# Get management apps

Retrieve a list of all management applications

Endpoint: GET /v1/management/applications
Security: ClientAccessToken, AdminAccessToken

## Security:

  - `ClientAccessToken` (unknown)
    oauth2

  - `AdminAccessToken` (unknown)
    oauth2

## Response 200 fields (application/json):

  - `result` (array, required)

  - `result.app_id` (string, required)
    Application ID

  - `result.tenant_id` (string, required)
    Tenant ID

  - `result.app_name` (string, required)
    Application name displayed in the Admin Portal

  - `result.app_description` (string, required)
    Short description of your application, displayed in the Admin Portal

  - `result.client_type` (string)
    Type of the default client
    Enum: "web", "native"

  - `result.client_id` (string)
    Client ID of the default client used for API requests

  - `result.client_display_name` (string)
    Client name of the default client to display when needed

  - `result.client_description` (string)
    Short description of the default client

  - `result.client_secret` (string)
    Client secret of the default client used to obtain tokens for API authorization

  - `result.redirect_uris` (array)
    List of URI approved for redirects for your default client

  - `result.login_preferences` (object, required)

  - `result.login_preferences.auth_methods` (object, required)
    Login preferences

  - `result.login_preferences.auth_methods.google` (object)
    Google login configuration

  - `result.login_preferences.auth_methods.google.clientId` (string, required)
    Client ID retrieved from the identity provider

  - `result.login_preferences.auth_methods.google.clientSecret` (string)
    Client Secret retrieved from the identity provider

  - `result.login_preferences.auth_methods.google.redirectUris` (array)
    List of URIs approved for redirects for your client
    Example: ["https://www.example.com/login"]

  - `result.login_preferences.auth_methods.facebook` (object)
    Facebook login configuration

  - `result.login_preferences.auth_methods.facebook.clientId` (string, required)
    Client ID retrieved from the identity provider

  - `result.login_preferences.auth_methods.facebook.clientSecret` (string)
    Client Secret retrieved from the identity provider

  - `result.login_preferences.auth_methods.facebook.redirectUris` (array)
    List of URIs approved for redirects for your client
    Example: ["https://www.example.com/login"]

  - `result.login_preferences.auth_methods.facebook.blockSignupWithoutEmail` (boolean)
    Blocks creating a new user when Facebook does not return an email address, which happens when the end-user declines to share their email on the consent screen. Existing users are not affected. Applies to OIDC login only; backend authentication is not affected.

  - `result.login_preferences.auth_methods.facebook.rerequestDeclinedScopes` (boolean)
    If a user previously declined to share their email during Facebook login, they will be asked to share it again on every login until they do. Applies to both OIDC login and backend authentication.

  - `result.login_preferences.auth_methods.email` (object)
    Email magic link login configuration

  - `result.login_preferences.auth_methods.email.expiresIn` (number, required)
    Number of minutes until the email link/code expires

  - `result.login_preferences.auth_methods.email.linksPerUser` (number, required)
    Allowed magic links to send a user per minute

  - `result.login_preferences.auth_methods.email.message` (object, required)

  - `result.login_preferences.auth_methods.email.message.primaryColor` (string, required)
    Primary color of the email, specified as a Hex color

  - `result.login_preferences.auth_methods.email.message.from` (string)
    Origin of the email message

  - `result.login_preferences.auth_methods.email.message.subject` (string)
    Subject of the email message

  - `result.login_preferences.auth_methods.email_otp` (object)
    Email one time password login configuration

  - `result.login_preferences.auth_methods.email_otp.expiresIn` (number, required)
    Number of minutes until the OTP expires

  - `result.login_preferences.auth_methods.email_otp.lockoutDuration` (number)
    OTP lockout duration (in minutes) after maximum attempts are reached
    Example: 15

  - `result.login_preferences.auth_methods.email_otp.maxFailures` (number, required)
    Number of wrong OTP attempts allowed before the passcode is invalidated. Must be between 1 and 20.
    Example: 3

  - `result.login_preferences.auth_methods.email_otp.codeLength` (number)
    The length of the generated OTP code. Must be between 4 and 8.
    Example: 6

  - `result.login_preferences.auth_methods.email_otp.crossClientsAllowed` (boolean)
    Determines if OTP authentication is allowed across different clients within the same application

  - `result.login_preferences.auth_methods.apple` (object)
    Apple login configuration

  - `result.login_preferences.auth_methods.apple.clientId` (string, required)
    Services ID retrieved from Apple

  - `result.login_preferences.auth_methods.apple.clientSecret` (string)
    Client Secret Signing Key retrieved from Apple

  - `result.login_preferences.auth_methods.apple.redirectUris` (array)
    List of URIs approved for redirects for your client
    Example: ["https://www.example.com/login"]

  - `result.login_preferences.auth_methods.apple.appleTeamId` (string, required)
    Apple Team ID

  - `result.login_preferences.auth_methods.apple.keyId` (string, required)
    Apple Key ID

  - `result.login_preferences.auth_methods.sms` (object)
    SMS one time password login configuration

  - `result.login_preferences.auth_methods.sms.expiresIn` (number, required)
    Number of minutes until the OTP expires

  - `result.login_preferences.auth_methods.sms.lockoutDuration` (number)
    OTP lockout duration (in minutes) after maximum attempts are reached
    Example: 15

  - `result.login_preferences.auth_methods.sms.maxFailures` (number, required)
    Number of wrong OTP attempts allowed before the passcode is invalidated. Must be between 1 and 20.
    Example: 3

  - `result.login_preferences.auth_methods.sms.codeLength` (number)
    The length of the generated OTP code. Must be between 4 and 8.
    Example: 6

  - `result.login_preferences.auth_methods.sms.crossClientsAllowed` (boolean)
    Determines if OTP authentication is allowed across different clients within the same application

  - `result.login_preferences.auth_methods.webauthn_api` (object)
    WebAuthn API configuration

  - `result.login_preferences.auth_methods.webauthn_api.failuresExpireIn` (number)
    Number of minutes until previous failed attempts are considered expired. Must be between 1 and 525600 minutes (1 year).
    Example: 15

  - `result.login_preferences.auth_methods.webauthn_api.lockoutTiers` (array)
    Progressive lockout tiers based on failed attempts

  - `result.login_preferences.auth_methods.webauthn_api.lockoutTiers.attempts` (number, required)
    Number of failed attempts before this tier is triggered
    Example: 3

  - `result.login_preferences.auth_methods.webauthn_api.lockoutTiers.duration` (number, required)
    Lockout duration in minutes for this tier
    Example: 15

  - `result.login_preferences.auth_methods.webauthn_api.rpId` (string, required)
    Domain to which WebAuthn credentials are registered and used to authenticate (e.g., example.com)

  - `result.login_preferences.auth_methods.webauthn_api.rpWebOrigins` (array)
    A list of Web origins that will be used to request registration and authentication. The origin must match the domain of the RP ID, but may be a subdomain of the RP ID (e.g., https://login.example.com ). The origin must also include the HTTPS scheme and port (if relevant).

  - `result.login_preferences.auth_methods.webauthn_api.rpMobileOrigins` (array)
    A list of mobile origins that will be used to request registration and authentication. The origin must match the domain of the RP ID.

  - `result.login_preferences.auth_methods.webauthn_api.replaceExistingPasskey` (boolean)
    Set to true in order to replace the existing passkey. Default is False.

  - `result.login_preferences.auth_methods.webauthn_api.maxFailures` (number)
    Number of wrong attempts allowed before the passcode is invalidated. Must be between 1 and 20.
    Example: 3

  - `result.login_preferences.auth_methods.webauthn_api.lockoutDuration` (number)
    Lockout duration (in minutes) after maximum attempts are reached
    Example: 15

  - `result.login_preferences.auth_methods.webauthn_api.allowSyncedPasskeys` (boolean)
    Allow synced passkeys

  - `result.login_preferences.auth_methods.webauthn_api.enforceAttestation` (boolean)
    Enforce attestation for device-bound passkeys

  - `result.login_preferences.auth_methods.webauthn_api.attestationType` (string)
    Attestation conveyance preference (none, indirect, or direct)
    Enum: "none", "indirect", "direct"

  - `result.login_preferences.auth_methods.webauthn_api.aaguidAllowList` (array)
    List of allowed AAGUIDs (Authenticator Attestation GUIDs). If specified, only authenticators with these AAGUIDs will be accepted. Mutually exclusive with aaguidBlockList.

  - `result.login_preferences.auth_methods.webauthn_api.aaguidBlockList` (array)
    List of blocked AAGUIDs (Authenticator Attestation GUIDs). Authenticators with these AAGUIDs will be rejected. Mutually exclusive with aaguidAllowList.

  - `result.login_preferences.auth_methods.webauthn_api.rpOrigin` (string)
    Web origin that will be used to request registration and authentication. The origin must match the domain of the RP ID, but may be a subdomain of the RP ID (e.g., https://login.example.com ). The origin must also include the HTTPS scheme and port (if relevant).

  - `result.login_preferences.auth_methods.webauthn_api.rpOrigins` (array)
    Use rpWebOrigins or rpMobileOrigins instead

  - `result.login_preferences.auth_methods.line` (object)
    Line login configuration

  - `result.login_preferences.auth_methods.password` (object)
    Password login configuration

  - `result.login_preferences.auth_methods.password.failuresExpireIn` (number)
    Number of minutes until previous failed attempts are considered expired. Must be between 1 and 525600 minutes (1 year).
    Example: 15

  - `result.login_preferences.auth_methods.password.lockoutTiers` (array)
    Progressive lockout tiers based on failed attempts

  - `result.login_preferences.auth_methods.password.resetValidityMinutes` (number, required)
    Number of minutes until reset password token/OTP expires.
    Example: 5

  - `result.login_preferences.auth_methods.password.passwordComplexity` (number, required)
    Password complexity. Must be between 1 and 5.
    Example: 5

  - `result.login_preferences.auth_methods.password.passwordMinLength` (number, required)
    Minimum required length of the password.
    Example: 14

  - `result.login_preferences.auth_methods.password.blockPreviousPasswords` (number, required)
    Number of most recent passwords to block the user from setting as their new password.
    Example: 0

  - `result.login_preferences.auth_methods.password.checkHibp` (boolean)
    Check password updates against HIBP.

  - `result.login_preferences.auth_methods.password.checkDictionary` (boolean)
    Check password updates against a predefined dictionary.

  - `result.login_preferences.auth_methods.password.passwordExpiresIn` (number, required)
    Number of days until the password expires. Must be between 1 and 1096 days (3 years).
    Example: 90

  - `result.login_preferences.auth_methods.password.ignoreExpiration` (boolean)
    Ignore password expiration. If true, the password will never expire.

  - `result.login_preferences.auth_methods.password.maxPasswordFailures` (number)
    Number of wrong password attempts allowed before the user is suspended. Must be between 1 and 20.
    Example: 5

  - `result.login_preferences.auth_methods.password.passwordSuspensionDuration` (number)
    Number of minutes to suspend the user from authenticating using password after the maximum number of allowed failed attempts is exceeded. Must be between 1 and 525600 minutes (1 year).
    Example: 15

  - `result.login_preferences.auth_methods.password.tempPasswordValidityHours` (number)
    Number of hours until temporary passwords are considered expired. Must be between 1 and 8760 hours (1 year).
    Example: 24

  - `result.login_preferences.auth_methods.password.requireMFA` (boolean)
    Require multi-factor authentication for password reset flows.

  - `result.login_preferences.auth_methods.password.codeLength` (number)
    The length of the generated OTP code. Must be between 4 and 8.
    Example: 6

  - `result.login_preferences.auth_methods.password.notifyOnPasswordUpdate` (boolean)
    Send email to end-user upon password update

  - `result.login_preferences.auth_methods.totp` (object)
    TOTP login configuration

  - `result.login_preferences.auth_methods.totp.failuresExpireIn` (number)
    Number of minutes until previous failed attempts are considered expired. Must be between 1 and 525600 minutes (1 year).
    Example: 15

  - `result.login_preferences.auth_methods.totp.lockoutTiers` (array)
    Progressive lockout tiers based on failed attempts

  - `result.login_preferences.auth_methods.totp.algorithm` (string)
    The algorithm used to generate the TOTP code
    Enum: "sha1", "sha256", "sha512"

  - `result.login_preferences.auth_methods.totp.digits` (number)
    Number of digits in the generated TOTP code, must be 6 or 8
    Example: 6

  - `result.login_preferences.auth_methods.totp.period` (number)
    Number of seconds in which the TOTP code is valid
    Example: 30

  - `result.login_preferences.auth_methods.totp.window` (number)
    Number of windows to check for valid TOTP codes
    Example: 2

  - `result.login_preferences.auth_methods.totp.issuer` (string)
    TOTP issuer
    Example: My Company

  - `result.login_preferences.auth_methods.totp.maxFailures` (number)
    Number of wrong TOTP attempts allowed before the passcode is invalidated. Must be between 1 and 20.
    Example: 3

  - `result.login_preferences.auth_methods.totp.lockoutDuration` (number)
    TOTP lockout duration (in minutes) after maximum attempts are reached
    Example: 15

  - `result.login_preferences.auth_methods.totp.maxTotpPerUser` (number)
    Maximum number of TOTP authenticators allowed per user. Must be between 1 and 50.
    Example: 1

  - `result.login_preferences.auth_methods.push` (object)
    Push configuration

  - `result.login_preferences.auth_methods.push.apn` (any)
    APN configuration. Can be a single object or an array of objects.

  - `result.login_preferences.auth_methods.push.apn.key` (string, required)
    APN key

  - `result.login_preferences.auth_methods.push.apn.keyId` (string, required)
    APN key id

  - `result.login_preferences.auth_methods.push.apn.teamId` (string, required)
    APN team id

  - `result.login_preferences.auth_methods.push.apn.bundle` (string, required)
    APN bundle

  - `result.login_preferences.auth_methods.push.apn.isProduction` (boolean)
    Is Production APN Environment

  - `result.login_preferences.auth_methods.push.fcm` (object)
    FCM configuration

  - `result.login_preferences.auth_methods.push.fcm.key` (object, required)
    FCM key

  - `result.login_preferences.auth_methods.tiktok` (object)
    TikTok login configuration

  - `result.login_preferences.auth_methods.pin_authenticator` (object)
    PIN authenticator configuration

  - `result.login_preferences.auth_methods.pin_authenticator.failuresExpireIn` (number)
    Number of minutes until previous failed attempts are considered expired. Must be between 1 and 525600 minutes (1 year).
    Example: 15

  - `result.login_preferences.auth_methods.pin_authenticator.lockoutTiers` (array)
    Progressive lockout tiers based on failed attempts

  - `result.login_preferences.auth_methods.pin_authenticator.maxFailures` (number)
    Number of wrong PIN Authenticator attempts allowed before the passcode is invalidated. Must be between 1 and 20.
    Example: 3

  - `result.login_preferences.auth_methods.pin_authenticator.lockoutDuration` (number)
    PIN Authenticator lockout duration (in minutes) after maximum attempts are reached
    Example: 15

  - `result.login_preferences.auth_methods.face` (object)
    Face authenticator configuration

  - `result.login_preferences.auth_methods.face.failuresExpireIn` (number)
    Number of minutes until previous failed attempts are considered expired. Must be between 1 and 525600 minutes (1 year).
    Example: 15

  - `result.login_preferences.auth_methods.face.lockoutTiers` (array)
    Progressive lockout tiers based on failed attempts

  - `result.login_preferences.auth_methods.face.maxFailures` (number)
    Number of wrong Face Authenticator attempts allowed. Must be between 1 and 20.
    Example: 3

  - `result.login_preferences.auth_methods.face.lockoutDuration` (number)
    Face Authenticator lockout duration (in minutes) after maximum attempts are reached
    Example: 15

  - `result.login_preferences.auth_methods.face.saveImageEmbedding` (boolean)
    Enables saving the image embedding

  - `result.created_at` (string, required)
    Date the application was created

  - `result.created_by` (string, required)
    The user that created the application

  - `result.updated_at` (string, required)
    Date the application was last updated

  - `result.resources` (array)
    List of resources the default client is allowed to explicitly request access to

  - `result.service_providers` (array, required)
    List of service providers this application is allowed to explicitly redirect to

  - `result.authenticator_preferences` (object, required)
    Configures the application as the Authentication Hub of this tenant, allowing other apps to use it to perform a centralized login.

  - `result.authenticator_preferences.is_centralized` (boolean, required)
    Indicates whether to set the application as the Authentication Hub for this tenant

  - `result.authenticator_preferences.login_uri` (string, required)
    URI of the application that will initiate an authentication flow when centralized login is requested
    Example: https://www.example.com/login

  - `result.allow_public_signup` (boolean, required)
    Determines if the application is allowed to request to create new users via login flows

  - `result.client_auth_method` (string)
    This field is deprecated- to configure pkce use "pkce" field instead
    Enum: "client_secret_basic", "self_signed_tls_client_auth", "tls_client_auth", "none", "private_key_jwt"

  - `result.pkce` (string)
    PKCE configuration
    Enum: "enforcePkceInsteadOfClientCredentials", "enforcePkceAlongsideClientCredentials", "allowPkceAlongsideClientCredentials"

  - `result.device_authorization` (object)
    Configuration for an [OAuth Device Authorization Flow](https://www.rfc-editor.org/rfc/rfc8628) of the default client

  - `result.device_authorization.enabled` (boolean, required)
    Determines if the client is allowed to use the OAuth device authorization flow

  - `result.device_authorization.approval_uri` (string, required)
    The URI of the page that allows the user to approve the access request
    Example: https://www.example.com/device/approval

  - `result.device_authorization.success_uri` (string, required)
    Callback URI that receives an indication of whether the end-user authentication was completed successfully.
    Example: https://www.example.com/device/complete

  - `result.device_authorization.input_uri` (string, required)
    The URI of the page that allows the user to enter the code
    Example: https://www.example.com/device/start

  - `result.ciba_authorization` (object)
    CIBA authorization flow configuration of the default client

  - `result.ciba_authorization.enabled` (boolean, required)
    Determines if the client is allowed to use the OAuth CIBA authorization flow

  - `result.ciba_authorization.login_uri` (string)
    The URI of the page that allows the user to log-in and verify the access request
    Example: https://www.example.com/ciba/login

  - `result.password_sharing_group_id` (string)
    If the app has opted in to password sharing, this identifies the group of apps that it shares passwords with.

  - `result.login_uri` (string)
    URI used to redirect the user to the login page of the application (when needed)
    Example: https://www.example.com/login

  - `result.b2b_invite_journey_id` (string)
    Journey ID used for B2B invite magic-link flows

  - `result.invite_member_uri` (string)
    URI used to redirect the member to the login page of the application (when needed)
    Example: https://www.example.com/login

  - `result.invite_client_id` (string)
    Client used for the email magic link invitation flow

  - `result.subdomain` (string)
    Subdomain of Org admin portal that can be offered for organizations to manage their users (when needed)
    Example: myapp

  - `result.invite_member_email_expiration_minutes` (number)
    Member invite email link expiration in minutes

  - `result.custom_domain` (object)
    Custom domain of the application that can be offered for the application to be accessed from

  - `result.custom_domain.domain` (string, required)
    Domain of the application that can be offered for the application to be accessed from
    Example: myapp.com

  - `result.custom_domain.updated_at` (string, required)
    Date the custom domain was last updated

  - `result.custom_domain.status` (string)
    The status of the custom domain validation process
    Enum: "pending", "verified", "error"

  - `result.custom_domain.error` (string)
    The error message if the custom domain validation process failed

  - `result.external_communication` (object)
    External communication configuration for the application

  - `result.external_communication.language` (string)
    Language configuration for the external communication. The default language is english.
    Enum: "en", "es", "pt", "fr", "ja", "fr-CA"

  - `result.signing_key_enabled` (boolean)
    Determines if application specific signing key is enabled

  - `result.refresh_token_invalidation_trigger_configuration` (object)
    Refresh token invalidation trigger configuration

  - `result.refresh_token_invalidation_trigger_configuration.invalidateOnMemberSuspension` (boolean)
    Determines if refresh tokens should be invalidated when a member is suspended

  - `result.refresh_token_invalidation_trigger_configuration.invalidateOnMemberPasswordReset` (boolean)
    Determines if refresh tokens should be invalidated when a member resets their password

  - `result.refresh_token_invalidation_trigger_configuration.invalidateOnMemberRoleUpdate` (boolean)
    Determines if refresh tokens should be invalidated when a member role is updated

  - `result.application_type` (string)
    Application type
    Enum: "ido", "basic"

## Response 400 fields (application/json):

  - `message` (array, required)
    Example: Bad request

  - `error_code` (number, required)
    Example: 400