I am the assigned Gen-ART reviewer for this draft. For background on Gen-ART, please see the FAQ at <http://wiki.tools.ietf.org/area/gen/trac/wiki/GenArtfaq> Please resolve these comments along with any other Last Call comments you may receive. Document: draft-ietf-oauth-dyn-reg-management-09 Reviewer: Peter Yee Review Date: Mar-22-2015 IETF LC End Date: Mar-23-2015 IESG Telechat date: TBD Summary: This draft is ready for publication as an Experimental RFC, but has nits that should be fixed before publication. [Ready with nits] This specification defines an OAuth client configuration endpoint that be can be used to manage dynamic client registration updates and the protocol used to interact with it. Major issues: None Minor issues: None Nits: None Page 2, section 1, 1st paragraph, 1st sentence: change “at” to “with”. “At” makes it sound like the client identifier is a server-only object. Page 5, step (D), change “at” to “to”. Page 5, step (G), append “or (F)” to the sentence. Page 5, section 2, 2nd paragraph: this paragraph is wholly subsumed by the Security Considerations. Why not just put a pointer to there rather than duplicate the text? Page 6, section 2.2: while not technically incorrect, I would argue that the update is being made to the server by the client, albeit with the server’s permission. Thus I find the wording of this first sentence somewhat misleading. Perhaps a rewrite would help? I find the use of “at the server” in the document allows a lot of looseness that encourages varying interpretations of what is meant. Page 7, 1st paragraph: remove the space in “top- level”. Page 7, 2nd paragraph, 2nd sentence: change “client” to “updated client metadata fields”. This is to make it clear the client must not include the forbidden fields in the updated fields it presents, but that most certainly items like the registration access token will be part of the request. Page 12, last paragraph, last sentence: clarify disclosure of what? Wasn't the deprovisioning process supposed to delete or make unavailable the metadata? So other than not having canceled the registration access token, what's to be disclosed? Page 15, section B.1, 1st sentence: change “token” to “tokens”. Page 15, section B.1, 2nd sentence: change “map” to “may”.