Applications¶

List applications for the authenticated user¶

GET /applications

Code samples

curl -X GET https://localhost:9543/api/v0.9/applications \
  -u {username}:{password} \
  -H 'Accept: application/json' \
  -H 'Authorization: Bearer {access-token}'

Returns all applications owned by the authenticated user in the specified organization.

Authentication¶

Parameters

Name	In	Type	Required	Description
limit	query	integer	false	Maximum number of records to return.
offset	query	integer	false	Number of records to skip before returning results.

Example responses

200 Response

{
  "list": [
    {
      "id": "my-weather-app",
      "displayName": "Weather App",
      "description": "Application used to call Weather APIs.",
      "appKeyMappings": [
        {
          "asClientId": "asgardeo-client-abc123",
          "kmId": "km-uuid-12345",
          "type": "PRODUCTION"
        }
      ]
    }
  ],
  "count": 1,
  "pagination": {
    "total": 1,
    "limit": 20,
    "offset": 0
  }
}

500 Response

{
  "status": "error",
  "code": "INTERNAL_SERVER_ERROR",
  "message": "An unexpected error occurred."
}

Responses

Status	Meaning	Description	Schema
200	OK	List of application DTOs.	Inline
500	Internal Server Error	Internal server error.	ErrorResponse

Response Schema

Status Code 200

Name	Type	Required	Restrictions	Description
» list	[ApplicationResponse]	false	none	none
»» id	string	false	none	The application's handle (unique per org). Not the internal database uuid.
»» displayName	string	false	none	none
»» description	string	false	none	none
»» appKeyMappings	[ApplicationKeyMappingSummary]	false	none	[OAuth client ID mapping entry attached to an application.]
»»» asClientId	string	false	none	OAuth client ID, created directly in the key manager and linked to this application.
»»» kmId	string	false	none	UUID of the key manager this client ID is linked to.
»»» type	string	false	none	Key type for this mapping.
»» createdBy	string	false	none	Identity of the user who created this application, or `deleted_user` if that user's IDP reference no longer exists. Present on single-resource GET responses and list items.
»» updatedBy	string	false	none	Identity of the user who last updated this application, or `deleted_user` if that user's IDP reference no longer exists. Present on single-resource GET responses only, omitted on list items.
»» createdAt	string(date-time)	false	none	none
»» updatedAt	string(date-time)	false	none	none
» count	integer	false	none	Number of items returned in this page.
» pagination	Pagination	false	none	Standard pagination metadata returned with collection responses.
»» total	integer	true	none	Total number of records matching the query.
»» limit	integer	true	none	Maximum number of records returned in this response.
»» offset	integer	true	none	Number of records skipped before this page.

Enumerated Values

Property	Value
type	PRODUCTION
type	SANDBOX

Create an application¶

POST /applications

Code samples

curl -X POST https://localhost:9543/api/v0.9/applications \
  -u {username}:{password} \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json' \
  -H 'Authorization: Bearer {access-token}' \
  -d @payload.json

Creates a Developer Portal application in the specified organization. The request may be JSON, multipart form fields, or an application YAML file in the application multipart field. An application.created webhook event is published to the organization's configured webhook subscribers.

Payload

{
  "displayName": "Weather App",
  "id": "my-weather-app",
  "description": "Application used to call Weather APIs."
}

displayName: Weather App
id: my-weather-app
description: Application used to call Weather APIs.

Authentication¶

Parameters

Name	In	Type	Required	Description
body	body	ApplicationRequest	true	Application payload. Send JSON, multipart form fields, or an application YAML file in the `application` field. The JSON example below (`displayName`, `id`, `description`) applies only to the `application/json` content type. When an application YAML file is uploaded instead, its content must use the nested shape `metadata.name` (handle) and `spec.displayName` / `spec.description` — any top-level `id` inside that YAML file is ignored.

Example responses

201 Response

{
  "id": "my-weather-app",
  "displayName": "Weather App",
  "description": "Application used to call Weather APIs.",
  "appKeyMappings": []
}

Bad request. Validation and other bad-request errors are returned as a standard error object (field-level details, when present, are carried in its errors array); some legacy handlers return a message-only object.

{
  "status": "error",
  "code": "MISSING_REQUIRED_PARAMETER",
  "message": "Missing required parameter."
}

{
  "message": "Missing or invalid fields in the request payload"
}

409 Response

{
  "status": "error",
  "code": "CONFLICT",
  "message": "Conflict"
}

500 Response

{
  "status": "error",
  "code": "INTERNAL_SERVER_ERROR",
  "message": "An unexpected error occurred."
}

Responses

Status	Meaning	Description	Schema
201	Created	Application DTO.	ApplicationResponse
400	Bad Request	Bad request. Validation and other bad-request errors are returned as a standard error object (field-level details, when present, are carried in its `errors` array); some legacy handlers return a message-only object.	Inline
409	Conflict	The request conflicts with an existing resource.	ErrorResponse
500	Internal Server Error	Internal server error.	ErrorResponse

Response Schema

Enumerated Values

Property	Value
status	error

Response Headers¶

Status	Header	Type	Format	Description
201	Location	string	uri	URL of the created application.

Get an application¶

GET /applications/{applicationId}

Code samples

curl -X GET https://localhost:9543/api/v0.9/applications/{applicationId} \
  -u {username}:{password} \
  -H 'Accept: application/json' \
  -H 'Authorization: Bearer {access-token}'

Returns the details of a single application owned by the authenticated user.

Authentication¶

Parameters

Name	In	Type	Required	Description
applicationId	path	string	true	The application's handle (unique per org).

Example responses

200 Response

{
  "id": "my-weather-app",
  "displayName": "Weather App",
  "description": "Application used to call Weather APIs.",
  "appKeyMappings": [],
  "createdBy": "[email protected]",
  "updatedBy": "[email protected]",
  "createdAt": "2026-05-07T08:30:00Z",
  "updatedAt": "2026-05-07T08:30:00Z"
}

404 Response

{
  "status": "error",
  "code": "ORG_NOT_FOUND",
  "message": "Organization not found."
}

500 Response

{
  "status": "error",
  "code": "INTERNAL_SERVER_ERROR",
  "message": "An unexpected error occurred."
}

Responses

Status	Meaning	Description	Schema
200	OK	Application DTO.	ApplicationResponse
404	Not Found	Resource not found.	ErrorResponse
500	Internal Server Error	Internal server error.	ErrorResponse

Update an application¶

PUT /applications/{applicationId}

Code samples

curl -X PUT https://localhost:9543/api/v0.9/applications/{applicationId} \
  -u {username}:{password} \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json' \
  -H 'Authorization: Bearer {access-token}' \
  -d @payload.json

Updates an application owned by the authenticated user in the specified organization. The request may be JSON, multipart form fields, or an application YAML file in the application multipart field. An application.updated webhook event is published.

Payload

{
  "displayName": "Weather App",
  "id": "my-weather-app",
  "description": "Application used to call Weather APIs."
}

displayName: Weather App
id: my-weather-app
description: Application used to call Weather APIs.

Authentication¶

Parameters

Name	In	Type	Required	Description
body	body	ApplicationRequest	true	Application payload. Send JSON, multipart form fields, or an application YAML file in the `application` field. The JSON example below (`displayName`, `id`, `description`) applies only to the `application/json` content type. When an application YAML file is uploaded instead, its content must use the nested shape `metadata.name` (handle) and `spec.displayName` / `spec.description` — any top-level `id` inside that YAML file is ignored.
applicationId	path	string	true	The application's handle (unique per org).

Example responses

200 Response

{
  "id": "my-weather-app",
  "displayName": "Weather App",
  "description": "Application used to call Weather APIs.",
  "appKeyMappings": [],
  "createdBy": "[email protected]",
  "updatedBy": "[email protected]",
  "createdAt": "2026-05-07T08:30:00Z",
  "updatedAt": "2026-05-07T08:30:00Z"
}

Bad request. Validation and other bad-request errors are returned as a standard error object (field-level details, when present, are carried in its errors array); some legacy handlers return a message-only object.

{
  "status": "error",
  "code": "MISSING_REQUIRED_PARAMETER",
  "message": "Missing required parameter."
}

{
  "message": "Missing or invalid fields in the request payload"
}

404 Response

{
  "status": "error",
  "code": "ORG_NOT_FOUND",
  "message": "Organization not found."
}

409 Response

{
  "status": "error",
  "code": "CONFLICT",
  "message": "Conflict"
}

500 Response

{
  "status": "error",
  "code": "INTERNAL_SERVER_ERROR",
  "message": "An unexpected error occurred."
}

Responses

Status	Meaning	Description	Schema
200	OK	Application DTO.	ApplicationResponse
400	Bad Request	Bad request. Validation and other bad-request errors are returned as a standard error object (field-level details, when present, are carried in its `errors` array); some legacy handlers return a message-only object.	Inline
404	Not Found	Resource not found.	ErrorResponse
409	Conflict	The request conflicts with an existing resource.	ErrorResponse
500	Internal Server Error	Internal server error.	ErrorResponse

Response Schema

Enumerated Values

Property	Value
status	error

Delete an application¶

DELETE /applications/{applicationId}

Code samples

curl -X DELETE https://localhost:9543/api/v0.9/applications/{applicationId} \
  -u {username}:{password} \
  -H 'Accept: text/plain' \
  -H 'Authorization: Bearer {access-token}'

Deletes an application owned by the authenticated user. Before removing the application record the service will make a best-effort attempt to revoke registered OAuth clients with their respective key managers and deletes all stored key mappings; failures are logged as warnings and do not abort deletion. An application.deleted webhook event is published, plus one apikey.application_updated event (with a cleared association) per API key that was associated with the application.

Authentication¶

Parameters

Name	In	Type	Required	Description
applicationId	path	string	true	The application's handle (unique per org).

Example responses

200 Response

"string"

404 Response

{
  "status": "error",
  "code": "ORG_NOT_FOUND",
  "message": "Organization not found."
}

500 Response

{
  "status": "error",
  "code": "INTERNAL_SERVER_ERROR",
  "message": "An unexpected error occurred."
}

Responses

Status	Meaning	Description	Schema
200	OK	Plain text success response.	string
404	Not Found	Resource not found.	ErrorResponse
500	Internal Server Error	Internal server error.	ErrorResponse