FusionAuth Application API

openapi: 3.2.0
info:
  version: 1.66.0
  title: FusionAuth Api Key Application API
  description: This is a FusionAuth server. Find out more at [https://fusionauth.io](https://fusionauth.io). You need to [set up an API key](https://fusionauth.io/docs/v1/tech/apis/authentication#managing-api-keys) in the FusionAuth instance you are using to test out the API calls.
  license:
    name: Apache2
servers:
- url: http://localhost:9011
- url: https://sandbox.fusionauth.io
security:
- ApiKeyAuth: []
tags:
- name: Application
paths:
  /api/application:
    post:
      description: Creates an application. You can optionally specify an Id for the application, if not provided one will be generated.
      operationId: createApplication
      parameters:
      - in: header
        name: X-FusionAuth-TenantId
        description: The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped.
        required: false
        schema:
          type: string
          format: UUID
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ApplicationRequest'
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApplicationResponse'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Errors'
      tags:
      - Application
    get:
      description: Retrieves all the applications that are currently inactive. OR Retrieves the application for the given Id or all the applications if the Id is null.
      operationId: retrieveApplication
      parameters:
      - name: inactive
        in: query
        schema:
          type: string
      - in: header
        name: X-FusionAuth-TenantId
        description: The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped.
        required: false
        schema:
          type: string
          format: UUID
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApplicationResponse'
        default:
          description: Error
      tags:
      - Application
  /api/application/search:
    post:
      description: Searches applications with the specified criteria and pagination.
      operationId: searchApplicationsWithId
      parameters: []
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ApplicationSearchRequest'
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApplicationSearchResponse'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Errors'
      tags:
      - Application
  /api/application/{applicationId}:
    post:
      description: Creates an application. You can optionally specify an Id for the application, if not provided one will be generated.
      operationId: createApplicationWithId
      parameters:
      - name: applicationId
        in: path
        schema:
          type: string
        required: true
        description: The Id to use for the application. If not provided a secure random UUID will be generated.
      - in: header
        name: X-FusionAuth-TenantId
        description: The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped.
        required: false
        schema:
          type: string
          format: UUID
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ApplicationRequest'
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApplicationResponse'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Errors'
      tags:
      - Application
    delete:
      description: Hard deletes an application. This is a dangerous operation and should not be used in most circumstances. This will delete the application, any registrations for that application, metrics and reports for the application, all the roles for the application, and any other data associated with the application. This operation could take a very long time, depending on the amount of data in your database. OR Deactivates the application with the given Id.
      operationId: deleteApplicationWithId
      parameters:
      - name: hardDelete
        in: query
        schema:
          type: string
      - name: applicationId
        in: path
        schema:
          type: string
        required: true
        description: The Id of the application to delete.
      - in: header
        name: X-FusionAuth-TenantId
        description: The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped.
        required: false
        schema:
          type: string
          format: UUID
      responses:
        '200':
          description: Success
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Errors'
      tags:
      - Application
    patch:
      description: Updates, via PATCH, the application with the given Id.
      operationId: patchApplicationWithId
      parameters:
      - name: applicationId
        in: path
        schema:
          type: string
        required: true
        description: The Id of the application to update.
      - in: header
        name: X-FusionAuth-TenantId
        description: The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped.
        required: false
        schema:
          type: string
          format: UUID
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ApplicationRequest'
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApplicationResponse'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Errors'
      tags:
      - Application
    put:
      description: Updates the application with the given Id. OR Reactivates the application with the given Id.
      operationId: updateApplicationWithId
      parameters:
      - name: applicationId
        in: path
        schema:
          type: string
        required: true
        description: The Id of the application to update.
      - in: header
        name: X-FusionAuth-TenantId
        description: The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped.
        required: false
        schema:
          type: string
          format: UUID
      - name: reactivate
        in: query
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ApplicationRequest'
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApplicationResponse'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Errors'
      tags:
      - Application
    get:
      description: Retrieves the application for the given Id or all the applications if the Id is null.
      operationId: retrieveApplicationWithId
      parameters:
      - name: applicationId
        in: path
        schema:
          type: string
        required: true
        description: The application Id.
      - in: header
        name: X-FusionAuth-TenantId
        description: The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped.
        required: false
        schema:
          type: string
          format: UUID
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApplicationResponse'
        default:
          description: Error
      tags:
      - Application
  /api/application/{applicationId}/oauth-configuration:
    get:
      description: Retrieves the Oauth2 configuration for the application for the given Application Id.
      operationId: retrieveOauthConfigurationWithId
      parameters:
      - name: applicationId
        in: path
        schema:
          type: string
        required: true
        description: The Id of the Application to retrieve OAuth configuration.
      - in: header
        name: X-FusionAuth-TenantId
        description: The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped.
        required: false
        schema:
          type: string
          format: UUID
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthConfigurationResponse'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Errors'
      tags:
      - Application
  /api/application/{applicationId}/role:
    post:
      description: Creates a new role for an application. You must specify the Id of the application you are creating the role for. You can optionally specify an Id for the role inside the ApplicationRole object itself, if not provided one will be generated.
      operationId: createApplicationRole
      parameters:
      - name: applicationId
        in: path
        schema:
          type: string
        required: true
        description: The Id of the application to create the role on.
      - in: header
        name: X-FusionAuth-TenantId
        description: The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped.
        required: false
        schema:
          type: string
          format: UUID
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ApplicationRequest'
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApplicationResponse'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Errors'
      tags:
      - Application
  /api/application/{applicationId}/role/{roleId}:
    post:
      description: Creates a new role for an application. You must specify the Id of the application you are creating the role for. You can optionally specify an Id for the role inside the ApplicationRole object itself, if not provided one will be generated.
      operationId: createApplicationRoleWithId
      parameters:
      - name: applicationId
        in: path
        schema:
          type: string
        required: true
        description: The Id of the application to create the role on.
      - name: roleId
        in: path
        schema:
          type: string
        required: true
        description: The Id of the role. If not provided a secure random UUID will be generated.
      - in: header
        name: X-FusionAuth-TenantId
        description: The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped.
        required: false
        schema:
          type: string
          format: UUID
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ApplicationRequest'
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApplicationResponse'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Errors'
      tags:
      - Application
    delete:
      description: Hard deletes an application role. This is a dangerous operation and should not be used in most circumstances. This permanently removes the given role from all users that had it.
      operationId: deleteApplicationRoleWithId
      parameters:
      - name: applicationId
        in: path
        schema:
          type: string
        required: true
        description: The Id of the application that the role belongs to.
      - name: roleId
        in: path
        schema:
          type: string
        required: true
        description: The Id of the role to delete.
      - in: header
        name: X-FusionAuth-TenantId
        description: The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped.
        required: false
        schema:
          type: string
          format: UUID
      responses:
        '200':
          description: Success
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Errors'
      tags:
      - Application
    patch:
      description: Updates, via PATCH, the application role with the given Id for the application.
      operationId: patchApplicationRoleWithId
      parameters:
      - name: applicationId
        in: path
        schema:
          type: string
        required: true
        description: The Id of the application that the role belongs to.
      - name: roleId
        in: path
        schema:
          type: string
        required: true
        description: The Id of the role to update.
      - in: header
        name: X-FusionAuth-TenantId
        description: The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped.
        required: false
        schema:
          type: string
          format: UUID
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ApplicationRequest'
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApplicationResponse'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Errors'
      tags:
      - Application
    put:
      description: Updates the application role with the given Id for the application.
      operationId: updateApplicationRoleWithId
      parameters:
      - name: applicationId
        in: path
        schema:
          type: string
        required: true
        description: The Id of the application that the role belongs to.
      - name: roleId
        in: path
        schema:
          type: string
        required: true
        description: The Id of the role to update.
      - in: header
        name: X-FusionAuth-TenantId
        description: The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped.
        required: false
        schema:
          type: string
          format: UUID
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ApplicationRequest'
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApplicationResponse'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Errors'
      tags:
      - Application
  /api/application/{applicationId}/scope:
    post:
      description: Creates a new custom OAuth scope for an application. You must specify the Id of the application you are creating the scope for. You can optionally specify an Id for the OAuth scope on the URL, if not provided one will be generated.
      operationId: createOAuthScope
      parameters:
      - name: applicationId
        in: path
        schema:
          type: string
        required: true
        description: The Id of the application to create the OAuth scope on.
      - in: header
        name: X-FusionAuth-TenantId
        description: The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped.
        required: false
        schema:
          type: string
          format: UUID
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ApplicationOAuthScopeRequest'
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApplicationOAuthScopeResponse'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Errors'
      tags:
      - Application
  /api/application/{applicationId}/scope/{scopeId}:
    post:
      description: Creates a new custom OAuth scope for an application. You must specify the Id of the application you are creating the scope for. You can optionally specify an Id for the OAuth scope on the URL, if not provided one will be generated.
      operationId: createOAuthScopeWithId
      parameters:
      - name: applicationId
        in: path
        schema:
          type: string
        required: true
        description: The Id of the application to create the OAuth scope on.
      - name: scopeId
        in: path
        schema:
          type: string
        required: true
        description: The Id of the OAuth scope. If not provided a secure random UUID will be generated.
      - in: header
        name: X-FusionAuth-TenantId
        description: The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped.
        required: false
        schema:
          type: string
          format: UUID
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ApplicationOAuthScopeRequest'
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApplicationOAuthScopeResponse'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Errors'
      tags:
      - Application
    delete:
      description: Hard deletes a custom OAuth scope. OAuth workflows that are still requesting the deleted OAuth scope may fail depending on the application's unknown scope policy.
      operationId: deleteOAuthScopeWithId
      parameters:
      - name: applicationId
        in: path
        schema:
          type: string
        required: true
        description: The Id of the application that the OAuth scope belongs to.
      - name: scopeId
        in: path
        schema:
          type: string
        required: true
        description: The Id of the OAuth scope to delete.
      - in: header
        name: X-FusionAuth-TenantId
        description: The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped.
        required: false
        schema:
          type: string
          format: UUID
      responses:
        '200':
          description: Success
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Errors'
      tags:
      - Application
    patch:
      description: Updates, via PATCH, the custom OAuth scope with the given Id for the application.
      operationId: patchOAuthScopeWithId
      parameters:
      - name: applicationId
        in: path
        schema:
          type: string
        required: true
        description: The Id of the application that the OAuth scope belongs to.
      - name: scopeId
        in: path
        schema:
          type: string
        required: true
        description: The Id of the OAuth scope to update.
      - in: header
        name: X-FusionAuth-TenantId
        description: The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped.
        required: false
        schema:
          type: string
          format: UUID
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ApplicationOAuthScopeRequest'
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApplicationOAuthScopeResponse'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Errors'
      tags:
      - Application
    get:
      description: Retrieves a custom OAuth scope.
      operationId: retrieveOAuthScopeWithId
      parameters:
      - name: applicationId
        in: path
        schema:
          type: string
        required: true
        description: The Id of the application that the OAuth scope belongs to.
      - name: scopeId
        in: path
        schema:
          type: string
        required: true
        description: The Id of the OAuth scope to retrieve.
      - in: header
        name: X-FusionAuth-TenantId
        description: The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped.
        required: false
        schema:
          type: string
          format: UUID
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApplicationOAuthScopeResponse'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Errors'
      tags:
      - Application
    put:
      description: Updates the OAuth scope with the given Id for the application.
      operationId: updateOAuthScopeWithId
      parameters:
      - name: applicationId
        in: path
        schema:
          type: string
        required: true
        description: The Id of the application that the OAuth scope belongs to.
      - name: scopeId
        in: path
        schema:
          type: string
        required: true
        description: The Id of the OAuth scope to update.
      - in: header
        name: X-FusionAuth-TenantId
        description: The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped.
        required: false
        schema:
          type: string
          format: UUID
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ApplicationOAuthScopeRequest'
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApplicationOAuthScopeResponse'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Errors'
      tags:
      - Application
components:
  schemas:
    ApplicationFormConfiguration:
      description: ''
      type: object
      properties:
        adminRegistrationFormId:
          type: string
          format: uuid
        selfServiceFormConfiguration:
          $ref: '#/components/schemas/SelfServiceFormConfiguration'
        selfServiceFormId:
          type: string
          format: uuid
    ProvidedScopePolicy:
      description: The handling policy for scopes provided by FusionAuth
      type: object
      properties:
        address:
          $ref: '#/components/schemas/Requirable'
        email:
          $ref: '#/components/schemas/Requirable'
        phone:
          $ref: '#/components/schemas/Requirable'
        profile:
          $ref: '#/components/schemas/Requirable'
    LoginHintConfiguration:
      description: ''
      type: object
      properties:
        parameterName:
          type: string
        enabled:
          type: boolean
    Errors:
      description: Standard error domain object that can also be used as the response from an API call.
      type: object
      properties:
        fieldErrors:
          type: array
          items:
            $ref: '#/components/schemas/Error'
        generalErrors:
          type: array
          items:
            $ref: '#/components/schemas/Error'
    RegistrationConfiguration:
      type: object
      properties:
        birthDate:
          $ref: '#/components/schemas/Requirable'
        completeRegistration:
          type: boolean
        confirmPassword:
          type: boolean
        firstName:
          $ref: '#/components/schemas/Requirable'
        formId:
          type: string
          format: uuid
        fullName:
          $ref: '#/components/schemas/Requirable'
        lastName:
          $ref: '#/components/schemas/Requirable'
        loginIdType:
          $ref: '#/components/schemas/LoginIdType'
        middleName:
          $ref: '#/components/schemas/Requirable'
        mobilePhone:
          $ref: '#/components/schemas/Requirable'
        preferredLanguages:
          $ref: '#/components/schemas/Requirable'
        type:
          $ref: '#/components/schemas/RegistrationType'
        enabled:
          type: boolean
    SelfServiceFormConfiguration:
      description: ''
      type: object
      properties:
        requireCurrentPasswordOnPasswordChange:
          type: boolean
    SAMLLogoutBehavior:
      type: string
      enum:
      - AllParticipants
      - OnlyOriginator
    Requirable:
      description: Something that can be required and thus also optional. This currently extends Enableable because anything that is  requiredoptional is almost always enableable as well.
      type: object
      properties:
        required:
          type: boolean
        enabled:
          type: boolean
    LoginConfiguration:
      type: object
      properties:
        allowTokenRefresh:
          type: boolean
        generateRefreshTokens:
          type: boolean
        requireAuthentication:
          type: boolean
    XMLSignatureLocation:
      type: string
      enum:
      - Assertion
      - Response
    LoginIdType:
      description: This is separate from IdentityType.
      type: string
      enum:
      - email
      - phoneNumber
      - username
    OAuthScopeHandlingPolicy:
      description: Controls the policy for whether OAuth workflows will more strictly adhere to the OAuth and OIDC specification  or run in backwards compatibility mode.
      type: string
      enum:
      - Compatibility
      - Strict
    OAuthConfigurationResponse:
      description: ''
      type: object
      properties:
        httpSessionMaxInactiveInterval:
          type: integer
        logoutURL:
          type: string
          format: URI
        oauthConfiguration:
          $ref: '#/components/schemas/OAuth2Configuration'
    ApplicationExternalIdentifierConfiguration:
      description: ''
      type: object
      properties:
        twoFactorTrustIdTimeToLiveInSeconds:
          type: integer
    VerificationStrategy:
      description: ''
      type: string
      enum:
      - ClickableLink
      - FormField
    Location:
      description: Location information. Useful for IP addresses and other displayable data objects.
      type: object
      properties:
        city:
          type: string
        country:
          type: string
        latitude:
          type: number
          format: double
        longitude:
          type: number
          format: double
        region:
          type: string
        zipcode:
          type: string
        displayString:
          type: string
    Oauth2AuthorizedURLValidationPolicy:
      description: ''
      type: string
      enum:
      - AllowWildcards
      - ExactMatch
    PasswordlessConfiguration:
      type: object
      properties:
        emailLoginStrategy:
          $ref: '#/components/schemas/PasswordlessStrategy'
        phoneLoginStrategy:
          $ref: '#/components/schemas/PasswordlessStrategy'
        enabled:
          type: boolean
    ZonedDateTime:
      description: 'The number of milliseconds since the unix epoch: January 1, 1970 00:00:00 UTC. This value is always in UTC.'
      example: '1659380719000'
      type: integer
      format: int64
    JWTConfiguration:
      description: JWT Configuration. A JWT Configuration for an Application may not be active if it is using the global configuration, the configuration  may be <code>enabled = false<code>.
      type: object
      properties:
        accessTokenKeyId:
          type: string
          format: uuid
        idTokenKeyId:
          type: string
          format: uuid
        refreshTokenExpirationPolicy:
          $ref: '#/components/schemas/RefreshTokenExpirationPolicy'
        refreshTokenOneTimeUseConfiguration:
          $ref: '#/components/schemas/RefreshTokenOneTimeUseConfiguration'
        refreshTokenRevocationPolicy:
          $ref: '#/components/schemas/RefreshTokenRevocationPolicy'
        refreshTokenSlidingWindowConfiguration:
          $ref: '#/components/schemas/RefreshTokenSlidingWindowConfiguration'
        refreshTokenTimeToLiveInMinutes:
          type: integer
        refreshTokenUsagePolicy:
          $ref: '#/components/schemas/RefreshTokenUsagePolicy'
        timeToLiveInSeconds:
          type: integer
        enabled:
          type: boolean
    PasswordlessStrategy:
      description: ''
      type: string
      enum:
      - ClickableLink
      - FormField
    ApplicationOAuthScope:
      description: A custom OAuth scope for a specific application.
      type: object
      properties:
        applicationId:
          type: string
          format: uuid
        data:
          type: object
          additionalProperties:
            type: object
        defaultConsentDetail:
          type: string
        defaultConsentMessage:
          type: string
        description:
          type: string
        id:
          type: string
          format: uuid
        insertInstant:
          $ref: '#/components/schemas/ZonedDateTime'
        lastUpdateInstant:
          $ref: '#/components/schemas/ZonedDateTime'
        name:
          type: string
        required:
          type: boolean
    RefreshToken

# --- truncated at 32 KB (52 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/fusionauth/refs/heads/main/openapi/fusionauth-application-api-openapi.yml