Update third party application (v2) | API Reference

POST

/v2/mgmt/thirdparty/app/update

Authorization

Descope Project ID and Management Key

AuthorizationBearer <token>

Project ID:Management Key as bearer token.

In: header

Request Body

application/json

id?string

name?string

description?string

logo?string

loginPageUrl?string

approvedCallbackUrls?array<string>

string

permissionsScopes?array<managementv1.ApplicationScope>

logoUrl?string

jwtBearerSettings?object

sessionSettings?object

audienceWhitelist?array<string>

string

forceAddAllAuthorizationInfo?boolean

connectionsScopes?array<managementv1.ApplicationScope>

defaultAudience?string

customAttributes?object

Custom attributes as key-value pairs. Keys must be strings; values can be strings, numbers, booleans, or arrays.

Example

{
  "attribute-key": "attribute-value"
}

cibaSettings?object

jarSettings?object

JAR (JWT-Secured Authorization Request, RFC 9101) settings for Third Party Applications

allowedTenants?array<string>

string

clientType?string

clientCredentialsDisabled?boolean

jwtBearerDisabled?boolean

cibaEnabled?boolean

forcePkce?boolean

allowPartialScopes?boolean

scopeClaimMapping?array<AppScopeClaimMappingEntry>

forceDpop?boolean

rarSettings?object

idJagTargetClients?object

clientAuthMethod?string

clientAuthMethod: "clientSecret" (default when empty), "privateKeyJwt" (only clientAssertions are accepted), "workloadIdentity" (only workloadClientAssertions are accepted) or "mtls" (only a registered mTLS certificate is accepted).

clientAssertions?array<ThirdPartyApplicationClientAssertion>

clientAssertions are the private_key_jwt trust entries (JWKS URL or PEM public key per entry).

workloadClientAssertions?array<ThirdPartyApplicationWorkloadClientAssertion>

workloadClientAssertions are the workload identity trust entries (SPIFFE trust domain or OIDC issuer per entry).

forcePar?boolean

mtlsClientAuthMethods?object

forceMtls?boolean

Update a third party application using the structured scope-claim mapping model, using a valid management key. The legacy attributesScopes field is ignored and cleared.

curl -X POST "https://api.descope.com/v2/mgmt/thirdparty/app/update" \  -H "Content-Type: application/json" \  -d '{}'

Was this helpful?