WSO2

WSO2 Application Secrets API

The Application Secrets API from WSO2 — 3 operation(s) for application secrets.

Documentation GitHub OpenAPI

Business capability

Developer Identity & Credential Management BC-4270.40

Operations 3

Each operation below carries the questions people ask an LLM about it and the instructions they give an agent to run it. Generated by API Evangelist overlay

POST /applications/{applicationId}/oauth-keys/{keyMappingId}/generate-secret Generate a new OAuth consumer secret · Generate a New Consumer Secret #

Ask an LLM

“How do I create an additional consumer secret for my application's OAuth keys?”

“Can an application have more than one consumer secret at a time?”

Tell an agent

Generate a new consumer secret for application {applicationId}, key mapping {keyMappingId}.

Create a fresh client secret on app {applicationId} key {keyMappingId}.

GET /applications/{applicationId}/oauth-keys/{keyMappingId}/secrets List an application's consumer secrets · Retrieve Consumer Secrets #

Ask an LLM

“Which consumer secrets exist for my application's OAuth keys?”

“Where can I see the client secrets issued for a key mapping?”

Tell an agent

List consumer secrets for application {applicationId}, key mapping {keyMappingId}.

Show the client secrets on app {applicationId} key {keyMappingId}.

POST /applications/{applicationId}/oauth-keys/{keyMappingId}/revoke-secret Revoke an OAuth consumer secret · Revoke a Consumer Secret #

Ask an LLM

“How do I revoke a compromised consumer secret?”

“Can I revoke one client secret while keeping the others active?”

Tell an agent destructive · confirm first

Revoke secret {secretId} on application {applicationId}, key mapping {keyMappingId}.

Invalidate client secret {secretId} for app {applicationId} key {keyMappingId}.

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this

find_apisBrowse and filter every API in the catalog.
get_api_artifactsOne API's artifacts, grouped by type.
get_openapiThe primary OpenAPI for this API.
find_similar_apisAPIs that look like this one.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This API

curl "https://apis.io/api/v1/apis/wso2:wso2-application-secrets-api"

All apis

curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

openapi: 3.2.0
info:
  title: WSO2 API Manager - Developer Portal Application Secrets API
  description: This document specifies a **RESTful API** for WSO2 **API Manager** - **Developer Portal**.
  contact:
    name: WSO2
    url: https://wso2.com/api-manager/
    email: architecture@wso2.com
  license:
    name: Apache 2.0
    url: http://www.apache.org/licenses/LICENSE-2.0.html
  version: v3
servers:
- url: https://apis.wso2.com/api/am/devportal/v3
tags:
- name: Application Secrets
paths:
  /applications/{applicationId}/oauth-keys/{keyMappingId}/generate-secret:
    post:
      tags:
      - Application Secrets
      summary: Generate a New Consumer Secret
      description: This operation can be used to generate a new consumer secret for an application for the given key type
      operationId: generateConsumerSecret
      parameters:
      - $ref: '#/components/parameters/applicationId'
      - $ref: '#/components/parameters/keyMappingId'
      requestBody:
        description: 'Request payload containing details for creating a new consumer secret

          '
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ConsumerSecretCreationRequest'
        required: true
      responses:
        201:
          description: 'Created.

            Successful response with the newly created object as entity in the body.

            Location header contains URL of newly created entity.

            '
          headers:
            Location:
              description: 'Location to the newly created secret entity.

                '
              schema:
                type: string
            Content-Type:
              description: 'The content type of the body.

                '
              schema:
                type: string
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ConsumerSecret'
        400:
          $ref: '#/components/responses/BadRequest'
        401:
          $ref: '#/components/responses/Unauthorized'
        403:
          $ref: '#/components/responses/Forbidden'
        500:
          $ref: '#/components/responses/InternalServerError'
      security:
      - OAuth2Security:
        - apim:subscribe
        - apim:app_manage
      x-code-samples:
      - lang: Curl
        source: "curl -k \\\n  -H \"Authorization: Bearer ae4eae22-3f65-387b-a171-d37eaa366fa8\" \\\n  -H \"Content-Type: application/json\" \\\n  -X POST \\\n  -d '{\"additionalProperties\":{\"description\":\"pizza application secret7\",\"expiresIn\":86400}}' \\\n  \"https://localhost:9443/api/am/devportal/v3/applications/16cd2684-9657-4a01-a956-4efd89e96077/oauth-keys/df972173-c957-46d4-96ac-99be8e303584/generate-secret\"\n"
  /applications/{applicationId}/oauth-keys/{keyMappingId}/secrets:
    get:
      tags:
      - Application Secrets
      summary: Retrieve Consumer Secrets
      description: This operation can be used to retrieve consumer secrets of an application for the given key type
      operationId: getConsumerSecrets
      parameters:
      - $ref: '#/components/parameters/applicationId'
      - $ref: '#/components/parameters/keyMappingId'
      responses:
        200:
          description: 'OK.

            Consumer secrets are retrieved.

            '
          headers:
            Content-Type:
              description: 'The content type of the body.

                '
              schema:
                type: string
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ConsumerSecretList'
        400:
          $ref: '#/components/responses/BadRequest'
        401:
          $ref: '#/components/responses/Unauthorized'
        403:
          $ref: '#/components/responses/Forbidden'
        404:
          $ref: '#/components/responses/NotFound'
        500:
          $ref: '#/components/responses/InternalServerError'
      security:
      - OAuth2Security:
        - apim:subscribe
        - apim:app_manage
      x-code-samples:
      - lang: Curl
        source: 'curl -k -H "Authorization: Bearer ae4eae22-3f65-387b-a171-d37eaa366fa8" -H "Content-Type: application/json" -X GET "https://localhost:9443/api/am/devportal/v3/applications/16cd2684-9657-4a01-a956-4efd89e96077/oauth-keys/df972173-c957-46d4-96ac-99be8e303584/secrets"'
  /applications/{applicationId}/oauth-keys/{keyMappingId}/revoke-secret:
    post:
      tags:
      - Application Secrets
      summary: Revoke a Consumer Secret
      description: This operation can be used to revoke a consumer secret for an application for the give key type
      operationId: revokeConsumerSecret
      parameters:
      - $ref: '#/components/parameters/applicationId'
      - $ref: '#/components/parameters/keyMappingId'
      requestBody:
        description: 'Request payload containing details for revoking a new consumer secret

          '
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ConsumerSecretDeletionRequest'
        required: true
      responses:
        204:
          description: 'OK.

            Consumer secret deleted.

            '
          content: {}
        400:
          $ref: '#/components/responses/BadRequest'
        401:
          $ref: '#/components/responses/Unauthorized'
        403:
          $ref: '#/components/responses/Forbidden'
        404:
          $ref: '#/components/responses/NotFound'
        500:
          $ref: '#/components/responses/InternalServerError'
      security:
      - OAuth2Security:
        - apim:subscribe
        - apim:app_manage
      x-code-samples:
      - lang: Curl
        source: "curl -k \\\n  -H \"Authorization: Bearer ae4eae22-3f65-387b-a171-d37eaa366fa8\" \\\n  -H \"Content-Type: application/json\" \\\n  -X POST \\\n  -d '{\"secretId\":\"sec_123456\"}' \\\n  \"https://localhost:9443/api/am/devportal/v3/applications/16cd2684-9657-4a01-a956-4efd89e96077/oauth-keys/df972173-c957-46d4-96ac-99be8e303584/revoke-secret\"\n"
components:
  responses:
    NotFound:
      description: Not Found. The specified resource does not exist.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            code: 404
            message: Not Found
            description: The specified resource does not exist
            moreInfo: ''
            error: []
    Unauthorized:
      description: Unauthorized. The user is not authorized.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            code: 401
            message: Unauthorized
            description: The user is not authorized
            moreInfo: ''
            error: []
    InternalServerError:
      description: Internal Server Error.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            code: 500
            message: Internal Server Error
            description: The server encountered an internal error. Please contact administrator.
            moreInfo: ''
            error: []
    Forbidden:
      description: Forbidden. The user does not have permission to perform this action.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            code: 403
            message: Forbidden
            description: The user does not have permission to perform this action
            moreInfo: ''
            error: []
    BadRequest:
      description: Bad Request. Invalid request or validation error.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            code: 400
            message: Bad Request
            description: Invalid request or validation error
            moreInfo: ''
            error: []
  schemas:
    ConsumerSecretDeletionRequest:
      type: object
      properties:
        secretId:
          type: string
          description: Unique identifier for the secret
          example: sec_123456
        additionalProperties:
          type: object
          description: Additional properties for the secret deletion request.
          additionalProperties:
            type: object
    ConsumerSecretList:
      title: Client Secret List
      properties:
        count:
          type: integer
          description: 'Number of consumer secrets returned.

            '
          example: 1
        list:
          type: array
          items:
            $ref: '#/components/schemas/ConsumerSecret'
    ConsumerSecret:
      type: object
      properties:
        secretId:
          type: string
          description: Unique identifier for the secret
          example: sec_123456
        secretValue:
          type: string
          description: The actual secret string
          example: '***r3tV@lu3'
        additionalProperties:
          type: object
          description: Additional dynamic properties for the secret creation request.
          additionalProperties:
            type: object
          example:
            expiresAt: 1761568483
            description: pizza application secret
    ConsumerSecretCreationRequest:
      type: object
      properties:
        additionalProperties:
          type: object
          description: Additional properties for the secret creation request.
          additionalProperties:
            type: object
          example:
            expiresIn: 86400
            description: pizza application secret
      example:
        additionalProperties:
          expiresIn: 86400
          description: pizza application secret
    Error:
      title: Error object returned with 4XX HTTP status
      required:
      - code
      - message
      type: object
      properties:
        code:
          type: integer
          format: int64
        message:
          type: string
          description: Error message.
        description:
          type: string
          description: 'A detail description about the error message.

            '
        moreInfo:
          type: string
          description: 'Preferably an url with more details about the error.

            '
        error:
          type: array
          description: 'If there are more than one error list them out.

            For example, list out validation errors by each field.

            '
          items:
            $ref: '#/components/schemas/ErrorListItem'
    ErrorListItem:
      title: Description of individual errors that may have occurred during a request.
      required:
      - code
      - message
      type: object
      properties:
        code:
          type: string
        message:
          type: string
          description: 'Description about individual errors occurred

            '
  parameters:
    applicationId:
      name: applicationId
      in: path
      description: 'Application Identifier consisting of the UUID of the Application.

        '
      required: true
      schema:
        type: string
    keyMappingId:
      name: keyMappingId
      in: path
      description: 'OAuth Key Identifier consisting of the UUID of the Oauth Key Mapping.

        '
      required: true
      schema:
        type: string
  securitySchemes:
    OAuth2Security:
      type: oauth2
      flows:
        password:
          tokenUrl: https://localhost:9443/oauth2/token
          scopes:
            openid: Authorize access to user details
            apim:subscribe: Subscribe API
            apim:api_key: Generate API Keys
            apim:app_manage: Retrieve, Manage and Import, Export applications
            apim:sub_manage: Retrieve, Manage subscriptions
            apim:store_settings: Retrieve Developer Portal settings
            apim:sub_alert_manage: Retrieve, subscribe and configure Developer Portal alert types
            apim:app_import_export: Import and export applications related operations
            apim:admin: Manage all admin operations

WSO2 Application Secrets API

Operations 3

Documentation

Specifications

Schemas & Data

Work with this as data

MCP server

Tools for apis

Call it yourself

Get an API key

OpenAPI Specification