# Create app

Create a new application with a default client. The fields marked as deprecated are now managed on the client level. To update a default client, create additional clients, or fetch all app clients, use `/clients` or `applications/{appId}/clients` endpoints. <br><br>**Required permissions**: `apps:create`, `[appId]:create`.

Endpoint: POST /v1/applications
Security: ClientAccessToken

## Request fields (application/json):

  - `app_name` (string, required)
    Name of the application
    Example: My App

  - `app_description` (string)
    Short description of the application

  - `service_providers` (array)
    List of service provider IDs associated with this application

  - `allow_public_signup` (boolean)
    Determines if the application is allowed to request to create new users via login flows

  - `authenticator_preferences` (object)
    Configures the application as the Authentication Hub of this tenant, allowing other apps to use it to perform a centralized login

  - `authenticator_preferences.is_centralized` (boolean, required)
    Indicates whether to set the application as the Authentication Hub for this tenant

  - `authenticator_preferences.login_uri` (string, required)
    URI of the application that will initiate an authentication flow when centralized login is requested
    Example: https://www.example.com/login

  - `login_uri` (string)
    URI used to redirect the user to the login page of the application (when needed)
    Example: https://www.example.com/login

  - `invite_member_uri` (string)
    URI used to redirect the member to the login page of the application (when needed)
    Example: https://www.example.com/login

  - `invite_member_email_expiration_minutes` (number)
    Member invite email link expiration in minutes

  - `refresh_token_invalidation_trigger_configuration` (object)
    Refresh token invalidation trigger configuration

  - `refresh_token_invalidation_trigger_configuration.invalidateOnMemberSuspension` (boolean)
    Determines if refresh tokens should be invalidated when a member is suspended

  - `refresh_token_invalidation_trigger_configuration.invalidateOnMemberPasswordReset` (boolean)
    Determines if refresh tokens should be invalidated when a member resets their password

  - `refresh_token_invalidation_trigger_configuration.invalidateOnMemberRoleUpdate` (boolean)
    Determines if refresh tokens should be invalidated when a member role is updated

  - `client_type` (string)
    Client type of the default client
    Enum: "web", "native"

  - `client_display_name` (string, required)
    Client name of the default client to display when needed

  - `client_description` (string)
    Short description of the default client

  - `first_client_authentication_protocol` (string)
    Defines the first client authentication protocol.
    Enum: "oidc", "saml"

  - `first_client` (any)
    Creates first client for the application. Client can be OIDC or SAML, depending what is set in first_client_authentication_protocol

  - `first_client.name` (string, required)
    Name of the client
    Example: My Client

  - `first_client.description` (string)
    Short description of the client

  - `first_client.resources` (array)
    List of resources IDs associated with this client

  - `first_client.authentication_protocol` (string)
    Authentication protocol used by the client
    Enum: "oidc", "saml"

  - `first_client.client_group_id` (string)
    Id of client group to associate with

  - `first_client.default_custom_claims` (array)
    List of client default custom claims

  - `first_client.default_user_info_claims` (array)
    List of client default custom claims returned by the UserInfo endpoint. Mutually exclusive with sync_id_token_claims_to_userinfo=true in the same request.

  - `first_client.sync_id_token_claims_to_userinfo` (boolean)
    When true, UserInfo custom claims are kept in sync with default_custom_claims (the ID Token list). Mutually exclusive with explicit default_user_info_claims in the same request.

  - `first_client.short_cookies_samesite_type` (string)
    Short cookies samesite type. Possible values: "none", "lax", "strict". Default: "lax"
    Enum: "lax", "none"

  - `first_client.redirect_uris` (array)
    List of URIs approved for redirects for your client
    Example: ["https://www.example.com/login"]

  - `first_client.client_type` (string)
    Client type
    Enum: "web", "native"

  - `first_client.device_authorization` (object)
    Configuration for an [OAuth Device Authorization Flow](https://www.rfc-editor.org/rfc/rfc8628)

  - `first_client.device_authorization.enabled` (boolean, required)
    Determines if the client is allowed to use the OAuth device authorization flow

  - `first_client.device_authorization.approval_uri` (string, required)
    The URI of the page that allows the user to approve the access request
    Example: https://www.example.com/device/approval

  - `first_client.device_authorization.success_uri` (string, required)
    Callback URI that receives an indication of whether the end-user authentication was completed successfully.
    Example: https://www.example.com/device/complete

  - `first_client.device_authorization.input_uri` (string, required)
    The URI of the page that allows the user to enter the code
    Example: https://www.example.com/device/start

  - `first_client.ciba_authorization` (object)
    CIBA authorization flow configuration

  - `first_client.ciba_authorization.enabled` (boolean, required)
    Determines if the client is allowed to use the OAuth CIBA authorization flow

  - `first_client.ciba_authorization.login_uri` (string)
    The URI of the page that allows the user to log-in and verify the access request
    Example: https://www.example.com/ciba/login

  - `first_client.is_third_party` (boolean)
    Is third party client

  - `first_client.allowed_scopes` (array)
    Allowed scopes

  - `first_client.consent_uri` (string)
    Consent URI

  - `first_client.consent_validity_period` (number)
    Consent validity period

  - `first_client.pkce` (string)
    PKCE configuration
    Enum: "enforcePkceInsteadOfClientCredentials", "enforcePkceAlongsideClientCredentials", "allowPkceAlongsideClientCredentials"

  - `first_client.supported_prompts` (array)
    Supported prompts for the OIDC authentication flow
    Example: ["login","consent","none"]

  - `first_client.token_expiration` (object)
    Token expiration settings

  - `first_client.token_expiration.access_token_ttl` (number)
    Access token time-to-live

  - `first_client.token_expiration.refresh_token_ttl` (number)
    Refresh token time-to-live

  - `first_client.token_expiration.max_refresh_rotate` (number)
    Maximum time the refresh token can be rotated

  - `first_client.session_expiration` (number)
    Session expiration time (seconds)

  - `first_client.enforce_par` (boolean)
    enforce PAR (Pushed Authorization Request) for this client

  - `first_client.role_ids` (array)
    Role IDs

  - `first_client.fapi_version_compliancy` (boolean)
    FAPI 2.0 compliancy configuration

  - `first_client.token_endpoint_auth_method` (string)
    This field is deprecated- to configure pkce use "pkce" field instead
    Enum: "client_secret_basic", "self_signed_tls_client_auth", "tls_client_auth", "none", "private_key_jwt"

  - `first_client.response_types` (array)
    Example: ["code"]

  - `first_client.authentication_configuration` (object)
    Client authentication configuration

  - `first_client.authentication_configuration.method` (string, required)
    Client authentication method
    Enum: "client_secret_basic", "self_signed_tls_client_auth", "tls_client_auth", "private_key_jwt"

  - `first_client.authentication_configuration.tls_client_auth` (object)
    TLS client authentication configuration for mTLS

  - `first_client.authentication_configuration.tls_client_auth.certificate_chain` (string)
    Certificate chain including intermediate CA certificates used for client certificate validation

  - `first_client.authentication_configuration.tls_client_auth.distinguished_name` (number)
    The length of the generated OTP code. Must be between 4 and 8.
    Example: 6

  - `first_client.authentication_configuration.tls_client_auth.ocsp_on` (boolean)
    Enables OCSP (Online Certificate Status Protocol) verification

  - `first_client.authentication_configuration.tls_client_auth.ocsp_responder_uri` (string)
    OCSP responder URI

  - `first_client.authentication_configuration.tls_client_auth.ocsp_responder_certificate` (string)
    OCSP responder certificate used for signature verification

  - `first_client.authentication_configuration.tls_client_auth.ocsp_fail_open` (boolean)
    OCSP fail-open

  - `first_client.authentication_configuration.isMtlsCertTokenBound` (boolean)
    States whether to bind the access token to the client certificate when mTLS is enabled

  - `first_client.authentication_configuration.jwks` (object)
    A set of JWK keys containing the public keys for the Client to use for authentication

  - `first_client.id_token_encryption` (object)
    ID Token encryption configuration

  - `first_client.id_token_encryption.enabled` (boolean, required)
    Determines if ID token encryption is enabled for the client

  - `first_client.id_token_encryption.jwks` (object)
    A set of JWK keys containing the public keys for the client to use for ID token encryption

  - `first_client.sp_acs_url` (string)
    SAML ACS URL

  - `first_client.sp_entity_id` (string, required)
    SAML Service provider entity ID

  - `first_client.sp_name_id_type` (string)
    SAML Name ID Type
    Enum: "email", "secondaryEmail", "username", "phoneNumber", "externalUserId"

  - `first_client.sign_assertion` (boolean)
    Sign SAML assertion

  - `first_client.optional_acs_url` (boolean)
    Allow ACS URL to be optional

  - `first_client.use_centralized_login` (boolean)
    When enabled, SAML SP-initiated SSO redirects to the tenant centralized hub application instead of hosted login

  - `redirect_uris` (array)
    List of URI approved for redirects for your default client
    Example: ["https://www.example.com/login"]

  - `logo` (string)
    URI of your application's logo, such as for email templates

  - `resources` (array)
    List of resources IDs associated with the default client

  - `device_authorization` (object)
    Configuration for an [OAuth Device Authorization Flow](https://www.rfc-editor.org/rfc/rfc8628) of the default client

  - `ciba_authorization` (object)
    CIBA authorization flow configuration of the default client

  - `client_auth_method` (string)
    This field is deprecated- to configure pkce use "pkce" field instead
    Enum: "client_secret_basic", "self_signed_tls_client_auth", "tls_client_auth", "none", "private_key_jwt"

  - `subdomain` (string)
    Subdomain of Org admin portal that can be offered for organizations to manage their users (when needed)
    Example: myapp

  - `custom_domain` (string)
    Domain of the application that can be offered for the application to be accessed from
    Example: myapp.com

  - `pkce` (string)
    PKCE configuration for client
    Enum: "enforcePkceInsteadOfClientCredentials", "enforcePkceAlongsideClientCredentials", "allowPkceAlongsideClientCredentials"

  - `should_delete_signing_key` (boolean)
    Determines whether the application-specific signing key should be deleted when disabled. If deleted, any tokens previously issued with this key will no longer be valid.

  - `signing_key_enabled` (boolean)
    Determines if application specific signing key is enabled

  - `invite_client_id` (string)
    Client used for the email magic link invitation flow

## Response 201 fields (application/json):

  - `result` (object, required)

  - `result.app_id` (string, required)
    Application ID

  - `result.tenant_id` (string, required)
    Tenant ID

  - `result.app_name` (string, required)
    Application name displayed in the Admin Portal

  - `result.app_description` (string, required)
    Short description of your application, displayed in the Admin Portal

  - `result.client_type` (string)
    Type of the default client
    Enum: "web", "native"

  - `result.logo` (string)
    URI of your application's logo, such as a logo used in email templates

  - `result.client_id` (string)
    Client ID of the default client used for API requests

  - `result.client_display_name` (string)
    Client name of the default client to display when needed

  - `result.client_description` (string)
    Short description of the default client

  - `result.client_secret` (string)
    Client secret of the default client used to obtain tokens for API authorization

  - `result.redirect_uris` (array)
    List of URI approved for redirects for your default client

  - `result.login_preferences` (object, required)

  - `result.login_preferences.auth_methods` (object, required)
    Login preferences

  - `result.login_preferences.auth_methods.google` (object)
    Google login configuration

  - `result.login_preferences.auth_methods.google.clientId` (string, required)
    Client ID retrieved from the identity provider

  - `result.login_preferences.auth_methods.google.clientSecret` (string)
    Client Secret retrieved from the identity provider

  - `result.login_preferences.auth_methods.google.redirectUris` (array)
    List of URIs approved for redirects for your client
    Example: ["https://www.example.com/login"]

  - `result.login_preferences.auth_methods.facebook` (object)
    Facebook login configuration

  - `result.login_preferences.auth_methods.email` (object)
    Email magic link login configuration

  - `result.login_preferences.auth_methods.email.expiresIn` (number, required)
    Number of minutes until the email link/code expires

  - `result.login_preferences.auth_methods.email.linksPerUser` (number, required)
    Allowed magic links to send a user per minute

  - `result.login_preferences.auth_methods.email.message` (object, required)

  - `result.login_preferences.auth_methods.email.message.primaryColor` (string, required)
    Primary color of the email, specified as a Hex color

  - `result.login_preferences.auth_methods.email.message.from` (string)
    Origin of the email message

  - `result.login_preferences.auth_methods.email.message.subject` (string)
    Subject of the email message

  - `result.login_preferences.auth_methods.email_otp` (object)
    Email one time password login configuration

  - `result.login_preferences.auth_methods.email_otp.expiresIn` (number, required)
    Number of minutes until the OTP expires

  - `result.login_preferences.auth_methods.email_otp.lockoutDuration` (number)
    OTP lockout duration (in minutes) after maximum attempts are reached
    Example: 15

  - `result.login_preferences.auth_methods.email_otp.maxFailures` (number, required)
    Number of wrong OTP attempts allowed before the passcode is invalidated. Must be between 1 and 20.
    Example: 3

  - `result.login_preferences.auth_methods.email_otp.codeLength` (number)
    The length of the generated OTP code. Must be between 4 and 8.
    Example: 6

  - `result.login_preferences.auth_methods.email_otp.crossClientsAllowed` (boolean)
    Determines if OTP authentication is allowed across different clients within the same application

  - `result.login_preferences.auth_methods.apple` (object)
    Apple login configuration

  - `result.login_preferences.auth_methods.apple.clientId` (string, required)
    Services ID retrieved from Apple

  - `result.login_preferences.auth_methods.apple.clientSecret` (string)
    Client Secret Signing Key retrieved from Apple

  - `result.login_preferences.auth_methods.apple.redirectUris` (array)
    List of URIs approved for redirects for your client
    Example: ["https://www.example.com/login"]

  - `result.login_preferences.auth_methods.apple.appleTeamId` (string, required)
    Apple Team ID

  - `result.login_preferences.auth_methods.apple.keyId` (string, required)
    Apple Key ID

  - `result.login_preferences.auth_methods.sms` (object)
    SMS one time password login configuration

  - `result.login_preferences.auth_methods.sms.expiresIn` (number, required)
    Number of minutes until the OTP expires

  - `result.login_preferences.auth_methods.sms.lockoutDuration` (number)
    OTP lockout duration (in minutes) after maximum attempts are reached
    Example: 15

  - `result.login_preferences.auth_methods.sms.maxFailures` (number, required)
    Number of wrong OTP attempts allowed before the passcode is invalidated. Must be between 1 and 20.
    Example: 3

  - `result.login_preferences.auth_methods.sms.codeLength` (number)
    The length of the generated OTP code. Must be between 4 and 8.
    Example: 6

  - `result.login_preferences.auth_methods.sms.crossClientsAllowed` (boolean)
    Determines if OTP authentication is allowed across different clients within the same application

  - `result.login_preferences.auth_methods.webauthn_api` (object)
    WebAuthn API configuration

  - `result.login_preferences.auth_methods.webauthn_api.failuresExpireIn` (number)
    Number of minutes until previous failed attempts are considered expired. Must be between 1 and 525600 minutes (1 year).
    Example: 15

  - `result.login_preferences.auth_methods.webauthn_api.lockoutTiers` (array)
    Progressive lockout tiers based on failed attempts

  - `result.login_preferences.auth_methods.webauthn_api.lockoutTiers.attempts` (number, required)
    Number of failed attempts before this tier is triggered
    Example: 3

  - `result.login_preferences.auth_methods.webauthn_api.lockoutTiers.duration` (number, required)
    Lockout duration in minutes for this tier
    Example: 15

  - `result.login_preferences.auth_methods.webauthn_api.rpId` (string, required)
    Domain to which WebAuthn credentials are registered and used to authenticate (e.g., example.com)

  - `result.login_preferences.auth_methods.webauthn_api.rpWebOrigins` (array)
    A list of Web origins that will be used to request registration and authentication. The origin must match the domain of the RP ID, but may be a subdomain of the RP ID (e.g., https://login.example.com ). The origin must also include the HTTPS scheme and port (if relevant).

  - `result.login_preferences.auth_methods.webauthn_api.rpMobileOrigins` (array)
    A list of mobile origins that will be used to request registration and authentication. The origin must match the domain of the RP ID.

  - `result.login_preferences.auth_methods.webauthn_api.replaceExistingPasskey` (boolean)
    Set to true in order to replace the existing passkey. Default is False.

  - `result.login_preferences.auth_methods.webauthn_api.maxFailures` (number)
    Number of wrong attempts allowed before the passcode is invalidated. Must be between 1 and 20.
    Example: 3

  - `result.login_preferences.auth_methods.webauthn_api.lockoutDuration` (number)
    Lockout duration (in minutes) after maximum attempts are reached
    Example: 15

  - `result.login_preferences.auth_methods.webauthn_api.allowSyncedPasskeys` (boolean)
    Allow synced passkeys

  - `result.login_preferences.auth_methods.webauthn_api.enforceAttestation` (boolean)
    Enforce attestation for device-bound passkeys

  - `result.login_preferences.auth_methods.webauthn_api.attestationType` (string)
    Attestation conveyance preference (none, indirect, or direct)
    Enum: "none", "indirect", "direct"

  - `result.login_preferences.auth_methods.webauthn_api.aaguidAllowList` (array)
    List of allowed AAGUIDs (Authenticator Attestation GUIDs). If specified, only authenticators with these AAGUIDs will be accepted. Mutually exclusive with aaguidBlockList.

  - `result.login_preferences.auth_methods.webauthn_api.aaguidBlockList` (array)
    List of blocked AAGUIDs (Authenticator Attestation GUIDs). Authenticators with these AAGUIDs will be rejected. Mutually exclusive with aaguidAllowList.

  - `result.login_preferences.auth_methods.webauthn_api.rpOrigin` (string)
    Web origin that will be used to request registration and authentication. The origin must match the domain of the RP ID, but may be a subdomain of the RP ID (e.g., https://login.example.com ). The origin must also include the HTTPS scheme and port (if relevant).

  - `result.login_preferences.auth_methods.webauthn_api.rpOrigins` (array)
    Use rpWebOrigins or rpMobileOrigins instead

  - `result.login_preferences.auth_methods.line` (object)
    Line login configuration

  - `result.login_preferences.auth_methods.password` (object)
    Password login configuration

  - `result.login_preferences.auth_methods.password.failuresExpireIn` (number)
    Number of minutes until previous failed attempts are considered expired. Must be between 1 and 525600 minutes (1 year).
    Example: 15

  - `result.login_preferences.auth_methods.password.lockoutTiers` (array)
    Progressive lockout tiers based on failed attempts

  - `result.login_preferences.auth_methods.password.resetValidityMinutes` (number, required)
    Number of minutes until reset password token/OTP expires.
    Example: 5

  - `result.login_preferences.auth_methods.password.passwordComplexity` (number, required)
    Password complexity. Must be between 1 and 5.
    Example: 5

  - `result.login_preferences.auth_methods.password.passwordMinLength` (number, required)
    Minimum required length of the password.
    Example: 14

  - `result.login_preferences.auth_methods.password.blockPreviousPasswords` (number, required)
    Number of most recent passwords to block the user from setting as their new password.
    Example: 0

  - `result.login_preferences.auth_methods.password.checkHibp` (boolean)
    Check password updates against HIBP.

  - `result.login_preferences.auth_methods.password.checkDictionary` (boolean)
    Check password updates against a predefined dictionary.

  - `result.login_preferences.auth_methods.password.passwordExpiresIn` (number, required)
    Number of days until the password expires. Must be between 1 and 1096 days (3 years).
    Example: 90

  - `result.login_preferences.auth_methods.password.ignoreExpiration` (boolean)
    Ignore password expiration. If true, the password will never expire.

  - `result.login_preferences.auth_methods.password.maxPasswordFailures` (number)
    Number of wrong password attempts allowed before the user is suspended. Must be between 1 and 20.
    Example: 5

  - `result.login_preferences.auth_methods.password.passwordSuspensionDuration` (number)
    Number of minutes to suspend the user from authenticating using password after the maximum number of allowed failed attempts is exceeded. Must be between 1 and 525600 minutes (1 year).
    Example: 15

  - `result.login_preferences.auth_methods.password.tempPasswordValidityHours` (number)
    Number of hours until temporary passwords are considered expired. Must be between 1 and 8760 hours (1 year).
    Example: 24

  - `result.login_preferences.auth_methods.password.requireMFA` (boolean)
    Require multi-factor authentication for password reset flows.

  - `result.login_preferences.auth_methods.password.codeLength` (number)
    The length of the generated OTP code. Must be between 4 and 8.
    Example: 6

  - `result.login_preferences.auth_methods.password.notifyOnPasswordUpdate` (boolean)
    Send email to end-user upon password update

  - `result.login_preferences.auth_methods.totp` (object)
    TOTP login configuration

  - `result.login_preferences.auth_methods.totp.failuresExpireIn` (number)
    Number of minutes until previous failed attempts are considered expired. Must be between 1 and 525600 minutes (1 year).
    Example: 15

  - `result.login_preferences.auth_methods.totp.lockoutTiers` (array)
    Progressive lockout tiers based on failed attempts

  - `result.login_preferences.auth_methods.totp.algorithm` (string)
    The algorithm used to generate the TOTP code
    Enum: "sha1", "sha256", "sha512"

  - `result.login_preferences.auth_methods.totp.digits` (number)
    Number of digits in the generated TOTP code, must be 6 or 8
    Example: 6

  - `result.login_preferences.auth_methods.totp.period` (number)
    Number of seconds in which the TOTP code is valid
    Example: 30

  - `result.login_preferences.auth_methods.totp.window` (number)
    Number of windows to check for valid TOTP codes
    Example: 2

  - `result.login_preferences.auth_methods.totp.issuer` (string)
    TOTP issuer
    Example: My Company

  - `result.login_preferences.auth_methods.totp.maxFailures` (number)
    Number of wrong TOTP attempts allowed before the passcode is invalidated. Must be between 1 and 20.
    Example: 3

  - `result.login_preferences.auth_methods.totp.lockoutDuration` (number)
    TOTP lockout duration (in minutes) after maximum attempts are reached
    Example: 15

  - `result.login_preferences.auth_methods.totp.maxTotpPerUser` (number)
    Maximum number of TOTP authenticators allowed per user. Must be between 1 and 50.
    Example: 1

  - `result.login_preferences.auth_methods.push` (object)
    Push configuration

  - `result.login_preferences.auth_methods.push.apn` (array)
    APN configuration. Can be a single object or an array of objects.

  - `result.login_preferences.auth_methods.push.apn.key` (string, required)
    APN key

  - `result.login_preferences.auth_methods.push.apn.keyId` (string, required)
    APN key id

  - `result.login_preferences.auth_methods.push.apn.teamId` (string, required)
    APN team id

  - `result.login_preferences.auth_methods.push.apn.bundle` (string, required)
    APN bundle

  - `result.login_preferences.auth_methods.push.apn.isProduction` (boolean)
    Is Production APN Environment

  - `result.login_preferences.auth_methods.push.fcm` (object)
    FCM configuration

  - `result.login_preferences.auth_methods.push.fcm.key` (object, required)
    FCM key

  - `result.login_preferences.auth_methods.tiktok` (object)
    TikTok login configuration

  - `result.login_preferences.auth_methods.pin_authenticator` (object)
    PIN authenticator configuration

  - `result.login_preferences.auth_methods.pin_authenticator.failuresExpireIn` (number)
    Number of minutes until previous failed attempts are considered expired. Must be between 1 and 525600 minutes (1 year).
    Example: 15

  - `result.login_preferences.auth_methods.pin_authenticator.lockoutTiers` (array)
    Progressive lockout tiers based on failed attempts

  - `result.login_preferences.auth_methods.pin_authenticator.maxFailures` (number)
    Number of wrong PIN Authenticator attempts allowed before the passcode is invalidated. Must be between 1 and 20.
    Example: 3

  - `result.login_preferences.auth_methods.pin_authenticator.lockoutDuration` (number)
    PIN Authenticator lockout duration (in minutes) after maximum attempts are reached
    Example: 15

  - `result.login_preferences.auth_methods.face` (object)
    Face authenticator configuration

  - `result.login_preferences.auth_methods.face.failuresExpireIn` (number)
    Number of minutes until previous failed attempts are considered expired. Must be between 1 and 525600 minutes (1 year).
    Example: 15

  - `result.login_preferences.auth_methods.face.lockoutTiers` (array)
    Progressive lockout tiers based on failed attempts

  - `result.login_preferences.auth_methods.face.maxFailures` (number)
    Number of wrong Face Authenticator attempts allowed. Must be between 1 and 20.
    Example: 3

  - `result.login_preferences.auth_methods.face.lockoutDuration` (number)
    Face Authenticator lockout duration (in minutes) after maximum attempts are reached
    Example: 15

  - `result.login_preferences.auth_methods.face.saveImageEmbedding` (boolean)
    Enables saving the image embedding

  - `result.created_at` (string, required)
    Date the application was created

  - `result.created_by` (string, required)
    The user that created the application

  - `result.updated_at` (string, required)
    Date the application was last updated

  - `result.resources` (array)
    List of resources the default client is allowed to explicitly request access to

  - `result.service_providers` (array, required)
    List of service providers this application is allowed to explicitly redirect to

  - `result.authenticator_preferences` (object, required)
    Configures the application as the Authentication Hub of this tenant, allowing other apps to use it to perform a centralized login.

  - `result.authenticator_preferences.is_centralized` (boolean, required)
    Indicates whether to set the application as the Authentication Hub for this tenant

  - `result.authenticator_preferences.login_uri` (string, required)
    URI of the application that will initiate an authentication flow when centralized login is requested
    Example: https://www.example.com/login

  - `result.allow_public_signup` (boolean, required)
    Determines if the application is allowed to request to create new users via login flows

  - `result.client_auth_method` (string)
    This field is deprecated- to configure pkce use "pkce" field instead
    Enum: "client_secret_basic", "self_signed_tls_client_auth", "tls_client_auth", "none", "private_key_jwt"

  - `result.pkce` (string)
    PKCE configuration
    Enum: "enforcePkceInsteadOfClientCredentials", "enforcePkceAlongsideClientCredentials", "allowPkceAlongsideClientCredentials"

  - `result.device_authorization` (object)
    Configuration for an [OAuth Device Authorization Flow](https://www.rfc-editor.org/rfc/rfc8628) of the default client

  - `result.device_authorization.enabled` (boolean, required)
    Determines if the client is allowed to use the OAuth device authorization flow

  - `result.device_authorization.approval_uri` (string, required)
    The URI of the page that allows the user to approve the access request
    Example: https://www.example.com/device/approval

  - `result.device_authorization.success_uri` (string, required)
    Callback URI that receives an indication of whether the end-user authentication was completed successfully.
    Example: https://www.example.com/device/complete

  - `result.device_authorization.input_uri` (string, required)
    The URI of the page that allows the user to enter the code
    Example: https://www.example.com/device/start

  - `result.ciba_authorization` (object)
    CIBA authorization flow configuration of the default client

  - `result.ciba_authorization.enabled` (boolean, required)
    Determines if the client is allowed to use the OAuth CIBA authorization flow

  - `result.ciba_authorization.login_uri` (string)
    The URI of the page that allows the user to log-in and verify the access request
    Example: https://www.example.com/ciba/login

  - `result.password_sharing_group_id` (string)
    If the app has opted in to password sharing, this identifies the group of apps that it shares passwords with.

  - `result.login_uri` (string)
    URI used to redirect the user to the login page of the application (when needed)
    Example: https://www.example.com/login

  - `result.invite_member_uri` (string)
    URI used to redirect the member to the login page of the application (when needed)
    Example: https://www.example.com/login

  - `result.invite_client_id` (string)
    Client used for the email magic link invitation flow

  - `result.subdomain` (string)
    Subdomain of Org admin portal that can be offered for organizations to manage their users (when needed)
    Example: myapp

  - `result.invite_member_email_expiration_minutes` (number)
    Member invite email link expiration in minutes

  - `result.custom_domain` (object)
    Custom domain of the application that can be offered for the application to be accessed from

  - `result.custom_domain.domain` (string, required)
    Domain of the application that can be offered for the application to be accessed from
    Example: myapp.com

  - `result.custom_domain.updated_at` (string, required)
    Date the custom domain was last updated

  - `result.custom_domain.status` (string)
    The status of the custom domain validation process
    Enum: "pending", "verified", "error"

  - `result.custom_domain.error` (string)
    The error message if the custom domain validation process failed

  - `result.external_communication` (object)
    External communication configuration for the application

  - `result.external_communication.language` (string)
    Language configuration for the external communication. The default language is english.
    Enum: "en", "es", "pt", "fr", "ja", "fr-CA"

  - `result.signing_key_enabled` (boolean)
    Determines if application specific signing key is enabled

  - `result.refresh_token_invalidation_trigger_configuration` (object)
    Refresh token invalidation trigger configuration

  - `result.refresh_token_invalidation_trigger_configuration.invalidateOnMemberSuspension` (boolean)
    Determines if refresh tokens should be invalidated when a member is suspended

  - `result.refresh_token_invalidation_trigger_configuration.invalidateOnMemberPasswordReset` (boolean)
    Determines if refresh tokens should be invalidated when a member resets their password

  - `result.refresh_token_invalidation_trigger_configuration.invalidateOnMemberRoleUpdate` (boolean)
    Determines if refresh tokens should be invalidated when a member role is updated

  - `result.application_type` (string)
    Application type
    Enum: "ido", "basic"

## Response 400 fields (application/json):

  - `message` (array, required)
    Example: Bad request

  - `error_code` (number, required)
    Example: 400

## Response 409 fields (application/json):

  - `message` (string, required)

  - `error_code` (number, required)

  - `ts_error_code` (string, required)