---
name: apps-routes
description: Handle 77 OpenAPI operation(s) under /api/v1/apps for the apps route group.
---

# apps API Routes

Handle 77 OpenAPI operation(s) under /api/v1/apps for the apps route group.

Use the generated operation tools to make real API calls. Do not invent API responses.
If a tool reports missing setup, return the exact setup field name to the caller.
For write, update, or delete operations, state the intended action before calling the tool.

## Operations

### list_applications

- Operation ID: `list_applications`
- Route: `GET /api/v1/apps`
- Mode: READ
- Summary: List all applications
- Parameters:
  - `q` in `query`
  - `after` in `query`
  - `useOptimization` in `query`
  - `alwaysIncludeVpnSettings` in `query`
  - `limit` in `query`
  - `filter` in `query`
  - `expand` in `query`
  - `includeNonDeleted` in `query`

### create_application

- Operation ID: `create_application`
- Route: `POST /api/v1/apps`
- Mode: WRITE
- Summary: Create an application
- Parameters:
  - `activate` in `query`
  - `OktaAccessGateway-Agent` in `header`
- Body: JSON request body accepted.

### get_application

- Operation ID: `get_application`
- Route: `GET /api/v1/apps/{appId}`
- Mode: READ
- Summary: Retrieve an application
- Parameters:
  - `appId` in `path` required
  - `expand` in `query`

### replace_application

- Operation ID: `replace_application`
- Route: `PUT /api/v1/apps/{appId}`
- Mode: WRITE
- Summary: Replace an application
- Parameters:
  - `appId` in `path` required
- Body: JSON request body accepted.

### delete_application

- Operation ID: `delete_application`
- Route: `DELETE /api/v1/apps/{appId}`
- Mode: WRITE
- Summary: Delete an application
- Parameters:
  - `appId` in `path` required

### get_default_provisioning_connection_for_application

- Operation ID: `get_default_provisioning_connection_for_application`
- Route: `GET /api/v1/apps/{appId}/connections/default`
- Mode: READ
- Summary: Retrieve the default provisioning connection
- Parameters:
  - `appId` in `path` required

### update_default_provisioning_connection_for_application

- Operation ID: `update_default_provisioning_connection_for_application`
- Route: `POST /api/v1/apps/{appId}/connections/default`
- Mode: WRITE
- Summary: Update the default provisioning connection
- Parameters:
  - `appId` in `path` required
  - `activate` in `query`
- Body: JSON request body accepted.

### get_user_provisioning_connection_jwks

- Operation ID: `get_user_provisioning_connection_jwks`
- Route: `GET /api/v1/apps/{appId}/connections/default/jwks`
- Mode: READ
- Summary: Retrieve a JSON Web Key Set (JWKS) for the default provisioning connection
- Parameters:
  - `appId` in `path` required

### activate_default_provisioning_connection_for_application

- Operation ID: `activate_default_provisioning_connection_for_application`
- Route: `POST /api/v1/apps/{appId}/connections/default/lifecycle/activate`
- Mode: WRITE
- Summary: Activate the default provisioning connection
- Parameters:
  - `appId` in `path` required

### deactivate_default_provisioning_connection_for_application

- Operation ID: `deactivate_default_provisioning_connection_for_application`
- Route: `POST /api/v1/apps/{appId}/connections/default/lifecycle/deactivate`
- Mode: WRITE
- Summary: Deactivate the default provisioning connection
- Parameters:
  - `appId` in `path` required

### list_csrs_for_application

- Operation ID: `list_csrs_for_application`
- Route: `GET /api/v1/apps/{appId}/credentials/csrs`
- Mode: READ
- Summary: List all certificate signing requests
- Parameters:
  - `appId` in `path` required

### generate_csr_for_application

- Operation ID: `generate_csr_for_application`
- Route: `POST /api/v1/apps/{appId}/credentials/csrs`
- Mode: WRITE
- Summary: Generate a certificate signing request
- Parameters:
  - `appId` in `path` required
- Body: JSON request body accepted.

### get_csr_for_application

- Operation ID: `get_csr_for_application`
- Route: `GET /api/v1/apps/{appId}/credentials/csrs/{csrId}`
- Mode: READ
- Summary: Retrieve a certificate signing request
- Parameters:
  - `appId` in `path` required
  - `csrId` in `path` required

### revoke_csr_from_application

- Operation ID: `revoke_csr_from_application`
- Route: `DELETE /api/v1/apps/{appId}/credentials/csrs/{csrId}`
- Mode: WRITE
- Summary: Revoke a certificate signing request
- Parameters:
  - `appId` in `path` required
  - `csrId` in `path` required

### publish_csr_from_application

- Operation ID: `publish_csr_from_application`
- Route: `POST /api/v1/apps/{appId}/credentials/csrs/{csrId}/lifecycle/publish`
- Mode: WRITE
- Summary: Publish a certificate signing request
- Parameters:
  - `appId` in `path` required
  - `csrId` in `path` required
- Body: JSON request body accepted.

### list_jwk

- Operation ID: `list_jwk`
- Route: `GET /api/v1/apps/{appId}/credentials/jwks`
- Mode: READ
- Summary: List all the OAuth 2.0 client JSON Web Keys
- Parameters:
  - `appId` in `path` required

### add_jwk

- Operation ID: `add_jwk`
- Route: `POST /api/v1/apps/{appId}/credentials/jwks`
- Mode: WRITE
- Summary: Add a JSON Web Key
- Parameters:
  - `appId` in `path` required
- Body: JSON request body accepted.

### get_jwk

- Operation ID: `get_jwk`
- Route: `GET /api/v1/apps/{appId}/credentials/jwks/{keyId}`
- Mode: READ
- Summary: Retrieve an OAuth 2.0 client JSON Web Key
- Parameters:
  - `appId` in `path` required
  - `keyId` in `path` required

### deletejwk

- Operation ID: `deletejwk`
- Route: `DELETE /api/v1/apps/{appId}/credentials/jwks/{keyId}`
- Mode: WRITE
- Summary: Delete an OAuth 2.0 client JSON Web Key
- Parameters:
  - `appId` in `path` required
  - `keyId` in `path` required

### activate_o_auth2_client_json_web_key

- Operation ID: `activate_o_auth2_client_json_web_key`
- Route: `POST /api/v1/apps/{appId}/credentials/jwks/{keyId}/lifecycle/activate`
- Mode: WRITE
- Summary: Activate an OAuth 2.0 client JSON Web Key
- Parameters:
  - `appId` in `path` required
  - `keyId` in `path` required

### deactivate_o_auth2_client_json_web_key

- Operation ID: `deactivate_o_auth2_client_json_web_key`
- Route: `POST /api/v1/apps/{appId}/credentials/jwks/{keyId}/lifecycle/deactivate`
- Mode: WRITE
- Summary: Deactivate an OAuth 2.0 client JSON Web Key
- Parameters:
  - `appId` in `path` required
  - `keyId` in `path` required

### list_application_keys

- Operation ID: `list_application_keys`
- Route: `GET /api/v1/apps/{appId}/credentials/keys`
- Mode: READ
- Summary: List all key credentials
- Parameters:
  - `appId` in `path` required

### generate_application_key

- Operation ID: `generate_application_key`
- Route: `POST /api/v1/apps/{appId}/credentials/keys/generate`
- Mode: WRITE
- Summary: Generate a key credential
- Parameters:
  - `appId` in `path` required
  - `validityYears` in `query` required

### get_application_key

- Operation ID: `get_application_key`
- Route: `GET /api/v1/apps/{appId}/credentials/keys/{keyId}`
- Mode: READ
- Summary: Retrieve a key credential
- Parameters:
  - `appId` in `path` required
  - `keyId` in `path` required

### clone_application_key

- Operation ID: `clone_application_key`
- Route: `POST /api/v1/apps/{appId}/credentials/keys/{keyId}/clone`
- Mode: WRITE
- Summary: Clone a key credential
- Parameters:
  - `appId` in `path` required
  - `keyId` in `path` required
  - `targetAid` in `query` required

### list_o_auth2_client_secrets

- Operation ID: `list_o_auth2_client_secrets`
- Route: `GET /api/v1/apps/{appId}/credentials/secrets`
- Mode: READ
- Summary: List all OAuth 2.0 client secrets
- Parameters:
  - `appId` in `path` required

### create_o_auth2_client_secret

- Operation ID: `create_o_auth2_client_secret`
- Route: `POST /api/v1/apps/{appId}/credentials/secrets`
- Mode: WRITE
- Summary: Create an OAuth 2.0 client secret
- Parameters:
  - `appId` in `path` required
- Body: JSON request body accepted.

### get_o_auth2_client_secret

- Operation ID: `get_o_auth2_client_secret`
- Route: `GET /api/v1/apps/{appId}/credentials/secrets/{secretId}`
- Mode: READ
- Summary: Retrieve an OAuth 2.0 client secret
- Parameters:
  - `appId` in `path` required
  - `secretId` in `path` required

### delete_o_auth2_client_secret

- Operation ID: `delete_o_auth2_client_secret`
- Route: `DELETE /api/v1/apps/{appId}/credentials/secrets/{secretId}`
- Mode: WRITE
- Summary: Delete an OAuth 2.0 client secret
- Parameters:
  - `appId` in `path` required
  - `secretId` in `path` required

### activate_o_auth2_client_secret

- Operation ID: `activate_o_auth2_client_secret`
- Route: `POST /api/v1/apps/{appId}/credentials/secrets/{secretId}/lifecycle/activate`
- Mode: WRITE
- Summary: Activate an OAuth 2.0 client secret
- Parameters:
  - `appId` in `path` required
  - `secretId` in `path` required

### deactivate_o_auth2_client_secret

- Operation ID: `deactivate_o_auth2_client_secret`
- Route: `POST /api/v1/apps/{appId}/credentials/secrets/{secretId}/lifecycle/deactivate`
- Mode: WRITE
- Summary: Deactivate an OAuth 2.0 client secret
- Parameters:
  - `appId` in `path` required
  - `secretId` in `path` required

### get_all_cross_app_access_connections

- Operation ID: `get_all_cross_app_access_connections`
- Route: `GET /api/v1/apps/{appId}/cwo/connections`
- Mode: READ
- Summary: Retrieve all Cross App Access connections
- Parameters:
  - `appId` in `path` required
  - `after` in `query`
  - `limit` in `query`
  - `status` in `query`
  - `requestingAppId` in `query`
  - `resourceAppId` in `query`
  - `activeAppsOnly` in `query`
  - `requestingAppName` in `query`
  - `resourceAppName` in `query`

### create_cross_app_access_connection

- Operation ID: `create_cross_app_access_connection`
- Route: `POST /api/v1/apps/{appId}/cwo/connections`
- Mode: WRITE
- Summary: Create a Cross App Access connection
- Parameters:
  - `appId` in `path` required
- Body: JSON request body accepted.

### get_cross_app_access_connection

- Operation ID: `get_cross_app_access_connection`
- Route: `GET /api/v1/apps/{appId}/cwo/connections/{connectionId}`
- Mode: READ
- Summary: Retrieve a Cross App Access connection
- Parameters:
  - `appId` in `path` required
  - `connectionId` in `path` required

### update_cross_app_access_connection

- Operation ID: `update_cross_app_access_connection`
- Route: `PATCH /api/v1/apps/{appId}/cwo/connections/{connectionId}`
- Mode: WRITE
- Summary: Update a Cross App Access connection
- Parameters:
  - `appId` in `path` required
  - `connectionId` in `path` required
- Body: JSON request body accepted.

### delete_cross_app_access_connection

- Operation ID: `delete_cross_app_access_connection`
- Route: `DELETE /api/v1/apps/{appId}/cwo/connections/{connectionId}`
- Mode: WRITE
- Summary: Delete a Cross App Access connection
- Parameters:
  - `appId` in `path` required
  - `connectionId` in `path` required

### list_features_for_application

- Operation ID: `list_features_for_application`
- Route: `GET /api/v1/apps/{appId}/features`
- Mode: READ
- Summary: List all features
- Parameters:
  - `appId` in `path` required

### get_feature_for_application

- Operation ID: `get_feature_for_application`
- Route: `GET /api/v1/apps/{appId}/features/{featureName}`
- Mode: READ
- Summary: Retrieve a feature
- Parameters:
  - `appId` in `path` required
  - `featureName` in `path` required

### update_feature_for_application

- Operation ID: `update_feature_for_application`
- Route: `PUT /api/v1/apps/{appId}/features/{featureName}`
- Mode: WRITE
- Summary: Update a feature
- Parameters:
  - `appId` in `path` required
  - `featureName` in `path` required
- Body: JSON request body accepted.

### list_federated_claims

- Operation ID: `list_federated_claims`
- Route: `GET /api/v1/apps/{appId}/federated-claims`
- Mode: READ
- Summary: List all configured federated claims
- Parameters:
  - `appId` in `path` required

### create_federated_claim

- Operation ID: `create_federated_claim`
- Route: `POST /api/v1/apps/{appId}/federated-claims`
- Mode: WRITE
- Summary: Create a federated claim
- Parameters:
  - `appId` in `path` required
- Body: JSON request body accepted.

### get_federated_claim

- Operation ID: `get_federated_claim`
- Route: `GET /api/v1/apps/{appId}/federated-claims/{claimId}`
- Mode: READ
- Summary: Retrieve a federated claim
- Parameters:
  - `appId` in `path` required
  - `claimId` in `path` required

### replace_federated_claim

- Operation ID: `replace_federated_claim`
- Route: `PUT /api/v1/apps/{appId}/federated-claims/{claimId}`
- Mode: WRITE
- Summary: Replace a federated claim
- Parameters:
  - `appId` in `path` required
  - `claimId` in `path` required
- Body: JSON request body accepted.

### delete_federated_claim

- Operation ID: `delete_federated_claim`
- Route: `DELETE /api/v1/apps/{appId}/federated-claims/{claimId}`
- Mode: WRITE
- Summary: Delete a federated claim
- Parameters:
  - `appId` in `path` required
  - `claimId` in `path` required

### list_scope_consent_grants

- Operation ID: `list_scope_consent_grants`
- Route: `GET /api/v1/apps/{appId}/grants`
- Mode: READ
- Summary: List all app grants
- Parameters:
  - `appId` in `path` required
  - `expand` in `query`

### grant_consent_to_scope

- Operation ID: `grant_consent_to_scope`
- Route: `POST /api/v1/apps/{appId}/grants`
- Mode: WRITE
- Summary: Grant consent to scope
- Parameters:
  - `appId` in `path` required
- Body: JSON request body accepted.

### get_scope_consent_grant

- Operation ID: `get_scope_consent_grant`
- Route: `GET /api/v1/apps/{appId}/grants/{grantId}`
- Mode: READ
- Summary: Retrieve an app grant
- Parameters:
  - `appId` in `path` required
  - `grantId` in `path` required
  - `expand` in `query`

### revoke_scope_consent_grant

- Operation ID: `revoke_scope_consent_grant`
- Route: `DELETE /api/v1/apps/{appId}/grants/{grantId}`
- Mode: WRITE
- Summary: Revoke an app grant
- Parameters:
  - `appId` in `path` required
  - `grantId` in `path` required

### list_group_push_mappings

- Operation ID: `list_group_push_mappings`
- Route: `GET /api/v1/apps/{appId}/group-push/mappings`
- Mode: READ
- Summary: List all group push mappings
- Parameters:
  - `appId` in `path` required
  - `after` in `query`
  - `limit` in `query`
  - `lastUpdated` in `query`
  - `sourceGroupId` in `query`
  - `status` in `query`

### create_group_push_mapping

- Operation ID: `create_group_push_mapping`
- Route: `POST /api/v1/apps/{appId}/group-push/mappings`
- Mode: WRITE
- Summary: Create a group push mapping
- Parameters:
  - `appId` in `path` required
- Body: JSON request body accepted.

### get_group_push_mapping

- Operation ID: `get_group_push_mapping`
- Route: `GET /api/v1/apps/{appId}/group-push/mappings/{mappingId}`
- Mode: READ
- Summary: Retrieve a group push mapping
- Parameters:
  - `appId` in `path` required
  - `mappingId` in `path` required

### update_group_push_mapping

- Operation ID: `update_group_push_mapping`
- Route: `PATCH /api/v1/apps/{appId}/group-push/mappings/{mappingId}`
- Mode: WRITE
- Summary: Update a group push mapping
- Parameters:
  - `appId` in `path` required
  - `mappingId` in `path` required
- Body: JSON request body accepted.

### delete_group_push_mapping

- Operation ID: `delete_group_push_mapping`
- Route: `DELETE /api/v1/apps/{appId}/group-push/mappings/{mappingId}`
- Mode: WRITE
- Summary: Delete a group push mapping
- Parameters:
  - `appId` in `path` required
  - `mappingId` in `path` required
  - `deleteTargetGroup` in `query` required

### list_application_group_assignments

- Operation ID: `list_application_group_assignments`
- Route: `GET /api/v1/apps/{appId}/groups`
- Mode: READ
- Summary: List all application groups
- Parameters:
  - `appId` in `path` required
  - `q` in `query`
  - `after` in `query`
  - `limit` in `query`
  - `expand` in `query`

### get_application_group_assignment

- Operation ID: `get_application_group_assignment`
- Route: `GET /api/v1/apps/{appId}/groups/{groupId}`
- Mode: READ
- Summary: Retrieve an application group
- Parameters:
  - `appId` in `path` required
  - `groupId` in `path` required
  - `expand` in `query`

### assign_group_to_application

- Operation ID: `assign_group_to_application`
- Route: `PUT /api/v1/apps/{appId}/groups/{groupId}`
- Mode: WRITE
- Summary: Assign an application group
- Parameters:
  - `appId` in `path` required
  - `groupId` in `path` required
- Body: JSON request body accepted.

### update_group_assignment_to_application

- Operation ID: `update_group_assignment_to_application`
- Route: `PATCH /api/v1/apps/{appId}/groups/{groupId}`
- Mode: WRITE
- Summary: Update an application group
- Parameters:
  - `appId` in `path` required
  - `groupId` in `path` required
- Body: JSON request body accepted.

### unassign_application_from_group

- Operation ID: `unassign_application_from_group`
- Route: `DELETE /api/v1/apps/{appId}/groups/{groupId}`
- Mode: WRITE
- Summary: Unassign an application group
- Parameters:
  - `appId` in `path` required
  - `groupId` in `path` required

### list_interclient_allowed_applications

- Operation ID: `list_interclient_allowed_applications`
- Route: `GET /api/v1/apps/{appId}/interclient-allowed-apps`
- Mode: READ
- Summary: List all allowed apps for a target app
- Parameters:
  - `appId` in `path` required

### create_interclient_trust_mapping

- Operation ID: `create_interclient_trust_mapping`
- Route: `POST /api/v1/apps/{appId}/interclient-allowed-apps`
- Mode: WRITE
- Summary: Create an allowed app mapping for a target app
- Parameters:
  - `appId` in `path` required
- Body: JSON request body accepted.

### delete_interclient_trust_mapping

- Operation ID: `delete_interclient_trust_mapping`
- Route: `DELETE /api/v1/apps/{appId}/interclient-allowed-apps/{allowedAppId}`
- Mode: WRITE
- Summary: Delete an interclient trust mapping
- Parameters:
  - `appId` in `path` required
  - `allowedAppId` in `path` required

### list_interclient_target_applications

- Operation ID: `list_interclient_target_applications`
- Route: `GET /api/v1/apps/{appId}/interclient-target-apps`
- Mode: READ
- Summary: List all target apps for an allowed app
- Parameters:
  - `appId` in `path` required

### activate_application

- Operation ID: `activate_application`
- Route: `POST /api/v1/apps/{appId}/lifecycle/activate`
- Mode: WRITE
- Summary: Activate an application
- Parameters:
  - `appId` in `path` required

### deactivate_application

- Operation ID: `deactivate_application`
- Route: `POST /api/v1/apps/{appId}/lifecycle/deactivate`
- Mode: WRITE
- Summary: Deactivate an application
- Parameters:
  - `appId` in `path` required

### upload_application_logo

- Operation ID: `upload_application_logo`
- Route: `POST /api/v1/apps/{appId}/logo`
- Mode: WRITE
- Summary: Upload an application logo
- Parameters:
  - `appId` in `path` required
- Body: JSON request body accepted.

### assign_application_policy

- Operation ID: `assign_application_policy`
- Route: `PUT /api/v1/apps/{appId}/policies/{policyId}`
- Mode: WRITE
- Summary: Assign an app sign-in policy
- Parameters:
  - `appId` in `path` required
  - `policyId` in `path` required

### preview_sam_lmetadata_for_application

- Operation ID: `preview_sam_lmetadata_for_application`
- Route: `GET /api/v1/apps/{appId}/sso/saml/metadata`
- Mode: READ
- Summary: Preview the application SAML metadata
- Parameters:
  - `appId` in `path` required
  - `kid` in `query` required

### list_o_auth2_tokens_for_application

- Operation ID: `list_o_auth2_tokens_for_application`
- Route: `GET /api/v1/apps/{appId}/tokens`
- Mode: READ
- Summary: List all application refresh tokens
- Parameters:
  - `appId` in `path` required
  - `expand` in `query`
  - `after` in `query`
  - `limit` in `query`

### revoke_o_auth2_tokens_for_application

- Operation ID: `revoke_o_auth2_tokens_for_application`
- Route: `DELETE /api/v1/apps/{appId}/tokens`
- Mode: WRITE
- Summary: Revoke all application tokens
- Parameters:
  - `appId` in `path` required

### get_o_auth2_token_for_application

- Operation ID: `get_o_auth2_token_for_application`
- Route: `GET /api/v1/apps/{appId}/tokens/{tokenId}`
- Mode: READ
- Summary: Retrieve an application token
- Parameters:
  - `appId` in `path` required
  - `tokenId` in `path` required
  - `expand` in `query`

### revoke_o_auth2_token_for_application

- Operation ID: `revoke_o_auth2_token_for_application`
- Route: `DELETE /api/v1/apps/{appId}/tokens/{tokenId}`
- Mode: WRITE
- Summary: Revoke an application token
- Parameters:
  - `appId` in `path` required
  - `tokenId` in `path` required

### list_application_users

- Operation ID: `list_application_users`
- Route: `GET /api/v1/apps/{appId}/users`
- Mode: READ
- Summary: List all application users
- Parameters:
  - `appId` in `path` required
  - `after` in `query`
  - `limit` in `query`
  - `q` in `query`
  - `expand` in `query`

### assign_user_to_application

- Operation ID: `assign_user_to_application`
- Route: `POST /api/v1/apps/{appId}/users`
- Mode: WRITE
- Summary: Assign an application user
- Parameters:
  - `appId` in `path` required
- Body: JSON request body accepted.

### get_application_user

- Operation ID: `get_application_user`
- Route: `GET /api/v1/apps/{appId}/users/{userId}`
- Mode: READ
- Summary: Retrieve an application user
- Parameters:
  - `appId` in `path` required
  - `userId` in `path` required
  - `expand` in `query`

### update_application_user

- Operation ID: `update_application_user`
- Route: `POST /api/v1/apps/{appId}/users/{userId}`
- Mode: WRITE
- Summary: Update an application user
- Parameters:
  - `appId` in `path` required
  - `userId` in `path` required
- Body: JSON request body accepted.

### unassign_user_from_application

- Operation ID: `unassign_user_from_application`
- Route: `DELETE /api/v1/apps/{appId}/users/{userId}`
- Mode: WRITE
- Summary: Unassign an application user
- Parameters:
  - `appId` in `path` required
  - `userId` in `path` required
  - `sendEmail` in `query`

### verify_provisioning_connection_for_application

- Operation ID: `verify_provisioning_connection_for_application`
- Route: `POST /api/v1/apps/{appName}/{appId}/oauth2/callback`
- Mode: WRITE
- Summary: Verify the provisioning connection
- Parameters:
  - `appName` in `path` required
  - `appId` in `path` required
  - `code` in `query`
  - `state` in `query`