Application

Retrieve, Create, Edit, and Delete Application

Manages application records. Depending on the action parameter, this endpoint retrieves, creates, updates, or deletes an application.

Access Requirements

Retrieve or save: request author must have projectID/project.can_manage_applications (if project_id is specified), or secret_data.application.canRead / secret_data.application.canSave for the target application. Having any role in /applications/ is sufficient to view application data.
Create (outside a project): can_create_app. Does not grant permission to update an existing application.
Delete: can_remove_apps, or projectID/project.can_manage_applications (if project_id is specified).
Update service metadata: can_publish_services.

Note

When creating a new application, application_id does not need to be specified, it is generated automatically. Deletion sets the removed flag on the application record rather than physically removing it.

Request

POST /api/permissions/application

Warning

Passing jwt, factor, and service_jwt in the request body is deprecated. Use the corresponding HTTP headers instead.

jwt string required 

User’s JWT token.
factor string conditionally required 

User device factor. Required if service_jwt is not provided.
service_jwt string conditionally required 

Service JWT. Required if factor is not provided.
action string required 

Action to perform. Allowed values: "get", "save", "delete".
data object required 

Action payload.
- application_id string or integer optional 
  
  ID of the application to retrieve, edit, or delete. Omit when creating a new application, it is assigned automatically.
- name string optional 
  
  Application name.
- description string optional 
  
  Application description.
- project_id string optional 
  
  ID of the project to associate the application with.
- removed boolean optional 
  
  Deletion flag. Defaults to false.
- settings object optional 
  
  Application settings, including GDPR removal URLs (settings.gdpr.char_sources, settings.gdpr.data_sources) and restricted login email domains (settings.restricted_domains).
- service_meta object optional 
  
  Service metadata for the application.
  - name string optional 
    
    Service name. Max 32 characters. Allowed characters: A–Z, a–z, 0–9, space, _, ..
  - description string optional 
    
    Service description. Max 1024 characters.
  - doc string optional 
    
    Documentation link.
  - url string optional 
    
    Service URL.
  - env string optional 
    
    Deployment environment (e.g., "prod", "dev").
  - tags array of strings optional 
    
    Service tags. Max 10 tags, each max 64 characters. Allowed characters: A–Z, a–z, 0–9, :, _. Can also be managed via the Set Application Tags endpoint.
  - public_key string optional 
    
    Service public key.
  - private_key string optional 
    
    Service private key.
  - config_schema object optional 
    
    JSON schema for service configuration.

Request example (save)

POST /api/permissions/application

Headers

Authorization: Bearer eyJhbGci...
Factor: ...

Body

{
  "action": "save",
  "data": {
    "name": "My App",
    "description": "Application description",
    "project_id": "my_project",
    "settings": {
      "gdpr": {
        "char_sources": ["https://example.com/gdpr"],
        "data_sources": [
          {
            "fetch": "https://example.com/fetch",
            "remove": "https://example.com/remove"
          }
        ]
      },
      "restricted_domains": ["example.com"]
    },
    "service_meta": {
      "name": "My App",
      "env": "prod",
      "url": "https://example.com"
    }
  }
}

Response

OK

Success

status string required 
- “OK”
data object optional 

Returned for "get" and "save" actions. Not returned for "delete".
- application_id integer required 
  
  Application ID.
- name string required 
  
  Application name.
- description string optional 
  
  Application description. Returned if specified.
- project_id string optional 
  
  ID of the project the application belongs to. Returned if specified.
- removed boolean required 
  
  Indicates whether the application has been deleted.

Response example (save/get)

{
  "status": "OK",
  "data": {
    "application_id": 50001,
    "name": "My App",
    "description": "Application description",
    "project_id": "my_project",
    "removed": false
  }
}

Response example (delete)

{
  "status": "OK"
}

ERROR

Error

status string required 
- “ERROR”
error string required 

Descriptive error message.

Response example

{
  "status": "ERROR",
  "error": "application not found"
}

Set Application Tags

Overwrites the existing tags for the application with the provided set.

Access Requirements

The request author must have the positive rule can_publish_services.

Request

POST /api/permissions/application/tags

Warning

Passing jwt, factor, and service_jwt in the request body is deprecated. Use the corresponding HTTP headers instead.

jwt string required 

User’s JWT token.
factor string conditionally required 

User device factor. Required if service_jwt is not provided.
service_jwt string conditionally required 

Service JWT. Required if factor is not provided.
data object required 
- application_id string or integer required 
  
  ID of the application.
- service_meta object required 
  
  Service metadata wrapper for the tag list.
  - tags array of strings required 
    
    New list of tags. Replaces the existing tags entirely.

Request example

POST /api/permissions/application/tags

Headers

Authorization: Bearer eyJhbGci...
Factor: ...

Body

{
  "data": {
    "application_id": 50001,
    "service_meta": {
      "tags": ["tag0", "tag1", "tag2"]
    }
  }
}

Response

OK

Success

status string required 
- “OK”

Response example

{
  "status": "OK"
}

ERROR

Error

status string required 
- “ERROR”
error string required 

Descriptive error message.

Response example

{
  "status": "ERROR",
  "error": "application not found"
}

Get Application Public Keys

Returns all public keys associated with the specified application, including:

The key stored in the file system
The key from the service metadata (application.service_meta.public_key)
Additional custom application keys

Request

GET /api/permissions/application/publicKeys/{appID}

appID integer required 

Application identifier.

Request example

GET /api/permissions/application/publicKeys/50001

Response

OK

Success

status string required 
- “OK”
keys array of objects required 

List of public keys.
- id string required 
  
  Key identifier.
- data string required 
  
  Public key content. For the SSO issuer application, this field is named "key" instead of "data".

Response example

{
  "status": "OK",
  "keys": [
    {
      "id": "keyID",
      "data": "-----BEGIN PUBLIC KEY-----\n..."
    }
  ]
}

ERROR

Error

status string required 
- “ERROR”
error string required 

Descriptive error message.

Response example

{
  "status": "ERROR",
  "error": "application not found"
}

Get Token Publisher Public Key

Returns the public part of a key by its key ID. Used for verifying the signature of a JWT. The key ID can be obtained from the token’s kid field.

Note

For token verification, you can also use GET /api/permissions/keys, which returns the token publisher’s public keys in JWKs format.

Request

GET /api/permissions/application/publicKey/{keyID}

keyID string required 

Key identifier.

Request example

GET /api/permissions/application/publicKey/abc123

Response

OK

Success

status string required 
- “OK”
key_id string required 

Key identifier.
public_key string required 

Public key content.

Response example

{
  "status": "OK",
  "key_id": "abc123",
  "public_key": "-----BEGIN PUBLIC KEY-----\n..."
}

ERROR

Error

status string required 
- “ERROR”
error string required 

Descriptive error message.

Response example

{
  "status": "ERROR",
  "error": "key not found"
}