PUT/api/apis/{api_server_id}/connect_app/{client_app_id}/first-partyAdmin

Mark an app-to-API connection first-party

Whether the connection is first-party: the app and the API server belong to the same party, so users signing in to the app for the API server (the authorization request's RFC 8707 resource) consent implicitly. Such requests get the API scopes they ask for, among those the app may be granted (the connection's scope allowances still apply), without the consent screen; the app authorization and the scope consents are recorded when the authorization code is minted, so they appear on the user's third-party access page, where the user can still withdraw them (signing in again records them again). prompt=consent still shows the consent screen. Requests that ask for none of the API server's scopes are unaffected. Platform administrators only: skipping the consent screen is a statement that the app may act for every user on the API server without asking them, which neither the API server's nor the app's managers can make for themselves. Turning it off does not withdraw the consents already recorded through it; users are asked for anything new.

operationId put_api_apis_api_server_id_connect_app_client_app_id_first_partyAPI servers

Authentication & permissionsAdmin

Platform administrators only

Accepted credentials: Auth server session (refresh token cookie)cookie "refresh_token_<auth_server_app_id>"
Access token (cookie)cookie "access_token_<auth_server_app_id>"
Access token (Bearer)Authorization: Bearer <JWT>
Who may call: Platform administrators only

Path parameters

Name	Type	Description
api_server_id*	string	API server id
client_app_id*	string	Client application id

Request body

Required

application/json

UpdateAppApiConnectionFirstPartyRequestMarks the connection first-party (true) or not (false). Unknown keys are rejected.

Property	Type	Description
first_party*	boolean

JSONExample

"first_party"true

Responses

application/json

AppApiConnectionFirstPartyResponse

Property	Type	Description
success*	true
first_party*	boolean	Whether the connection is first-party: the app and the API server belong to the same party, so users signing in to the app for the API server (the authorization request's RFC 8707 `resource`) consent implicitly. Such requests get the API scopes they ask for, among those the app may be granted (the connection's scope allowances still apply), without the consent screen; the app authorization and the scope consents are recorded when the authorization code is minted, so they appear on the user's third-party access page, where the user can still withdraw them (signing in again records them again). `prompt=consent` still shows the consent screen. Requests that ask for none of the API server's scopes are unaffected.

JSONExample

"success"true

"first_party"true

Example request

bashcurl

curl -X PUT 'https://auth.schemavaults.com/api/apis/<api_server_id>/connect_app/<client_app_id>/first-party' \
  -b 'refresh_token_<auth_server_app_id>=<value>' \
  -H 'Content-Type: application/json' \
  -d '{
  "first_party": true
}'

Other methods on this path

GETGet whether an app-to-API connection is first-party

Authentication & permissionsAdmin

Path parameters

Request body

Responses

200Whether the connection is now first-party

400The request failed validation (issues lists the offending fields) or was refused by the handler

401No valid session cookie, access token cookie or bearer access token was presented, or the token was revoked

403The caller is not a platform administrator

404No such app or API server, or they are not connected

500Failed to update the connection

Example request

Other methods on this path