openapi: 3.1.1
info:
  title: WorkOS admin-portal applications API
  description: WorkOS REST API
  version: '1.0'
  contact:
    name: WorkOS
    url: https://workos.com
    email: support@workos.com
  license:
    name: MIT
    url: https://opensource.org/license/MIT
servers:
- url: https://api.workos.com
  description: Production
- url: https://api.workos-test.com
  description: Staging
security:
- bearer: []
tags:
- name: applications
  description: Manage Connect Applications.
  x-displayName: Applications
paths:
  /connect/applications:
    get:
      description: List all Connect Applications in the current environment with optional filtering.
      operationId: ApplicationsController_list
      parameters:
      - name: before
        required: false
        in: query
        description: An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `before="obj_123"` to fetch a new batch of objects before `"obj_123"`.
        schema:
          example: xxx_01HXYZ123456789ABCDEFGHIJ
          type: string
      - name: after
        required: false
        in: query
        description: An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `after="obj_123"` to fetch a new batch of objects after `"obj_123"`.
        schema:
          example: xxx_01HXYZ987654321KJIHGFEDCBA
          type: string
      - name: limit
        required: false
        in: query
        description: Upper limit on the number of objects to return, between `1` and `100`.
        schema:
          minimum: 1
          maximum: 100
          default: 10
          example: 10
          type: integer
      - name: order
        required: false
        in: query
        description: Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). Defaults to descending.
        schema:
          $ref: '#/components/schemas/PaginationOrder'
      - name: organization_id
        required: false
        in: query
        description: Filter Connect Applications by organization ID.
        schema:
          type: string
          example: org_01EHZNVPK3SFK441A1RGBFSHRT
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ConnectApplicationList'
        '422':
          description: Unprocessable Entity
          content:
            application/json:
              schema:
                type: object
                properties:
                  message:
                    type: string
                    description: A human-readable description of the error.
                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
                required:
                - message
      summary: List Connect Applications
      tags:
      - applications
    post:
      description: Create a new Connect Application. Supports both OAuth and Machine-to-Machine (M2M) application types.
      operationId: ApplicationsController_create
      parameters: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              oneOf:
              - $ref: '#/components/schemas/CreateOAuthApplicationDto'
              - $ref: '#/components/schemas/CreateM2MApplicationDto'
      responses:
        '201':
          description: Created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ConnectApplication'
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                type: object
                properties:
                  message:
                    type: string
                    description: A human-readable description of the error.
                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
                required:
                - message
        '422':
          description: Unprocessable Entity
          content:
            application/json:
              schema:
                type: object
                properties:
                  message:
                    type: string
                    description: A human-readable description of the error.
                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
                required:
                - message
      summary: Create a Connect Application
      tags:
      - applications
  /connect/applications/{id}:
    get:
      description: Retrieve details for a specific Connect Application by ID or client ID.
      operationId: ApplicationsController_find
      parameters:
      - name: id
        required: true
        in: path
        description: The application ID or client ID of the Connect Application.
        schema:
          type: string
          example: conn_app_01HXYZ123456789ABCDEFGHIJ
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ConnectApplication'
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                type: object
                properties:
                  message:
                    type: string
                    description: A human-readable description of the error.
                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
                required:
                - message
      summary: Get a Connect Application
      tags:
      - applications
    put:
      description: Update an existing Connect Application. For OAuth applications, you can update redirect URIs. For all applications, you can update the name, description, and scopes.
      operationId: ApplicationsController_update
      parameters:
      - name: id
        required: true
        in: path
        description: The application ID or client ID of the Connect Application.
        schema:
          type: string
          example: conn_app_01HXYZ123456789ABCDEFGHIJ
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateOAuthApplicationDto'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ConnectApplication'
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                type: object
                properties:
                  message:
                    type: string
                    description: A human-readable description of the error.
                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
                required:
                - message
        '422':
          description: Unprocessable Entity
          content:
            application/json:
              schema:
                type: object
                properties:
                  message:
                    type: string
                    description: A human-readable description of the error.
                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
                required:
                - message
      summary: Update a Connect Application
      tags:
      - applications
    delete:
      description: Delete an existing Connect Application.
      operationId: ApplicationsController_delete
      parameters:
      - name: id
        required: true
        in: path
        description: The application ID or client ID of the Connect Application.
        schema:
          type: string
          example: conn_app_01HXYZ123456789ABCDEFGHIJ
      responses:
        '204':
          description: No Content
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                type: object
                properties:
                  message:
                    type: string
                    description: A human-readable description of the error.
                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
                required:
                - message
      summary: Delete a Connect Application
      tags:
      - applications
components:
  schemas:
    UpdateOAuthApplicationDto:
      type: object
      properties:
        name:
          type: string
          description: The name of the application.
          example: My Application
        description:
          type:
          - string
          - 'null'
          description: A description for the application.
          example: An application for managing user access
        scopes:
          description: The OAuth scopes granted to the application.
          example:
          - openid
          - profile
          - email
          type:
          - array
          - 'null'
          items:
            type: string
        redirect_uris:
          description: Updated redirect URIs for the application. OAuth applications only.
          example:
          - uri: https://example.com/callback
            default: true
          type:
          - array
          - 'null'
          items:
            $ref: '#/components/schemas/RedirectUriDto'
    ConnectApplication:
      allOf:
      - type: object
        properties:
          object:
            type: string
            description: Distinguishes the connect application object.
            example: connect_application
            const: connect_application
          id:
            type: string
            description: The unique ID of the connect application.
            example: conn_app_01HXYZ123456789ABCDEFGHIJ
          client_id:
            type: string
            description: The client ID of the connect application.
            example: client_01HXYZ123456789ABCDEFGHIJ
          description:
            type:
            - string
            - 'null'
            description: A description of the connect application.
            example: An application for managing user access
          name:
            type: string
            description: The name of the connect application.
            example: My Application
          scopes:
            type: array
            items:
              type: string
            description: The scopes available for this application.
            example:
            - openid
            - profile
            - email
          created_at:
            format: date-time
            type: string
            description: An ISO 8601 timestamp.
            example: '2026-01-15T12:00:00.000Z'
          updated_at:
            format: date-time
            type: string
            description: An ISO 8601 timestamp.
            example: '2026-01-15T12:00:00.000Z'
        required:
        - object
        - id
        - client_id
        - description
        - name
        - scopes
        - created_at
        - updated_at
      - oneOf:
        - allOf:
          - type: object
            properties:
              application_type:
                type: string
                description: The type of the application.
                const: oauth
              redirect_uris:
                type: array
                items:
                  type: object
                  properties:
                    uri:
                      type: string
                      format: uri
                      description: The redirect URI for the application.
                      example: https://example.com/callback
                    default:
                      type: boolean
                      description: Whether this is the default redirect URI.
                      example: true
                  required:
                  - uri
                  - default
                description: The redirect URIs configured for this application.
              uses_pkce:
                type: boolean
                description: Whether the application uses PKCE for authorization.
                example: true
            required:
            - application_type
            - redirect_uris
            - uses_pkce
          - oneOf:
            - type: object
              properties:
                is_first_party:
                  type: boolean
                  description: Whether the application is a first-party application.
                  example: true
                  const: true
              required:
              - is_first_party
            - type: object
              properties:
                is_first_party:
                  type: boolean
                  description: Whether the application is a first-party application.
                  example: false
                  const: false
                was_dynamically_registered:
                  type: boolean
                  description: Whether the application was dynamically registered.
                  example: false
                  const: false
                organization_id:
                  type: string
                  description: The ID of the organization the application belongs to.
                  example: org_01EHZNVPK3SFK441A1RGBFSHRT
              required:
              - is_first_party
              - was_dynamically_registered
              - organization_id
            - type: object
              properties:
                is_first_party:
                  type: boolean
                  description: Whether the application is a first-party application.
                  example: false
                  const: false
                was_dynamically_registered:
                  type: boolean
                  description: Whether the application was dynamically registered.
                  example: true
                  const: true
              required:
              - is_first_party
              - was_dynamically_registered
        - type: object
          properties:
            application_type:
              type: string
              description: The type of the application.
              example: m2m
              const: m2m
            organization_id:
              type: string
              description: The ID of the organization the application belongs to.
              example: org_01EHZNVPK3SFK441A1RGBFSHRT
          required:
          - application_type
          - organization_id
    PaginationOrder:
      type: string
      enum:
      - normal
      - desc
      - asc
      example: desc
      default: desc
    CreateOAuthApplicationDto:
      type: object
      properties:
        name:
          type: string
          description: The name of the application.
          example: My Application
        application_type:
          type: string
          description: The type of application to create.
          const: oauth
        description:
          type:
          - string
          - 'null'
          description: A description for the application.
          example: An application for managing user access
        scopes:
          description: The OAuth scopes granted to the application.
          example:
          - openid
          - profile
          - email
          type:
          - array
          - 'null'
          items:
            type: string
        redirect_uris:
          description: Redirect URIs for the application.
          example:
          - uri: https://example.com/callback
            default: true
          type:
          - array
          - 'null'
          items:
            $ref: '#/components/schemas/RedirectUriDto'
        uses_pkce:
          type:
          - boolean
          - 'null'
          description: Whether the application uses PKCE (Proof Key for Code Exchange).
          example: true
        is_first_party:
          type: boolean
          description: Whether this is a first-party application. Third-party applications require an organization_id.
          example: true
        organization_id:
          type:
          - string
          - 'null'
          description: The organization ID this application belongs to. Required when is_first_party is false.
          example: org_01EHZNVPK3SFK441A1RGBFSHRT
      required:
      - name
      - application_type
      - is_first_party
    RedirectUriDto:
      type: object
      properties:
        uri:
          type: string
          description: The redirect URI.
          example: https://example.com/callback
        default:
          type:
          - boolean
          - 'null'
          description: Whether this is the default redirect URI.
          example: true
      required:
      - uri
    ConnectApplicationList:
      type: object
      properties:
        object:
          type: string
          description: Indicates this is a list response.
          const: list
        data:
          type: array
          items:
            $ref: '#/components/schemas/ConnectApplication'
          description: The list of records for the current page.
        list_metadata:
          type: object
          properties:
            before:
              type:
              - string
              - 'null'
              description: An object ID that defines your place in the list. When the ID is not present, you are at the start of the list.
              example: conn_app_01HXYZ123456789ABCDEFGHIJ
            after:
              type:
              - string
              - 'null'
              description: An object ID that defines your place in the list. When the ID is not present, you are at the end of the list.
              example: conn_app_01HXYZ987654321KJIHGFEDCBA
          required:
          - before
          - after
          description: Pagination cursors for navigating between pages of results.
      required:
      - object
      - data
      - list_metadata
    CreateM2MApplicationDto:
      type: object
      properties:
        name:
          type: string
          description: The name of the application.
          example: My Application
        application_type:
          type: string
          description: The type of application to create.
          const: m2m
        description:
          type:
          - string
          - 'null'
          description: A description for the application.
          example: An application for managing user access
        scopes:
          description: The OAuth scopes granted to the application.
          example:
          - openid
          - profile
          - email
          type:
          - array
          - 'null'
          items:
            type: string
        organization_id:
          type: string
          description: The organization ID this application belongs to.
          example: org_01EHZNVPK3SFK441A1RGBFSHRT
      required:
      - name
      - application_type
      - organization_id
  securitySchemes:
    bearer:
      scheme: bearer
      bearerFormat: JWT
      type: http
      description: 'Your WorkOS API key prefixed with `sk_`. Pass it as a Bearer token: `Authorization: Bearer sk_example_123456789`.'
    access_token:
      scheme: bearer
      bearerFormat: JWT
      type: http
      description: An SSO access token returned from the Get a Profile and Token endpoint.