Application Schema

Retrieve and Edit Application Schema

Retrieves or updates the schema for the specified application.

Access Requirements

The request author must have secret_data.application.canReadSchema to read the schema, or secret_data.application.canModifySchema to update it.

Note

User-defined permissions must be placed within the root sections (public_data, private_data, roles). Permissions placed outside these sections are ignored.

Request

POST /api/permissions/meta/schema

Warning

Passing jwt, factor, and service_jwt in the request body is deprecated. Use the corresponding HTTP headers instead.

jwt string required 

User’s JWT token.
factor string conditionally required 

User device factor. Required if service_jwt is not provided.
service_jwt string conditionally required 

Service JWT. Required if factor is not provided.
action string required 

Action to perform. Allowed values: "get", "save".
application_id string or integer required 

ID of the application whose schema is being retrieved or edited.
data object optional 

Application schema. Required for the "save" action.

Request example (get)

POST /api/permissions/meta/schema

Headers

Authorization: Bearer eyJhbGci...
Factor: ...

Body

{
  "action": "get",
  "application_id": 50001
}

Response

OK

Success

The response includes the full application schema. The example below shows the default schema for new applications.

status string required 
- “OK”
data object required 

The application schema.
- application_id string or integer required 
  
  ID of the application.
- login object required 
  
  Login permission rules (can, cannot).
- private_data object required 
  
  Private permission rules.
- public_data object required 
  
  Public permission rules.
- roles object required 
  
  Role definitions.
- secret_data object required 
  
  System-level permission rules (not editable by users).
- version integer optional 
  
  Schema version. Incremented automatically on each save.
- updated_at integer optional 
  
  Unix timestamp of the last schema update. Set automatically on each save.

Response example

{
  "status": "OK",
  "data": {
    "application_id": 50001,
    "login": {
      "can": { "value": true, "protected": false, "description": "" },
      "cannot": { "value": false, "protected": false, "description": "" }
    },
    "private_data": {},
    "public_data": {},
    "roles": {},
    "secret_data": {
      "application": {
        "canCreateJwt": { "value": false },
        "canModifySchema": { "value": false },
        "canRead": { "value": false },
        "canReadSchema": { "value": false },
        "canSave": { "value": false },
        "canSeeRoleList": { "value": false }
      },
      "meta": {
        "roles": {
          "canRead": { "value": "self" },
          "canWrite": { "value": "none" }
        },
        "private": {
          "canRead": { "value": "self" },
          "canWrite": { "value": "none" }
        },
        "public": {
          "canRead": { "value": "all" },
          "canWrite": { "value": "none" }
        },
        "secret": {
          "canRead": { "value": "none" },
          "canWrite": { "value": "none" }
        }
      }
    }
  }
}

ERROR

Error

status string required 
- “ERROR”
error string required 

Descriptive error message.

Response example

{
  "status": "ERROR",
  "error": "application not found"
}

Retrieve Application Public Keys

See Get Application Public Keys and Get Token Publisher Public Key.

Retrieve SSO Public Keys

Returns the token publisher’s public keys in JWKs format. Used to verify tokens issued by the SSO system.

Request

GET /api/permissions/keys

No request parameters required.

Response

OK

Success

Returns a JSON object in JWKs format containing the list of public keys.

ERROR

Error

status string required 
- “ERROR”
error string required 

Descriptive error message.

Response example

{
  "status": "ERROR",
  "error": "internal error"
}