# Update app

Updates an application. The fields marked as deprecated are now managed on the client level. To update a default client, create additional clients, or fetch all app clients, use /clients or applications/{appId}/clients endpoints. Note: Fields that are objects cannot be partially updated, since the new value you set will just replace the current one. Required permissions: apps:edit, [appId]:edit.

Endpoint: PUT /v1/applications/{appId}
Security: ClientAccessToken

## Path parameters:

  - `appId` (string, required)
    ID of the application to update

## Request fields (application/json):

  - `app_name` (string)
    Name of the application
    Example: "My App"

  - `app_description` (string)
    Short description of the application

  - `service_providers` (array)
    List of service provider IDs associated with this application

  - `allow_public_signup` (boolean)
    Determines if the application is allowed to request to create new users via login flows

  - `authenticator_preferences` (object)
    Configures the application as the Authentication Hub of this tenant, allowing other apps to use it to perform a centralized login

  - `authenticator_preferences.is_centralized` (boolean, required)
    Indicates whether to set the application as the Authentication Hub for this tenant

  - `authenticator_preferences.login_uri` (string, required)
    URI of the application that will initiate an authentication flow when centralized login is requested
    Example: "https://www.example.com/login"

  - `login_uri` (string)
    URI used to redirect the user to the login page of the application (when needed)
    Example: "https://www.example.com/login"

  - `invite_member_uri` (string)
    URI used to redirect the member to the login page of the application (when needed)
    Example: "https://www.example.com/login"

  - `invite_member_email_expiration_minutes` (number)
    Member invite email link expiration in minutes

  - `refresh_token_invalidation_trigger_configuration` (object)
    Refresh token invalidation trigger configuration

  - `refresh_token_invalidation_trigger_configuration.invalidateOnMemberSuspension` (boolean)
    Determines if refresh tokens should be invalidated when a member is suspended

  - `refresh_token_invalidation_trigger_configuration.invalidateOnMemberPasswordReset` (boolean)
    Determines if refresh tokens should be invalidated when a member resets their password

  - `refresh_token_invalidation_trigger_configuration.invalidateOnMemberRoleUpdate` (boolean)
    Determines if refresh tokens should be invalidated when a member role is updated

  - `first_client_authentication_protocol` (string)
    Defines the first client authentication protocol.
    Enum: "oidc", "saml"

  - `first_client` (any) — one of:
    Creates first client for the application. Client can be OIDC or SAML, depending what is set in first_client_authentication_protocol
    - ApiCreateOidcClientInput:
      - `name` (string, required)
        Name of the client
        Example: "My Client"
      - `description` (string)
        Short description of the client
      - `resources` (array)
        List of resources IDs associated with this client
      - `authentication_protocol` (string)
        Authentication protocol used by the client
        Enum: same as `first_client_authentication_protocol` (2 values)
      - `client_group_id` (string)
        Id of client group to associate with
      - `default_custom_claims` (array)
        List of client default custom claims
        Enum: "tid", "fname", "lname", "mname", "email", "email_verified", "phone_number", "phone_number_verified", "groups", "new_user", "birthday", "language", "city", "address", "country", "street_address", "address_type", "webauthn", "roles", "ts_roles", "role_values", "ts_permissions", "permissions", "approval_data", "custom_group_data", "username", "secondary_phone_numbers", "secondary_emails", "picture", "created_at", "last_auth", "auth_time", "external_account_id", "external_user_id", "app_name", "custom_data", "custom_app_data", "ai_actor"
      - `default_user_info_claims` (array)
        List of client default custom claims returned by the UserInfo endpoint. Mutually exclusive with sync_id_token_claims_to_userinfo=true in the same request.
        Enum: same as `default_custom_claims` in "ApiCreateOidcClientInput" (38 values)
      - `sync_id_token_claims_to_userinfo` (boolean)
        When true, UserInfo custom claims are kept in sync with default_custom_claims (the ID Token list). Mutually exclusive with explicit default_user_info_claims in the same request.
      - `short_cookies_samesite_type` (string)
        Short cookies samesite type. Possible values: "none", "lax", "strict". Default: "lax"
        Enum: "lax", "none"
      - `redirect_uris` (array)
        List of URIs approved for redirects for your client
        Example: ["https://www.example.com/login"]
      - `client_type` (string)
        Client type
        Enum: "web", "native"
      - `device_authorization` (object)
        Configuration for an [OAuth Device Authorization Flow](https://www.rfc-editor.org/rfc/rfc8628)
      - `device_authorization.enabled` (boolean, required)
        Determines if the client is allowed to use the OAuth device authorization flow
      - `device_authorization.approval_uri` (string, required)
        The URI of the page that allows the user to approve the access request
        Example: "https://www.example.com/device/approval"
      - `device_authorization.success_uri` (string, required)
        Callback URI that receives an indication of whether the end-user authentication was completed successfully.
        Example: "https://www.example.com/device/complete"
      - `device_authorization.input_uri` (string, required)
        The URI of the page that allows the user to enter the code
        Example: "https://www.example.com/device/start"
      - `ciba_authorization` (object)
        CIBA authorization flow configuration
      - `ciba_authorization.enabled` (boolean, required)
        Determines if the client is allowed to use the OAuth CIBA authorization flow
      - `ciba_authorization.login_uri` (string)
        The URI of the page that allows the user to log-in and verify the access request
        Example: "https://www.example.com/ciba/login"
      - `is_third_party` (boolean)
        Is third party client
      - `allowed_scopes` (array)
        Allowed scopes
      - `consent_uri` (string)
        Consent URI
      - `consent_validity_period` (number)
        Consent validity period
      - `pkce` (string)
        PKCE configuration
        Enum: "enforcePkceInsteadOfClientCredentials", "enforcePkceAlongsideClientCredentials", "allowPkceAlongsideClientCredentials"
      - `supported_prompts` (array)
        Supported prompts for the OIDC authentication flow
        Enum: "login", "consent", "none"
      - `token_expiration` (object)
        Token expiration settings
      - `token_expiration.access_token_ttl` (number)
        Access token time-to-live
      - `token_expiration.refresh_token_ttl` (number)
        Refresh token time-to-live
      - `token_expiration.max_refresh_rotate` (number)
        Maximum time the refresh token can be rotated
      - `session_expiration` (number)
        Session expiration time (seconds)
      - `enforce_par` (boolean)
        enforce PAR (Pushed Authorization Request) for this client
      - `role_ids` (array)
        Role IDs
      - `fapi_version_compliancy` (boolean)
        FAPI 2.0 compliancy configuration
      - `response_types` (array)
        Enum: "code", "id_token"
      - `authentication_configuration` (object)
        Client authentication configuration
      - `authentication_configuration.method` (string, required)
        Client authentication method
        Enum: "client_secret_basic", "self_signed_tls_client_auth", "tls_client_auth", "private_key_jwt"
      - `authentication_configuration.tls_client_auth` (object)
        TLS client authentication configuration for mTLS
      - `authentication_configuration.tls_client_auth.certificate_chain` (string)
        Certificate chain including intermediate CA certificates used for client certificate validation
      - `authentication_configuration.tls_client_auth.distinguished_name` (number)
        The length of the generated OTP code. Must be between 4 and 8.
        Example: 6
      - `authentication_configuration.tls_client_auth.ocsp_on` (boolean)
        Enables OCSP (Online Certificate Status Protocol) verification
      - `authentication_configuration.tls_client_auth.ocsp_responder_uri` (string)
        OCSP responder URI
      - `authentication_configuration.tls_client_auth.ocsp_responder_certificate` (string)
        OCSP responder certificate used for signature verification
      - `authentication_configuration.tls_client_auth.ocsp_fail_open` (boolean)
        OCSP fail-open
      - `authentication_configuration.isMtlsCertTokenBound` (boolean)
        States whether to bind the access token to the client certificate when mTLS is enabled
      - `authentication_configuration.jwks` (object)
        A set of JWK keys containing the public keys for the Client to use for authentication
      - `id_token_encryption` (object)
        ID Token encryption configuration
      - `id_token_encryption.enabled` (boolean, required)
        Determines if ID token encryption is enabled for the client
      - `id_token_encryption.jwks` (object)
        A set of JWK keys containing the public keys for the client to use for ID token encryption
      - `token_endpoint_auth_method` (string)
        This field is deprecated- to configure pkce use "pkce" field instead
        Enum: "client_secret_basic", "self_signed_tls_client_auth", "tls_client_auth", "none", "private_key_jwt"
    - ApiCreateSamlClientInput:
      - `name` (string, required)
        Name of the client
        Example: "My Client"
      - `description` (string)
        Short description of the client
      - `resources` (array)
        List of resources IDs associated with this client
      - `authentication_protocol` (string)
        Authentication protocol used by the client
        Enum: same as `first_client_authentication_protocol` (2 values)
      - `client_group_id` (string)
        Id of client group to associate with
      - `default_custom_claims` (array)
        List of client default custom claims
        Enum: same as `default_custom_claims` in "ApiCreateOidcClientInput" (38 values)
      - `default_user_info_claims` (array)
        List of client default custom claims returned by the UserInfo endpoint. Mutually exclusive with sync_id_token_claims_to_userinfo=true in the same request.
        Enum: same as `default_custom_claims` in "ApiCreateOidcClientInput" (38 values)
      - `sync_id_token_claims_to_userinfo` (boolean)
        When true, UserInfo custom claims are kept in sync with default_custom_claims (the ID Token list). Mutually exclusive with explicit default_user_info_claims in the same request.
      - `short_cookies_samesite_type` (string)
        Short cookies samesite type. Possible values: "none", "lax", "strict". Default: "lax"
        Enum: same as `short_cookies_samesite_type` in "ApiCreateOidcClientInput" (2 values)
      - `sp_acs_url` (string)
        SAML ACS URL
      - `sp_entity_id` (string, required)
        SAML Service provider entity ID
      - `sp_name_id_type` (string)
        SAML Name ID Type
        Enum: "email", "secondaryEmail", "username", "phoneNumber", "externalUserId"
      - `supported_prompts` (array)
        Supported prompts for the OIDC authentication flow
        Enum: same as `supported_prompts` in "ApiCreateOidcClientInput" (3 values)
      - `sign_assertion` (boolean)
        Sign SAML assertion
      - `optional_acs_url` (boolean)
        Allow ACS URL to be optional
      - `use_centralized_login` (boolean)
        When enabled, SAML SP-initiated SSO redirects to the tenant centralized hub application instead of hosted login

  - `logo` (string)
    URI of your application's logo, such as for email templates

  - `subdomain` (string)
    Subdomain of Org admin portal that can be offered for organizations to manage their users (when needed)
    Example: "myapp"

  - `custom_domain` (string)
    Domain of the application that can be offered for the application to be accessed from
    Example: "myapp.com"

  - `pkce` (string)
    PKCE configuration for client
    Enum: same as `pkce` in "ApiCreateOidcClientInput" (3 values)

  - `should_delete_signing_key` (boolean)
    Determines whether the application-specific signing key should be deleted when disabled. If deleted, any tokens previously issued with this key will no longer be valid.

  - `signing_key_enabled` (boolean)
    Determines if application specific signing key is enabled

  - `invite_client_id` (string)
    Client used for the email magic link invitation flow

  - `client_type` (string)
    Client type of the default client
    Enum: same as `client_type` in "ApiCreateOidcClientInput" (2 values)

  - `client_display_name` (string)
    Client name of the default client to display when needed

  - `client_description` (string)
    Short description of the default client

  - `redirect_uris` (array)
    List of URI approved for redirects for your default client
    Example: ["https://www.example.com/login"]

  - `resources` (array)
    List of resources IDs associated with the default client

  - `device_authorization` (object)
    Configuration for an [OAuth Device Authorization Flow](https://www.rfc-editor.org/rfc/rfc8628) of the default client

  - `device_authorization.enabled` (boolean, required)
    Determines if the client is allowed to use the OAuth device authorization flow

  - `device_authorization.approval_uri` (string, required)
    The URI of the page that allows the user to approve the access request
    Example: "https://www.example.com/device/approval"

  - `device_authorization.success_uri` (string, required)
    Callback URI that receives an indication of whether the end-user authentication was completed successfully.
    Example: "https://www.example.com/device/complete"

  - `device_authorization.input_uri` (string, required)
    The URI of the page that allows the user to enter the code
    Example: "https://www.example.com/device/start"

  - `ciba_authorization` (object)
    CIBA authorization flow configuration of the default client

  - `ciba_authorization.enabled` (boolean, required)
    Determines if the client is allowed to use the OAuth CIBA authorization flow

  - `ciba_authorization.login_uri` (string)
    The URI of the page that allows the user to log-in and verify the access request
    Example: "https://www.example.com/ciba/login"

  - `client_auth_method` (string)
    This field is deprecated- to configure pkce use "pkce" field instead
    Enum: same as `token_endpoint_auth_method` in "ApiCreateOidcClientInput" (5 values)

## Response 200 fields (application/json):

  - `result` (object, required)

  - `result.app_id` (string, required)
    Application ID

  - `result.tenant_id` (string, required)
    Tenant ID

  - `result.app_name` (string, required)
    Application name displayed in the Admin Portal

  - `result.app_description` (string, required)
    Short description of your application, displayed in the Admin Portal

  - `result.logo` (string,null)
    URI of your application's logo, such as a logo used in email templates

  - `result.login_preferences` (object, required)

  - `result.login_preferences.auth_methods` (object, required)
    Login preferences

  - `result.login_preferences.auth_methods.google` (object)
    Google login configuration

  - `result.login_preferences.auth_methods.google.clientId` (string, required)
    Client ID retrieved from the identity provider

  - `result.login_preferences.auth_methods.google.clientSecret` (string)
    Client Secret retrieved from the identity provider

  - `result.login_preferences.auth_methods.google.redirectUris` (array)
    List of URIs approved for redirects for your client
    Example: ["https://www.example.com/login"]

  - `result.login_preferences.auth_methods.facebook` (object)
    Facebook login configuration

  - `result.login_preferences.auth_methods.facebook.clientId` (string, required)
    Client ID retrieved from the identity provider

  - `result.login_preferences.auth_methods.facebook.clientSecret` (string)
    Client Secret retrieved from the identity provider

  - `result.login_preferences.auth_methods.facebook.redirectUris` (array)
    List of URIs approved for redirects for your client
    Example: ["https://www.example.com/login"]

  - `result.login_preferences.auth_methods.email` (object)
    Email magic link login configuration

  - `result.login_preferences.auth_methods.email.expiresIn` (number, required)
    Number of minutes until the email link/code expires

  - `result.login_preferences.auth_methods.email.linksPerUser` (number, required)
    Allowed magic links to send a user per minute

  - `result.login_preferences.auth_methods.email.message` (object, required)

  - `result.login_preferences.auth_methods.email.message.primaryColor` (string, required)
    Primary color of the email, specified as a Hex color

  - `result.login_preferences.auth_methods.email.message.from` (string)
    Origin of the email message

  - `result.login_preferences.auth_methods.email.message.subject` (string)
    Subject of the email message

  - `result.login_preferences.auth_methods.email_otp` (object)
    Email one time password login configuration

  - `result.login_preferences.auth_methods.email_otp.expiresIn` (number, required)
    Number of minutes until the OTP expires

  - `result.login_preferences.auth_methods.email_otp.lockoutDuration` (number)
    OTP lockout duration (in minutes) after maximum attempts are reached
    Example: 15

  - `result.login_preferences.auth_methods.email_otp.maxFailures` (number, required)
    Number of wrong OTP attempts allowed before the passcode is invalidated. Must be between 1 and 20.
    Example: 3

  - `result.login_preferences.auth_methods.email_otp.codeLength` (number)
    The length of the generated OTP code. Must be between 4 and 8.
    Example: 6

  - `result.login_preferences.auth_methods.email_otp.crossClientsAllowed` (boolean)
    Determines if OTP authentication is allowed across different clients within the same application

  - `result.login_preferences.auth_methods.email_otp.message` (object, required)

  - `result.login_preferences.auth_methods.apple` (object)
    Apple login configuration

  - `result.login_preferences.auth_methods.apple.clientId` (string, required)
    Services ID retrieved from Apple

  - `result.login_preferences.auth_methods.apple.clientSecret` (string)
    Client Secret Signing Key retrieved from Apple

  - `result.login_preferences.auth_methods.apple.redirectUris` (array)
    List of URIs approved for redirects for your client
    Example: ["https://www.example.com/login"]

  - `result.login_preferences.auth_methods.apple.appleTeamId` (string, required)
    Apple Team ID

  - `result.login_preferences.auth_methods.apple.keyId` (string, required)
    Apple Key ID

  - `result.login_preferences.auth_methods.sms` (object)
    SMS one time password login configuration

  - `result.login_preferences.auth_methods.sms.expiresIn` (number, required)
    Number of minutes until the OTP expires

  - `result.login_preferences.auth_methods.sms.lockoutDuration` (number)
    OTP lockout duration (in minutes) after maximum attempts are reached
    Example: 15

  - `result.login_preferences.auth_methods.sms.maxFailures` (number, required)
    Number of wrong OTP attempts allowed before the passcode is invalidated. Must be between 1 and 20.
    Example: 3

  - `result.login_preferences.auth_methods.sms.codeLength` (number)
    The length of the generated OTP code. Must be between 4 and 8.
    Example: 6

  - `result.login_preferences.auth_methods.sms.crossClientsAllowed` (boolean)
    Determines if OTP authentication is allowed across different clients within the same application

  - `result.login_preferences.auth_methods.webauthn_api` (object)
    WebAuthn API configuration

  - `result.login_preferences.auth_methods.webauthn_api.failuresExpireIn` (number)
    Number of minutes until previous failed attempts are considered expired. Must be between 1 and 525600 minutes (1 year).
    Example: 15

  - `result.login_preferences.auth_methods.webauthn_api.lockoutTiers` (array)
    Progressive lockout tiers based on failed attempts

  - `result.login_preferences.auth_methods.webauthn_api.lockoutTiers.attempts` (number, required)
    Number of failed attempts before this tier is triggered
    Example: 3

  - `result.login_preferences.auth_methods.webauthn_api.lockoutTiers.duration` (number, required)
    Lockout duration in minutes for this tier
    Example: 15

  - `result.login_preferences.auth_methods.webauthn_api.rpId` (string, required)
    Domain to which WebAuthn credentials are registered and used to authenticate (e.g., example.com)

  - `result.login_preferences.auth_methods.webauthn_api.rpWebOrigins` (array)
    A list of Web origins that will be used to request registration and authentication. The origin must match the domain of the RP ID, but may be a subdomain of the RP ID (e.g., https://login.example.com ). The origin must also include the HTTPS scheme and port (if relevant).

  - `result.login_preferences.auth_methods.webauthn_api.rpMobileOrigins` (array)
    A list of mobile origins that will be used to request registration and authentication. The origin must match the domain of the RP ID.

  - `result.login_preferences.auth_methods.webauthn_api.replaceExistingPasskey` (boolean)
    Set to true in order to replace the existing passkey. Default is False.

  - `result.login_preferences.auth_methods.webauthn_api.allowSyncedPasskeys` (boolean)
    Allow synced passkeys

  - `result.login_preferences.auth_methods.webauthn_api.enforceAttestation` (boolean)
    Enforce attestation for device-bound passkeys

  - `result.login_preferences.auth_methods.webauthn_api.attestationType` (string)
    Attestation conveyance preference (none, indirect, or direct)
    Enum: "none", "indirect", "direct"

  - `result.login_preferences.auth_methods.webauthn_api.aaguidAllowList` (array)
    List of allowed AAGUIDs (Authenticator Attestation GUIDs). If specified, only authenticators with these AAGUIDs will be accepted. Mutually exclusive with aaguidBlockList.

  - `result.login_preferences.auth_methods.webauthn_api.aaguidBlockList` (array)
    List of blocked AAGUIDs (Authenticator Attestation GUIDs). Authenticators with these AAGUIDs will be rejected. Mutually exclusive with aaguidAllowList.

  - `result.login_preferences.auth_methods.webauthn_api.maxFailures` (number)
    Number of wrong attempts allowed before the passcode is invalidated. Must be between 1 and 20.
    Example: 3

  - `result.login_preferences.auth_methods.webauthn_api.lockoutDuration` (number)
    Lockout duration (in minutes) after maximum attempts are reached
    Example: 15

  - `result.login_preferences.auth_methods.webauthn_api.rpOrigin` (string)
    Web origin that will be used to request registration and authentication. The origin must match the domain of the RP ID, but may be a subdomain of the RP ID (e.g., https://login.example.com ). The origin must also include the HTTPS scheme and port (if relevant).

  - `result.login_preferences.auth_methods.webauthn_api.rpOrigins` (array)
    Use rpWebOrigins or rpMobileOrigins instead

  - `result.login_preferences.auth_methods.line` (object)
    Line login configuration

  - `result.login_preferences.auth_methods.line.clientId` (string, required)
    Client ID retrieved from the identity provider

  - `result.login_preferences.auth_methods.line.clientSecret` (string)
    Client Secret retrieved from the identity provider

  - `result.login_preferences.auth_methods.line.redirectUris` (array)
    List of URIs approved for redirects for your client
    Example: ["https://www.example.com/login"]

  - `result.login_preferences.auth_methods.password` (object)
    Password login configuration

  - `result.login_preferences.auth_methods.password.failuresExpireIn` (number)
    Number of minutes until previous failed attempts are considered expired. Must be between 1 and 525600 minutes (1 year).
    Example: 15

  - `result.login_preferences.auth_methods.password.lockoutTiers` (array)
    Progressive lockout tiers based on failed attempts

  - `result.login_preferences.auth_methods.password.resetValidityMinutes` (number, required)
    Number of minutes until reset password token/OTP expires.
    Example: 5

  - `result.login_preferences.auth_methods.password.passwordComplexity` (number, required)
    Password complexity. Must be between 1 and 5.
    Example: 5

  - `result.login_preferences.auth_methods.password.passwordMinLength` (number, required)
    Minimum required length of the password.
    Example: 14

  - `result.login_preferences.auth_methods.password.blockPreviousPasswords` (number, required)
    Number of most recent passwords to block the user from setting as their new password.

  - `result.login_preferences.auth_methods.password.checkHibp` (boolean)
    Check password updates against HIBP.

  - `result.login_preferences.auth_methods.password.checkDictionary` (boolean)
    Check password updates against a predefined dictionary.

  - `result.login_preferences.auth_methods.password.passwordExpiresIn` (number, required)
    Number of days until the password expires. Must be between 1 and 1096 days (3 years).
    Example: 90

  - `result.login_preferences.auth_methods.password.ignoreExpiration` (boolean)
    Ignore password expiration. If true, the password will never expire.

  - `result.login_preferences.auth_methods.password.maxPasswordFailures` (number)
    Number of wrong password attempts allowed before the user is suspended. Must be between 1 and 20.
    Example: 5

  - `result.login_preferences.auth_methods.password.passwordSuspensionDuration` (number)
    Number of minutes to suspend the user from authenticating using password after the maximum number of allowed failed attempts is exceeded. Must be between 1 and 525600 minutes (1 year).
    Example: 15

  - `result.login_preferences.auth_methods.password.tempPasswordValidityHours` (number)
    Number of hours until temporary passwords are considered expired. Must be between 1 and 8760 hours (1 year).
    Example: 24

  - `result.login_preferences.auth_methods.password.message` (object, required)

  - `result.login_preferences.auth_methods.password.requireMFA` (boolean)
    Require multi-factor authentication for password reset flows.

  - `result.login_preferences.auth_methods.password.codeLength` (number)
    The length of the generated OTP code. Must be between 4 and 8.
    Example: 6

  - `result.login_preferences.auth_methods.password.notifyOnPasswordUpdate` (boolean)
    Send email to end-user upon password update

  - `result.login_preferences.auth_methods.totp` (object)
    TOTP login configuration

  - `result.login_preferences.auth_methods.totp.failuresExpireIn` (number)
    Number of minutes until previous failed attempts are considered expired. Must be between 1 and 525600 minutes (1 year).
    Example: 15

  - `result.login_preferences.auth_methods.totp.lockoutTiers` (array)
    Progressive lockout tiers based on failed attempts

  - `result.login_preferences.auth_methods.totp.algorithm` (string)
    The algorithm used to generate the TOTP code
    Enum: "sha1", "sha256", "sha512"

  - `result.login_preferences.auth_methods.totp.digits` (number)
    Number of digits in the generated TOTP code, must be 6 or 8
    Example: 6

  - `result.login_preferences.auth_methods.totp.period` (number)
    Number of seconds in which the TOTP code is valid
    Example: 30

  - `result.login_preferences.auth_methods.totp.window` (number)
    Number of windows to check for valid TOTP codes
    Example: 2

  - `result.login_preferences.auth_methods.totp.issuer` (string)
    TOTP issuer
    Example: "My Company"

  - `result.login_preferences.auth_methods.totp.maxTotpPerUser` (number)
    Maximum number of TOTP authenticators allowed per user. Must be between 1 and 50.
    Example: 1

  - `result.login_preferences.auth_methods.totp.maxFailures` (number)
    Number of wrong TOTP attempts allowed before the passcode is invalidated. Must be between 1 and 20.
    Example: 3

  - `result.login_preferences.auth_methods.totp.lockoutDuration` (number)
    TOTP lockout duration (in minutes) after maximum attempts are reached
    Example: 15

  - `result.login_preferences.auth_methods.push` (object)
    Push configuration

  - `result.login_preferences.auth_methods.push.apn` (array)
    APN configuration. Can be a single object or an array of objects.
    - `key` (string, required)
      APN key
    - `keyId` (string, required)
      APN key id
    - `teamId` (string, required)
      APN team id
    - `bundle` (string, required)
      APN bundle
    - `isProduction` (boolean)
      Is Production APN Environment

  - `result.login_preferences.auth_methods.push.fcm` (object)
    FCM configuration

  - `result.login_preferences.auth_methods.push.fcm.key` (object, required)
    FCM key

  - `result.login_preferences.auth_methods.tiktok` (object)
    TikTok login configuration

  - `result.login_preferences.auth_methods.tiktok.clientId` (string, required)
    Client ID retrieved from the identity provider

  - `result.login_preferences.auth_methods.tiktok.clientSecret` (string)
    Client Secret retrieved from the identity provider

  - `result.login_preferences.auth_methods.tiktok.redirectUris` (array)
    List of URIs approved for redirects for your client
    Example: ["https://www.example.com/login"]

  - `result.login_preferences.auth_methods.pin_authenticator` (object)
    PIN authenticator configuration

  - `result.login_preferences.auth_methods.pin_authenticator.failuresExpireIn` (number)
    Number of minutes until previous failed attempts are considered expired. Must be between 1 and 525600 minutes (1 year).
    Example: 15

  - `result.login_preferences.auth_methods.pin_authenticator.lockoutTiers` (array)
    Progressive lockout tiers based on failed attempts

  - `result.login_preferences.auth_methods.pin_authenticator.maxFailures` (number)
    Number of wrong PIN Authenticator attempts allowed before the passcode is invalidated. Must be between 1 and 20.
    Example: 3

  - `result.login_preferences.auth_methods.pin_authenticator.lockoutDuration` (number)
    PIN Authenticator lockout duration (in minutes) after maximum attempts are reached
    Example: 15

  - `result.login_preferences.auth_methods.face` (object)
    Face authenticator configuration

  - `result.login_preferences.auth_methods.face.failuresExpireIn` (number)
    Number of minutes until previous failed attempts are considered expired. Must be between 1 and 525600 minutes (1 year).
    Example: 15

  - `result.login_preferences.auth_methods.face.lockoutTiers` (array)
    Progressive lockout tiers based on failed attempts

  - `result.login_preferences.auth_methods.face.saveImageEmbedding` (boolean)
    Enables saving the image embedding

  - `result.login_preferences.auth_methods.face.maxFailures` (number)
    Number of wrong Face Authenticator attempts allowed. Must be between 1 and 20.
    Example: 3

  - `result.login_preferences.auth_methods.face.lockoutDuration` (number)
    Face Authenticator lockout duration (in minutes) after maximum attempts are reached
    Example: 15

  - `result.created_at` (string, required)
    Date the application was created

  - `result.created_by` (string, required)
    The user that created the application

  - `result.updated_at` (string, required)
    Date the application was last updated

  - `result.service_providers` (array, required)
    List of service providers this application is allowed to explicitly redirect to

  - `result.authenticator_preferences` (object, required)
    Configures the application as the Authentication Hub of this tenant, allowing other apps to use it to perform a centralized login.

  - `result.authenticator_preferences.is_centralized` (boolean, required)
    Indicates whether to set the application as the Authentication Hub for this tenant

  - `result.authenticator_preferences.login_uri` (string, required)
    URI of the application that will initiate an authentication flow when centralized login is requested
    Example: "https://www.example.com/login"

  - `result.allow_public_signup` (boolean, required)
    Determines if the application is allowed to request to create new users via login flows

  - `result.pkce` (string)
    PKCE configuration
    Enum: same as `pkce` in "ApiCreateOidcClientInput" (3 values)

  - `result.password_sharing_group_id` (string)
    If the app has opted in to password sharing, this identifies the group of apps that it shares passwords with.

  - `result.login_uri` (string)
    URI used to redirect the user to the login page of the application (when needed)
    Example: "https://www.example.com/login"

  - `result.invite_member_uri` (string)
    URI used to redirect the member to the login page of the application (when needed)
    Example: "https://www.example.com/login"

  - `result.invite_client_id` (string)
    Client used for the email magic link invitation flow

  - `result.subdomain` (string)
    Subdomain of Org admin portal that can be offered for organizations to manage their users (when needed)
    Example: "myapp"

  - `result.invite_member_email_expiration_minutes` (number)
    Member invite email link expiration in minutes

  - `result.custom_domain` (object)
    Custom domain of the application that can be offered for the application to be accessed from

  - `result.custom_domain.domain` (string, required)
    Domain of the application that can be offered for the application to be accessed from
    Example: "myapp.com"

  - `result.custom_domain.updated_at` (string, required)
    Date the custom domain was last updated

  - `result.custom_domain.status` (string)
    The status of the custom domain validation process
    Enum: "pending", "verified", "error"

  - `result.custom_domain.error` (string)
    The error message if the custom domain validation process failed

  - `result.external_communication` (object)
    External communication configuration for the application

  - `result.external_communication.language` (string)
    Language configuration for the external communication. The default language is english.
    Enum: "en", "es", "pt", "fr", "ja", "fr-CA"

  - `result.signing_key_enabled` (boolean)
    Determines if application specific signing key is enabled

  - `result.refresh_token_invalidation_trigger_configuration` (object)
    Refresh token invalidation trigger configuration

  - `result.refresh_token_invalidation_trigger_configuration.invalidateOnMemberSuspension` (boolean)
    Determines if refresh tokens should be invalidated when a member is suspended

  - `result.refresh_token_invalidation_trigger_configuration.invalidateOnMemberPasswordReset` (boolean)
    Determines if refresh tokens should be invalidated when a member resets their password

  - `result.refresh_token_invalidation_trigger_configuration.invalidateOnMemberRoleUpdate` (boolean)
    Determines if refresh tokens should be invalidated when a member role is updated

  - `result.application_type` (string)
    Application type
    Enum: "ido", "basic"

  - `result.client_type` (string)
    Type of the default client
    Enum: same as `client_type` in "ApiCreateOidcClientInput" (2 values)

  - `result.client_id` (string)
    Client ID of the default client used for API requests

  - `result.client_display_name` (string)
    Client name of the default client to display when needed

  - `result.client_description` (string)
    Short description of the default client

  - `result.client_secret` (string)
    Client secret of the default client used to obtain tokens for API authorization

  - `result.redirect_uris` (array)
    List of URI approved for redirects for your default client

  - `result.resources` (array)
    List of resources the default client is allowed to explicitly request access to

  - `result.client_auth_method` (string)
    This field is deprecated- to configure pkce use "pkce" field instead
    Enum: same as `token_endpoint_auth_method` in "ApiCreateOidcClientInput" (5 values)

  - `result.device_authorization` (object)
    Configuration for an [OAuth Device Authorization Flow](https://www.rfc-editor.org/rfc/rfc8628) of the default client

  - `result.device_authorization.enabled` (boolean, required)
    Determines if the client is allowed to use the OAuth device authorization flow

  - `result.device_authorization.approval_uri` (string, required)
    The URI of the page that allows the user to approve the access request
    Example: "https://www.example.com/device/approval"

  - `result.device_authorization.success_uri` (string, required)
    Callback URI that receives an indication of whether the end-user authentication was completed successfully.
    Example: "https://www.example.com/device/complete"

  - `result.device_authorization.input_uri` (string, required)
    The URI of the page that allows the user to enter the code
    Example: "https://www.example.com/device/start"

  - `result.ciba_authorization` (object)
    CIBA authorization flow configuration of the default client

  - `result.ciba_authorization.enabled` (boolean, required)
    Determines if the client is allowed to use the OAuth CIBA authorization flow

  - `result.ciba_authorization.login_uri` (string)
    The URI of the page that allows the user to log-in and verify the access request
    Example: "https://www.example.com/ciba/login"

## Response 400 fields (application/json):

  - `message` (array, required)
    Example: "Bad request"

  - `error_code` (number, required)
    Example: 400

## Response 404 fields (application/json):

  - `message` (string, required)

  - `error_code` (number, required)
    Example: 404