diff --git a/go.mod b/go.mod
index 037eaf2..bf879a8 100644
--- a/go.mod
+++ b/go.mod
@@ -8,6 +8,7 @@ tool (
 )
 
 require (
+	buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.11-20260415201107-50325440f8f2.1
 	google.golang.org/grpc v1.80.0
 	google.golang.org/protobuf v1.36.11
 )
diff --git a/go.sum b/go.sum
index e09d98f..f397197 100644
--- a/go.sum
+++ b/go.sum
@@ -1,3 +1,5 @@
+buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.11-20260415201107-50325440f8f2.1 h1:s6hzCXtND/ICdGPTMGk7C+/BFlr2Jg5GyH0NKf4XGXg=
+buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.11-20260415201107-50325440f8f2.1/go.mod h1:tvtbpgaVXZX4g6Pn+AnzFycuRK3MOz5HJfEGeEllXYM=
 github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
 github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
diff --git a/proto/kms/api/cmk/sessionmanager/oidcmapping/v1/oidcmapping.pb.go b/proto/kms/api/cmk/sessionmanager/oidcmapping/v1/oidcmapping.pb.go
index 76ecb80..7f35ea5 100644
--- a/proto/kms/api/cmk/sessionmanager/oidcmapping/v1/oidcmapping.pb.go
+++ b/proto/kms/api/cmk/sessionmanager/oidcmapping/v1/oidcmapping.pb.go
@@ -7,6 +7,7 @@
 package oidcmappingv1
 
 import (
+	_ "buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go/buf/validate"
 	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
 	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
 	reflect "reflect"
@@ -29,7 +30,7 @@ type ApplyOIDCMappingRequest struct {
 	JwksUri       *string                `protobuf:"bytes,3,opt,name=jwks_uri,json=jwksUri,proto3,oneof" json:"jwks_uri,omitempty"`
 	Audiences     []string               `protobuf:"bytes,4,rep,name=audiences,proto3" json:"audiences,omitempty"`
 	Properties    map[string]string      `protobuf:"bytes,5,rep,name=properties,proto3" json:"properties,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
-	ClientId      *string                `protobuf:"bytes,6,opt,name=client_id,json=clientId,proto3,oneof" json:"client_id,omitempty"`
+	ClientId      string                 `protobuf:"bytes,6,opt,name=client_id,json=clientId,proto3" json:"client_id,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
@@ -100,8 +101,8 @@ func (x *ApplyOIDCMappingRequest) GetProperties() map[string]string {
 }
 
 func (x *ApplyOIDCMappingRequest) GetClientId() string {
-	if x != nil && x.ClientId != nil {
-		return *x.ClientId
+	if x != nil {
+		return x.ClientId
 	}
 	return ""
 }
@@ -453,7 +454,7 @@ var File_kms_api_cmk_sessionmanager_oidcmapping_v1_oidcmapping_proto protoreflec
 
 const file_kms_api_cmk_sessionmanager_oidcmapping_v1_oidcmapping_proto_rawDesc = "" +
 	"\n" +
-	";kms/api/cmk/sessionmanager/oidcmapping/v1/oidcmapping.proto\x12)kms.api.cmk.sessionmanager.oidcmapping.v1\"\xfc\x02\n" +
+	";kms/api/cmk/sessionmanager/oidcmapping/v1/oidcmapping.proto\x12)kms.api.cmk.sessionmanager.oidcmapping.v1\x1a\x1bbuf/validate/validate.proto\"\xf2\x02\n" +
 	"\x17ApplyOIDCMappingRequest\x12\x1b\n" +
 	"\ttenant_id\x18\x01 \x01(\tR\btenantId\x12\x16\n" +
 	"\x06issuer\x18\x02 \x01(\tR\x06issuer\x12\x1e\n" +
@@ -461,14 +462,12 @@ const file_kms_api_cmk_sessionmanager_oidcmapping_v1_oidcmapping_proto_rawDesc =
 	"\taudiences\x18\x04 \x03(\tR\taudiences\x12r\n" +
 	"\n" +
 	"properties\x18\x05 \x03(\v2R.kms.api.cmk.sessionmanager.oidcmapping.v1.ApplyOIDCMappingRequest.PropertiesEntryR\n" +
-	"properties\x12 \n" +
-	"\tclient_id\x18\x06 \x01(\tH\x01R\bclientId\x88\x01\x01\x1a=\n" +
+	"properties\x12$\n" +
+	"\tclient_id\x18\x06 \x01(\tB\a\xbaH\x04r\x02\x10\x01R\bclientId\x1a=\n" +
 	"\x0fPropertiesEntry\x12\x10\n" +
 	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
 	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01B\v\n" +
-	"\t_jwks_uriB\f\n" +
-	"\n" +
-	"_client_id\"_\n" +
+	"\t_jwks_uri\"_\n" +
 	"\x18ApplyOIDCMappingResponse\x12\x18\n" +
 	"\asuccess\x18\x01 \x01(\bR\asuccess\x12\x1d\n" +
 	"\amessage\x18\x02 \x01(\tH\x00R\amessage\x88\x01\x01B\n" +
diff --git a/proto/kms/api/cmk/sessionmanager/oidcmapping/v1/oidcmapping.proto b/proto/kms/api/cmk/sessionmanager/oidcmapping/v1/oidcmapping.proto
index 6898bce..da351ed 100644
--- a/proto/kms/api/cmk/sessionmanager/oidcmapping/v1/oidcmapping.proto
+++ b/proto/kms/api/cmk/sessionmanager/oidcmapping/v1/oidcmapping.proto
@@ -2,6 +2,8 @@ syntax = "proto3";
 
 package kms.api.cmk.sessionmanager.oidcmapping.v1;
 
+import "buf/validate/validate.proto";
+
 option go_package = "github.com/openkcm/api-sdk/proto/kms/api/cmk/sessionmanager/oidcmapping/v1;oidcmappingv1";
 
 service Service {
@@ -18,7 +20,7 @@ message ApplyOIDCMappingRequest {
   optional string jwks_uri = 3;
   repeated string audiences = 4;
   map<string, string> properties = 5;
-  optional string client_id = 6;
+  string client_id = 6 [(buf.validate.field).string.min_len = 1];
 }
 
 message ApplyOIDCMappingResponse {