GET/api/apis/{api_server_id}/connect_app/{client_app_id}/first-partyAuthenticated

Get whether an app-to-API connection is first-party

Whether the connection is first-party: the app and the API server belong to the same party, so users signing in to the app for the API server (the authorization request's RFC 8707 resource) consent implicitly. Such requests get the API scopes they ask for, among those the app may be granted (the connection's scope allowances still apply), without the consent screen; the app authorization and the scope consents are recorded when the authorization code is minted, so they appear on the user's third-party access page, where the user can still withdraw them (signing in again records them again). prompt=consent still shows the consent screen. Requests that ask for none of the API server's scopes are unaffected. Off by default.

operationId get_api_apis_api_server_id_connect_app_client_app_id_first_partyAPI servers

Authentication & permissionsAuthenticated

Any authenticated user

Accepted credentials
Who may call
Any authenticated user
Notes
Organization owners/admins (or the owning user) of the API server or of the app, or platform administrators.

Path parameters

NameTypeDescription
api_server_id*string

API server id

client_app_id*string

Client application id

Responses

application/json
AppApiConnectionFirstPartyResponse
PropertyTypeDescription
success*true
first_party*boolean

Whether the connection is first-party: the app and the API server belong to the same party, so users signing in to the app for the API server (the authorization request's RFC 8707 resource) consent implicitly. Such requests get the API scopes they ask for, among those the app may be granted (the connection's scope allowances still apply), without the consent screen; the app authorization and the scope consents are recorded when the authorization code is minted, so they appear on the user's third-party access page, where the user can still withdraw them (signing in again records them again). prompt=consent still shows the consent screen. Requests that ask for none of the API server's scopes are unaffected.

JSONExample
"success"true
"first_party"true

Example request

bashcurl
curl -X GET 'https://auth.schemavaults.com/api/apis/<api_server_id>/connect_app/<client_app_id>/first-party' \
  -b 'refresh_token_<auth_server_app_id>=<value>'

Other methods on this path

GET /api/apis/{api_server_id}/connect_app/{client_app_id}/first-party | SchemaVaults Auth API