Retrieve an Application

Edit on GitHubEdit MD

This API is used to retrieve one or all of the configured Applications. Specifying an Id on the URI will retrieve a single Application. Leaving off the Id will retrieve all of the Applications.

Request#

Retrieve all of the active Applications

GET/api/application

OpenAPI Spec

Request Headers#

X-FusionAuth-TenantId String optional

The unique Id of the tenant used to scope this API request.

The tenant Id is not required on this request even when more than one tenant has been configured because the tenant can be identified based upon the request parameters or it is otherwise not required.

Specify a tenant Id on this request when you want to ensure the request is scoped to a specific tenant. The tenant Id may be provided through this header or by using a tenant locked API key to achieve the same result.

See Making an API request using a Tenant Id for additional information.

Retrieve all of the inactive Applications

GET/api/application?inactive=true

OpenAPI Spec

Request Headers#

X-FusionAuth-TenantId String optional

The unique Id of the tenant used to scope this API request.

See Making an API request using a Tenant Id for additional information.

Request Parameters#

inactive Boolean optional

Set this parameter to true in order to retrieve only inactive Applications. Setting this parameter to false is equivalent omitting the inactive parameter.

Retrieve a single Application by Id

GET/api/application/{applicationId}

OpenAPI Spec

Request Headers#

X-FusionAuth-TenantId String optional

The unique Id of the tenant used to scope this API request.

See Making an API request using a Tenant Id for additional information.

Request Parameters#

applicationId UUID optional

The Id of the Application to retrieve. This request will return the Application if it exists regardless if the Application is active or not.

Response#

The response for this API contains either a single Application or all of the Applications. When you call this API with an Id the response will contain just that Application. When you call this API without an Id the response will contain all of the Applications. Both response types are defined below along with an example JSON response.

Response Codes

Code	Description
200	The request was successful. The response will contain a JSON body.
400	The request was invalid and/or malformed. The response will contain an Errors JSON Object with the specific errors. This status will also be returned if a paid FusionAuth license is required and is not present.
401	You did not supply a valid Authorization header. The header was omitted or your API key was not valid. The response will be empty. See Authentication.
404	The object you requested doesn't exist. The response will be empty.
500	There was an internal error. A stack trace is provided and logged in the FusionAuth log files. The response will be empty.

Response Body#

application.accessControlConfiguration.uiIPAccessControlListId UUID Available since 1.30.0

The Id of the IP Access Control List limiting access to this application.

application.active Boolean DEPRECATED

Whether or not the Application is active.

Deprecated since 1.22.0

In version 1.22.0 and beyond, prefer the use of state.

application.authenticationTokenConfiguration.enabled Boolean

Whether or not Users can have Authentication Tokens associated with this Application.

application.baseURL String Available since 1.68.0

The base URL used when rendering links in templates for this Application. When defined, this value overrides tenant.baseURL.

application.cleanSpeakConfiguration.applicationIds Array<UUID>

An array of UUIDs that map to the CleanSpeak applications for this Application. It is possible that a single Application in FusionAuth might have multiple Applications in CleanSpeak. For example, a FusionAuth Application for a game might have one CleanSpeak Application for usernames and another Application for chat.

This property is used when CleanSpeak sends user action notifications to FusionAuth (when users are disciplined for example). FusionAuth will translate the CleanSpeak ids to FusionAuth ids and then apply the user action.

application.cleanSpeakConfiguration.enabled Boolean

True if CleanSpeak integration is enabled. This setting is global and is not modifiable using this API.

application.cleanSpeakConfiguration.usernameModeration.applicationId UUID

The Id of the CleanSpeak application that usernames are sent to for moderation.

application.cleanSpeakConfiguration.usernameModeration.enabled Boolean

True if CleanSpeak username moderation is enabled.

application.data Object

An object that can hold any information about the Application that should be persisted.

application.emailConfiguration.emailVerificationEmailTemplateId UUID optional Available since 1.19.0

The Id of the Email Template used to send emails to users to verify that their email address is valid. When configured, this value will take precedence over the same configuration from the Tenant when an application context is known.

application.emailConfiguration.emailUpdateEmailTemplateId UUID optional Available since 1.30.0

The Id of the Email Template used to send emails to users when their email address is updated. When configured, this value will take precedence over the same configuration from the Tenant when an application context is known.

application.emailConfiguration.emailVerifiedEmailTemplateId UUID optional Available since 1.19.0

The Id of the Email Template used to notify a user that their email address has been verified. When configured, this value will take precedence over the same configuration from the Tenant when an application context is known.

application.emailConfiguration.forgotPasswordEmailTemplateId UUID optional Available since 1.19.0

The Id of the Email Template that is used when a user is sent a forgot password email. When configured, this value will take precedence over the same configuration from the Tenant when an application context is known.

application.emailConfiguration.loginIdInUseOnCreateEmailTemplateId UUID optional Available since 1.30.0

The Id of the Email Template used to send emails to users when another user attempts to create an account with their login Id. When configured, this value will take precedence over the same configuration from the Tenant when an application context is known.

application.emailConfiguration.loginIdInUseOnUpdateEmailTemplateId UUID optional Available since 1.30.0

The Id of the Email Template used to send emails to users when another user attempts to update an existing account to use their login Id. When configured, this value will take precedence over the same configuration from the Tenant when an application context is known.

application.emailConfiguration.loginNewDeviceEmailTemplateId UUID optional Available since 1.30.0

The Id of the Email Template used to send emails to users when they log in on a new device. When configured, this value will take precedence over the same configuration from the Tenant when an application context is known.

application.emailConfiguration.loginSuspiciousEmailTemplateId UUID optional Available since 1.30.0

The Id of the Email Template used to send emails to users when a suspicious login occurs. When configured, this value will take precedence over the same configuration from the Tenant when an application context is known.

application.emailConfiguration.passwordlessEmailTemplateId UUID optional Available since 1.19.0

The Id of the Passwordless Email Template, sent to users when they start a passwordless login. When configured, this value will take precedence over the same configuration from the Tenant when an application context is known.

application.emailConfiguration.passwordResetSuccessEmailTemplateId UUID optional Available since 1.30.0

The Id of the Email Template used to send emails to users when they have completed a 'forgot password' workflow and their password has been reset. When configured, this value will take precedence over the same configuration from the Tenant when an application context is known.

application.emailConfiguration.passwordUpdateEmailTemplateId UUID optional Available since 1.30.0

The Id of the Email Template used to send emails to users when their password has been updated. When configured, this value will take precedence over the same configuration from the Tenant when an application context is known.

application.emailConfiguration.setPasswordEmailTemplateId UUID optional Available since 1.19.0

The Id of the Email Template that is used when a user had their account created for them and they must set their password manually and they are sent an email to set their password. When configured, this value will take precedence over the same configuration from the Tenant when an application context is known.

application.emailConfiguration.twoFactorMethodAddEmailTemplateId UUID optional Available since 1.30.0

The Id of the Email Template used to send emails to users when a MFA method has been added to their account. When configured, this value will take precedence over the same configuration from the Tenant when an application context is known.

application.emailConfiguration.twoFactorMethodRemoveEmailTemplateId UUID optional Available since 1.30.0

The Id of the Email Template used to send emails to users when a MFA method has been removed from their account. When configured, this value will take precedence over the same configuration from the Tenant when an application context is known.

application.formConfiguration.adminRegistrationFormId UUID Available since 1.20.0

The unique Id of the form to use for the Add and Edit User Registration form when used in the FusionAuth admin UI.

application.formConfiguration.selfServiceFormConfiguration.requireCurrentPasswordOnPasswordChange Boolean Available since 1.45.0

When enabled a user will be required to provide their current password when changing their password on a self-service account form.

application.formConfiguration.selfServiceFormId UUID Available since 1.26.0

The unique Id of the form to enable authenticated users to manage their profile on the account page.

application.id UUID

The unique identifier for this Application.

application.insertInstant Long Available since 1.18.0

The instant that the Application was added to the FusionAuth database.

application.jwtConfiguration.accessTokenKeyId UUID Available since 1.6.0

The Id of the signing key used to sign the access token.

application.jwtConfiguration.accessTokenVerificationKeyIds Array<UUID> Available since 1.69.0

The list of access token verification key Ids that are trusted by this application. application.jwtConfiguration.accessTokenKeyId is implicitly included in this list.

application.jwtConfiguration.enabled Boolean

Indicates if this application is using the JWT configuration defined here or the global JWT configuration defined by the Tenant. If this is false the signing algorithm configured in the Tenant will be used. If true the signing algorithm defined in this application will be used.

application.jwtConfiguration.idTokenKeyId UUID Available since 1.6.0

The Id of the signing key used to sign the Id token.

application.jwtConfiguration.idTokenVerificationKeyIds Array<UUID> Available since 1.69.0

The list of Id token verification key Ids that are trusted by this application. application.jwtConfiguration.idTokenKeyId is implicitly included in this list.

application.jwtConfiguration.refreshTokenExpirationPolicy String Available since 1.17.0

The Refresh Token expiration policy.

The possible values are:

Fixed - the expiration is calculated from the time the token is issued.
SlidingWindow - the expiration is calculated from the last time the token was used.
SlidingWindowWithMaximumLifetime - the expiration is calculated from the last time the token was used, or until the maximumTimeToLiveInMinutes is reached. Available since 1.46.0

application.jwtConfiguration.refreshTokenOneTimeUseConfiguration.gracePeriodInSeconds Integer Available since 1.55.1

The length of time specified in seconds that a one-time use token can be reused.

This value must be greater than 0 and less than 86400 which is equal to 24 hours. Setting this value to 0 effectively disables the grace period which means a one-time token may not be reused. For security reasons, you should keep this value as small as possible, and only increase past 0 to improve reliability for an asynchronous or clustered integration that may require a brief grace period.

Note that one-time use tokens refreshed within a grace period are not considered for revocation when tenant.jwtConfiguration.refreshTokenRevocationPolicy.onOneTimeTokenReuse is true. When a token is reused within the grace period the current token will be returned on the API response and the token will not be rotated.

application.jwtConfiguration.refreshTokenSlidingWindowConfiguration.maximumTimeToLiveInMinutes Integer Available since 1.46.0

The maximum lifetime of a refresh token when using a refreshTokenExpirationPolicy of SlidingWindowWithMaximumLifetime.

application.jwtConfiguration.refreshTokenTimeToLiveInMinutes Integer Available since 1.2.0

The length of time in minutes the JWT refresh token will live before it is expired and is not able to be exchanged for a JWT.

application.jwtConfiguration.refreshTokenUsagePolicy String Available since 1.17.0

The refresh token usage policy. The following are valid values:

Reusable - the token does not change after it was issued.
OneTimeUse - the token value will be changed each time the token is used to refresh a JWT. The client must store the new value after each usage.

application.jwtConfiguration.timeToLiveInSeconds Integer

The length of time in seconds the JWT will live before it is expired and no longer valid.

application.lambdaConfiguration.accessTokenPopulateId UUID Available since 1.6.0

The Id of the Lambda that will be invoked when an access token is generated for this application. This will be utilized during OAuth2 and OpenID Connect authentication requests as well as when an access token is generated for the Login API.

application.lambdaConfiguration.idTokenPopulateId UUID Available since 1.6.0

The Id of the Lambda that will be invoked when an Id token is generated for this application during an OpenID Connect authentication request.

application.lambdaConfiguration.multiFactorRequirementId UUID optional Available since 1.62.0

The Id of the lambda that will be invoked during logins, password changes, and MFA Status API calls to perform various validations to decide whether to challenge the user on one of their MFA methods.

application.lambdaConfiguration.samlv2PopulateId UUID Available since 1.6.0

The Id of the Lambda that will be invoked when a SAML response is generated during a SAML authentication request.

application.lambdaConfiguration.selfServiceRegistrationValidationId UUID Available since 1.43.0

The unique Id of the lambda that will be used to perform additional validation on registration form steps.

application.lambdaConfiguration.userinfoPopulateId UUID Available since 1.50.0

The Id of the Lambda that will be invoked when a UserInfo response is generated for this application.

application.lastUpdateInstant Long Available since 1.18.0

The instant that the Application was last updated in the FusionAuth database.

application.name String

The name of the Application.

application.loginConfiguration.allowTokenRefresh Boolean Available since 1.5.0

Indicates if a JWT may be refreshed using a Refresh Token for this application. This configuration is separate from issuing new Refresh Tokens which is controlled by the generateRefreshTokens parameter. This configuration indicates specifically if an existing Refresh Token may be used to request a new JWT using the Refresh API.

application.loginConfiguration.generateRefreshTokens Boolean Available since 1.5.0

Indicates if a Refresh Token should be issued from the Login API.

application.loginConfiguration.requireAuthentication Boolean Available since 1.5.0

Indicates if the Login API should require an API key. If you set this value to false and your FusionAuth API is on a public network, anyone may attempt to use the Login API.

application.multiFactorConfiguration.email.templateId UUID Available since 1.26.0

The Id of the email template that is used when notifying a user to complete a multi-factor authentication request.

application.multiFactorConfiguration.sms.templateId UUID Available since 1.26.0

The Id of the SMS template that is used when notifying a user to complete a multi-factor authentication request.

application.multiFactorConfiguration.voice.templateId UUID Available since 1.65.0

The Id of the voice template that is used when notifying a user to complete a multi-factor authentication request.

application.oauthConfiguration.authorizedOriginURLs Array<String>

An array of URLs that are the authorized origins for this Application.

When this configuration is omitted, all HTTP origins are allowed to use the browser based grants and the HTTP response header of X-Frame-Options: DENY will be added to each response to disallow iframe loading.

application.oauthConfiguration.authorizedRedirectURLs Array<String>

An array of URLs that are the authorized redirect URLs for this Application.

application.oauthConfiguration.authorizedURLValidationPolicy String Available since 1.43.0

Controls the validation policy for application.oauthConfiguration.authorizedOriginURLs and application.oauthConfiguration.authorizedRedirectURLs.

The possible values are:

ExactMatch - Only the configured values that do not contain wildcards are considered for validation. Values during OAuth 2.0 workflows must match a configured value exactly.
AllowWildcards - Configured values with and without wildcards are considered for validation. Values during OAuth 2.0 workflows can be matched against wildcard patterns or exactly match a configured value.

application.oauthConfiguration.clientAuthenticationPolicy String Available since 1.28.0

Determines the client authentication requirements for the OAuth 2.0 Token endpoint.

The possible values are:

Required - The client must provide client credentials when using the Token endpoint. The client_id and client_secret may be provided using a Basic Authorization HTTP header, or by sending these parameters in the request body using POST data.
NotRequired - Providing client credentials is optional when using the Token endpoint.
NotRequiredWhenUsingPKCE - The client must provide client credentials when using the Token endpoint unless a valid PCKE code_verifier has been provided in the request body using POST data.

application.oauthConfiguration.clientId String

The OAuth client Id of the Application.

application.oauthConfiguration.clientSecret String

The OAuth client secret.

application.oauthConfiguration.consentMode String Available since 1.50.0

Controls the policy for prompting a user to consent to requested OAuth scopes. This configuration only takes effect when application.oauthConfiguration.relationship is ThirdParty.

The possible values are:

AlwaysPrompt - Always prompt the user for consent.
RememberDecision - Remember previous consents; only prompt if the choice expires or if the requested or required scopes have changed. The duration of this persisted choice is controlled by the Tenant's externalIdentifierConfiguration.rememberOAuthScopeConsentChoiceTimeToLiveInSeconds value.
NeverPrompt - The user will be never be prompted to consent to requested OAuth scopes. Permission will be granted implicitly as if this were a FirstParty application. This configuration is meant for testing purposes only and should not be used in production.

application.oauthConfiguration.debug Boolean Available since 1.25.0

Whether or not FusionAuth will log a debug Event Log. This is particular useful for debugging the authorization code exchange with the Token endpoint during an Authorization Code grant.

application.oauthConfiguration.deviceVerificationURL String Available since 1.11.0

The device verification URL to be used with the Device Code grant type.

application.oauthConfiguration.enabledGrants Array<String> Available since 1.5.0

The enabled grants for this application.

Supported values include:

authorization_code
implicit
password
refresh_token
urn:ietf:params:oauth:grant-type:device_code Available since 1.11.0

application.oauthConfiguration.generateRefreshTokens Boolean Available since 1.3.0

Determines if the OAuth 2.0 Token endpoint will generate a refresh token when the offline_access scope is requested.

application.oauthConfiguration.logoutBehavior String Available since 1.11.0

Behavior when /oauth2/logout is called.

Valid values:

RedirectOnly: end the SSO session and redirect to the configured Logout URL or the passed in post_logout_redirect_uri value.
AllApplications: end the SSO session and make a GET request to all configured Logout URLs for every application in the tenant.

application.oauthConfiguration.logoutURL String

The logout URL for the Application. FusionAuth will redirect to this URL after the user logs out of OAuth.

application.oauthConfiguration.proofKeyForCodeExchangePolicy String Available since 1.28.0

Determines the PKCE requirements when using the authorization code grant.

The possible values are:

Required - The client must provide a valid code_verifier on the request body when completing the authorization code grant.
NotRequired - Providing a code_verifier is optional when completing the authorization code grant.
NotRequiredWhenUsingClientAuthentication - The client must provide a valid code_verifier on the request body when completing the authorization code grant unless valid client credentials have been provided using a Basic Authorization HTTP header, or by sending these parameters in the request body using POST data.

application.oauthConfiguration.providedScopePolicy.address.enabled Boolean Available since 1.50.0

Whether the address OAuth scope provided by FusionAuth is enabled for this application.

application.oauthConfiguration.providedScopePolicy.address.required Boolean Available since 1.50.0

Whether consent to the address OAuth scope provided by FusionAuth is required for this application when present on the OAuth request.

application.oauthConfiguration.providedScopePolicy.email.enabled Boolean Available since 1.50.0

Whether the email OAuth scope provided by FusionAuth is enabled for this application.

application.oauthConfiguration.providedScopePolicy.email.required Boolean Available since 1.50.0

Whether consent to the email OAuth scope provided by FusionAuth is required for this application when present on the OAuth request.

application.oauthConfiguration.providedScopePolicy.phone.enabled Boolean Available since 1.50.0

Whether the phone OAuth scope provided by FusionAuth is enabled for this application.

application.oauthConfiguration.providedScopePolicy.phone.required Boolean Available since 1.50.0

Whether consent to the phone OAuth scope provided by FusionAuth is required for this application when present on the OAuth request.

application.oauthConfiguration.providedScopePolicy.profile.enabled Boolean Available since 1.50.0

Whether the profile OAuth scope provided by FusionAuth is enabled for this application.

application.oauthConfiguration.providedScopePolicy.profile.required Boolean Available since 1.50.0

Whether consent to the profile OAuth scope provided by FusionAuth is required for this application when present on the OAuth request.

application.oauthConfiguration.relationship String Available since 1.50.0

The application's relationship to the OAuth server.

The possible values are:

FirstParty - The application has the same owner as the authorization server. Consent to requested OAuth scopes is granted implicitly.
ThirdParty - The application is external to the authorization server. Users will be prompted to consent to requested OAuth scopes based on application.oauthConfiguration.consentMode.

application.oauthConfiguration.requireClientAuthentication Boolean Available since 1.3.0DEPRECATED

Determines if the OAuth 2.0 Token endpoint requires client authentication. If this is enabled, the client must provide client credentials when using the Token endpoint. The client_id and client_secret may be provided using a Basic Authorization HTTP header, or by sending these parameters in the request body using POST data.

In version 1.28.0 and beyond, client authentication can be managed via application.oauthConfiguration.clientAuthenticationPolicy.

application.oauthConfiguration.requireRegistration Boolean Available since 1.28.0

Determines if the user will be required to be registered, or complete registration before redirecting to the configured callback in the authorization code grant or the implicit grant. This configuration does not affect any other grant, and does not affect the API usage.

application.oauthConfiguration.scopeHandlingPolicy String Available since 1.50.0

Controls the policy for handling of OAuth scopes when populating JWTs and the UserInfo response.

The possible values are:

Compatibility - OAuth workflows will populate JWT and UserInfo claims in a manner compatible with versions of FusionAuth before version 1.50.0.
Strict - OAuth workflows will populate token and UserInfo claims according to the OpenID Connect 1.0 specification based on requested and consented scopes.

application.oauthConfiguration.unknownScopePolicy String Available since 1.50.0

Controls the policy for handling unknown scopes on an OAuth request.

The possible values are:

Allow - Unknown scopes will be allowed on the request, passed through the OAuth workflow, and written to the resulting tokens without consent.
Remove - Unknown scopes will be removed from the OAuth workflow, but the workflow will proceed without them.
Reject - Unknown scopes will be rejected and cause the OAuth workflow to fail with an error.

application.passwordlessConfiguration.enabled Boolean Available since 1.5.0

Determines if passwordless login is enabled for this application.

application.passwordlessConfiguration.emailLoginStrategy String Available since 1.64.0

The default login strategy by which the user will complete the passwordless login via email. The possible values are:

ClickableLink - send the user a clickable link that they can open in a web browser to authenticate
FormField - send the user a short code that they can enter into a form field to authenticate

application.passwordlessConfiguration.phoneLoginStrategy String Available since 1.64.0

The default login strategy by which the user will complete the passwordless login via phone. The possible values are:

ClickableLink - send the user a clickable link that they can open in a web browser to authenticate
FormField - send the user a short code that they can enter into a form field to authenticate

application.phoneConfiguration.forgotPasswordTemplateId UUID Available since 1.59.0

The Id of the Message Template that is used when sending a user a forgot password message.

application.phoneConfiguration.identityUpdateTemplateId UUID Available since 1.59.0

The Id of the Message Template used to send a message to a user when their phone number has been updated. The message will be sent to both their new and old phone numbers.

application.phoneConfiguration.loginIdInUseOnCreateTemplateId UUID Available since 1.59.0

The Id of the Message Template used to send a message to a user when another user attempts to create an account with their login Id.

application.phoneConfiguration.loginIdInUseOnUpdateTemplateId UUID Available since 1.59.0

The Id of the Message Template used to send a message to a user when another user attempts to update an existing account to use their login Id.

application.phoneConfiguration.loginNewDeviceTemplateId UUID Available since 1.59.0

The Id of the Message Template used to send a message to a user when they log in on a new device.

application.phoneConfiguration.loginSuspiciousTemplateId UUID Available since 1.59.0

The Id of the Message Template used to send a message to a user when a suspicious login using their login Id occurs.

application.phoneConfiguration.passwordlessTemplateId UUID Available since 1.59.0

The Id of the Passwordless Message Template, sent to users when they start a passwordless login.

application.phoneConfiguration.passwordResetSuccessTemplateId UUID Available since 1.59.0

The Id of the Message Template used to send a message to a user when they have completed a 'forgot password' workflow and their password has been reset.

application.phoneConfiguration.passwordUpdateTemplateId UUID Available since 1.59.0

The Id of the Message Template used to send a message to a user when their password has been updated.

application.phoneConfiguration.setPasswordTemplateId UUID optional Available since 1.59.0

The Id of the SMS Message Template used when a user must set their password manually after their account was created for them (by an admin, for example).

application.phoneConfiguration.twoFactorMethodRemoveTemplateId UUID Available since 1.59.0

The Id of the Message Template used to send a message to a user when a MFA method has been removed from their account.

application.phoneConfiguration.twoFactorMethodAddTemplateId UUID Available since 1.59.0

The Id of the Message Template used to send a message to a user when a MFA method has been added to their account.

application.phoneConfiguration.verificationCompleteTemplateId UUID Available since 1.59.0

The Id of the Message Template used to notify a user that their phone number has been verified.

application.phoneConfiguration.verificationTemplateId UUID Available since 1.59.0

The Id of the Message Template used to send SMS messages to users to verify that their phone number is valid.

application.registrationConfiguration.birthDate.enabled Boolean Available since 1.4.0

Determines if the birthDate field will be included on the registration form.

application.registrationConfiguration.birthDate.required Boolean Available since 1.4.0

Determines if the birthDate field is required when displayed on the registration form.

application.registrationConfiguration.confirmPassword Boolean Available since 1.4.0

Determines if the password should be confirmed during self service registration, this means that the user will be required to type the password twice.

application.registrationConfiguration.completeRegistration Boolean Available since 1.65.0

Users cannot self-register, but can complete missing information from an existing registration. Defaults to false.

When true, any registered user logging in to this application using hosted login pages is prompted to complete missing registration information based on the application's configured registration form.

If application.registrationConfiguration.enabled is true, completeRegistration is ignored. In that case, users can create a registration or complete profile information.

application.registrationConfiguration.enabled Boolean Available since 1.4.0

Determines if self service registration is enabled for this application. When this value is false, you may still use the Registration API, this only affects if the self service option is available during the OAuth 2.0 login.

application.registrationConfiguration.firstName.enabled Boolean Available since 1.4.0

Determines if the firstName field will be included on the registration form.

application.registrationConfiguration.firstName.required Boolean Available since 1.4.0

Determines if the firstName field is required when displayed on the registration form.

application.registrationConfiguration.formId UUID Available since 1.18.0

The Id of an associated Form when using advanced registration configuration type.

application.registrationConfiguration.fullName.enabled Boolean Available since 1.4.0

Determines if the fullName field will be included on the registration form.

application.registrationConfiguration.fullName.required Boolean Available since 1.4.0

Determines if the fullName field is required when displayed on the registration form.

application.registrationConfiguration.lastName.enabled Boolean Available since 1.4.0

Determines if the lastName field will be included on the registration form.

application.registrationConfiguration.lastName.required Boolean Available since 1.4.0

Determines if the lastName field is required when displayed on the registration form.

application.registrationConfiguration.loginIdType String Available since 1.4.0

The unique login Id that will be collected during registration. A value of email or phoneNumber is preferred because an email or phone number is unique. The possible values are:

email
phoneNumber Available since 1.59.0
username

application.registrationConfiguration.middleName.enabled Boolean Available since 1.4.0

Determines if the middleName field will be included on the registration form.

application.registrationConfiguration.middleName.required Boolean Available since 1.4.0

Determines if the middleName field is required when displayed on the registration form.

application.registrationConfiguration.mobilePhone.enabled Boolean Available since 1.4.0

Determines if the mobilePhone field will be included on the registration form.

application.registrationConfiguration.mobilePhone.required Boolean Available since 1.4.0

Determines if the mobilePhone field is required when displayed on the registration form.

application.registrationConfiguration.preferredLanguages.enabled Boolean Available since 1.47.0

Determines if the preferredLanguages field will be included on the registration form.

application.registrationConfiguration.preferredLanguages.required Boolean Available since 1.47.0

Determines if the preferredLanguages field is required when displayed on the registration form.

application.registrationConfiguration.type String Available since 1.18.0

The type of registration flow.

Supported values include:

basic - the basic self registration options available prior to version 1.18.0.
advanced - advanced usage of custom forms, requires a paid plan.

application.registrationDeletePolicy.unverified.enabled Boolean Available since 1.13.0

Indicates that users without a verified registration for this application will have their registration permanently deleted after application.registrationDeletePolicy.unverified.numberOfDaysToRetain days.

application.registrationDeletePolicy.unverified.enabledInstant Long Available since 1.48.0

The instant that this policy was enabled.

User registrations created before this time will not be eligible to be deleted. This means that you can safely enable this feature and the policy will only be enforced for user registrations created after this policy was enabled.

Please note that prior to version 1.48.0, when enabling this policy all unverified user registrations are eligible for deletion.

application.registrationDeletePolicy.unverified.numberOfDaysToRetain Integer Available since 1.13.0

The number of days from registration a user's registration will be retained before being deleted for not completing registration verification. Value must be greater than 0.

application.roles Array

An array of Role objects.

application.roles[x].description String

A description of the role.

application.roles[x].id UUID

The Id of the Role.

application.roles[x].name String

The name of the Role.

application.roles[x].isDefault Boolean

Whether or not the Role is a default role. A default role is automatically assigned to a user during registration if no roles are provided.

application.roles[x].isSuperRole Boolean

Whether or not the Role is a considered to be a super user role. This is a marker to indicate that it supersedes all other roles. FusionAuth will attempt to enforce this contract when using the web UI, it is not enforced programmatically when using the API.

application.samlv2Configuration.assertionEncryptionConfiguration.digestAlgorithm String Available since 1.47.0

The message digest algorithm to use when encrypting the symmetric key for transport. The possible values are:

SHA1 - SHA-1 hashing algorithm
SHA256 - SHA-256 hashing algorithm
SHA384 - SHA-384 hashing algorithm
SHA512 - SHA-512 hashing algorithm

application.samlv2Configuration.assertionEncryptionConfiguration.enabled Boolean Available since 1.47.0

Whether or SAML assertion encryption is enabled for this Application.

application.samlv2Configuration.assertionEncryptionConfiguration.encryptionAlgorithm String Available since 1.47.0

The symmetric key encryption algorithm that will be used to encrypt SAML assertions. A new symmetric key will be generated every time an assertion is encrypted. AES ciphers can operate in Cipher Block Chaining (CBC) or Galois/Counter Mode (GCM). The possible values are:

AES128 - AES in CBC mode with a 128-bit key
AES192 - AES in CBC mode with a 192-bit key
AES256 - AES in CBC mode with a 256-bit key
AES128GCM - AES using GCM with a 128-bit key
AES192GCM - AES using GCM with a 192-bit key
AES256GCM - AES using GCM with a 256-bit key
TripleDES - Triple DES with a 192-bit key

application.samlv2Configuration.assertionEncryptionConfiguration.keyLocation String Available since 1.47.0

The location that the encrypted symmetric key information will be placed in the SAML response in relation to the EncryptedData element containing the encrypted assertion value. The possible values are:

Child - The EncryptedKey element will be wrapped in a KeyInfo element and added inside the EncryptedData
Sibling - The EncryptedKey element will be added to the document as a sibling of EncryptedData

application.samlv2Configuration.assertionEncryptionConfiguration.keyTransportAlgorithm String Available since 1.47.0

The encryption algorithm used to encrypt the symmetric key for transport in the SAML response. The possible values are:

RSAv15 - RSA version 1.5
RSA_OAEP - RSA encryption with Optimal Asymmetric Encryption Padding using the mask generation function and hash specified by application.samlv2Configuration.assertionEncryptionConfiguration.maskGenerationFunction
RSA_OAEP_MGF1P - RSA encryption with Optimal Asymmetric Encryption Padding using the MGF1 mask generation function and SHA-1 hash

application.samlv2Configuration.assertionEncryptionConfiguration.keyTransportEncryptionKeyId UUID Available since 1.47.0

The unique Id of the Key used to encrypt the symmetric key for transport in the SAML response.

application.samlv2Configuration.assertionEncryptionConfiguration.maskGenerationFunction String Available since 1.47.0

The mask generation function and hash function to use for the Optimal Asymmetric Encryption Padding when encrypting a symmetric key for transport. The possible values are:

MGF1_SHA1 - MGF1 mask generation function with SHA-1 hash
MGF1_SHA224 - MGF1 mask generation function with SHA-224 hash
MGF1_SHA256 - MGF1 mask generation function with SHA-256 hash
MGF1_SHA384 - MGF1 mask generation function with SHA-384 hash
MGF1_SHA512 - MGF1 mask generation function with SHA-512 hash

This value is only used when the application.samlv2Configuration.assertionEncryptionConfiguration.keyTransportAlgorithm is set to RSA_OAEP. RSAv15 does not require a message digest function, and RSA_OAEP_MGF1P will always use MGF1_SHA1 regardless of this value.

application.samlv2Configuration.audience String Available since 1.6.0

The audience for the SAML response sent to back to the service provider from FusionAuth. Some service providers require different audience values than the issuer and this configuration option lets you change the audience in the response.

application.samlv2Configuration.authorizedRedirectURLs Array<String> Available since 1.20.0

One or more authorized URLS that may be specified by the SAML v2 Service Provider in the Authentication request [AssertionConsumerServiceURL] element. If a requested URL is not in this list the request will be rejected by FusionAuth.

This is the URL that FusionAuth will send the SAML response during a SAML login request, this URL is also referred to as the Assertion Consumer Service or ACS). If the Authentication request does not contain the [AssertionConsumerServiceURL] element, the first URL found in this list will be used to send the SAML response back to the Service Provider.

application.samlv2Configuration.callbackURL String Available since 1.6.0DEPRECATED

The URL of the callback (sometimes called the Assertion Consumer Service or ACS). This is where FusionAuth sends the browser after the user logs in via SAML.

This field is preserved for backwards compatibility and may be removed in a future release. This is the first value found in the authorizedRedirectURLs parameter.

application.samlv2Configuration.debug Boolean Available since 1.6.0

Whether or not FusionAuth will log SAML debug messages to the event log. This is useful for debugging purposes.

application.samlv2Configuration.defaultVerificationKeyId UUID Available since 1.20.0DEPRECATED

The verification key used to verify a signature when the SAML v2 Service Provider is using HTTP Redirect Bindings OR HTTP POST Bindings.

If a [KeyInfo] element is found, Key Master will be used to resolve the key but the key must still match this value.

Deprecated since 1.69.0

In version 1.69.0 and above, use application.samlv2Configuration.verificationKeyIds. For backwards compatibility, FusionAuth populates application.samlv2Configuration.defaultVerificationKeyId with the first entry in application.samlv2Configuration.verificationKeyIds.

application.samlv2Configuration.enabled Boolean Available since 1.6.0

Whether or not the SAML IdP for this Application is enabled or not.

application.samlv2Configuration.initiatedLogin.enabled Boolean Available since 1.41.0

Determines if SAML v2 IdP initiated login is enabled for this application.

application.samlv2Configuration.initiatedLogin.nameIdFormat String Available since 1.41.0

The value sent in the AuthN response to the SAML v2 Service Provider in the NameID assertion.

application.samlv2Configuration.issuer String Available since 1.6.0

The issuer that identifies the service provider and allows FusionAuth to load the correct Application and SAML configuration.

application.samlv2Configuration.keyId UUID Available since 1.6.0

The unique Id of the Key used to sign the SAML response.

application.samlv2Configuration.loginHintConfiguration.enabled Boolean Available since 1.47.0

Determines if support for a login hint sent by a SAML service provider is enabled for this application.

application.samlv2Configuration.loginHintConfiguration.parameterName String Available since 1.47.0

The name of the login hint parameter provided by the service provider on an AuthnRequest. If this parameter is present, its value will be used to pre-populate the username field on the FusionAuth login form.

application.samlv2Configuration.logout.behavior String Available since 1.25.0

The possible values are:

AllParticipants - each session participant that has enabled single logout will be sent a Logout Request
OnlyOriginator - no other session participants will be notified when a logout request is sent for this application

This configuration is functionally equivalent to the Logout Behavior found in the OAuth2 configuration.

application.samlv2Configuration.logout.defaultVerificationKeyId UUID Available since 1.25.0DEPRECATED

The verification key used to verify a signature when the SAML v2 Service Provider is using HTTP Redirect Bindings OR HTTP POST Bindings.

If a [KeyInfo] element is found, Key Master will be used to resolve the key but the key must still match this value.

Deprecated since 1.69.0

In version 1.69.0 and beyond, use application.samlv2Configuration.logout.verificationKeyIds. For backwards compatibility, FusionAuth populates application.samlv2Configuration.logout.defaultVerificationKeyId with the first entry in **application.samlv2Configuration.logout.verificationKeyIds.

application.samlv2Configuration.logout.keyId UUID Available since 1.25.0

The unique Id of the Key used to sign the SAML Logout response.

application.samlv2Configuration.logout.requireSignedRequests Boolean Available since 1.25.0

When this value is true all Logout requests missing a signature will be rejected.

application.samlv2Configuration.logout.singleLogout.enabled Boolean Available since 1.25.0

Whether or not SAML Single Logout for this SAML IdP is enabled.

application.samlv2Configuration.logout.singleLogout.keyId UUID Available since 1.25.0

The unique Id of the Key used to sign the SAML Single Logout response.

application.samlv2Configuration.logout.singleLogout.url String Available since 1.25.0

The URL at which you want to receive the LogoutRequest from FusionAuth.

application.samlv2Configuration.logout.singleLogout.xmlSignatureC14nMethod String Available since 1.25.0

The XML signature canonicalization method used when digesting and signing the Single Logout response.

The possible values are:

exclusive: The URI for this method is http://www.w3.org/2001/10/xml-exc-c14n#
exclusive_with_comments: The URI for this method is http://www.w3.org/2001/10/xml-exc-c14n#WithComments
inclusive: The URI for this method is http://www.w3.org/TR/2001/REC-xml-c14n-20010315
inclusive_with_comments: The URI for this method is http://www.w3.org/TR/2001/REC-xml-c14n-20010315#WithComments

application.samlv2Configuration.logout.xmlSignatureC14nMethod String Available since 1.25.0

The XML signature canonicalization method used when digesting and signing the Logout response.

The possible values are:

exclusive: The URI for this method is http://www.w3.org/2001/10/xml-exc-c14n#
exclusive_with_comments: The URI for this method is http://www.w3.org/2001/10/xml-exc-c14n#WithComments
inclusive: The URI for this method is http://www.w3.org/TR/2001/REC-xml-c14n-20010315
inclusive_with_comments: The URI for this method is http://www.w3.org/TR/2001/REC-xml-c14n-20010315#WithComments

application.samlv2Configuration.logout.verificationKeyIds Array<UUID> Available since 1.69.0

The verification keys used to verify a signature when the SAML v2 Service Provider is using HTTP Redirect Bindings OR HTTP POST Bindings.

If a [KeyInfo] element is found, Key Master will be used to resolve the key but the key must still be included in this list.

application.samlv2Configuration.logoutURL String Available since 1.6.0

The URL that the browser is taken to after the user logs out of the SAML service provider.

application.samlv2Configuration.requireSignedRequests Boolean Available since 1.20.0

When this value is true all requests missing a signature will be rejected.

application.samlv2Configuration.verificationKeyIds Array<UUID> Available since 1.69.0

The verification keys used to verify a signature when the SAML v2 Service Provider is using HTTP Redirect Bindings OR HTTP POST Bindings.

If a [KeyInfo] element is found, Key Master will be used to resolve the key but the key must still be included in this list.

application.samlv2Configuration.xmlSignatureC14nMethod String Available since 1.6.0

The XML signature canonicalization method used when digesting and signing the SAML response.

The possible values are:

exclusive: The URI for this method is http://www.w3.org/2001/10/xml-exc-c14n#
exclusive_with_comments: The URI for this method is http://www.w3.org/2001/10/xml-exc-c14n#WithComments
inclusive: The URI for this method is http://www.w3.org/TR/2001/REC-xml-c14n-20010315
inclusive_with_comments: The URI for this method is http://www.w3.org/TR/2001/REC-xml-c14n-20010315#WithComments

application.samlv2Configuration.xmlSignatureLocation String Available since 1.21.0

The location to place the XML signature when signing the SAML response.

The possible values are:

Assertion - The XML signature will be added as a child element of the Assertion.
Response - The XML signature will be added as a child element of the Response.

application.scopes Array Available since 1.50.0

An array of OAuth Scope objects.

application.scopes[x].defaultConsentDetail String Available since 1.50.0

The default detail to display on the OAuth consent screen if one cannot be found in the theme.

application.scopes[x].defaultConsentMessage String Available since 1.50.0

The default message to display on the OAuth consent screen if one cannot be found in the theme.

application.scopes[x].description String Available since 1.50.0

A description of the OAuth Scope for internal use.

application.scopes[x].id UUID Available since 1.50.0

The Id of the OAuth Scope.

application.scopes[x].insertInstant Long Available since 1.50.0

The instant that the OAuth Scope was added to the FusionAuth database.

application.scopes[x].lastUpdateInstant Long Available since 1.50.0

The instant that the OAuth Scope was last updated in the FusionAuth database.

application.scopes[x].name String Available since 1.50.0

The name of the OAuth Scope. This is the value that will be used to request the scope in OAuth workflows.

application.scopes[x].required Boolean Available since 1.50.0

Determines if the OAuth Scope is required when requested in an OAuth workflow.

application.state String Available since 1.22.0

The current state of the application. The following are valid values:

Active - The Application is active.
Inactive - The Application is not active. An Application can not be modified or authenticated against when inactive.

application.tenantId UUID

The unique Id of the Tenant.

application.themeId UUID Available since 1.27.0

The unique Id of the theme to be used to style the login page and other end user templates.

application.universalConfiguration.universal Boolean optional Available since 1.58.0

Indicates if this application is a universal application.

application.verificationEmailTemplateId UUID

The Id of the Email Template that is used to send the Registration Verification emails to users.

application.verifyRegistration Boolean

Whether or not registrations to this Application may be verified.

application.webAuthnConfiguration.bootstrapWorkflow.enabled Boolean Available since 1.41.0

Whether the WebAuthn bootstrap workflow is enabled for this application. This overrides the tenant configuration. Has no effect if application.webAuthnConfiguration.enabled is false.

application.webAuthnConfiguration.enabled Boolean Available since 1.41.0

Indicates if this application enables WebAuthn workflows based on the configuration defined here or the Tenant WebAuthn configuration. If this is false, WebAuthn workflows are enabled based on the Tenant configuration. If true, WebAuthn workflows are enabled according to the configuration of this application.

application.webAuthnConfiguration.reauthenticationWorkflow.enabled Boolean Available since 1.41.0

Whether the WebAuthn reauthentication workflow is enabled for this application. This overrides the tenant configuration. Has no effect if application.webAuthnConfiguration.enabled is false.

Example Response JSON for a Single Application

{
  "application": {
    "id": "8174f72f-5ecd-4eae-8de8-7fef597b3473",
    "accessControlConfiguration": {
      "uiIPAccessControlListId": "11d49de7-69f6-46fc-8270-0b3aa626327a"
    },
    "active": true,
    "baseURL": "https://example.com",
    "cleanSpeakConfiguration": {
      "applicationIds": [
        "6b4253e0-cee0-47dd-973a-a27b9e23987c",
        "76a556ec-4ba8-4140-9085-555ee9a8bb1a"
      ],
      "enabled": true,
      "usernameModeration": {
        "applicationId": "2338dc41-bed0-4cdb-8251-ac68701e9bc7",
        "enabled": true
      }
    },
    "data": {
      "externalApplication": "Acme. Customer Support Forum",
      "productOwner": "john@acme.com"
    },
    "emailConfiguration": {
      "emailUpdateEmailTemplateId": "ec3045c7-97d8-47f8-8725-61b93deacf5d",
      "emailVerificationEmailTemplateId": "e6c74b53-d43d-471e-ae7e-906456d0f341",
      "emailVerifiedEmailTemplateId": "1c3045c7-97d8-47f8-8725-61b93deacf5d",
      "forgotPasswordEmailTemplateId": "162b3719-3d71-4638-b9bf-f3e2093f7fe1",
      "loginIdInUseOnCreateEmailTemplateId": "1c3045c7-97d8-47f8-8725-61b93deacf5d",
      "loginIdInUseOnUpdateEmailTemplateId": "2c3045c7-97d8-47f8-8725-61b93deacf5d",
      "loginNewDeviceEmailTemplateId": "3c3045c7-97d8-47f8-8725-61b93deacf5d",
      "loginSuspiciousEmailTemplateId": "4c3045c7-97d8-47f8-8725-61b93deacf5d",
      "passwordlessEmailTemplateId": "162b3719-3d71-4638-b9bf-f3e2093f7fe1",
      "passwordResetSuccessEmailTemplateId": "5c3045c7-97d8-47f8-8725-61b93deacf5d",
      "passwordUpdateEmailTemplateId": "6c3045c7-97d8-47f8-8725-61b93deacf5d",
      "setPasswordEmailTemplateId": "e160cc59-a73e-4d95-8287-f82e5c541a5c",
      "twoFactorMethodAddEmailTemplateId": "7c3045c7-97d8-47f8-8725-61b93deacf5d",
      "twoFactorMethodRemoveEmailTemplateId": "8c3045c7-97d8-47f8-8725-61b93deacf5d"
    },
    "formConfiguration": {
      "adminRegistrationFormId": "e37dff97-9a94-48af-a0a6-c0bdfdd62c48"
    },
    "insertInstant": 1595361142909,
    "jwtConfiguration": {
      "accessTokenKeyId": "025233ca-d4f3-2aa4-eca9-7e4200e9b472",
      "accessTokenVerificationKeyIds": [
        "f8c3de3d-1fea-4d7c-a8b0-29f63c4c3454"
      ],
      "enabled": true,
      "idTokenKeyId": "092dbedc-30af-4149-9c61-b578f2c72f59",
      "idTokenVerificationKeyIds": [
        "ce05a618-25fb-40a9-949c-f8029f8bf858"
      ],
      "refreshTokenTimeToLiveInMinutes": 43200,
      "timeToLiveInSeconds": 3600
    },
    "lambdaConfiguration": {
      "accessTokenPopulateId": "cbb303a4-0968-479c-ad62-de46b3fad130",
      "idTokenPopulateId": "9987eec8-af37-4339-a969-bb462ff8b491",
      "samlv2PopulateId": "0e58eb2b-b39e-41ad-bc06-52cd189b5908",
      "userinfoPopulateId": "faaa713c-befd-43ee-9387-907828f80882"
    },
    "lastUpdateInstant": 1595361143101,
    "multiFactorConfiguration": {
      "email": {
        "templateId": "859f394b-22a6-4fa6-ba55-de700df9e950"
      },
      "loginPolicy": "Required",
      "sms": {
        "templateId": "17760f96-dca7-448b-9a8f-c49016aa7210"
      },
      "trustPolicy": "Any"
    },
    "name": "Forum",
    "loginConfiguration": {
      "allowTokenRefresh": false,
      "generateRefreshTokens": false,
      "requireAuthentication": true
    },
    "oauthConfiguration": {
      "authorizedOriginURLs": [
        "http://www.example.com"
      ],
      "authorizedRedirectURLs": [
        "http://www.example.com/oauth-callback"
      ],
      "authorizedURLValidationPolicy": "ExactMatch",
      "clientAuthenticationPolicy": "Required",
      "clientId": "8174f72f-5ecd-4eae-8de8-7fef597b3473",
      "clientSecret": "+fcXet9Iu2kQi61yWD9Tu4ReZ113P6yEAkr32v6WKOQ=",
      "consentMode": "AlwaysPrompt",
      "debug": false,
      "enabledGrants": [
        "authorization_code",
        "refresh_token"
      ],
      "generateRefreshTokens": true,
      "logoutBehavior": "AllApplications",
      "logoutURL": "http://www.example.com/logout",
      "proofKeyForCodeExchangePolicy": "NotRequired",
      "providedScopePolicy": {
        "address": {
          "enabled": true,
          "required": false
        },
        "email": {
          "enabled": true,
          "required": false
        },
        "phone": {
          "enabled": true,
          "required": false
        },
        "profile": {
          "enabled": true,
          "required": false
        }
      },
      "relationship": "FirstParty",
      "requireClientAuthentication": true,
      "requireRegistration": false,
      "scopeHandlingPolicy": "Compatibility",
      "unknownScopePolicy": "Reject"
    },
    "passwordlessConfiguration": {
      "enabled": false,
      "emailLoginStrategy": "ClickableLink",
      "phoneLoginStrategy": "FormField"
    },
    "phoneConfiguration": {
      "forgotPasswordTemplateId": "f90c8a8f-db77-4f2f-a3dd-5f692faf5d55",
      "identityUpdateTemplateId": "77df7e94-2dbf-44ab-b58c-06ac4224c449",
      "loginIdInUseOnCreateTemplateId": "7880dac6-809b-489e-8a69-363b043dd0f4",
      "loginIdInUseOnUpdateTemplateId": "de14b495-a358-4941-bb6b-0ddce04370ef",
      "loginNewDeviceTemplateId": "d77ac611-ddff-4a06-903c-fafe5c1f9f7a",
      "loginSuspiciousTemplateId": "73a8408a-e857-4ce2-82bb-d15b94d7c709",
      "passwordResetSuccessTemplateId": "6a0f3a7a-3511-4936-a546-3bd8f68dbdd3",
      "passwordUpdateTemplateId": "3ca81208-5678-434f-92b8-7fcc3b62bc7a",
      "passwordlessTemplateId": "e8449783-60a7-483f-8c66-bcdf0d05705f",
      "setPasswordTemplateId": "a6655c95-d94c-4dea-8191-0190f562bc39",
      "twoFactorMethodAddTemplateId": "c450521d-7f39-4a21-ba02-ced83225efcc",
      "twoFactorMethodRemoveTemplateId": "fba4fe64-3a29-45f8-895f-520d73d93659",
      "verificationCompleteTemplateId": "7b6b80bd-e3a5-42ff-b333-93ef37c192df",
      "verificationTemplateId": "c96ed02d-fbc6-4b27-9e74-54444747d18a"
    },
    "registrationConfiguration": {
      "enabled": false,
      "type": "basic"
    },
    "registrationDeletePolicy": {
      "unverified": {
        "enabled": true,
        "enabledInstant": 1698772159415,
        "numberOfDaysToRetain": 30
      }
    },
    "roles": [
      {
        "description": "Administrators that have access to everything",
        "id": "ce485a91-906f-4615-af75-81d37dc71e90",
        "name": "admin",
        "isDefault": false
      },
      {
        "description": "Normal users that have access to nothing",
        "id": "ce485a91-906f-4615-af75-81d37dc71e91",
        "name": "user",
        "isDefault": true
      }
    ],
    "samlv2Configuration": {
      "audience": "example.com",
      "authorizedRedirectURLs": [
        "https://www.example.com/samlv2/acs"
      ],
      "callbackURL": "https://www.example.com/samlv2/acs",
      "debug": false,
      "defaultVerificationKeyId": "be980e51-c94c-49f9-bfb5-90571c34a791",
      "enabled": true,
      "initiatedLogin": {
        "enabled": false,
        "nameIdFormat": "urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"
      },
      "issuer": "example.com",
      "keyId": "0a52ace4-3016-47da-906a-f7d272fbdaed",
      "loginHintConfiguration": {
        "enabled": true,
        "parameterName": "login_hint"
      },
      "logout": {
        "behavior": "OnlyOriginator",
        "defaultVerificationKeyId": "0a52ace4-3016-47da-906a-f7d272fbdaed",
        "keyId": "0a52ace4-3016-47da-906a-f7d272fbdaed",
        "requireSignedRequests": true,
        "singleLogout": {
          "enabled": true,
          "keyId": "0a52ace4-3016-47da-906a-f7d272fbdaed",
          "url": "https://www.example.com/logout",
          "xmlSignatureC14nMethod": "exclusive_with_comments"
        },
        "xmlSignatureC14nMethod": "exclusive_with_comments",
        "verificationKeyIds": [
          "0a52ace4-3016-47da-906a-f7d272fbdaed",
          "fa21f572-40f5-4484-9393-4d9d7aa0a4bd"
        ]
      },
      "logoutURL": "https://www.example.com/logout",
      "requireSignedRequests": true,
      "verificationKeyIds": [
        "be980e51-c94c-49f9-bfb5-90571c34a791",
        "f2f9f93e-8af0-4728-9ebf-5e3261694f3f"
      ],
      "xmlSignatureC14nMethod": "exclusive_with_comments",
      "xmlSignatureLocation": "Assertion"
    },
    "scopes": [
      {
        "defaultConsentDetail": "Your calendar data will be used to provide you enhanced reminders",
        "defaultConsentMessage": "Read your calendar",
        "id": "b1e5afb2-e18f-4174-82c2-1fa7975ac598",
        "name": "calendar:read",
        "required": true
      },
      {
        "defaultConsentDetail": "Create new events to remind you of upcoming discussions",
        "defaultConsentMessage": "Write your calendar",
        "id": "a9ae0a21-be87-4f04-850d-20a75020448b",
        "name": "calendar:write",
        "required": false
      }
    ],
    "state": "Active",
    "tenantId": "50435e55-6e95-4d54-96d0-9c953dd53eeb",
    "universalConfiguration": {
      "universal": false
    },
    "verifyRegistration": false,
    "webAuthnConfiguration": {
      "bootstrapWorkflow": {
        "enabled": false
      },
      "enabled": false,
      "reauthenticationWorkflow": {
        "enabled": false
      }
    }
  }
}

Response Body#

applications[x] Array

The list of Application objects.

applications[x].accessControlConfiguration.uiIPAccessControlListId UUID Available since 1.30.0

The Id of the IP Access Control List limiting access to this application.

applications[x].active Boolean DEPRECATED

Whether or not the Application is active.

Deprecated since 1.22.0

In version 1.22.0 and beyond, prefer the use of state.

applications[x].authenticationTokenConfiguration.enabled Boolean

Whether or not Users can have Authentication Tokens associated with this Application.

applications[x].baseURL String Available since 1.68.0

The base URL used when rendering links in templates for this Application. When defined, this value overrides tenant.baseURL.

applications[x].cleanSpeakConfiguration.applicationIds Array<UUID>

applications[x].cleanSpeakConfiguration.enabled Boolean

True if CleanSpeak integration is enabled. This setting is global and is not modifiable using this API.

applications[x].cleanSpeakConfiguration.usernameModeration.applicationId UUID

The Id of the CleanSpeak application that usernames are sent to for moderation.

applications[x].cleanSpeakConfiguration.usernameModeration.enabled Boolean

True if CleanSpeak username moderation is enabled.

applications[x].data Object

An object that can hold any information about the Application that should be persisted.

applications[x].emailConfiguration.emailVerificationEmailTemplateId UUID optional Available since 1.19.0

applications[x].emailConfiguration.emailUpdateEmailTemplateId UUID optional Available since 1.30.0

applications[x].emailConfiguration.emailVerifiedEmailTemplateId UUID optional Available since 1.19.0

applications[x].emailConfiguration.forgotPasswordEmailTemplateId UUID optional Available since 1.19.0

applications[x].emailConfiguration.loginIdInUseOnCreateEmailTemplateId UUID optional Available since 1.30.0

applications[x].emailConfiguration.loginIdInUseOnUpdateEmailTemplateId UUID optional Available since 1.30.0

applications[x].emailConfiguration.loginNewDeviceEmailTemplateId UUID optional Available since 1.30.0

applications[x].emailConfiguration.loginSuspiciousEmailTemplateId UUID optional Available since 1.30.0

applications[x].emailConfiguration.passwordlessEmailTemplateId UUID optional Available since 1.19.0

applications[x].emailConfiguration.passwordResetSuccessEmailTemplateId UUID optional Available since 1.30.0

applications[x].emailConfiguration.passwordUpdateEmailTemplateId UUID optional Available since 1.30.0

applications[x].emailConfiguration.setPasswordEmailTemplateId UUID optional Available since 1.19.0

applications[x].emailConfiguration.twoFactorMethodAddEmailTemplateId UUID optional Available since 1.30.0

applications[x].emailConfiguration.twoFactorMethodRemoveEmailTemplateId UUID optional Available since 1.30.0

applications[x].formConfiguration.adminRegistrationFormId UUID Available since 1.20.0

The unique Id of the form to use for the Add and Edit User Registration form when used in the FusionAuth admin UI.

applications[x].formConfiguration.selfServiceFormConfiguration.requireCurrentPasswordOnPasswordChange Boolean Available since 1.45.0

When enabled a user will be required to provide their current password when changing their password on a self-service account form.

applications[x].formConfiguration.selfServiceFormId UUID Available since 1.26.0

The unique Id of the form to enable authenticated users to manage their profile on the account page.

applications[x].id UUID

The unique identifier for this Application.

applications[x].insertInstant Long Available since 1.18.0

The instant that the Application was added to the FusionAuth database.

applications[x].jwtConfiguration.accessTokenKeyId UUID Available since 1.6.0

The Id of the signing key used to sign the access token.

applications[x].jwtConfiguration.accessTokenVerificationKeyIds Array<UUID> Available since 1.69.0

The list of access token verification key Ids that are trusted by this application. application.jwtConfiguration.accessTokenKeyId is implicitly included in this list.

applications[x].jwtConfiguration.enabled Boolean

applications[x].jwtConfiguration.idTokenKeyId UUID Available since 1.6.0

The Id of the signing key used to sign the Id token.

applications[x].jwtConfiguration.idTokenVerificationKeyIds Array<UUID> Available since 1.69.0

The list of Id token verification key Ids that are trusted by this application. application.jwtConfiguration.idTokenKeyId is implicitly included in this list.

applications[x].jwtConfiguration.refreshTokenExpirationPolicy String Available since 1.17.0

The Refresh Token expiration policy.

The possible values are:

Fixed - the expiration is calculated from the time the token is issued.
SlidingWindow - the expiration is calculated from the last time the token was used.
SlidingWindowWithMaximumLifetime - the expiration is calculated from the last time the token was used, or until the maximumTimeToLiveInMinutes is reached. Available since 1.46.0

applications[x].jwtConfiguration.refreshTokenOneTimeUseConfiguration.gracePeriodInSeconds Integer Available since 1.55.1

The length of time specified in seconds that a one-time use token can be reused.

applications[x].jwtConfiguration.refreshTokenSlidingWindowConfiguration.maximumTimeToLiveInMinutes Integer Available since 1.46.0

The maximum lifetime of a refresh token when using a refreshTokenExpirationPolicy of SlidingWindowWithMaximumLifetime.

applications[x].jwtConfiguration.refreshTokenTimeToLiveInMinutes Integer Available since 1.2.0

The length of time in minutes the JWT refresh token will live before it is expired and is not able to be exchanged for a JWT.

applications[x].jwtConfiguration.refreshTokenUsagePolicy String Available since 1.17.0

The refresh token usage policy. The following are valid values:

Reusable - the token does not change after it was issued.
OneTimeUse - the token value will be changed each time the token is used to refresh a JWT. The client must store the new value after each usage.

applications[x].jwtConfiguration.timeToLiveInSeconds Integer

The length of time in seconds the JWT will live before it is expired and no longer valid.

applications[x].lambdaConfiguration.accessTokenPopulateId UUID Available since 1.6.0

applications[x].lambdaConfiguration.idTokenPopulateId UUID Available since 1.6.0

The Id of the Lambda that will be invoked when an Id token is generated for this application during an OpenID Connect authentication request.

applications[x].lambdaConfiguration.multiFactorRequirementId UUID optional Available since 1.62.0

The Id of the lambda that will be invoked during logins, password changes, and MFA Status API calls to perform various validations to decide whether to challenge the user on one of their MFA methods.

applications[x].lambdaConfiguration.samlv2PopulateId UUID Available since 1.6.0

The Id of the Lambda that will be invoked when a SAML response is generated during a SAML authentication request.

applications[x].lambdaConfiguration.selfServiceRegistrationValidationId UUID Available since 1.43.0

The unique Id of the lambda that will be used to perform additional validation on registration form steps.

applications[x].lambdaConfiguration.userinfoPopulateId UUID Available since 1.50.0

The Id of the Lambda that will be invoked when a UserInfo response is generated for this application.

applications[x].lastUpdateInstant Long Available since 1.18.0

The instant that the Application was last updated in the FusionAuth database.

applications[x].name String

The name of the Application.

applications[x].loginConfiguration.allowTokenRefresh Boolean Available since 1.5.0

applications[x].loginConfiguration.generateRefreshTokens Boolean Available since 1.5.0

Indicates if a Refresh Token should be issued from the Login API.

applications[x].loginConfiguration.requireAuthentication Boolean Available since 1.5.0

Indicates if the Login API should require an API key. If you set this value to false and your FusionAuth API is on a public network, anyone may attempt to use the Login API.

applications[x].multiFactorConfiguration.email.templateId UUID Available since 1.26.0

The Id of the email template that is used when notifying a user to complete a multi-factor authentication request.

applications[x].multiFactorConfiguration.sms.templateId UUID Available since 1.26.0

The Id of the SMS template that is used when notifying a user to complete a multi-factor authentication request.

applications[x].multiFactorConfiguration.voice.templateId UUID Available since 1.65.0

The Id of the voice template that is used when notifying a user to complete a multi-factor authentication request.

applications[x].oauthConfiguration.authorizedOriginURLs Array<String>

An array of URLs that are the authorized origins for this Application.

applications[x].oauthConfiguration.authorizedRedirectURLs Array<String>

An array of URLs that are the authorized redirect URLs for this Application.

applications[x].oauthConfiguration.authorizedURLValidationPolicy String Available since 1.43.0

Controls the validation policy for applications[x].oauthConfiguration.authorizedOriginURLs and applications[x].oauthConfiguration.authorizedRedirectURLs.

The possible values are:

ExactMatch - Only the configured values that do not contain wildcards are considered for validation. Values during OAuth 2.0 workflows must match a configured value exactly.
AllowWildcards - Configured values with and without wildcards are considered for validation. Values during OAuth 2.0 workflows can be matched against wildcard patterns or exactly match a configured value.

applications[x].oauthConfiguration.clientAuthenticationPolicy String Available since 1.28.0

Determines the client authentication requirements for the OAuth 2.0 Token endpoint.

The possible values are:

Required - The client must provide client credentials when using the Token endpoint. The client_id and client_secret may be provided using a Basic Authorization HTTP header, or by sending these parameters in the request body using POST data.
NotRequired - Providing client credentials is optional when using the Token endpoint.
NotRequiredWhenUsingPKCE - The client must provide client credentials when using the Token endpoint unless a valid PCKE code_verifier has been provided in the request body using POST data.

applications[x].oauthConfiguration.clientId String

The OAuth client Id of the Application.

applications[x].oauthConfiguration.clientSecret String

The OAuth client secret.

applications[x].oauthConfiguration.consentMode String Available since 1.50.0

Controls the policy for prompting a user to consent to requested OAuth scopes. This configuration only takes effect when applications[x].oauthConfiguration.relationship is ThirdParty.

The possible values are:

AlwaysPrompt - Always prompt the user for consent.
RememberDecision - Remember previous consents; only prompt if the choice expires or if the requested or required scopes have changed. The duration of this persisted choice is controlled by the Tenant's externalIdentifierConfiguration.rememberOAuthScopeConsentChoiceTimeToLiveInSeconds value.
NeverPrompt - The user will be never be prompted to consent to requested OAuth scopes. Permission will be granted implicitly as if this were a FirstParty application. This configuration is meant for testing purposes only and should not be used in production.

applications[x].oauthConfiguration.debug Boolean Available since 1.25.0

Whether or not FusionAuth will log a debug Event Log. This is particular useful for debugging the authorization code exchange with the Token endpoint during an Authorization Code grant.

applications[x].oauthConfiguration.deviceVerificationURL String Available since 1.11.0

The device verification URL to be used with the Device Code grant type.

applications[x].oauthConfiguration.enabledGrants Array<String> Available since 1.5.0

The enabled grants for this application.

Supported values include:

authorization_code
implicit
password
refresh_token
urn:ietf:params:oauth:grant-type:device_code Available since 1.11.0

applications[x].oauthConfiguration.generateRefreshTokens Boolean Available since 1.3.0

Determines if the OAuth 2.0 Token endpoint will generate a refresh token when the offline_access scope is requested.

applications[x].oauthConfiguration.logoutBehavior String Available since 1.11.0

Behavior when /oauth2/logout is called.

Valid values:

RedirectOnly: end the SSO session and redirect to the configured Logout URL or the passed in post_logout_redirect_uri value.
AllApplications: end the SSO session and make a GET request to all configured Logout URLs for every application in the tenant.

applications[x].oauthConfiguration.logoutURL String

The logout URL for the Application. FusionAuth will redirect to this URL after the user logs out of OAuth.

applications[x].oauthConfiguration.proofKeyForCodeExchangePolicy String Available since 1.28.0

Determines the PKCE requirements when using the authorization code grant.

The possible values are:

Required - The client must provide a valid code_verifier on the request body when completing the authorization code grant.
NotRequired - Providing a code_verifier is optional when completing the authorization code grant.
NotRequiredWhenUsingClientAuthentication - The client must provide a valid code_verifier on the request body when completing the authorization code grant unless valid client credentials have been provided using a Basic Authorization HTTP header, or by sending these parameters in the request body using POST data.

applications[x].oauthConfiguration.providedScopePolicy.address.enabled Boolean Available since 1.50.0

Whether the address OAuth scope provided by FusionAuth is enabled for this application.

applications[x].oauthConfiguration.providedScopePolicy.address.required Boolean Available since 1.50.0

Whether consent to the address OAuth scope provided by FusionAuth is required for this application when present on the OAuth request.

applications[x].oauthConfiguration.providedScopePolicy.email.enabled Boolean Available since 1.50.0

Whether the email OAuth scope provided by FusionAuth is enabled for this application.

applications[x].oauthConfiguration.providedScopePolicy.email.required Boolean Available since 1.50.0

Whether consent to the email OAuth scope provided by FusionAuth is required for this application when present on the OAuth request.

applications[x].oauthConfiguration.providedScopePolicy.phone.enabled Boolean Available since 1.50.0

Whether the phone OAuth scope provided by FusionAuth is enabled for this application.

applications[x].oauthConfiguration.providedScopePolicy.phone.required Boolean Available since 1.50.0

Whether consent to the phone OAuth scope provided by FusionAuth is required for this application when present on the OAuth request.

applications[x].oauthConfiguration.providedScopePolicy.profile.enabled Boolean Available since 1.50.0

Whether the profile OAuth scope provided by FusionAuth is enabled for this application.

applications[x].oauthConfiguration.providedScopePolicy.profile.required Boolean Available since 1.50.0

Whether consent to the profile OAuth scope provided by FusionAuth is required for this application when present on the OAuth request.

applications[x].oauthConfiguration.relationship String Available since 1.50.0

The application's relationship to the OAuth server.

The possible values are:

FirstParty - The application has the same owner as the authorization server. Consent to requested OAuth scopes is granted implicitly.
ThirdParty - The application is external to the authorization server. Users will be prompted to consent to requested OAuth scopes based on applications[x].oauthConfiguration.consentMode.

applications[x].oauthConfiguration.requireClientAuthentication Boolean Available since 1.3.0DEPRECATED

In version 1.28.0 and beyond, client authentication can be managed via applications[x].oauthConfiguration.clientAuthenticationPolicy.

applications[x].oauthConfiguration.requireRegistration Boolean Available since 1.28.0

applications[x].oauthConfiguration.scopeHandlingPolicy String Available since 1.50.0

Controls the policy for handling of OAuth scopes when populating JWTs and the UserInfo response.

The possible values are:

Compatibility - OAuth workflows will populate JWT and UserInfo claims in a manner compatible with versions of FusionAuth before version 1.50.0.
Strict - OAuth workflows will populate token and UserInfo claims according to the OpenID Connect 1.0 specification based on requested and consented scopes.

applications[x].oauthConfiguration.unknownScopePolicy String Available since 1.50.0

Controls the policy for handling unknown scopes on an OAuth request.

The possible values are:

Allow - Unknown scopes will be allowed on the request, passed through the OAuth workflow, and written to the resulting tokens without consent.
Remove - Unknown scopes will be removed from the OAuth workflow, but the workflow will proceed without them.
Reject - Unknown scopes will be rejected and cause the OAuth workflow to fail with an error.

applications[x].passwordlessConfiguration.enabled Boolean Available since 1.5.0

Determines if passwordless login is enabled for this application.

applications[x].passwordlessConfiguration.emailLoginStrategy String Available since 1.64.0

The default login strategy by which the user will complete the passwordless login via email. The possible values are:

ClickableLink - send the user a clickable link that they can open in a web browser to authenticate
FormField - send the user a short code that they can enter into a form field to authenticate

applications[x].passwordlessConfiguration.phoneLoginStrategy String Available since 1.64.0

The default login strategy by which the user will complete the passwordless login via phone. The possible values are:

ClickableLink - send the user a clickable link that they can open in a web browser to authenticate
FormField - send the user a short code that they can enter into a form field to authenticate

applications[x].phoneConfiguration.forgotPasswordTemplateId UUID Available since 1.59.0

The Id of the Message Template that is used when sending a user a forgot password message.

applications[x].phoneConfiguration.identityUpdateTemplateId UUID Available since 1.59.0

The Id of the Message Template used to send a message to a user when their phone number has been updated. The message will be sent to both their new and old phone numbers.

applications[x].phoneConfiguration.loginIdInUseOnCreateTemplateId UUID Available since 1.59.0

The Id of the Message Template used to send a message to a user when another user attempts to create an account with their login Id.

applications[x].phoneConfiguration.loginIdInUseOnUpdateTemplateId UUID Available since 1.59.0

The Id of the Message Template used to send a message to a user when another user attempts to update an existing account to use their login Id.

applications[x].phoneConfiguration.loginNewDeviceTemplateId UUID Available since 1.59.0

The Id of the Message Template used to send a message to a user when they log in on a new device.

applications[x].phoneConfiguration.loginSuspiciousTemplateId UUID Available since 1.59.0

The Id of the Message Template used to send a message to a user when a suspicious login using their login Id occurs.

applications[x].phoneConfiguration.passwordlessTemplateId UUID Available since 1.59.0

The Id of the Passwordless Message Template, sent to users when they start a passwordless login.

applications[x].phoneConfiguration.passwordResetSuccessTemplateId UUID Available since 1.59.0

The Id of the Message Template used to send a message to a user when they have completed a 'forgot password' workflow and their password has been reset.

applications[x].phoneConfiguration.passwordUpdateTemplateId UUID Available since 1.59.0

The Id of the Message Template used to send a message to a user when their password has been updated.

applications[x].phoneConfiguration.setPasswordTemplateId UUID optional Available since 1.59.0

The Id of the SMS Message Template used when a user must set their password manually after their account was created for them (by an admin, for example).

applications[x].phoneConfiguration.twoFactorMethodRemoveTemplateId UUID Available since 1.59.0

The Id of the Message Template used to send a message to a user when a MFA method has been removed from their account.

applications[x].phoneConfiguration.twoFactorMethodAddTemplateId UUID Available since 1.59.0

The Id of the Message Template used to send a message to a user when a MFA method has been added to their account.

applications[x].phoneConfiguration.verificationCompleteTemplateId UUID Available since 1.59.0

The Id of the Message Template used to notify a user that their phone number has been verified.

applications[x].phoneConfiguration.verificationTemplateId UUID Available since 1.59.0

The Id of the Message Template used to send SMS messages to users to verify that their phone number is valid.

applications[x].registrationConfiguration.birthDate.enabled Boolean Available since 1.4.0

Determines if the birthDate field will be included on the registration form.

applications[x].registrationConfiguration.birthDate.required Boolean Available since 1.4.0

Determines if the birthDate field is required when displayed on the registration form.

applications[x].registrationConfiguration.confirmPassword Boolean Available since 1.4.0

Determines if the password should be confirmed during self service registration, this means that the user will be required to type the password twice.

applications[x].registrationConfiguration.completeRegistration Boolean Available since 1.65.0

Users cannot self-register, but can complete missing information from an existing registration. Defaults to false.

If application.registrationConfiguration.enabled is true, completeRegistration is ignored. In that case, users can create a registration or complete profile information.

applications[x].registrationConfiguration.enabled Boolean Available since 1.4.0

applications[x].registrationConfiguration.firstName.enabled Boolean Available since 1.4.0

Determines if the firstName field will be included on the registration form.

applications[x].registrationConfiguration.firstName.required Boolean Available since 1.4.0

Determines if the firstName field is required when displayed on the registration form.

applications[x].registrationConfiguration.formId UUID Available since 1.18.0

The Id of an associated Form when using advanced registration configuration type.

applications[x].registrationConfiguration.fullName.enabled Boolean Available since 1.4.0

Determines if the fullName field will be included on the registration form.

applications[x].registrationConfiguration.fullName.required Boolean Available since 1.4.0

Determines if the fullName field is required when displayed on the registration form.

applications[x].registrationConfiguration.lastName.enabled Boolean Available since 1.4.0

Determines if the lastName field will be included on the registration form.

applications[x].registrationConfiguration.lastName.required Boolean Available since 1.4.0

Determines if the lastName field is required when displayed on the registration form.

applications[x].registrationConfiguration.loginIdType String Available since 1.4.0

The unique login Id that will be collected during registration. A value of email or phoneNumber is preferred because an email or phone number is unique. The possible values are:

email
phoneNumber Available since 1.59.0
username

applications[x].registrationConfiguration.middleName.enabled Boolean Available since 1.4.0

Determines if the middleName field will be included on the registration form.

applications[x].registrationConfiguration.middleName.required Boolean Available since 1.4.0

Determines if the middleName field is required when displayed on the registration form.

applications[x].registrationConfiguration.mobilePhone.enabled Boolean Available since 1.4.0

Determines if the mobilePhone field will be included on the registration form.

applications[x].registrationConfiguration.mobilePhone.required Boolean Available since 1.4.0

Determines if the mobilePhone field is required when displayed on the registration form.

applications[x].registrationConfiguration.preferredLanguages.enabled Boolean Available since 1.47.0

Determines if the preferredLanguages field will be included on the registration form.

applications[x].registrationConfiguration.preferredLanguages.required Boolean Available since 1.47.0

Determines if the preferredLanguages field is required when displayed on the registration form.

applications[x].registrationConfiguration.type String Available since 1.18.0

The type of registration flow.

Supported values include:

basic - the basic self registration options available prior to version 1.18.0.
advanced - advanced usage of custom forms, requires a paid plan.

applications[x].registrationDeletePolicy.unverified.enabled Boolean Available since 1.13.0

Indicates that users without a verified registration for this application will have their registration permanently deleted after applications[x].registrationDeletePolicy.unverified.numberOfDaysToRetain days.

applications[x].registrationDeletePolicy.unverified.enabledInstant Long Available since 1.48.0

The instant that this policy was enabled.

Please note that prior to version 1.48.0, when enabling this policy all unverified user registrations are eligible for deletion.

applications[x].registrationDeletePolicy.unverified.numberOfDaysToRetain Integer Available since 1.13.0

The number of days from registration a user's registration will be retained before being deleted for not completing registration verification. Value must be greater than 0.

applications[x].roles Array

An array of Role objects.

applications[x].roles[x].description String

A description of the role.

applications[x].roles[x].id UUID

The Id of the Role.

applications[x].roles[x].name String

The name of the Role.

applications[x].roles[x].isDefault Boolean

Whether or not the Role is a default role. A default role is automatically assigned to a user during registration if no roles are provided.

applications[x].roles[x].isSuperRole Boolean

applications[x].samlv2Configuration.assertionEncryptionConfiguration.digestAlgorithm String Available since 1.47.0

The message digest algorithm to use when encrypting the symmetric key for transport. The possible values are:

SHA1 - SHA-1 hashing algorithm
SHA256 - SHA-256 hashing algorithm
SHA384 - SHA-384 hashing algorithm
SHA512 - SHA-512 hashing algorithm

applications[x].samlv2Configuration.assertionEncryptionConfiguration.enabled Boolean Available since 1.47.0

Whether or SAML assertion encryption is enabled for this Application.

applications[x].samlv2Configuration.assertionEncryptionConfiguration.encryptionAlgorithm String Available since 1.47.0

AES128 - AES in CBC mode with a 128-bit key
AES192 - AES in CBC mode with a 192-bit key
AES256 - AES in CBC mode with a 256-bit key
AES128GCM - AES using GCM with a 128-bit key
AES192GCM - AES using GCM with a 192-bit key
AES256GCM - AES using GCM with a 256-bit key
TripleDES - Triple DES with a 192-bit key

applications[x].samlv2Configuration.assertionEncryptionConfiguration.keyLocation String Available since 1.47.0

Child - The EncryptedKey element will be wrapped in a KeyInfo element and added inside the EncryptedData
Sibling - The EncryptedKey element will be added to the document as a sibling of EncryptedData

applications[x].samlv2Configuration.assertionEncryptionConfiguration.keyTransportAlgorithm String Available since 1.47.0

The encryption algorithm used to encrypt the symmetric key for transport in the SAML response. The possible values are:

RSAv15 - RSA version 1.5
RSA_OAEP - RSA encryption with Optimal Asymmetric Encryption Padding using the mask generation function and hash specified by application.samlv2Configuration.assertionEncryptionConfiguration.maskGenerationFunction
RSA_OAEP_MGF1P - RSA encryption with Optimal Asymmetric Encryption Padding using the MGF1 mask generation function and SHA-1 hash

applications[x].samlv2Configuration.assertionEncryptionConfiguration.keyTransportEncryptionKeyId UUID Available since 1.47.0

The unique Id of the Key used to encrypt the symmetric key for transport in the SAML response.

applications[x].samlv2Configuration.assertionEncryptionConfiguration.maskGenerationFunction String Available since 1.47.0

The mask generation function and hash function to use for the Optimal Asymmetric Encryption Padding when encrypting a symmetric key for transport. The possible values are:

MGF1_SHA1 - MGF1 mask generation function with SHA-1 hash
MGF1_SHA224 - MGF1 mask generation function with SHA-224 hash
MGF1_SHA256 - MGF1 mask generation function with SHA-256 hash
MGF1_SHA384 - MGF1 mask generation function with SHA-384 hash
MGF1_SHA512 - MGF1 mask generation function with SHA-512 hash

applications[x].samlv2Configuration.audience String Available since 1.6.0

applications[x].samlv2Configuration.authorizedRedirectURLs Array<String> Available since 1.20.0

applications[x].samlv2Configuration.callbackURL String Available since 1.6.0DEPRECATED

The URL of the callback (sometimes called the Assertion Consumer Service or ACS). This is where FusionAuth sends the browser after the user logs in via SAML.

This field is preserved for backwards compatibility and may be removed in a future release. This is the first value found in the authorizedRedirectURLs parameter.

applications[x].samlv2Configuration.debug Boolean Available since 1.6.0

Whether or not FusionAuth will log SAML debug messages to the event log. This is useful for debugging purposes.

applications[x].samlv2Configuration.defaultVerificationKeyId UUID Available since 1.20.0DEPRECATED

The verification key used to verify a signature when the SAML v2 Service Provider is using HTTP Redirect Bindings OR HTTP POST Bindings.

If a [KeyInfo] element is found, Key Master will be used to resolve the key but the key must still match this value.

Deprecated since 1.69.0

applications[x].samlv2Configuration.enabled Boolean Available since 1.6.0

Whether or not the SAML IdP for this Application is enabled or not.

applications[x].samlv2Configuration.initiatedLogin.enabled Boolean Available since 1.41.0

Determines if SAML v2 IdP initiated login is enabled for this application.

applications[x].samlv2Configuration.initiatedLogin.nameIdFormat String Available since 1.41.0

The value sent in the AuthN response to the SAML v2 Service Provider in the NameID assertion.

applications[x].samlv2Configuration.issuer String Available since 1.6.0

The issuer that identifies the service provider and allows FusionAuth to load the correct Application and SAML configuration.

applications[x].samlv2Configuration.keyId UUID Available since 1.6.0

The unique Id of the Key used to sign the SAML response.

applications[x].samlv2Configuration.loginHintConfiguration.enabled Boolean Available since 1.47.0

Determines if support for a login hint sent by a SAML service provider is enabled for this application.

applications[x].samlv2Configuration.loginHintConfiguration.parameterName String Available since 1.47.0

applications[x].samlv2Configuration.logout.behavior String Available since 1.25.0

The possible values are:

AllParticipants - each session participant that has enabled single logout will be sent a Logout Request
OnlyOriginator - no other session participants will be notified when a logout request is sent for this application

This configuration is functionally equivalent to the Logout Behavior found in the OAuth2 configuration.

applications[x].samlv2Configuration.logout.defaultVerificationKeyId UUID Available since 1.25.0DEPRECATED

The verification key used to verify a signature when the SAML v2 Service Provider is using HTTP Redirect Bindings OR HTTP POST Bindings.

If a [KeyInfo] element is found, Key Master will be used to resolve the key but the key must still match this value.

Deprecated since 1.69.0

applications[x].samlv2Configuration.logout.keyId UUID Available since 1.25.0

The unique Id of the Key used to sign the SAML Logout response.

applications[x].samlv2Configuration.logout.requireSignedRequests Boolean Available since 1.25.0

When this value is true all Logout requests missing a signature will be rejected.

applications[x].samlv2Configuration.logout.singleLogout.enabled Boolean Available since 1.25.0

Whether or not SAML Single Logout for this SAML IdP is enabled.

applications[x].samlv2Configuration.logout.singleLogout.keyId UUID Available since 1.25.0

The unique Id of the Key used to sign the SAML Single Logout response.

applications[x].samlv2Configuration.logout.singleLogout.url String Available since 1.25.0

The URL at which you want to receive the LogoutRequest from FusionAuth.

applications[x].samlv2Configuration.logout.singleLogout.xmlSignatureC14nMethod String Available since 1.25.0

The XML signature canonicalization method used when digesting and signing the Single Logout response.

The possible values are:

exclusive: The URI for this method is http://www.w3.org/2001/10/xml-exc-c14n#
exclusive_with_comments: The URI for this method is http://www.w3.org/2001/10/xml-exc-c14n#WithComments
inclusive: The URI for this method is http://www.w3.org/TR/2001/REC-xml-c14n-20010315
inclusive_with_comments: The URI for this method is http://www.w3.org/TR/2001/REC-xml-c14n-20010315#WithComments

applications[x].samlv2Configuration.logout.xmlSignatureC14nMethod String Available since 1.25.0

The XML signature canonicalization method used when digesting and signing the Logout response.

The possible values are:

exclusive: The URI for this method is http://www.w3.org/2001/10/xml-exc-c14n#
exclusive_with_comments: The URI for this method is http://www.w3.org/2001/10/xml-exc-c14n#WithComments
inclusive: The URI for this method is http://www.w3.org/TR/2001/REC-xml-c14n-20010315
inclusive_with_comments: The URI for this method is http://www.w3.org/TR/2001/REC-xml-c14n-20010315#WithComments

applications[x].samlv2Configuration.logout.verificationKeyIds Array<UUID> Available since 1.69.0

The verification keys used to verify a signature when the SAML v2 Service Provider is using HTTP Redirect Bindings OR HTTP POST Bindings.

If a [KeyInfo] element is found, Key Master will be used to resolve the key but the key must still be included in this list.

applications[x].samlv2Configuration.logoutURL String Available since 1.6.0

The URL that the browser is taken to after the user logs out of the SAML service provider.

applications[x].samlv2Configuration.requireSignedRequests Boolean Available since 1.20.0

When this value is true all requests missing a signature will be rejected.

applications[x].samlv2Configuration.verificationKeyIds Array<UUID> Available since 1.69.0

The verification keys used to verify a signature when the SAML v2 Service Provider is using HTTP Redirect Bindings OR HTTP POST Bindings.

If a [KeyInfo] element is found, Key Master will be used to resolve the key but the key must still be included in this list.

applications[x].samlv2Configuration.xmlSignatureC14nMethod String Available since 1.6.0

The XML signature canonicalization method used when digesting and signing the SAML response.

The possible values are:

exclusive: The URI for this method is http://www.w3.org/2001/10/xml-exc-c14n#
exclusive_with_comments: The URI for this method is http://www.w3.org/2001/10/xml-exc-c14n#WithComments
inclusive: The URI for this method is http://www.w3.org/TR/2001/REC-xml-c14n-20010315
inclusive_with_comments: The URI for this method is http://www.w3.org/TR/2001/REC-xml-c14n-20010315#WithComments

applications[x].samlv2Configuration.xmlSignatureLocation String Available since 1.21.0

The location to place the XML signature when signing the SAML response.

The possible values are:

Assertion - The XML signature will be added as a child element of the Assertion.
Response - The XML signature will be added as a child element of the Response.

applications[x].scopes Array Available since 1.50.0

An array of OAuth Scope objects.

applications[x].scopes[x].defaultConsentDetail String Available since 1.50.0

The default detail to display on the OAuth consent screen if one cannot be found in the theme.

applications[x].scopes[x].defaultConsentMessage String Available since 1.50.0

The default message to display on the OAuth consent screen if one cannot be found in the theme.

applications[x].scopes[x].description String Available since 1.50.0

A description of the OAuth Scope for internal use.

applications[x].scopes[x].id UUID Available since 1.50.0

The Id of the OAuth Scope.

applications[x].scopes[x].insertInstant Long Available since 1.50.0

The instant that the OAuth Scope was added to the FusionAuth database.

applications[x].scopes[x].lastUpdateInstant Long Available since 1.50.0

The instant that the OAuth Scope was last updated in the FusionAuth database.

applications[x].scopes[x].name String Available since 1.50.0

The name of the OAuth Scope. This is the value that will be used to request the scope in OAuth workflows.

applications[x].scopes[x].required Boolean Available since 1.50.0

Determines if the OAuth Scope is required when requested in an OAuth workflow.

applications[x].state String Available since 1.22.0

The current state of the application. The following are valid values:

Active - The Application is active.
Inactive - The Application is not active. An Application can not be modified or authenticated against when inactive.

applications[x].tenantId UUID

The unique Id of the Tenant.

applications[x].themeId UUID Available since 1.27.0

The unique Id of the theme to be used to style the login page and other end user templates.

applications[x].universalConfiguration.universal Boolean optional Available since 1.58.0

Indicates if this application is a universal application.

applications[x].verificationEmailTemplateId UUID

The Id of the Email Template that is used to send the Registration Verification emails to users.

applications[x].verifyRegistration Boolean

Whether or not registrations to this Application may be verified.

applications[x].webAuthnConfiguration.bootstrapWorkflow.enabled Boolean Available since 1.41.0

Whether the WebAuthn bootstrap workflow is enabled for this application. This overrides the tenant configuration. Has no effect if applications[x].webAuthnConfiguration.enabled is false.

applications[x].webAuthnConfiguration.enabled Boolean Available since 1.41.0

applications[x].webAuthnConfiguration.reauthenticationWorkflow.enabled Boolean Available since 1.41.0

Whether the WebAuthn reauthentication workflow is enabled for this application. This overrides the tenant configuration. Has no effect if applications[x].webAuthnConfiguration.enabled is false.

Example Response JSON for all the Applications

{
  "applications": [
    {
      "id": "8174f72f-5ecd-4eae-8de8-7fef597b3473",
      "accessControlConfiguration": {
        "uiIPAccessControlListId": "11d49de7-69f6-46fc-8270-0b3aa626327a"
      },
      "active": true,
      "baseURL": "https://example.com",
      "cleanSpeakConfiguration": {
        "applicationIds": [
          "6b4253e0-cee0-47dd-973a-a27b9e23987c",
          "76a556ec-4ba8-4140-9085-555ee9a8bb1a"
        ],
        "enabled": true,
        "usernameModeration": {
          "applicationId": "2338dc41-bed0-4cdb-8251-ac68701e9bc7",
          "enabled": true
        }
      },
      "data": {
        "externalApplication": "Acme. Customer Support Forum",
        "productOwner": "john@acme.com"
      },
      "emailConfiguration": {
        "emailUpdateEmailTemplateId": "ec3045c7-97d8-47f8-8725-61b93deacf5d",
        "emailVerificationEmailTemplateId": "e6c74b53-d43d-471e-ae7e-906456d0f341",
        "emailVerifiedEmailTemplateId": "1c3045c7-97d8-47f8-8725-61b93deacf5d",
        "forgotPasswordEmailTemplateId": "162b3719-3d71-4638-b9bf-f3e2093f7fe1",
        "loginIdInUseOnCreateEmailTemplateId": "1c3045c7-97d8-47f8-8725-61b93deacf5d",
        "loginIdInUseOnUpdateEmailTemplateId": "2c3045c7-97d8-47f8-8725-61b93deacf5d",
        "loginNewDeviceEmailTemplateId": "3c3045c7-97d8-47f8-8725-61b93deacf5d",
        "loginSuspiciousEmailTemplateId": "4c3045c7-97d8-47f8-8725-61b93deacf5d",
        "passwordlessEmailTemplateId": "162b3719-3d71-4638-b9bf-f3e2093f7fe1",
        "passwordResetSuccessEmailTemplateId": "5c3045c7-97d8-47f8-8725-61b93deacf5d",
        "passwordUpdateEmailTemplateId": "6c3045c7-97d8-47f8-8725-61b93deacf5d",
        "setPasswordEmailTemplateId": "e160cc59-a73e-4d95-8287-f82e5c541a5c",
        "twoFactorMethodAddEmailTemplateId": "7c3045c7-97d8-47f8-8725-61b93deacf5d",
        "twoFactorMethodRemoveEmailTemplateId": "8c3045c7-97d8-47f8-8725-61b93deacf5d"
      },
      "formConfiguration": {
        "adminRegistrationFormId": "e37dff97-9a94-48af-a0a6-c0bdfdd62c48"
      },
      "insertInstant": 1595361142909,
      "jwtConfiguration": {
        "accessTokenKeyId": "025233ca-d4f3-2aa4-eca9-7e4200e9b472",
        "accessTokenVerificationKeyIds": [
          "f8c3de3d-1fea-4d7c-a8b0-29f63c4c3454"
        ],
        "enabled": true,
        "idTokenKeyId": "092dbedc-30af-4149-9c61-b578f2c72f59",
        "idTokenVerificationKeyIds": [
          "ce05a618-25fb-40a9-949c-f8029f8bf858"
        ],
        "refreshTokenTimeToLiveInMinutes": 43200,
        "timeToLiveInSeconds": 3600
      },
      "lambdaConfiguration": {
        "accessTokenPopulateId": "cbb303a4-0968-479c-ad62-de46b3fad130",
        "idTokenPopulateId": "9987eec8-af37-4339-a969-bb462ff8b491",
        "samlv2PopulateId": "0e58eb2b-b39e-41ad-bc06-52cd189b5908",
        "userinfoPopulateId": "faaa713c-befd-43ee-9387-907828f80882"
      },
      "lastUpdateInstant": 1595361143101,
      "multiFactorConfiguration": {
        "email": {
          "templateId": "859f394b-22a6-4fa6-ba55-de700df9e950"
        },
        "loginPolicy": "Required",
        "sms": {
          "templateId": "17760f96-dca7-448b-9a8f-c49016aa7210"
        },
        "trustPolicy": "Any"
      },
      "name": "Forum",
      "loginConfiguration": {
        "allowTokenRefresh": false,
        "generateRefreshTokens": false,
        "requireAuthentication": true
      },
      "oauthConfiguration": {
        "authorizedOriginURLs": [
          "http://www.example.com"
        ],
        "authorizedRedirectURLs": [
          "http://www.example.com/oauth-callback"
        ],
        "authorizedURLValidationPolicy": "ExactMatch",
        "clientAuthenticationPolicy": "Required",
        "clientId": "8174f72f-5ecd-4eae-8de8-7fef597b3473",
        "clientSecret": "+fcXet9Iu2kQi61yWD9Tu4ReZ113P6yEAkr32v6WKOQ=",
        "consentMode": "AlwaysPrompt",
        "debug": false,
        "enabledGrants": [
          "authorization_code",
          "refresh_token"
        ],
        "generateRefreshTokens": true,
        "logoutBehavior": "AllApplications",
        "logoutURL": "http://www.example.com/logout",
        "proofKeyForCodeExchangePolicy": "NotRequired",
        "providedScopePolicy": {
          "address": {
            "enabled": true,
            "required": false
          },
          "email": {
            "enabled": true,
            "required": false
          },
          "phone": {
            "enabled": true,
            "required": false
          },
          "profile": {
            "enabled": true,
            "required": false
          }
        },
        "relationship": "FirstParty",
        "requireClientAuthentication": true,
        "requireRegistration": false,
        "scopeHandlingPolicy": "Compatibility",
        "unknownScopePolicy": "Reject"
      },
      "passwordlessConfiguration": {
        "enabled": false,
        "emailLoginStrategy": "ClickableLink",
        "phoneLoginStrategy": "FormField"
      },
      "phoneConfiguration": {
        "forgotPasswordTemplateId": "f90c8a8f-db77-4f2f-a3dd-5f692faf5d55",
        "identityUpdateTemplateId": "77df7e94-2dbf-44ab-b58c-06ac4224c449",
        "loginIdInUseOnCreateTemplateId": "7880dac6-809b-489e-8a69-363b043dd0f4",
        "loginIdInUseOnUpdateTemplateId": "de14b495-a358-4941-bb6b-0ddce04370ef",
        "loginNewDeviceTemplateId": "d77ac611-ddff-4a06-903c-fafe5c1f9f7a",
        "loginSuspiciousTemplateId": "73a8408a-e857-4ce2-82bb-d15b94d7c709",
        "passwordResetSuccessTemplateId": "6a0f3a7a-3511-4936-a546-3bd8f68dbdd3",
        "passwordUpdateTemplateId": "3ca81208-5678-434f-92b8-7fcc3b62bc7a",
        "passwordlessTemplateId": "e8449783-60a7-483f-8c66-bcdf0d05705f",
        "setPasswordTemplateId": "a6655c95-d94c-4dea-8191-0190f562bc39",
        "twoFactorMethodAddTemplateId": "c450521d-7f39-4a21-ba02-ced83225efcc",
        "twoFactorMethodRemoveTemplateId": "fba4fe64-3a29-45f8-895f-520d73d93659",
        "verificationCompleteTemplateId": "7b6b80bd-e3a5-42ff-b333-93ef37c192df",
        "verificationTemplateId": "c96ed02d-fbc6-4b27-9e74-54444747d18a"
      },
      "registrationConfiguration": {
        "enabled": false,
        "type": "basic"
      },
      "registrationDeletePolicy": {
        "unverified": {
          "enabled": true,
          "enabledInstant": 1698772159415,
          "numberOfDaysToRetain": 30
        }
      },
      "roles": [
        {
          "description": "Administrators that have access to everything",
          "id": "ce485a91-906f-4615-af75-81d37dc71e90",
          "name": "admin",
          "isDefault": false
        },
        {
          "description": "Normal users that have access to nothing",
          "id": "ce485a91-906f-4615-af75-81d37dc71e91",
          "name": "user",
          "isDefault": true
        }
      ],
      "samlv2Configuration": {
        "audience": "example.com",
        "authorizedRedirectURLs": [
          "https://www.example.com/samlv2/acs"
        ],
        "callbackURL": "https://www.example.com/samlv2/acs",
        "debug": false,
        "defaultVerificationKeyId": "be980e51-c94c-49f9-bfb5-90571c34a791",
        "enabled": true,
        "initiatedLogin": {
          "enabled": false,
          "nameIdFormat": "urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"
        },
        "issuer": "example.com",
        "keyId": "0a52ace4-3016-47da-906a-f7d272fbdaed",
        "loginHintConfiguration": {
          "enabled": true,
          "parameterName": "login_hint"
        },
        "logout": {
          "behavior": "OnlyOriginator",
          "defaultVerificationKeyId": "0a52ace4-3016-47da-906a-f7d272fbdaed",
          "keyId": "0a52ace4-3016-47da-906a-f7d272fbdaed",
          "requireSignedRequests": true,
          "singleLogout": {
            "enabled": true,
            "keyId": "0a52ace4-3016-47da-906a-f7d272fbdaed",
            "url": "https://www.example.com/logout",
            "xmlSignatureC14nMethod": "exclusive_with_comments"
          },
          "xmlSignatureC14nMethod": "exclusive_with_comments",
          "verificationKeyIds": [
            "0a52ace4-3016-47da-906a-f7d272fbdaed",
            "fa21f572-40f5-4484-9393-4d9d7aa0a4bd"
          ]
        },
        "logoutURL": "https://www.example.com/logout",
        "requireSignedRequests": true,
        "verificationKeyIds": [
          "be980e51-c94c-49f9-bfb5-90571c34a791",
          "f2f9f93e-8af0-4728-9ebf-5e3261694f3f"
        ],
        "xmlSignatureC14nMethod": "exclusive_with_comments",
        "xmlSignatureLocation": "Assertion"
      },
      "scopes": [
        {
          "defaultConsentDetail": "Your calendar data will be used to provide you enhanced reminders",
          "defaultConsentMessage": "Read your calendar",
          "id": "b1e5afb2-e18f-4174-82c2-1fa7975ac598",
          "name": "calendar:read",
          "required": true
        },
        {
          "defaultConsentDetail": "Create new events to remind you of upcoming discussions",
          "defaultConsentMessage": "Write your calendar",
          "id": "a9ae0a21-be87-4f04-850d-20a75020448b",
          "name": "calendar:write",
          "required": false
        }
      ],
      "state": "Active",
      "tenantId": "50435e55-6e95-4d54-96d0-9c953dd53eeb",
      "universalConfiguration": {
        "universal": false
      },
      "verifyRegistration": false,
      "webAuthnConfiguration": {
        "bootstrapWorkflow": {
          "enabled": false
        },
        "enabled": false,
        "reauthenticationWorkflow": {
          "enabled": false
        }
      }
    }
  ]
}