Application Keys¶

Map an OAuth client_id to a Developer Portal application¶

POST /applications/{applicationId}/generate-keys

Code samples

curl -X POST https://localhost:9543/api/v0.9/applications/{applicationId}/generate-keys \
  -u {username}:{password} \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json' \
  -H 'Authorization: Bearer {access-token}' \
  -d @payload.json

Maps an OAuth client_id — created directly in the selected key manager — to the specified application. The portal does not create or register OAuth clients; it only stores the client_id reference and later proxies token requests for it.

Payload

{
  "keyManager": "Resident Key Manager",
  "type": "PRODUCTION",
  "consumerKey": "consumer-key-123"
}

Authentication¶

Parameters

Name	In	Type	Required	Description
body	body	AppKeyMappingRequest	true	Maps an OAuth client_id — created directly in the key manager — to this application. The application is identified by the `applicationId` path parameter.
applicationId	path	string	true	The application's handle (unique per org).

Example responses

200 Response

{
  "keyMappingId": "km-12345",
  "keyManager": "Resident Key Manager",
  "type": "PRODUCTION",
  "consumerKey": "consumer-key-123",
  "tokenEndpoint": "https://api.asgardeo.io/t/myorg/oauth2/token"
}

Bad request. Validation and other bad-request errors are returned as a standard error object (field-level details, when present, are carried in its errors array); some legacy handlers return a message-only object.

{
  "status": "error",
  "code": "MISSING_REQUIRED_PARAMETER",
  "message": "Missing required parameter."
}

{
  "message": "Missing or invalid fields in the request payload"
}

404 Response

{
  "status": "error",
  "code": "ORG_NOT_FOUND",
  "message": "Organization not found."
}

409 Response

{
  "status": "error",
  "code": "CONFLICT",
  "message": "Conflict"
}

500 Response

{
  "status": "error",
  "code": "INTERNAL_SERVER_ERROR",
  "message": "An unexpected error occurred."
}

Responses

Status	Meaning	Description	Schema
200	OK	Application OAuth key mapping response.	ApplicationOAuthKeyResponse
400	Bad Request	Bad request. Validation and other bad-request errors are returned as a standard error object (field-level details, when present, are carried in its `errors` array); some legacy handlers return a message-only object.	Inline
404	Not Found	Resource not found.	ErrorResponse
409	Conflict	The request conflicts with an existing resource.	ErrorResponse
500	Internal Server Error	Internal server error.	ErrorResponse

Response Schema

Enumerated Values

Property	Value
status	error

Generate an OAuth access token¶

POST /applications/{applicationId}/oauth-keys/{keyMappingId}/generate-token

Code samples

curl -X POST https://localhost:9543/api/v0.9/applications/{applicationId}/oauth-keys/{keyMappingId}/generate-token \
  -u {username}:{password} \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json' \
  -H 'Authorization: Bearer {access-token}' \
  -d @payload.json

Generates an access token for an existing application OAuth key mapping. The portal calls the Authorization Server token endpoint directly using the client appKeyMappings supplied in consumerSecret.

Payload

{
  "consumerSecret": "my-consumer-secret",
  "scopes": [
    "weather.read"
  ],
  "validityPeriod": 3600
}

Authentication¶

Parameters

Name	In	Type	Required	Description
body	body	OAuthGenerateTokenRequest	false	OAuth token generation payload. The portal calls the Authorization Server token endpoint directly.
applicationId	path	string	true	The application's handle (unique per org).
keyMappingId	path	string	true	none

Example responses

200 Response

{
  "accessToken": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.example",
  "validityTime": 3600,
  "tokenScopes": [
    "weather.read"
  ]
}

Bad request. Validation and other bad-request errors are returned as a standard error object (field-level details, when present, are carried in its errors array); some legacy handlers return a message-only object.

{
  "status": "error",
  "code": "MISSING_REQUIRED_PARAMETER",
  "message": "Missing required parameter."
}

{
  "message": "Missing or invalid fields in the request payload"
}

404 Response

{
  "status": "error",
  "code": "ORG_NOT_FOUND",
  "message": "Organization not found."
}

500 Response

{
  "status": "error",
  "code": "INTERNAL_SERVER_ERROR",
  "message": "An unexpected error occurred."
}

Responses

Status	Meaning	Description	Schema
200	OK	OAuth access token response.	OAuthTokenResponse
400	Bad Request	Bad request. Validation and other bad-request errors are returned as a standard error object (field-level details, when present, are carried in its `errors` array); some legacy handlers return a message-only object.	Inline
404	Not Found	Resource not found.	ErrorResponse
500	Internal Server Error	Internal server error.	ErrorResponse

Response Schema

Enumerated Values

Property	Value
status	error

Remove an OAuth client_id mapping¶

DELETE /applications/{applicationId}/oauth-keys/{keyMappingId}

Code samples

curl -X DELETE https://localhost:9543/api/v0.9/applications/{applicationId}/oauth-keys/{keyMappingId} \
  -u {username}:{password} \
  -H 'Accept: application/json' \
  -H 'Authorization: Bearer {access-token}'

Removes the local client_id mapping for an application. This does not affect the OAuth client in the key manager — that client is owned and managed externally.

Authentication¶

Parameters

Name	In	Type	Required	Description
applicationId	path	string	true	The application's handle (unique per org).
keyMappingId	path	string	true	none

Example responses

200 Response

{
  "message": "Operation completed successfully"
}

404 Response

{
  "status": "error",
  "code": "ORG_NOT_FOUND",
  "message": "Organization not found."
}

500 Response

{
  "status": "error",
  "code": "INTERNAL_SERVER_ERROR",
  "message": "An unexpected error occurred."
}

Responses

Status	Meaning	Description	Schema
200	OK	Message or generic response payload.	Inline
404	Not Found	Resource not found.	ErrorResponse
500	Internal Server Error	Internal server error.	ErrorResponse