List the clients of a realm on a Keycloak host. Returns clientId, internal UUID (id), and name for each client.

Fetch the full representation of one client by clientId. Secret-bearing fields (client secret, registration access token) are always redacted.

List a client's dedicated-scope protocol mappers: id, name, mapper type (protocolMapper), and config.

Idempotently ensure a client has an oidc-hardcoded-claim-mapper emitting the given claim. Matches existing mappers by claim name: reports 'already-present' when the config matches, a diff + update when it differs, and a create when absent. With write=false (default) it only returns the plan; write=true applies it.

Delete one of a client's protocol mappers by mapper UUID. With write=false (default) it reports which mapper would be deleted; write=true performs the deletion.

Fetch a confidential client's current secret and write ONLY the value to a local file (mode 0600, no trailing newline). The secret value is never returned to the caller or logged — the tool returns only metadata (path, byte length). This is a read against Keycloak (no mutation), so it is not write-gated.

Rotate a confidential client's secret and write ONLY the NEW value to a local file (mode 0600, no trailing newline). The secret value is never returned to the caller or logged — the tool returns only metadata. This mutates Keycloak: with write=false (default) it returns a dry-run plan and rotates nothing; with write=true it rotates. Production hosts (us/za) additionally require allowProdWrite in the config.