{  "app": {    "id": "string",    "name": "string",    "description": "string",    "enabled": true,    "logo": "string",    "appType": "string",    "samlSettings": {      "loginPageUrl": "string",      "idpCert": "string",      "useMetadataInfo": true,      "metadataUrl": "string",      "entityId": "string",      "acsUrl": "string",      "certificate": "string",      "attributeMapping": [        {          "name": "string",          "type": "string",          "value": "string"        }      ],      "groupsMapping": [        {          "name": "string",          "type": "string",          "filterType": "string",          "value": "string",          "roles": [            {              "id": "string",              "name": "string"            }          ]        }      ],      "idpMetadataUrl": "string",      "idpEntityId": "string",      "idpSsoUrl": "string",      "acsAllowedCallbacks": [        "string"      ],      "subjectNameIdType": "string",      "subjectNameIdFormat": "string",      "defaultRelayState": "string",      "idpInitiatedUrl": "string",      "forceAuthentication": true,      "idpLogoutUrl": "string",      "logoutRedirectUrl": "string",      "errorRedirectUrl": "string",      "defaultSignatureAlgorithm": "string"    },    "oidcSettings": {      "loginPageUrl": "string",      "issuer": "string",      "discoveryUrl": "string",      "claims": [        "string"      ],      "forceAuthentication": true,      "jwtBearerSettings": {        "issuers": {          "property1": {            "jwksUri": "string",            "signAlgorithm": "string",            "userInfoUri": "string",            "externalIdFieldName": "string",            "jitDisabled": true,            "attributeMapping": {              "name": "string",              "email": "string",              "group": "string",              "givenName": "string",              "middleName": "string",              "familyName": "string",              "picture": "string",              "customAttributes": {                "property1": "string",                "property2": "string"              }            }          },          "property2": {            "jwksUri": "string",            "signAlgorithm": "string",            "userInfoUri": "string",            "externalIdFieldName": "string",            "jitDisabled": true,            "attributeMapping": {              "name": "string",              "email": "string",              "group": "string",              "givenName": "string",              "middleName": "string",              "familyName": "string",              "picture": "string",              "customAttributes": {                "property1": "string",                "property2": "string"              }            }          }        },        "jwtBearerGrantTypeAudienceToUse": "string",        "jwtBearerGrantTypeScopeToUse": "string",        "jwtBearerGrantTypeCustomClaimsToUse": "string"      },      "backChannelLogoutUrl": "string",      "customIdpInitiatedLoginPageUrl": "string",      "sessionSettings": {        "enabled": true,        "refreshTokenExpiration": 0,        "refreshTokenExpirationUnit": "string",        "sessionTokenExpiration": 0,        "sessionTokenExpirationUnit": "string",        "userTemplateId": "string",        "keyTemplateId": "string",        "keySessionTokenExpiration": 0,        "keySessionTokenExpirationUnit": "string"      },      "clientId": "string",      "clientSecret": "string",      "clientType": "string",      "approvedRedirectUrls": [        "string"      ],      "authorizationCodeDisabled": true,      "clientCredentialsDisabled": true,      "refreshTokenDisabled": true,      "jwtBearerDisabled": true,      "deviceCodeDisabled": true,      "forcePkce": true,      "defaultAudience": "string",      "scopeClaimMapping": [        {          "scope": "string",          "claims": {            "property1": "string",            "property2": "string"          },          "description": "string",          "useProjectMapping": true,          "mandatory": true,          "claimTargets": {            "property1": {              "tokens": [                "string"              ]            },            "property2": {              "tokens": [                "string"              ]            }          }        }      ],      "trustedAppsAudience": "string",      "mtlsClientAuthMethods": {        "tlsClientAuth": {          "credentials": [            {              "id": "string",              "name": "string",              "subjectDn": "string",              "pem": "string",              "thumbprint": "string",              "createdAt": 0            }          ]        },        "selfSignedTlsClientAuth": {          "credentials": [            {              "id": "string",              "name": "string",              "subjectDn": "string",              "pem": "string",              "thumbprint": "string",              "createdAt": 0            }          ]        }      }    },    "customSettings": {      "loginPageUrl": "string",      "sessionSettings": {        "enabled": true,        "refreshTokenExpiration": 0,        "refreshTokenExpirationUnit": "string",        "sessionTokenExpiration": 0,        "sessionTokenExpirationUnit": "string",        "userTemplateId": "string",        "keyTemplateId": "string",        "keySessionTokenExpiration": 0,        "keySessionTokenExpirationUnit": "string"      }    },    "wsfedSettings": {      "loginPageUrl": "string",      "realm": "string",      "replyUrl": "string",      "attributeMapping": [        {          "name": "string",          "type": "string",          "value": "string"        }      ],      "groupsMapping": [        {          "name": "string",          "type": "string",          "filterType": "string",          "value": "string",          "roles": [            {              "id": "string",              "name": "string"            }          ]        }      ],      "forceAuthentication": true,      "logoutRedirectUrl": "string",      "errorRedirectUrl": "string",      "idpCert": "string",      "idpInitiatedUrl": "string",      "idpMetadataUrl": "string",      "idpEntityId": "string",      "idpSsoUrl": "string",      "idpLogoutUrl": "string",      "replyAllowedCallbacks": [        "string"      ]    },    "trustedAppIds": [      "string"    ],    "customAttributes": {      "attribute-key": "attribute-value"    },    "serviceAccountRoles": [      {        "targetAppId": "string",        "roleIds": [          "string"        ]      }    ],    "createdTime": 0  }}

export interface Response {app?: SSOApplication}export interface SSOApplication {id?: string/** * int64 version - excluded *  string projectId - copied */name?: stringdescription?: stringenabled?: booleanlogo?: stringappType?: stringsamlSettings?: SSOApplicationSAMLSettingsoidcSettings?: SSOApplicationOIDCSettingscustomSettings?: SSOApplicationCustomSettingswsfedSettings?: SSOApplicationWSFedSettings/** * trustedAppIds lists sibling SSO apps whose roles are included in this app's JWT under the *  `trustedApps` claim at login time. Only OIDC and Custom app types may set a non-empty value. */trustedAppIds?: string[]/** * Custom attributes as key-value pairs. Keys must be strings; values can be strings, numbers, booleans, or arrays. */customAttributes?: {[k: string]: string}/** * serviceAccountRoles assigns this app (when client_credentials is enabled) application-roles in its *  trusted apps; surfaced in its client_credentials token under the `app.trustedApps` claim. */serviceAccountRoles?: {targetAppId?: stringroleIds?: string[]}[]/** * createdTime is epoch seconds (int32 so it serializes as a JSON number). */createdTime?: number}export interface SSOApplicationSAMLSettings {loginPageUrl?: stringidpCert?: stringuseMetadataInfo?: booleanmetadataUrl?: stringentityId?: stringacsUrl?: stringcertificate?: stringattributeMapping?: {name?: stringtype?: stringvalue?: string}[]groupsMapping?: {name?: stringtype?: stringfilterType?: stringvalue?: stringroles?: SAMLIDPRoleGroupMappingInfo[]}[]idpMetadataUrl?: stringidpEntityId?: stringidpSsoUrl?: stringacsAllowedCallbacks?: string[]subjectNameIdType?: stringsubjectNameIdFormat?: stringdefaultRelayState?: stringidpInitiatedUrl?: stringforceAuthentication?: booleanidpLogoutUrl?: stringlogoutRedirectUrl?: stringerrorRedirectUrl?: stringdefaultSignatureAlgorithm?: string}export interface SAMLIDPRoleGroupMappingInfo {id?: stringname?: string}export interface SSOApplicationOIDCSettings {loginPageUrl?: stringissuer?: stringdiscoveryUrl?: stringclaims?: string[]forceAuthentication?: booleanjwtBearerSettings?: {issuers?: {[k: string]: IssuerSettings}jwtBearerGrantTypeAudienceToUse?: stringjwtBearerGrantTypeScopeToUse?: stringjwtBearerGrantTypeCustomClaimsToUse?: string}backChannelLogoutUrl?: stringcustomIdpInitiatedLoginPageUrl?: stringsessionSettings?: {enabled?: booleanrefreshTokenExpiration?: numberrefreshTokenExpirationUnit?: stringsessionTokenExpiration?: numbersessionTokenExpirationUnit?: stringuserTemplateId?: stringkeyTemplateId?: stringkeySessionTokenExpiration?: numberkeySessionTokenExpirationUnit?: string}clientId?: string/** * Descope-generated, may be imported on create. Always empty on load; fetch it via GetSSOApplicationSecret. */clientSecret?: stringclientType?: stringapprovedRedirectUrls?: string[]authorizationCodeDisabled?: booleanclientCredentialsDisabled?: booleanrefreshTokenDisabled?: booleanjwtBearerDisabled?: booleandeviceCodeDisabled?: booleanforcePkce?: boolean/** * Default audience policy for issued tokens. Applies only to modern apps (non-empty clientType): *  'projectId', 'clientId', 'appId', empty (both), or 'empty' (no aud at all). Legacy apps are *  unaffected. Mirrors third-party apps. */defaultAudience?: string/** * Per-app scope→claims mapping. When non-empty, this mapping REPLACES the project-wide *  ScopeClaimMapping for tokens issued by this app: only scopes listed here can be requested *  (the set of scopes doubles as an allow-list — requesting an unlisted scope returns *  InvalidArguments), and only this mapping's claims are emitted. Per-entry useProjectMapping *  lets an app opt back into the project's claims for an individual scope without restating *  them. Empty list preserves today's behavior (no per-app restriction; project-wide mapping *  applies if configured). */scopeClaimMapping?: {scope?: string/** * claims is consulted only when useProjectMapping is false. When useProjectMapping is true, *  the project-wide mapping's entry for `scope` provides the claims and this field is ignored. */claims?: {[k: string]: string}description?: string/** * useProjectMapping, when true, reuses the project-wide ScopeClaimMapping's entry for this *  scope (the app's `claims` field is ignored). Default false uses the app's own `claims`. */useProjectMapping?: boolean/** * mandatory, when true, means the scope is always granted and cannot be deselected by the *  user on the consent screen. Mirrors the inverse of the legacy ApplicationScope.optional. */mandatory?: boolean/** * claimTargets narrows which tokens a claim is written to, keyed by the claim name. *  Consulted only when useProjectMapping is false — when it is true the project-wide *  entry supplies both the claims and their targets. Empty means every token. */claimTargets?: {/** * ClaimTokenTargets lists the tokens a single mapped claim is written to. An empty *  list means every token, which is the default for claims with no entry. *  *  Values are plain strings rather than an enum because this field is served over two *  JSON surfaces with different enum encodings: the management API marshals via protojson *  (enum names) while the console API marshals the proto with encoding/json (enum numbers). *  A string renders identically on both. Unknown values are dropped on write, so a claim *  with no valid target falls back to the "every token" default. *  *  Wrapper message because proto3 map values cannot be `repeated`. */[k: string]: {tokens?: string[]}}}[]/** * Audience policy applied to trusted sibling apps' identifiers when appended to the issued token's *  `aud` (see SSOApplication.trustedAppIds). Same value set as defaultAudience: 'projectId' / *  'clientId' / 'appId' / empty (=both) / 'empty' (add none). Independent of defaultAudience. */trustedAppsAudience?: stringmtlsClientAuthMethods?: {tlsClientAuth?: TLSClientAuthselfSignedTlsClientAuth?: SelfSignedTLSClientAuth}}export interface IssuerSettings {jwksUri?: stringsignAlgorithm?: stringuserInfoUri?: stringexternalIdFieldName?: string/** * Cross-App Access JIT provisioning, per trusted issuer. jitDisabled: only sign in an already- *  provisioned user, do not create. attributeMapping maps assertion claims to user fields. Group->role / *  FGA / default-role / priority mapping is read from the tenant's shared SSO config, NOT per issuer. */jitDisabled?: booleanattributeMapping?: {name?: stringemail?: stringgroup?: stringgivenName?: stringmiddleName?: stringfamilyName?: stringpicture?: stringcustomAttributes?: {[k: string]: string}}}export interface TLSClientAuth {credentials?: {id?: stringname?: stringsubjectDn?: stringpem?: stringthumbprint?: stringcreatedAt?: number}[]}export interface SelfSignedTLSClientAuth {credentials?: MTLSClientAuthCredential[]}export interface MTLSClientAuthCredential {id?: stringname?: stringsubjectDn?: stringpem?: stringthumbprint?: stringcreatedAt?: number}export interface SSOApplicationCustomSettings {loginPageUrl?: stringsessionSettings?: {enabled?: booleanrefreshTokenExpiration?: numberrefreshTokenExpirationUnit?: stringsessionTokenExpiration?: numbersessionTokenExpirationUnit?: stringuserTemplateId?: stringkeyTemplateId?: stringkeySessionTokenExpiration?: numberkeySessionTokenExpirationUnit?: string}}export interface SSOApplicationWSFedSettings {loginPageUrl?: stringrealm?: stringreplyUrl?: stringattributeMapping?: {name?: stringtype?: stringvalue?: string}[]groupsMapping?: {name?: stringtype?: stringfilterType?: stringvalue?: stringroles?: SAMLIDPRoleGroupMappingInfo[]}[]forceAuthentication?: booleanlogoutRedirectUrl?: stringerrorRedirectUrl?: stringidpCert?: stringidpInitiatedUrl?: stringidpMetadataUrl?: stringidpEntityId?: stringidpSsoUrl?: stringidpLogoutUrl?: stringreplyAllowedCallbacks?: string[]}