API ReferenceManagementInbound Apps
POST
/v2/mgmt/thirdparty/app/create

Authorization

Descope Project ID and Management Key
AuthorizationBearer <token>

Project ID:Management Key as bearer token.

In: header

Request Body

application/json

name?string
description?string
logo?string
loginPageUrl?string
approvedCallbackUrls?array<string>
string
permissionsScopes?array<managementv1.ApplicationScope>
consentFlowId?string
logoUrl?string
jwtBearerSettings?object
sessionSettings?object
nonConfidentialClient?boolean
audienceWhitelist?array<string>
string
clientId?string
clientSecret?string
forceAddAllAuthorizationInfo?boolean
connectionsScopes?array<managementv1.ApplicationScope>
defaultAudience?string
customAttributes?object

Custom attributes as key-value pairs. Keys must be strings; values can be strings, numbers, booleans, or arrays.

Example{ "attribute-key": "attribute-value" }
cibaSettings?object
jarSettings?object

JAR (JWT-Secured Authorization Request, RFC 9101) settings for Third Party Applications

allowedTenants?array<string>
string
clientType?string
forcePkce?boolean
allowPartialScopes?boolean
scopeClaimMapping?array<AppScopeClaimMappingEntry>
forceDpop?boolean
rarSettings?object
idJagTargetClients?object
clientAuthMethod?string

clientAuthMethod: "clientSecret" (default when empty), "privateKeyJwt" (only clientAssertions are accepted), "workloadIdentity" (only workloadClientAssertions are accepted) or "mtls" (only a registered mTLS certificate is accepted).

clientAssertions?array<ThirdPartyApplicationClientAssertion>

clientAssertions are the private_key_jwt trust entries (JWKS URL or PEM public key per entry).

workloadClientAssertions?array<ThirdPartyApplicationWorkloadClientAssertion>

workloadClientAssertions are the workload identity trust entries (SPIFFE trust domain or OIDC issuer per entry).

forcePar?boolean
mtlsClientAuthMethods?object
forceMtls?boolean

Create a new third party application using the structured scope-claim mapping model, using a valid management key. The legacy attributesScopes field is ignored.

curl -X POST "https://api.descope.com/v2/mgmt/thirdparty/app/create" \  -H "Content-Type: application/json" \  -d '{}'
{  "id": "string",  "cleartext": "string",  "clientId": "string"}
export interface Response {id?: stringcleartext?: stringclientId?: string}
Was this helpful?

Add a named third party application secret POST

Add a new named client secret to a third party application, using a valid management key. Returns the new secret metadata and its cleartext value (shown only once).

Load all third party applications (v2) POST

Loads all third party applications in the structured scope-claim mapping model, using a valid management key. Legacy attributesScopes are converted to scopeClaimMapping and returned empty.