DELETE/api/apps/{app_id}/callback-urls/{app_callback_url_ref_id}Authenticated

Remove a callback URL from an app

Removes a callback URL from a client application's explicit allowlist. When the last one for an environment is removed, a public client accepts no redirect_uri in that environment any more, while a confidential client falls back to accepting any path on the app's domains. Requires management access; hardcoded apps cannot be configured.

operationId delete_api_apps_app_id_callback_urls_app_callback_url_ref_idClient applications

Authentication & permissionsAuthenticated

Any authenticated user

Accepted credentials: Auth server session (refresh token cookie)cookie "refresh_token_<auth_server_app_id>"
Access token (cookie)cookie "access_token_<auth_server_app_id>"
Access token (Bearer)Authorization: Bearer <JWT>
Who may call: Any authenticated user

Path parameters

Name	Type	Description
app_id*	string	Client application id
app_callback_url_ref_id*	string (uuid)	The callback URL reference id

Responses

application/json

SuccessMessageResponse

Property	Type	Description
success*	true
message*	string

JSONExample

"success"true

"message""string"

Example request

bashcurl

curl -X DELETE 'https://auth.schemavaults.com/api/apps/<app_id>/callback-urls/<app_callback_url_ref_id>' \
  -b 'refresh_token_<auth_server_app_id>=<value>'

Authentication & permissionsAuthenticated

Path parameters

Responses

200The callback URL was removed

400The request failed validation (issues lists the offending fields) or was refused by the handler

401No valid session cookie, access token cookie or bearer access token was presented, or the token was revoked

403The app is hardcoded, or the caller may not manage it (platform administrators, owners / admins of the owning organization, or the owning user only)

404No such app, or no callback URL with the given id for this app

500Failed to load the app or verify authorization

Example request