POST/api/appsAuthenticated

Create a client application

Registers a new client application (OAuth client). The owner is resolved from the owner_type / owner_organization_id / owner_uid fields: platform-owned apps need a platform administrator, organization-owned apps an owner or admin of that organization, and user-owned apps require the allow_user_owned_resource_creation server setting. Apps flagged hardcoded cannot be created. The optional initial_domains (http(s) origins) and initial_callback_urls (exact redirect_uri values) are registered in the same transaction as the app: if any is refused, nothing is created. Callback URLs are optional, but without one in an environment a public client (no client secret) cannot sign users in there, and a confidential client accepts any path on its domains as a redirect_uri.

operationId post_api_appsClient applications

Authentication & permissionsAuthenticated

Any authenticated user

Accepted credentials: Auth server session (refresh token cookie)cookie "refresh_token_<auth_server_app_id>"
Access token (cookie)cookie "access_token_<auth_server_app_id>"
Access token (Bearer)Authorization: Bearer <JWT>
Who may call: Any authenticated user

Request body

Required — The app definition plus optional initial domains and callback URLs. created_by and the ownership are derived from the caller and the requested owner fields.

application/json

SchemaVaultsAppCreationRequest

Property	Type	Description
app_id*	string	Client Application ID minLength: 2maxLength: 64pattern: ^[a-z0-9_-]*$
app_name*	string	maxLength: 128
app_description*	string	maxLength: 512
created_at*	number	minimum: 0
public*	boolean
hardcoded*	boolean
web*	boolean
owner_type	"platform" \| "organization" \| "user" \| "dynamic-client-registration"
owner_organization_id	string \| null \| null
owner_uid	string (uuid) \| null (uuid) \| null
created_by	string (uuid) \| null (uuid) \| null
client_uri	string (uri) \| null (uri) \| null	maxLength: 2048
logo_uri	string (uri) \| null (uri) \| null	maxLength: 2048
tos_uri	string (uri) \| null (uri) \| null	maxLength: 2048
policy_uri	string (uri) \| null (uri) \| null	maxLength: 2048
contacts	string[] \| null \| null	maxItems: 20
grant_types	"authorization_code" \| "refresh_token"[] \| null \| null
response_types	"code"[] \| null \| null
token_endpoint_auth_method	"none" \| "client_secret_basic" \| "client_secret_post" \| null \| null
software_id	string \| null \| null	maxLength: 255
software_version	string \| null \| null	maxLength: 255
registered_scope	string \| null \| null	maxLength: 1024
client_id_issued_at	integer \| null \| null	minimum: 0
initial_domains	object[]	maxItems: 10
domain*	string	maxLength: 255
environment*	"development" \| "staging" \| "test" \| "production"
initial_callback_urls	object[]	maxItems: 20
callback_url*	string (uri)	maxLength: 2048
environment*	"development" \| "staging" \| "test" \| "production"

JSONExample

"app_id""string"

"app_name""string"

"app_description""string"

"created_at"1.5

"public"true

"hardcoded"true

"web"true

"owner_type""platform"

"owner_organization_id""string"

"owner_uid""123e4567-e89b-12d3-a456-426614174000"

"created_by""123e4567-e89b-12d3-a456-426614174000"

"client_uri""https://example.com"

"logo_uri""https://example.com"

"tos_uri""https://example.com"

"policy_uri""https://example.com"

"contacts"

"string"

"grant_types"

"authorization_code"

"response_types"

"code"

"token_endpoint_auth_method""none"

"software_id""string"

"software_version""string"

"registered_scope""string"

"client_id_issued_at"1

"initial_domains"

"domain""string"

"environment""development"

"initial_callback_urls"

"callback_url""https://example.com"

"environment""development"

Responses

application/json

ResourceCreationResponse

Property	Type	Description
success*	true
message*	string
resource_id*	string	Identifier of the created / affected resource

JSONExample

"success"true

"message""string"

"resource_id""string"

Example request

bashcurl

curl -X POST 'https://auth.schemavaults.com/api/apps' \
  -b 'refresh_token_<auth_server_app_id>=<value>' \
  -H 'Content-Type: application/json' \
  -d '{
  "app_id": "string",
  "app_name": "string",
  "app_description": "string",
  "created_at": 1.5,
  "public": true,
  "hardcoded": true,
  "web": true,
  "owner_type": "platform",
  "owner_organization_id": "string",
  "owner_uid": "123e4567-e89b-12d3-a456-426614174000",
  "created_by": "123e4567-e89b-12d3-a456-426614174000",
  "client_uri": "https://example.com",
  "logo_uri": "https://example.com",
  "tos_uri": "https://example.com",
  "policy_uri": "https://example.com",
  "contacts": [
    "string"
  ],
  "grant_types": [
    "authorization_code"
  ],
  "response_types": [
    "code"
  ],
  "token_endpoint_auth_method": "none",
  "software_id": "string",
  "software_version": "string",
  "registered_scope": "string",
  "client_id_issued_at": 1,
  "initial_domains": [
    {
      "domain": "string",
      "environment": "development"
    }
  ],
  "initial_callback_urls": [
    {
      "callback_url": "https://example.com",
      "environment": "development"
    }
  ]
}'

Other methods on this path

GETList client applications

Authentication & permissionsAuthenticated

Request body

Responses

200The app was created

400The request failed validation (issues lists the offending fields) or was refused by the handler

401No valid session cookie, access token cookie or bearer access token was presented, or the token was revoked

403The account is disabled, or the credential is valid but not allowed to perform this operation

409An app with this id already exists, or a listed domain / callback URL is a duplicate

500Failed to create the app

Example request

Other methods on this path