API ReferenceManagementInbound Apps
POST
/v2/mgmt/thirdparty/app/create

Authorization

Descope Project ID and Management Key
AuthorizationBearer <token>

Project ID:Management Key as bearer token.

In: header

Request Body

application/json

name*string
Length1 <= length <= 254
description?string
Lengthlength <= 100000
logo?string
Lengthlength <= 2097152
loginPageUrl?string
approvedCallbackUrls?array<string>
string
permissionsScopes?array<managementv1.ApplicationScope>
consentFlowId?string
Lengthlength <= 1000
logoUrl?string
jwtBearerSettings?object
sessionSettings?object
nonConfidentialClient?boolean
audienceWhitelist?array<string>
string
Itemsitems <= 100
clientId?string
Lengthlength <= 10000
clientSecret?string
Lengthlength <= 10000
forceAddAllAuthorizationInfo?boolean
connectionsScopes?array<managementv1.ApplicationScope>
defaultAudience?string
customAttributes?object

Custom attributes as key-value pairs. Keys must be strings; values can be strings, numbers, booleans, or arrays.

Example{ "attribute-key": "attribute-value" }
cibaSettings?object
jarSettings?object

JAR (JWT-Secured Authorization Request, RFC 9101) settings for Third Party Applications

allowedTenants?array<string>
string
clientType?string
forcePkce?boolean
allowPartialScopes?boolean
scopeClaimMapping?array<AppScopeClaimMappingEntry>
forceDpop?boolean
rarSettings?object
idJagTargetClients?object
clientAuthMethod?string

clientAuthMethod: "clientSecret" (default when empty), "privateKeyJwt" (only clientAssertions are accepted), "workloadIdentity" (only workloadClientAssertions are accepted) or "mtls" (only a registered mTLS certificate is accepted).

clientAssertions?array<ThirdPartyApplicationClientAssertion>

clientAssertions are the private_key_jwt trust entries (JWKS URL or PEM public key per entry).

workloadClientAssertions?array<ThirdPartyApplicationWorkloadClientAssertion>

workloadClientAssertions are the workload identity trust entries (SPIFFE trust domain or OIDC issuer per entry).

forcePar?boolean
mtlsClientAuthMethods?object
forceMtls?boolean
authorizationCodeDisabled?boolean

authorizationCodeDisabled rejects the authorization_code grant for this app, including its authorization requests. Default false.

clientCredentialsDisabled?boolean

clientCredentialsDisabled rejects the client_credentials grant for this app. Default false. A public client cannot use this grant.

refreshTokenDisabled?boolean

refreshTokenDisabled rejects the refresh_token grant for this app, so its tokens cannot be refreshed. Default false.

jwtBearerDisabled?boolean

jwtBearerDisabled rejects the JWT bearer grant (urn:ietf:params:oauth:grant-type:jwt-bearer) for this app. Default false. A public client cannot use this grant.

deviceCodeDisabled?boolean

deviceCodeDisabled rejects the device authorization grant (urn:ietf:params:oauth:grant-type:device_code) for this app. Default false.

tokenExchangeDisabled?boolean

tokenExchangeDisabled rejects the token exchange grant (urn:ietf:params:oauth:grant-type:token-exchange) for this app. Default false.

cibaEnabled?boolean

cibaEnabled allows the CIBA grant (urn:openid:params:grant-type:ciba) for this app and requires cibaSettings. Default false. A public client cannot use this grant.

tags?array<string>
string

tags label the app, matched by policy rules through client.tags conditions. Up to 100 tags, each up to 100 bytes. Default empty.

Itemsitems <= 100

Create a new third party application using the structured scope-claim mapping model, using a valid management key. The legacy attributesScopes field is ignored.

curl -X POST "https://api.descope.com/v2/mgmt/thirdparty/app/create" \  -H "Content-Type: application/json" \  -d '{    "name": "string"  }'
{  "id": "string",  "cleartext": "string",  "clientId": "string"}
export interface Response {id?: stringcleartext?: stringclientId?: string}
Was this helpful?

Create third party application consent POST

Create a user consent for a third party application, using a valid management key. Use it to migrate consents a user already granted elsewhere, so the user is not asked to consent again. The scopes are added to any existing consent of the user for the same application and tenant. The consent is validated like one granted on the consent screen: every scope must be defined by the application, the mandatory scopes of the application must be included (all of its scopes when it does not allow partial scopes), and the user must hold the roles and permissions the scopes map to. Consents of agentic applications cannot be created.

Delete inbound app attribute DELETE

Delete a single inbound app custom attribute definition by machine name, using a valid management key.