/api/appsAuthenticatedCreate a client application
Registers a new client application (OAuth client). The owner is resolved from the owner_type / owner_organization_id / owner_uid fields: platform-owned apps need a platform administrator, organization-owned apps an owner or admin of that organization, and user-owned apps require the allow_user_owned_resource_creation server setting. Apps flagged hardcoded cannot be created.
post_api_appsClient applicationsAuthentication & permissionsAuthenticated
Any authenticated user
- Accepted credentials
- Auth server session (refresh token cookie)
cookie "refresh_token_<auth_server_app_id>" - Access token (cookie)
cookie "access_token_<auth_server_app_id>" - Access token (Bearer)
Authorization: Bearer <JWT>
- Auth server session (refresh token cookie)
- Who may call
- Any authenticated user
Request body
Required — created_by and the ownership are derived from the caller and the requested owner fields.
| Property | Type | Description |
|---|---|---|
| app_id* | string | Client Application ID minLength: 2maxLength: 64pattern: ^[a-z0-9_-]*$ |
| app_name* | string | maxLength: 128 |
| app_description* | string | maxLength: 512 |
| created_at* | number | minimum: 0 |
| public* | boolean | |
| hardcoded* | boolean | |
| web* | boolean | |
| owner_type | "platform" | "organization" | "user" | "dynamic-client-registration" | |
| owner_organization_id | string | null | null | |
| owner_uid | string (uuid) | null (uuid) | null | |
| created_by | string (uuid) | null (uuid) | null | |
| client_uri | string (uri) | null (uri) | null | maxLength: 2048 |
| logo_uri | string (uri) | null (uri) | null | maxLength: 2048 |
| tos_uri | string (uri) | null (uri) | null | maxLength: 2048 |
| policy_uri | string (uri) | null (uri) | null | maxLength: 2048 |
| contacts | string[] | null | null | maxItems: 20 |
| grant_types | "authorization_code" | "refresh_token"[] | null | null | |
| response_types | "code"[] | null | null | |
| token_endpoint_auth_method | "none" | "client_secret_basic" | "client_secret_post" | null | null | |
| software_id | string | null | null | maxLength: 255 |
| software_version | string | null | null | maxLength: 255 |
| registered_scope | string | null | null | maxLength: 1024 |
| client_id_issued_at | integer | null | null | minimum: 0 |
Responses
| Property | Type | Description |
|---|---|---|
| success* | true | |
| message* | string | |
| resource_id* | string | Identifier of the created / affected resource |
Example request
curl -X POST 'https://auth.schemavaults.com/api/apps' \
-b 'refresh_token_<auth_server_app_id>=<value>' \
-H 'Content-Type: application/json' \
-d '{
"app_id": "string",
"app_name": "string",
"app_description": "string",
"created_at": 1.5,
"public": true,
"hardcoded": true,
"web": true,
"owner_type": "platform",
"owner_organization_id": "string",
"owner_uid": "123e4567-e89b-12d3-a456-426614174000",
"created_by": "123e4567-e89b-12d3-a456-426614174000",
"client_uri": "https://example.com",
"logo_uri": "https://example.com",
"tos_uri": "https://example.com",
"policy_uri": "https://example.com",
"contacts": [
"string"
],
"grant_types": [
"authorization_code"
],
"response_types": [
"code"
],
"token_endpoint_auth_method": "none",
"software_id": "string",
"software_version": "string",
"registered_scope": "string",
"client_id_issued_at": 1
}'