Application API

Endpoint	Method	Description
application:createApplication	websocket	Create application
application:updateApplication	websocket	Update application
application:deleteApplication	websocket	Delete application
application:getApplication	websocket	Get application
application:createVersion	websocket	Create application version
application:updateVersion	websocket	Update application version
application:getVersion	websocket	Get application version
application:listVersions	websocket	List application versions
application:submitVersionForReview	websocket	Submit application version for review
application:cancelVersionReview	websocket	Cancel application version review
application:reviewVersion	websocket	Review application version
application:publishVersion	websocket	Publish application version
application:updatePublishedNetworks	websocket	Update application published networks
application:setDefaultApplication	websocket	Set default application
application:removeDefaultApplication	websocket	Remove default application
application:getDefaultApplication	websocket	Get default application
application:listVersionReviews	websocket	List application version reviews
application:assignRole	websocket	Assign application role
application:removeRole	websocket	Remove application role
application:listRoles	websocket	List application roles
application:transferOwnership	websocket	Transfer application ownership
application:addExternalTester	websocket	Add external tester
application:removeExternalTester	websocket	Remove external tester
application:listExternalTesters	websocket	List external testers
application:searchPublishedApplications	websocket	Search published applications
application:searchMyApplications	websocket	Search my applications
application:searchMyTesterAssignments	websocket	Search my tester assignments
application:searchReviewQueue	websocket	Search application review queue
appManifest:getIdentityToken	websocket	Get identity token
application:createClientCredentials	websocket	Create application client credentials
application:regenerateClientCredentials	websocket	Regenerate application client credentials
application:deleteClientCredentials	websocket	Delete application client credentials
application:getClientCredentials	websocket	Get application client credentials
application:revealClientCredentialsSecret	websocket	Reveal application client credentials secret
application:createOidcClient	websocket	Create application oidc client
application:regenerateOidcClientSecret	websocket	Regenerate application oidc client secret
application:deleteOidcClient	websocket	Delete application oidc client
application:updateOidcClientRedirectUris	websocket	Update application oidc client redirect uris
application:getOidcClient	websocket	Get application oidc client

Create application

Method: websocket

Endpoint: application:createApplication

Request:

{
    "data": {
        "name": string
        "description": string
        "version": string  // developer-supplied, e.g. v1.1.1 or v1.1.1#hash; defaults to v1.0.0 if empty
    }
    "event": { "id": string, "date": timestamp }
}

Response:

{
    "data": {
        "id": string
        "created": timestamp
        "updated": timestamp
        "name": string
        "description": string
        "version": string  // label of the most recently created version, e.g. v1.1.1 or v1.1.1#hash
        "oidcClientId": string  // id of the separate AuthClient used for OIDC login; empty if not yet configured
    }
    "error": { "status": bool, "code": int, "message": string }
}

Update application

Method: websocket

Endpoint: application:updateApplication

Request:

{
    "data": {
        "applicationId": string
        "name": string
        "description": string
    }
    "event": { "id": string, "date": timestamp }
}

Response:

{
    "data": {
        "id": string
        "created": timestamp
        "updated": timestamp
        "name": string
        "description": string
        "version": string  // label of the most recently created version, e.g. v1.1.1 or v1.1.1#hash
        "oidcClientId": string  // id of the separate AuthClient used for OIDC login; empty if not yet configured
    }
    "error": { "status": bool, "code": int, "message": string }
}

Delete application

Method: websocket

Endpoint: application:deleteApplication

Request:

{
    "data": {
        "applicationId": string
    }
    "event": { "id": string, "date": timestamp }
}

Response:

{
    "error": { "status": bool, "code": int, "message": string }
}

Get application

Method: websocket

Endpoint: application:getApplication

Request:

{
    "data": {
        "applicationId": string
    }
    "event": { "id": string, "date": timestamp }
}

Response:

{
    "data": {
        "id": string
        "created": timestamp
        "updated": timestamp
        "name": string
        "description": string
        "version": string  // label of the most recently created version, e.g. v1.1.1 or v1.1.1#hash
        "oidcClientId": string  // id of the separate AuthClient used for OIDC login; empty if not yet configured
    }
    "error": { "status": bool, "code": int, "message": string }
}

Create application version

Method: websocket

Endpoint: application:createVersion

Request:

{
    "data": {
        "applicationId": string
        "version": string  // developer-supplied, e.g. v1.1.1 or v1.1.1#hash; auto-filled by bumping the patch of the latest version if empty
        "customParams": map[string]{ custom structure }
    }
    "event": { "id": string, "date": timestamp }
}

Response:

{
    "data": {
        "applicationId": string
        "version": string  // developer-supplied, e.g. v1.1.1 or v1.1.1#hash
        "status": string  // draft/inReview/approved/released/rejected
        "customParams": map[string]{ custom structure }  // client-defined data: icons, client/interface settings, permissions, etc
        "requestedNetworks": [ string ]  // developer's requested networks on submit; ['all'] or specific network ids
        "requestedExcludedNetworks": [ string ]  // excluded network ids, only meaningful alongside 'all'
        "approvedNetworks": [ string ]  // reviewer's approved networks, set on approval; may differ from requested
        "approvedExcludedNetworks": [ string ]  // excluded network ids, only meaningful alongside 'all'
        "submitComment": string  // developer's note to the reviewer, set on submit
        "created": timestamp
        "updated": timestamp
    }
    "error": { "status": bool, "code": int, "message": string }
}

Update application version

Method: websocket

Endpoint: application:updateVersion

Request:

{
    "data": {
        "applicationId": string
        "version": string
        "customParams": map[string]{ custom structure }
    }
    "event": { "id": string, "date": timestamp }
}

Response:

{
    "data": {
        "applicationId": string
        "version": string  // developer-supplied, e.g. v1.1.1 or v1.1.1#hash
        "status": string  // draft/inReview/approved/released/rejected
        "customParams": map[string]{ custom structure }  // client-defined data: icons, client/interface settings, permissions, etc
        "requestedNetworks": [ string ]  // developer's requested networks on submit; ['all'] or specific network ids
        "requestedExcludedNetworks": [ string ]  // excluded network ids, only meaningful alongside 'all'
        "approvedNetworks": [ string ]  // reviewer's approved networks, set on approval; may differ from requested
        "approvedExcludedNetworks": [ string ]  // excluded network ids, only meaningful alongside 'all'
        "submitComment": string  // developer's note to the reviewer, set on submit
        "created": timestamp
        "updated": timestamp
    }
    "error": { "status": bool, "code": int, "message": string }
}

Get application version

Method: websocket

Endpoint: application:getVersion

Request:

{
    "data": {
        "applicationId": string
        "version": string
    }
    "event": { "id": string, "date": timestamp }
}

Response:

{
    "data": {
        "applicationId": string
        "version": string  // developer-supplied, e.g. v1.1.1 or v1.1.1#hash
        "status": string  // draft/inReview/approved/released/rejected
        "customParams": map[string]{ custom structure }  // client-defined data: icons, client/interface settings, permissions, etc
        "requestedNetworks": [ string ]  // developer's requested networks on submit; ['all'] or specific network ids
        "requestedExcludedNetworks": [ string ]  // excluded network ids, only meaningful alongside 'all'
        "approvedNetworks": [ string ]  // reviewer's approved networks, set on approval; may differ from requested
        "approvedExcludedNetworks": [ string ]  // excluded network ids, only meaningful alongside 'all'
        "submitComment": string  // developer's note to the reviewer, set on submit
        "created": timestamp
        "updated": timestamp
    }
    "error": { "status": bool, "code": int, "message": string }
}

List application versions

Method: websocket

Endpoint: application:listVersions

Request:

{
    "data": {
        "applicationId": string
    }
    "event": { "id": string, "date": timestamp }
}

Response:

{
    "data": {
        "versions": [{
            "applicationId": string
            "version": string  // developer-supplied, e.g. v1.1.1 or v1.1.1#hash
            "status": string  // draft/inReview/approved/released/rejected
            "customParams": map[string]{ custom structure }  // client-defined data: icons, client/interface settings, permissions, etc
            "requestedNetworks": [ string ]  // developer's requested networks on submit; ['all'] or specific network ids
            "requestedExcludedNetworks": [ string ]  // excluded network ids, only meaningful alongside 'all'
            "approvedNetworks": [ string ]  // reviewer's approved networks, set on approval; may differ from requested
            "approvedExcludedNetworks": [ string ]  // excluded network ids, only meaningful alongside 'all'
            "submitComment": string  // developer's note to the reviewer, set on submit
            "created": timestamp
            "updated": timestamp
        }]
    }
    "error": { "status": bool, "code": int, "message": string }
}

Submit application version for review

Method: websocket

Endpoint: application:submitVersionForReview

Description: Fails if another version of this Application is already inReview or approved - only one version may be in the review pipeline at a time.

Request:

{
    "data": {
        "applicationId": string
        "version": string
        "networks": [ string ]  // ['all'] or specific network ids; defaults to previously published networks, or the caller's current network
        "excludedNetworks": [ string ]  // excluded network ids, only meaningful alongside 'all'
        "comment": string  // developer's note to the reviewer, e.g. what changed or what to focus review on
    }
    "event": { "id": string, "date": timestamp }
}

Response:

{
    "data": {
        "applicationId": string
        "version": string  // developer-supplied, e.g. v1.1.1 or v1.1.1#hash
        "status": string  // draft/inReview/approved/released/rejected
        "customParams": map[string]{ custom structure }  // client-defined data: icons, client/interface settings, permissions, etc
        "requestedNetworks": [ string ]  // developer's requested networks on submit; ['all'] or specific network ids
        "requestedExcludedNetworks": [ string ]  // excluded network ids, only meaningful alongside 'all'
        "approvedNetworks": [ string ]  // reviewer's approved networks, set on approval; may differ from requested
        "approvedExcludedNetworks": [ string ]  // excluded network ids, only meaningful alongside 'all'
        "submitComment": string  // developer's note to the reviewer, set on submit
        "created": timestamp
        "updated": timestamp
    }
    "error": { "status": bool, "code": int, "message": string }
}

Cancel application version review

Method: websocket

Endpoint: application:cancelVersionReview

Description: Withdraws a submission, moving an inReview or approved (not yet published) version back to draft. Discards every review decision recorded for this version and removes its review queue entry.

Request:

{
    "data": {
        "applicationId": string
        "version": string
    }
    "event": { "id": string, "date": timestamp }
}

Response:

{
    "data": {
        "applicationId": string
        "version": string  // developer-supplied, e.g. v1.1.1 or v1.1.1#hash
        "status": string  // draft/inReview/approved/released/rejected
        "customParams": map[string]{ custom structure }  // client-defined data: icons, client/interface settings, permissions, etc
        "requestedNetworks": [ string ]  // developer's requested networks on submit; ['all'] or specific network ids
        "requestedExcludedNetworks": [ string ]  // excluded network ids, only meaningful alongside 'all'
        "approvedNetworks": [ string ]  // reviewer's approved networks, set on approval; may differ from requested
        "approvedExcludedNetworks": [ string ]  // excluded network ids, only meaningful alongside 'all'
        "submitComment": string  // developer's note to the reviewer, set on submit
        "created": timestamp
        "updated": timestamp
    }
    "error": { "status": bool, "code": int, "message": string }
}

Review application version

Method: websocket

Endpoint: application:reviewVersion

Description: Records an approve/reject decision, or an advisory comment/annotation with no decision at all (e.g. from an automated reviewer), for an application version. Requires the global release permission (system developers / AI reviewer's service account) - or, for a version not requesting every network, a network administrator whose managed networks overlap the requested ones (their approval is narrowed to just those networks). An approval moves the version to Approved, awaiting a separate, explicit publishVersion call.

Request:

{
    "data": {
        "applicationId": string
        "version": string
        "decision": string  // approved/rejected, or empty for an advisory comment/annotation with no decision (e.g. from an automated reviewer)
        "comment": string  // optional comment from the reviewer
        "approvedNetworks": [ string ]  // only used on approval; defaults to the requested networks
        "approvedExcludedNetworks": [ string ]  // excluded network ids, only meaningful alongside 'all'
    }
    "event": { "id": string, "date": timestamp }
}

Response:

{
    "error": { "status": bool, "code": int, "message": string }
}

Publish application version

Method: websocket

Endpoint: application:publishVersion

Description: Makes an Approved version live, superseding whatever version was previously published. Either the app's own owner/admin or a system developer can publish.

Request:

{
    "data": {
        "applicationId": string
        "version": string
    }
    "event": { "id": string, "date": timestamp }
}

Response:

{
    "data": {
        "applicationId": string
        "version": string  // developer-supplied, e.g. v1.1.1 or v1.1.1#hash
        "status": string  // draft/inReview/approved/released/rejected
        "customParams": map[string]{ custom structure }  // client-defined data: icons, client/interface settings, permissions, etc
        "requestedNetworks": [ string ]  // developer's requested networks on submit; ['all'] or specific network ids
        "requestedExcludedNetworks": [ string ]  // excluded network ids, only meaningful alongside 'all'
        "approvedNetworks": [ string ]  // reviewer's approved networks, set on approval; may differ from requested
        "approvedExcludedNetworks": [ string ]  // excluded network ids, only meaningful alongside 'all'
        "submitComment": string  // developer's note to the reviewer, set on submit
        "created": timestamp
        "updated": timestamp
    }
    "error": { "status": bool, "code": int, "message": string }
}

Update application published networks

Method: websocket

Endpoint: application:updatePublishedNetworks

Description: Lets a system developer adjust which networks a Released application is visible in, independent of any new review. Requires the global release permission.

Request:

{
    "data": {
        "applicationId": string
        "networks": [ string ]  // ['all'] or a list of specific network ids
        "excludedNetworks": [ string ]
    }
    "event": { "id": string, "date": timestamp }
}

Response:

{
    "data": {
        "applicationId": string
        "version": string
        "name": string
        "description": string
        "customParams": map[string]{ custom structure }  // client-defined data from the released version: icons, client/interface settings, permissions, etc
        "networks": [ string ]  // ['all'] or specific network ids the app is published in
        "excludedNetworks": [ string ]  // excluded network ids, only meaningful alongside 'all'
        "publishedAt": timestamp
    }
    "error": { "status": bool, "code": int, "message": string }
}

Set default application

Method: websocket

Endpoint: application:setDefaultApplication

Description: Sets networkId's single default application, replacing whatever was set before. Requires the global release permission (system developers).

Request:

{
    "data": {
        "networkId": string
        "category": string  // app/auth; defaults to 'app'
        "applicationId": string
    }
    "event": { "id": string, "date": timestamp }
}

Response:

{
    "data": {
        "networkId": string
        "category": string
        "applicationId": string
        "updated": timestamp
    }
    "error": { "status": bool, "code": int, "message": string }
}

Remove default application

Method: websocket

Endpoint: application:removeDefaultApplication

Description: Clears networkId's default application, if any. Requires the global release permission (system developers).

Request:

{
    "data": {
        "networkId": string
        "category": string  // app/auth; defaults to 'app'
    }
    "event": { "id": string, "date": timestamp }
}

Response:

{
    "error": { "status": bool, "code": int, "message": string }
}

Get default application

Method: websocket

Endpoint: application:getDefaultApplication

Description: Resolves networkId's default application to its currently published version.

Request:

{
    "data": {
        "networkId": string  // defaults to the caller's current network
        "category": string  // app/auth; defaults to 'app'
    }
    "event": { "id": string, "date": timestamp }
}

Response:

{
    "data": {
        "applicationId": string
        "version": string
        "name": string
        "description": string
        "customParams": map[string]{ custom structure }  // client-defined data from the released version: icons, client/interface settings, permissions, etc
        "networks": [ string ]  // ['all'] or specific network ids the app is published in
        "excludedNetworks": [ string ]  // excluded network ids, only meaningful alongside 'all'
        "publishedAt": timestamp
    }
    "error": { "status": bool, "code": int, "message": string }
}

List application version reviews

Method: websocket

Endpoint: application:listVersionReviews

Request:

{
    "data": {
        "applicationId": string
        "version": string
    }
    "event": { "id": string, "date": timestamp }
}

Response:

{
    "data": {
        "reviews": [{
            "applicationId": string
            "version": string
            "reviewId": string
            "reviewerId": string
            "decision": string  // approved/rejected, or empty for an advisory comment/annotation with no decision
            "comment": string  // reviewer's note to the developer, or an advisory comment/annotation with no decision
            "approvedNetworks": [ string ]  // audit copy of the networks approved by this decision; only meaningful when Decision is approved
            "approvedExcludedNetworks": [ string ]  // excluded network ids, only meaningful alongside 'all'
            "created": timestamp
            "invalidated": bool  // set when the version is pulled back to draft after this approval, kept for audit history
        }]
    }
    "error": { "status": bool, "code": int, "message": string }
}

Assign application role

Method: websocket

Endpoint: application:assignRole

Request:

{
    "data": {
        "applicationId": string
        "userId": string
        "roleId": string  // applicationAdmin/applicationTester (applicationOwner can be assigned via TransferApplicationOwnership)
    }
    "event": { "id": string, "date": timestamp }
}

Response:

{
    "error": { "status": bool, "code": int, "message": string }
}

Remove application role

Method: websocket

Endpoint: application:removeRole

Request:

{
    "data": {
        "applicationId": string
        "userId": string
        "roleId": string  // applicationAdmin/applicationTester (applicationOwner can be assigned via TransferApplicationOwnership)
    }
    "event": { "id": string, "date": timestamp }
}

Response:

{
    "error": { "status": bool, "code": int, "message": string }
}

List application roles

Method: websocket

Endpoint: application:listRoles

Description: Lists users explicitly assigned an app-scoped role (owner/admin/tester) on this Application.

Request:

{
    "data": {
        "applicationId": string
    }
    "event": { "id": string, "date": timestamp }
}

Response:

{
    "data": {
        "roles": [{
            "userId": string
            "roleId": string
        }]
    }
    "error": { "status": bool, "code": int, "message": string }
}

Transfer application ownership

Method: websocket

Endpoint: application:transferOwnership

Description: Makes newOwnerUserId an Owner. If the caller was themselves an Owner, they're demoted to Admin afterward so they keep access instead of being locked out.

Request:

{
    "data": {
        "applicationId": string
        "newOwnerUserId": string
    }
    "event": { "id": string, "date": timestamp }
}

Response:

{
    "error": { "status": bool, "code": int, "message": string }
}

Add external tester

Method: websocket

Endpoint: application:addExternalTester

Request:

{
    "data": {
        "applicationId": string
        "version": string
        "userId": string
    }
    "event": { "id": string, "date": timestamp }
}

Response:

{
    "error": { "status": bool, "code": int, "message": string }
}

Remove external tester

Method: websocket

Endpoint: application:removeExternalTester

Request:

{
    "data": {
        "applicationId": string
        "version": string
        "userId": string
    }
    "event": { "id": string, "date": timestamp }
}

Response:

{
    "error": { "status": bool, "code": int, "message": string }
}

List external testers

Method: websocket

Endpoint: application:listExternalTesters

Request:

{
    "data": {
        "applicationId": string
        "version": string
    }
    "event": { "id": string, "date": timestamp }
}

Response:

{
    "data": {
        "testers": [{
            "applicationId": string
            "version": string
            "userId": string
            "created": timestamp
        }]
    }
    "error": { "status": bool, "code": int, "message": string }
}

Search published applications

Method: websocket

Endpoint: application:searchPublishedApplications

Description: End-user discovery/search: released applications/versions, optionally filtered by a case-insensitive substring match on name. Cursor-paginated: pass the response's NextCursor back as Cursor for the next page; empty NextCursor means done.

Request:

{
    "data": {
        "query": string  // case-insensitive substring match against the application name; empty matches everything
        "cursor": string  // opaque; omit for the first page, otherwise pass back the previous response's NextCursor
        "limit": int  // page size, clamped server-side; omit for the default
    }
    "event": { "id": string, "date": timestamp }
}

Response:

{
    "data": {
        "applications": [{
            "applicationId": string
            "version": string
            "name": string
            "description": string
            "customParams": map[string]{ custom structure }  // client-defined data from the released version: icons, client/interface settings, permissions, etc
            "networks": [ string ]  // ['all'] or specific network ids the app is published in
            "excludedNetworks": [ string ]  // excluded network ids, only meaningful alongside 'all'
            "publishedAt": timestamp
        }]
        "nextCursor": string  // opaque; pass back as Cursor to fetch the next page. Empty means no more results
    }
    "error": { "status": bool, "code": int, "message": string }
}

Search my applications

Method: websocket

Endpoint: application:searchMyApplications

Description: Owner/admin/internal-tester discovery/search: every application the caller has an app-scoped role on, optionally filtered by a case-insensitive substring match on name. Cursor-paginated: pass the response's NextCursor back as Cursor for the next page; empty NextCursor means done.

Request:

{
    "data": {
        "query": string  // case-insensitive substring match against the application name; empty matches everything
        "cursor": string  // opaque; omit for the first page, otherwise pass back the previous response's NextCursor
        "limit": int  // page size, clamped server-side; omit for the default
    }
    "event": { "id": string, "date": timestamp }
}

Response:

{
    "data": {
        "applications": [{
            "id": string
            "created": timestamp
            "updated": timestamp
            "name": string
            "description": string
            "version": string  // label of the most recently created version, e.g. v1.1.1 or v1.1.1#hash
            "oidcClientId": string  // id of the separate AuthClient used for OIDC login; empty if not yet configured
            "roleId": string  // applicationOwner/applicationAdmin/applicationTester
        }]
        "nextCursor": string  // opaque; pass back as Cursor to fetch the next page. Empty means no more results
    }
    "error": { "status": bool, "code": int, "message": string }
}

Search my tester assignments

Method: websocket

Endpoint: application:searchMyTesterAssignments

Description: External-tester discovery/search: application versions the caller was granted tester access to, optionally filtered by a case-insensitive substring match on name. Cursor-paginated: pass the response's NextCursor back as Cursor for the next page; empty NextCursor means done.

Request:

{
    "data": {
        "query": string  // case-insensitive substring match against the application name; empty matches everything
        "cursor": string  // opaque; omit for the first page, otherwise pass back the previous response's NextCursor
        "limit": int  // page size, clamped server-side; omit for the default
    }
    "event": { "id": string, "date": timestamp }
}

Response:

{
    "data": {
        "applications": [{
            "id": string
            "created": timestamp
            "updated": timestamp
            "name": string
            "description": string
            "version": string  // label of the most recently created version, e.g. v1.1.1 or v1.1.1#hash
            "oidcClientId": string  // id of the separate AuthClient used for OIDC login; empty if not yet configured
        }]
        "nextCursor": string  // opaque; pass back as Cursor to fetch the next page. Empty means no more results
    }
    "error": { "status": bool, "code": int, "message": string }
}

Search application review queue

Method: websocket

Endpoint: application:searchReviewQueue

Description: System-reviewer discovery/search: applications tracked by the review queue, optionally filtered by Status (pending/approved/rejected) and/or a name substring. Results are ordered oldest-submitted-first. Requires the global release permission, or network administrator permission on at least one network - in which case results are scoped to entries overlapping the networks they administer.

Request:

{
    "data": {
        "status": string  // pending/approved/rejected; empty means all statuses
        "query": string  // case-insensitive substring match against the application name; empty matches everything
        "cursor": string  // opaque; omit for the first page, otherwise pass back the previous response's NextCursor
        "limit": int  // page size, clamped server-side; omit for the default
    }
    "event": { "id": string, "date": timestamp }
}

Response:

{
    "data": {
        "versions": [{
            "applicationId": string
            "version": string
            "name": string
            "status": string  // pending/approved/rejected
            "submittedAt": timestamp
            "decidedAt": timestamp
            "reviewerId": string
            "requestedNetworks": [ string ]  // denormalized from the submission's ApplicationVersion
            "requestedExcludedNetworks": [ string ]  // denormalized from the submission's ApplicationVersion
            "submitComment": string  // denormalized from the submission's ApplicationVersion
        }]
        "nextCursor": string  // opaque; pass back as Cursor to fetch the next page. Empty means no more results
    }
    "error": { "status": bool, "code": int, "message": string }
}

Get identity token

Method: websocket

Endpoint: appManifest:getIdentityToken

Description: Issues a short-lived signed identity JWT for the given application. Requires the user to be authenticated. JWT claims: sub=userId, aud=applicationId, iss=platform, exp=5min, email=user email.

Request:

{
    "data": {
        "applicationId": string
    }
    "event": { "id": string, "date": timestamp }
}

Response:

{
    "data": {
        "token": string
    }
    "error": { "status": bool, "code": int, "message": string }
}

Create application client credentials

Method: websocket

Endpoint: application:createClientCredentials

Description: Generates a clientId/clientSecret pair the application can use to call the partner API as itself. There's exactly one set of credentials per application; this fails if one already exists - use regenerateClientCredentials to rotate it, or delete it first. The plaintext secret is only ever returned here; afterward, use revealClientCredentialsSecret.

Request:

{
    "data": {
        "applicationId": string
    }
    "event": { "id": string, "date": timestamp }
}

Response:

{
    "data": {
        "clientId": string
        "clientSecret": string
        "clientName": string
        "scope": [ string ]
        "redirectUris": [ string ]
        "authPageUrl": string
        "devMode": bool
    }
    "error": { "status": bool, "code": int, "message": string }
}

Regenerate application client credentials

Method: websocket

Endpoint: application:regenerateClientCredentials

Description: Rotates the secret of an already-existing client, keeping its clientId and every other field unchanged. The previous secret is invalidated immediately. Fails if no credentials exist yet - use createClientCredentials first.

Request:

{
    "data": {
        "applicationId": string
    }
    "event": { "id": string, "date": timestamp }
}

Response:

{
    "data": {
        "clientId": string
        "clientSecret": string
        "clientName": string
        "scope": [ string ]
        "redirectUris": [ string ]
        "authPageUrl": string
        "devMode": bool
    }
    "error": { "status": bool, "code": int, "message": string }
}

Delete application client credentials

Method: websocket

Endpoint: application:deleteClientCredentials

Request:

{
    "data": {
        "applicationId": string
    }
    "event": { "id": string, "date": timestamp }
}

Response:

{
    "error": { "status": bool, "code": int, "message": string }
}

Get application client credentials

Method: websocket

Endpoint: application:getClientCredentials

Description: Returns the application's client info without its secret.

Request:

{
    "data": {
        "applicationId": string
    }
    "event": { "id": string, "date": timestamp }
}

Response:

{
    "data": {
        "clientId": string
        "clientName": string
        "scope": [ string ]
        "redirectUris": [ string ]
        "authPageUrl": string
        "devMode": bool
    }
    "error": { "status": bool, "code": int, "message": string }
}

Reveal application client credentials secret

Method: websocket

Endpoint: application:revealClientCredentialsSecret

Description: Returns the application's current client secret. Separate from getClientCredentials so the secret is only ever transmitted when explicitly asked for.

Request:

{
    "data": {
        "applicationId": string
    }
    "event": { "id": string, "date": timestamp }
}

Response:

{
    "data": {
        "clientSecret": string
    }
    "error": { "status": bool, "code": int, "message": string }
}

Create application oidc client

Method: websocket

Endpoint: application:createOidcClient

Description: Creates a dedicated OIDC client the application can use to let its own end users log in with their Roomful identity. There's exactly one OIDC client per application; this fails if one already exists - use regenerateOidcClientSecret to rotate its secret, or delete it first. The plaintext secret is only ever returned here or from regenerateOidcClientSecret - it cannot be revealed again afterward.

Request:

{
    "data": {
        "applicationId": string
        "redirectUris": [ string ]
    }
    "event": { "id": string, "date": timestamp }
}

Response:

{
    "data": {
        "clientId": string
        "clientSecret": string
        "clientName": string
        "scope": [ string ]
        "redirectUris": [ string ]
        "authPageUrl": string
        "devMode": bool
    }
    "error": { "status": bool, "code": int, "message": string }
}

Regenerate application oidc client secret

Method: websocket

Endpoint: application:regenerateOidcClientSecret

Description: Rotates the secret of the application's existing OIDC client, keeping its clientId and every other field unchanged. The previous secret is invalidated immediately.

Request:

{
    "data": {
        "applicationId": string
    }
    "event": { "id": string, "date": timestamp }
}

Response:

{
    "data": {
        "clientId": string
        "clientSecret": string
        "clientName": string
        "scope": [ string ]
        "redirectUris": [ string ]
        "authPageUrl": string
        "devMode": bool
    }
    "error": { "status": bool, "code": int, "message": string }
}

Delete application oidc client

Method: websocket

Endpoint: application:deleteOidcClient

Request:

{
    "data": {
        "applicationId": string
    }
    "event": { "id": string, "date": timestamp }
}

Response:

{
    "error": { "status": bool, "code": int, "message": string }
}

Update application oidc client redirect uris

Method: websocket

Endpoint: application:updateOidcClientRedirectUris

Description: Sets the application's OIDC client's whitelisted redirect URIs, replacing whatever was set before.

Request:

{
    "data": {
        "applicationId": string
        "redirectUris": [ string ]
    }
    "event": { "id": string, "date": timestamp }
}

Response:

{
    "data": {
        "clientId": string
        "clientName": string
        "scope": [ string ]
        "redirectUris": [ string ]
        "authPageUrl": string
        "devMode": bool
    }
    "error": { "status": bool, "code": int, "message": string }
}

Get application oidc client

Method: websocket

Endpoint: application:getOidcClient

Description: Returns the application's OIDC client info without its secret.

Request:

{
    "data": {
        "applicationId": string
    }
    "event": { "id": string, "date": timestamp }
}

Response:

{
    "data": {
        "clientId": string
        "clientName": string
        "scope": [ string ]
        "redirectUris": [ string ]
        "authPageUrl": string
        "devMode": bool
    }
    "error": { "status": bool, "code": int, "message": string }
}