PUT/api/apis/{api_server_id}/connect_app/{client_app_id}/scopesAuthenticated

Set a connected app's API scope allowances

Replaces which of the API server's scopes the connected client application may be granted. Restricting the user allowance, or removing a scope from it, also stops already-issued refresh tokens from carrying the removed scopes on their next rotation; a service-account scope applies from the app's next client_credentials grant.

operationId put_api_apis_api_server_id_connect_app_client_app_id_scopesAPI servers

Authentication & permissionsAuthenticated

Any authenticated user

Accepted credentials
Who may call
Any authenticated user
Notes
Organization owners/admins of the API server's owning organization, its owning user, or platform administrators.

Path parameters

NameTypeDescription
api_server_id*string

API server id

client_app_id*string

Client application id

Request body

Required

application/json
UpdateAppApiScopePolicyRequestReplaces the connection's scope allowances. Every value must be a scope the API server defines; lists hold unique values. Unknown keys are rejected.
PropertyTypeDescription
restrict_user_scopes*boolean
user_scopes*string[]

maxItems: 100

service_account_scopes*string[]

maxItems: 100

JSONExample
"restrict_user_scopes"true
"user_scopes"
"string"
"service_account_scopes"
"string"

Responses

application/json
AppApiScopePolicyResponse
PropertyTypeDescription
success*true
policy*AppApiScopePolicy

Which of the API server's scopes the connected app may be granted. restrict_user_scopes false (the default): users may grant the app every scope the API server defines (each user still consents per scope); true: only user_scopes. service_account_scopes: the scopes the app's own service account gets on the client_credentials grant, where no user consents (none by default).

restrict_user_scopes*boolean
user_scopes*string[]
service_account_scopes*string[]
JSONExample
"success"true
"policy"
"restrict_user_scopes"true
"user_scopes"
"string"
"service_account_scopes"
"string"

Example request

bashcurl
curl -X PUT 'https://auth.schemavaults.com/api/apis/<api_server_id>/connect_app/<client_app_id>/scopes' \
  -b 'refresh_token_<auth_server_app_id>=<value>' \
  -H 'Content-Type: application/json' \
  -d '{
  "restrict_user_scopes": true,
  "user_scopes": [
    "string"
  ],
  "service_account_scopes": [
    "string"
  ]
}'

Other methods on this path