Rotate an app's secret
A new secret, in the response this once. The current one keeps working for `overlap_seconds`, so the app can be redeployed with the new one first. Needs `org.apps.edit`. Recorded as `app.secret_rotated`.
/v1/orgs/{org}/brands/{brand}/apps/{app}/rotate-secretA new secret, in the response this once. The current one keeps working for overlap_seconds, so the app can be redeployed with the new one first. Needs org.apps.edit. Recorded as app.secret_rotated.
Authorization
bearer An org API key (sk_live_…, sk_test_…), or an access token from the Synq issuer (the synq brand, on the accounts host) for this API.
In: header
Path Parameters
The app's client_id
Request Body
application/json
TypeScript Definitions
Use the request body type in TypeScript.
Response Body
application/json
application/problem+json
application/problem+json
application/problem+json
application/problem+json
application/problem+json
application/problem+json
curl -X POST "https://example.com/v1/orgs/string/brands/string/apps/string/rotate-secret" \ -H "Content-Type: application/json" \ -d '{}'{ "id": "string", "brand_id": "string", "name": "string", "app_type": "web", "source": "dashboard", "first_party": true, "own_ui_sign_in": true, "sign_in_methods": [ "string" ], "test_sign_ins": true, "disabled": true, "redirect_uris": [ "string" ], "post_logout_redirect_uris": [ "string" ], "backchannel_logout_uri": "string", "backchannel_logout_session_required": true, "client_uri": "string", "logo_uri": "string", "policy_uri": "string", "tos_uri": "string", "initiate_login_uri": "string", "jwks_uri": "string", "token_endpoint_auth_method": "string", "pkce_optional": true, "spa_refresh_tokens": true, "refresh_token_reuse_window_seconds": 0, "previous_secret_expires_at": "2019-08-24T14:15:22Z", "last_used_at": "2019-08-24T14:15:22Z", "created_at": "2019-08-24T14:15:22Z", "warnings": [ { "code": "string", "message": "string" } ], "client_secret": "string"}Change an app PATCH
Its name, URIs, links and settings, or whether it is disabled; never its type. Send null to clear a link. Needs `org.apps.edit`. Recorded as `app.updated`.
Make an app POST
A web, SPA, native or machine app of the brand. A web or machine app's secret is in the response, this once; only its hash is kept. Needs `org.apps.edit`, and room under the org's plan (403 `plan_quota_exceeded`, naming the plan that has room in `required_plan`; apps that registered themselves don't count). Recorded as `app.created`.