GET/api/apps/{app_id}/client-secretAuthenticated

Get client secret metadata

Reports whether a client application has a client secret (is a confidential client) and when it was generated / rotated. The secret itself is never retrievable after generation. Requires management access; hardcoded apps cannot be configured.

operationId get_api_apps_app_id_client_secretClient applications

Authentication & permissionsAuthenticated

Any authenticated user

Accepted credentials: Auth server session (refresh token cookie)cookie "refresh_token_<auth_server_app_id>"
Access token (cookie)cookie "access_token_<auth_server_app_id>"
Access token (Bearer)Authorization: Bearer <JWT>
Who may call: Any authenticated user

Path parameters

Name	Type	Description
app_id*	string	Client application id

Responses

application/json

ClientSecretMetadataResponse

Property	Type	Description
success*	true
has_client_secret*	boolean	Whether the app currently has a client secret (is a confidential client)
created_at	number	First-generation time (ms since epoch); absent without a secret
updated_at	number	Last generation / rotation time (ms since epoch); absent without a secret

JSONExample

"success"true

"has_client_secret"true

"created_at"1.5

"updated_at"1.5

Example request

bashcurl

curl -X GET 'https://auth.schemavaults.com/api/apps/<app_id>/client-secret' \
  -b 'refresh_token_<auth_server_app_id>=<value>'

Authentication & permissionsAuthenticated

Path parameters

Responses

200The client secret metadata

400The request failed validation (issues lists the offending fields) or was refused by the handler

401No valid session cookie, access token cookie or bearer access token was presented, or the token was revoked

403The app is hardcoded, or the caller may not manage it (platform administrators, owners / admins of the owning organization, or the owning user only)

404No such app

500Failed to load the app or verify authorization

Example request

Other methods on this path