06..080928d32e4 100644
--- a/modules/integration/tests-integration/tests-backend/src/test/resources/testng.xml
+++ b/modules/integration/tests-integration/tests-backend/src/test/resources/testng.xml
@@ -148,6 +148,8 @@
             <class name="org.wso2.identity.integration.test.oauth2.OAuth2AuthorizationCodeGrantJWTTokenTestCase"/>
             <class name="org.wso2.identity.integration.test.recovery.PasswordRecoveryTestCase"/>
             <class name="org.wso2.identity.integration.test.oidc.OIDCIdentityFederationTestCase"/>
+            <class name="org.wso2.identity.integration.test.oauth2.OAuth2RichAuthorizationRequestsTestCase"/>
+            <class name="org.wso2.identity.integration.test.oauth2.OAuth2RichAuthorizationRequestsGrantTypesTestCase"/>
         </classes>
     </test>
 
diff --git a/pom.xml b/pom.xml
index ff9e03e5402..927c61d1616 100755
--- a/pom.xml
+++ b/pom.xml
@@ -2126,6 +2126,11 @@
                     </exclusion>
                 </exclusions>
             </dependency>
+            <dependency>
+                <groupId>io.vertx</groupId>
+                <artifactId>vertx-json-schema</artifactId>
+                <version>${io.vertx.version}</version>
+            </dependency>
             <!-- Pax Logging -->
             <dependency>
                 <groupId>org.wso2.org.ops4j.pax.logging</groupId>
@@ -2365,7 +2370,7 @@
     <properties>
 
         <!--Carbon Identity Framework Version-->
-        <carbon.identity.framework.version>7.6.7</carbon.identity.framework.version>
+        <carbon.identity.framework.version>7.6.8-SNAPSHOT</carbon.identity.framework.version>
         <carbon.identity.framework.version.range>[5.14.67, 8.0.0)</carbon.identity.framework.version.range>
 
         <!--SAML Common Utils Version-->
@@ -2386,7 +2391,7 @@
 
 
         <!-- Identity Inbound Versions   -->
-        <identity.inbound.auth.oauth.version>7.0.190</identity.inbound.auth.oauth.version>
+        <identity.inbound.auth.oauth.version>7.0.191-SNAPSHOT</identity.inbound.auth.oauth.version>
         <identity.inbound.auth.saml.version>5.11.45</identity.inbound.auth.saml.version>
         <identity.inbound.auth.openid.version>5.10.2</identity.inbound.auth.openid.version>
         <identity.inbound.auth.sts.version>5.11.12</identity.inbound.auth.sts.version>
@@ -2477,7 +2482,7 @@
 
         <!-- Identity REST API feature -->
         <identity.api.dispatcher.version>2.0.17</identity.api.dispatcher.version>
-        <identity.server.api.version>1.2.251</identity.server.api.version>
+        <identity.server.api.version>1.2.252-SNAPSHOT</identity.server.api.version>
         <identity.user.api.version>1.3.45</identity.user.api.version>
 
         <identity.agent.sso.version>5.5.9</identity.agent.sso.version>
@@ -2490,7 +2495,7 @@
         <!-- Identity Portal Versions -->
         <identity.apps.console.version>2.34.25</identity.apps.console.version>
         <identity.apps.myaccount.version>2.13.1</identity.apps.myaccount.version>
-        <identity.apps.core.version>2.7.4</identity.apps.core.version>
+        <identity.apps.core.version>2.7.7-SNAPSHOT</identity.apps.core.version>
         <identity.apps.tests.version>1.6.378</identity.apps.tests.version>
 
         <!-- Charon -->
@@ -2529,6 +2534,7 @@
         <axis2-transports.version>2.0.0-wso2v42</axis2-transports.version>
         <h2database.wso2.version>2.2.224.wso2v2</h2database.wso2.version>
         <slf4j.version>1.7.28</slf4j.version>
+        <io.vertx.version>4.5.10</io.vertx.version>
 
         <!-- UI styles dependency versions -->
         <equinox.http.servlet.version>2.2.2</equinox.http.servlet.version>