v2/mgmt/thirdparty/app/updateAuthorization
Descope Project ID and Management Key Project ID:Management Key as bearer token.
In: header
Request Body
application/json
1 <= length <= 100001 <= length <= 254length <= 100000length <= 20971521 <= lengthitems <= 100Custom attributes as key-value pairs. Keys must be strings; values can be strings, numbers, booleans, or arrays.
{
"attribute-key": "attribute-value"
}JAR (JWT-Secured Authorization Request, RFC 9101) settings for Third Party Applications
clientCredentialsDisabled rejects the client_credentials grant for this app. Default false. A public client cannot use this grant.
jwtBearerDisabled rejects the JWT bearer grant (urn:ietf:params:oauth:grant-type:jwt-bearer) for this app. Default false. A public client cannot use this grant.
cibaEnabled allows the CIBA grant (urn:openid:params:grant-type:ciba) for this app and requires cibaSettings. Default false. A public client cannot use this grant.
clientAuthMethod: "clientSecret" (default when empty), "privateKeyJwt" (only clientAssertions are accepted), "workloadIdentity" (only workloadClientAssertions are accepted) or "mtls" (only a registered mTLS certificate is accepted).
clientAssertions are the private_key_jwt trust entries (JWKS URL or PEM public key per entry).
workloadClientAssertions are the workload identity trust entries (SPIFFE trust domain or OIDC issuer per entry).
authorizationCodeDisabled rejects the authorization_code grant for this app, including its authorization requests. Default false.
refreshTokenDisabled rejects the refresh_token grant for this app, so its tokens cannot be refreshed. Default false.
deviceCodeDisabled rejects the device authorization grant (urn:ietf:params:oauth:grant-type:device_code) for this app. Default false.
tokenExchangeDisabled rejects the token exchange grant (urn:ietf:params:oauth:grant-type:token-exchange) for this app. Default false.
tags replace the app's labels, matched by policy rules through client.tags conditions. Up to 100 tags, each up to 100 bytes. Empty clears them.
items <= 100Update a third party application using the structured scope-claim mapping model, using a valid management key. The legacy attributesScopes field is ignored and cleared.
curl -X POST "https://api.descope.com/v2/mgmt/thirdparty/app/update" \ -H "Content-Type: application/json" \ -d '{ "id": "string", "name": "string", "loginPageUrl": "string" }'Set inbound app attribute POST
Create or update a single inbound app custom attribute definition (upsert by machine name), using a valid management key. Each inbound app sets its own values for these attributes, which JWT templates read as {{app.customAttributes.<name>}}.
Outbound Apps
Manage outbound applications that allow your users to authenticate with external services.