WSO2

WSO2 Application Tokens API

The Application Tokens API from WSO2 — 2 operation(s) for application tokens.

Documentation GitHub OpenAPI

Business capability

Developer Identity & Credential Management BC-4270.40

Operations 2

Each operation below carries the questions people ask an LLM about it and the instructions they give an agent to run it. Generated by API Evangelist overlay

POST /applications/{applicationId}/keys/{keyType}/generate-token Generate an access token by key type · Generate Application Token #

Ask an LLM

“Can I get a client-credentials access token for my production keys?”

“How long can an access token generated for an app's key type stay valid?”

Tell an agent

Generate a {keyType} access token for application {applicationId}.

Get a {keyType} token for app {applicationId} valid for {validityPeriod} seconds with scopes {scopes}.

POST /applications/{applicationId}/oauth-keys/{keyMappingId}/generate-token Generate an access token for a key mapping · Generate Application Token #

Ask an LLM

“Can I generate a token from one specific key manager mapping?”

“Is it possible to revoke the old token while generating a new one for a key mapping?”

Tell an agent

Generate an access token from key mapping {keyMappingId} of application {applicationId}.

Issue a token for mapping {keyMappingId} on app {applicationId}, revoking old token {revokeToken}.

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this

find_apisBrowse and filter every API in the catalog.
get_api_artifactsOne API's artifacts, grouped by type.
get_openapiThe primary OpenAPI for this API.
find_similar_apisAPIs that look like this one.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This API

curl "https://apis.io/api/v1/apis/wso2:wso2-application-tokens-api"

All apis

curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

openapi: 3.2.0
info:
  title: WSO2 API Manager - Developer Portal Application Tokens API
  description: This document specifies a **RESTful API** for WSO2 **API Manager** - **Developer Portal**.
  contact:
    name: WSO2
    url: https://wso2.com/api-manager/
    email: architecture@wso2.com
  license:
    name: Apache 2.0
    url: http://www.apache.org/licenses/LICENSE-2.0.html
  version: v3
servers:
- url: https://apis.wso2.com/api/am/devportal/v3
tags:
- name: Application Tokens
paths:
  /applications/{applicationId}/keys/{keyType}/generate-token:
    post:
      tags:
      - Application Tokens
      summary: Generate Application Token
      description: Generate an access token for application by client_credentials grant type
      parameters:
      - $ref: '#/components/parameters/applicationId'
      - $ref: '#/components/parameters/keyType'
      - $ref: '#/components/parameters/If-Match'
      requestBody:
        description: 'Application token generation request object

          '
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ApplicationTokenGenerateRequest'
        required: true
      responses:
        200:
          description: 'OK.

            Token is generated.

            '
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApplicationToken'
        400:
          $ref: '#/components/responses/BadRequest'
        404:
          $ref: '#/components/responses/NotFound'
        412:
          $ref: '#/components/responses/PreconditionFailed'
      deprecated: true
      security:
      - OAuth2Security:
        - apim:subscribe
        - apim:app_manage
      x-code-samples:
      - lang: Curl
        source: 'curl -k -H "Authorization: Bearer ae4eae22-3f65-387b-a171-d37eaa366fa8" -H "Content-Type: application/json" -X POST -d @data.json "https://localhost:9443/api/am/devportal/v3/applications/16cd2684-9657-4a01-a956-4efd89e96077/keys/PRODUCTION/generate-token"'
      operationId: postApplicationsByApplicationIdKeysByKeyTypeGenerateToken
      x-operation-id-source: derived
  /applications/{applicationId}/oauth-keys/{keyMappingId}/generate-token:
    post:
      tags:
      - Application Tokens
      summary: Generate Application Token
      description: Generate an access token for application by client_credentials grant type
      parameters:
      - $ref: '#/components/parameters/applicationId'
      - $ref: '#/components/parameters/keyMappingId'
      - $ref: '#/components/parameters/If-Match'
      requestBody:
        description: 'Application token generation request object

          '
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ApplicationTokenGenerateRequest'
        required: true
      responses:
        200:
          description: 'OK.

            Token is generated.

            '
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApplicationToken'
        400:
          $ref: '#/components/responses/BadRequest'
        404:
          $ref: '#/components/responses/NotFound'
        412:
          $ref: '#/components/responses/PreconditionFailed'
      security:
      - OAuth2Security:
        - apim:subscribe
        - apim:app_manage
      x-code-samples:
      - lang: Curl
        source: 'curl -k -H "Authorization: Bearer ae4eae22-3f65-387b-a171-d37eaa366fa8" -H "Content-Type: application/json" -X POST -d @data.json "https://localhost:9443/api/am/devportal/v3/applications/16cd2684-9657-4a01-a956-4efd89e96077/oauth-keys/{keyMappingId}/generate-token"'
      operationId: postApplicationsByApplicationIdOauthKeysByKeyMappingIdGenerateToken
      x-operation-id-source: derived
components:
  responses:
    NotFound:
      description: Not Found. The specified resource does not exist.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            code: 404
            message: Not Found
            description: The specified resource does not exist
            moreInfo: ''
            error: []
    PreconditionFailed:
      description: Precondition Failed. The request has not been performed because one of the preconditions is not met.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            code: 412
            message: Precondition Failed
            description: The request has not been performed because one of the preconditions is not met
            moreInfo: ''
            error: []
    BadRequest:
      description: Bad Request. Invalid request or validation error.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            code: 400
            message: Bad Request
            description: Invalid request or validation error
            moreInfo: ''
            error: []
  schemas:
    ApplicationTokenGenerateRequest:
      title: Application access token generation request object
      type: object
      properties:
        consumerSecret:
          type: string
          description: Consumer secret of the application
          example: cV5pvyisxug5b5QZInq9cGZrMOMa
        validityPeriod:
          type: integer
          description: Token validity period
          format: int64
          example: 3600
        scopes:
          type: array
          description: Allowed scopes (space seperated) for the access token
          example:
          - apim:subscribe
          items:
            type: string
        revokeToken:
          type: string
          description: Token to be revoked, if any
          example: ''
        grantType:
          type: string
          default: CLIENT_CREDENTIALS
          enum:
          - CLIENT_CREDENTIALS
          - TOKEN_EXCHANGE
        additionalProperties:
          type: object
          properties: {}
          description: Additional parameters if Authorization server needs any
    ApplicationToken:
      title: Application token details to invoke APIs
      type: object
      properties:
        accessToken:
          type: string
          description: Access token
          example: 1.2345678901234568E30
        tokenScopes:
          type: array
          description: Valid comma seperated scopes for the access token
          example:
          - default
          - read_api
          - write_api
          items:
            type: string
        validityTime:
          type: integer
          description: Maximum validity time for the access token
          format: int64
          example: 3600
    Error:
      title: Error object returned with 4XX HTTP status
      required:
      - code
      - message
      type: object
      properties:
        code:
          type: integer
          format: int64
        message:
          type: string
          description: Error message.
        description:
          type: string
          description: 'A detail description about the error message.

            '
        moreInfo:
          type: string
          description: 'Preferably an url with more details about the error.

            '
        error:
          type: array
          description: 'If there are more than one error list them out.

            For example, list out validation errors by each field.

            '
          items:
            $ref: '#/components/schemas/ErrorListItem'
    ErrorListItem:
      title: Description of individual errors that may have occurred during a request.
      required:
      - code
      - message
      type: object
      properties:
        code:
          type: string
        message:
          type: string
          description: 'Description about individual errors occurred

            '
  parameters:
    If-Match:
      name: If-Match
      in: header
      description: 'Validator for conditional requests; based on ETag.

        '
      schema:
        type: string
    keyType:
      name: keyType
      in: path
      description: '**Application Key Type** standing for the type of the keys (i.e. Production or Sandbox).

        '
      required: true
      schema:
        type: string
        enum:
        - PRODUCTION
        - SANDBOX
    applicationId:
      name: applicationId
      in: path
      description: 'Application Identifier consisting of the UUID of the Application.

        '
      required: true
      schema:
        type: string
    keyMappingId:
      name: keyMappingId
      in: path
      description: 'OAuth Key Identifier consisting of the UUID of the Oauth Key Mapping.

        '
      required: true
      schema:
        type: string
  securitySchemes:
    OAuth2Security:
      type: oauth2
      flows:
        password:
          tokenUrl: https://localhost:9443/oauth2/token
          scopes:
            openid: Authorize access to user details
            apim:subscribe: Subscribe API
            apim:api_key: Generate API Keys
            apim:app_manage: Retrieve, Manage and Import, Export applications
            apim:sub_manage: Retrieve, Manage subscriptions
            apim:store_settings: Retrieve Developer Portal settings
            apim:sub_alert_manage: Retrieve, subscribe and configure Developer Portal alert types
            apim:app_import_export: Import and export applications related operations
            apim:admin: Manage all admin operations