---
url: /apidocs/application.md
---
## Application API

| Endpoint | Method | Description |
|-----|-----|-----|
| [application:createApplication](#create-application) | websocket | Create application |
| [application:updateApplication](#update-application) | websocket | Update application |
| [application:deleteApplication](#delete-application) | websocket | Delete application |
| [application:getApplication](#get-application) | websocket | Get application |
| [application:createVersion](#create-application-version) | websocket | Create application version |
| [application:updateVersion](#update-application-version) | websocket | Update application version |
| [application:getVersion](#get-application-version) | websocket | Get application version |
| [application:listVersions](#list-application-versions) | websocket | List application versions |
| [application:submitVersionForReview](#submit-application-version-for-review) | websocket | Submit application version for review |
| [application:cancelVersionReview](#cancel-application-version-review) | websocket | Cancel application version review |
| [application:reviewVersion](#review-application-version) | websocket | Review application version |
| [application:publishVersion](#publish-application-version) | websocket | Publish application version |
| [application:updatePublishedNetworks](#update-application-published-networks) | websocket | Update application published networks |
| [application:setDefaultApplication](#set-default-application) | websocket | Set default application |
| [application:removeDefaultApplication](#remove-default-application) | websocket | Remove default application |
| [application:getDefaultApplication](#get-default-application) | websocket | Get default application |
| [application:listVersionReviews](#list-application-version-reviews) | websocket | List application version reviews |
| [application:assignRole](#assign-application-role) | websocket | Assign application role |
| [application:removeRole](#remove-application-role) | websocket | Remove application role |
| [application:listRoles](#list-application-roles) | websocket | List application roles |
| [application:transferOwnership](#transfer-application-ownership) | websocket | Transfer application ownership |
| [application:addExternalTester](#add-external-tester) | websocket | Add external tester |
| [application:removeExternalTester](#remove-external-tester) | websocket | Remove external tester |
| [application:listExternalTesters](#list-external-testers) | websocket | List external testers |
| [application:searchPublishedApplications](#search-published-applications) | websocket | Search published applications |
| [application:searchMyApplications](#search-my-applications) | websocket | Search my applications |
| [application:searchMyTesterAssignments](#search-my-tester-assignments) | websocket | Search my tester assignments |
| [application:searchReviewQueue](#search-application-review-queue) | websocket | Search application review queue |
| [appManifest:getIdentityToken](#get-identity-token) | websocket | Get identity token |
| [application:createClientCredentials](#create-application-client-credentials) | websocket | Create application client credentials |
| [application:regenerateClientCredentials](#regenerate-application-client-credentials) | websocket | Regenerate application client credentials |
| [application:deleteClientCredentials](#delete-application-client-credentials) | websocket | Delete application client credentials |
| [application:getClientCredentials](#get-application-client-credentials) | websocket | Get application client credentials |
| [application:revealClientCredentialsSecret](#reveal-application-client-credentials-secret) | websocket | Reveal application client credentials secret |
| [application:createOidcClient](#create-application-oidc-client) | websocket | Create application oidc client |
| [application:regenerateOidcClientSecret](#regenerate-application-oidc-client-secret) | websocket | Regenerate application oidc client secret |
| [application:deleteOidcClient](#delete-application-oidc-client) | websocket | Delete application oidc client |
| [application:updateOidcClientRedirectUris](#update-application-oidc-client-redirect-uris) | websocket | Update application oidc client redirect uris |
| [application:getOidcClient](#get-application-oidc-client) | websocket | Get application oidc client |

### Create application

**Method:** websocket

**Endpoint:** application:createApplication

**Request:**

**Response:**

### Update application

**Method:** websocket

**Endpoint:** application:updateApplication

**Request:**

**Response:**

### Delete application

**Method:** websocket

**Endpoint:** application:deleteApplication

**Request:**

**Response:**

### Get application

**Method:** websocket

**Endpoint:** application:getApplication

**Request:**

**Response:**

### Create application version

**Method:** websocket

**Endpoint:** application:createVersion

**Request:**

**Response:**

### Update application version

**Method:** websocket

**Endpoint:** application:updateVersion

**Request:**

**Response:**

### Get application version

**Method:** websocket

**Endpoint:** application:getVersion

**Request:**

**Response:**

### List application versions

**Method:** websocket

**Endpoint:** application:listVersions

**Request:**

**Response:**

### Submit application version for review

**Method:** websocket

**Endpoint:** application:submitVersionForReview

**Description:** Fails if another version of this Application is already inReview or approved - only one version may be in the review pipeline at a time.

**Request:**

**Response:**

### Cancel application version review

**Method:** websocket

**Endpoint:** application:cancelVersionReview

**Description:** Withdraws a submission, moving an inReview or approved (not yet published) version back to draft. Discards every review decision recorded for this version and removes its review queue entry.

**Request:**

**Response:**

### Review application version

**Method:** websocket

**Endpoint:** application:reviewVersion

**Description:** Records an approve/reject decision, or an advisory comment/annotation with no decision at all (e.g. from an automated reviewer), for an application version. Requires the global release permission (system developers / AI reviewer's service account) - or, for a version not requesting every network, a network administrator whose managed networks overlap the requested ones (their approval is narrowed to just those networks). An approval moves the version to Approved, awaiting a separate, explicit publishVersion call.

**Request:**

**Response:**

### Publish application version

**Method:** websocket

**Endpoint:** application:publishVersion

**Description:** Makes an Approved version live, superseding whatever version was previously published. Either the app's own owner/admin or a system developer can publish.

**Request:**

**Response:**

### Update application published networks

**Method:** websocket

**Endpoint:** application:updatePublishedNetworks

**Description:** Lets a system developer adjust which networks a Released application is visible in, independent of any new review. Requires the global release permission.

**Request:**

**Response:**

### Set default application

**Method:** websocket

**Endpoint:** application:setDefaultApplication

**Description:** Sets networkId's single default application, replacing whatever was set before. Requires the global release permission (system developers).

**Request:**

**Response:**

### Remove default application

**Method:** websocket

**Endpoint:** application:removeDefaultApplication

**Description:** Clears networkId's default application, if any. Requires the global release permission (system developers).

**Request:**

**Response:**

### Get default application

**Method:** websocket

**Endpoint:** application:getDefaultApplication

**Description:** Resolves networkId's default application to its currently published version.

**Request:**

**Response:**

### List application version reviews

**Method:** websocket

**Endpoint:** application:listVersionReviews

**Request:**

**Response:**

### Assign application role

**Method:** websocket

**Endpoint:** application:assignRole

**Request:**

**Response:**

### Remove application role

**Method:** websocket

**Endpoint:** application:removeRole

**Request:**

**Response:**

### List application roles

**Method:** websocket

**Endpoint:** application:listRoles

**Description:** Lists users explicitly assigned an app-scoped role (owner/admin/tester) on this Application.

**Request:**

**Response:**

### Transfer application ownership

**Method:** websocket

**Endpoint:** application:transferOwnership

**Description:** Makes newOwnerUserId an Owner. If the caller was themselves an Owner, they're demoted to Admin afterward so they keep access instead of being locked out.

**Request:**

**Response:**

### Add external tester

**Method:** websocket

**Endpoint:** application:addExternalTester

**Request:**

**Response:**

### Remove external tester

**Method:** websocket

**Endpoint:** application:removeExternalTester

**Request:**

**Response:**

### List external testers

**Method:** websocket

**Endpoint:** application:listExternalTesters

**Request:**

**Response:**

### Search published applications

**Method:** websocket

**Endpoint:** application:searchPublishedApplications

**Description:** End-user discovery/search: released applications/versions, optionally filtered by a case-insensitive substring match on name. Cursor-paginated: pass the response's NextCursor back as Cursor for the next page; empty NextCursor means done.

**Request:**

**Response:**

### Search my applications

**Method:** websocket

**Endpoint:** application:searchMyApplications

**Description:** Owner/admin/internal-tester discovery/search: every application the caller has an app-scoped role on, optionally filtered by a case-insensitive substring match on name. Cursor-paginated: pass the response's NextCursor back as Cursor for the next page; empty NextCursor means done.

**Request:**

**Response:**

### Search my tester assignments

**Method:** websocket

**Endpoint:** application:searchMyTesterAssignments

**Description:** External-tester discovery/search: application versions the caller was granted tester access to, optionally filtered by a case-insensitive substring match on name. Cursor-paginated: pass the response's NextCursor back as Cursor for the next page; empty NextCursor means done.

**Request:**

**Response:**

### Search application review queue

**Method:** websocket

**Endpoint:** application:searchReviewQueue

**Description:** System-reviewer discovery/search: applications tracked by the review queue, optionally filtered by Status (pending/approved/rejected) and/or a name substring. Results are ordered oldest-submitted-first. Requires the global release permission, or network administrator permission on at least one network - in which case results are scoped to entries overlapping the networks they administer.

**Request:**

**Response:**

### Get identity token

**Method:** websocket

**Endpoint:** appManifest:getIdentityToken

**Description:** Issues a short-lived signed identity JWT for the given application. Requires the user to be authenticated. JWT claims: sub=userId, aud=applicationId, iss=platform, exp=5min, email=user email.

**Request:**

**Response:**

### Create application client credentials

**Method:** websocket

**Endpoint:** application:createClientCredentials

**Description:** Generates a clientId/clientSecret pair the application can use to call the partner API as itself. There's exactly one set of credentials per application; this fails if one already exists - use regenerateClientCredentials to rotate it, or delete it first. The plaintext secret is only ever returned here; afterward, use revealClientCredentialsSecret.

**Request:**

**Response:**

### Regenerate application client credentials

**Method:** websocket

**Endpoint:** application:regenerateClientCredentials

**Description:** Rotates the secret of an already-existing client, keeping its clientId and every other field unchanged. The previous secret is invalidated immediately. Fails if no credentials exist yet - use createClientCredentials first.

**Request:**

**Response:**

### Delete application client credentials

**Method:** websocket

**Endpoint:** application:deleteClientCredentials

**Request:**

**Response:**

### Get application client credentials

**Method:** websocket

**Endpoint:** application:getClientCredentials

**Description:** Returns the application's client info without its secret.

**Request:**

**Response:**

### Reveal application client credentials secret

**Method:** websocket

**Endpoint:** application:revealClientCredentialsSecret

**Description:** Returns the application's current client secret. Separate from getClientCredentials so the secret is only ever transmitted when explicitly asked for.

**Request:**

**Response:**

### Create application oidc client

**Method:** websocket

**Endpoint:** application:createOidcClient

**Description:** Creates a dedicated OIDC client the application can use to let its own end users log in with their Roomful identity. There's exactly one OIDC client per application; this fails if one already exists - use regenerateOidcClientSecret to rotate its secret, or delete it first. The plaintext secret is only ever returned here or from regenerateOidcClientSecret - it cannot be revealed again afterward.

**Request:**

**Response:**

### Regenerate application oidc client secret

**Method:** websocket

**Endpoint:** application:regenerateOidcClientSecret

**Description:** Rotates the secret of the application's existing OIDC client, keeping its clientId and every other field unchanged. The previous secret is invalidated immediately.

**Request:**

**Response:**

### Delete application oidc client

**Method:** websocket

**Endpoint:** application:deleteOidcClient

**Request:**

**Response:**

### Update application oidc client redirect uris

**Method:** websocket

**Endpoint:** application:updateOidcClientRedirectUris

**Description:** Sets the application's OIDC client's whitelisted redirect URIs, replacing whatever was set before.

**Request:**

**Response:**

### Get application oidc client

**Method:** websocket

**Endpoint:** application:getOidcClient

**Description:** Returns the application's OIDC client info without its secret.

**Request:**

**Response:**