1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
|
---
stage: Software Supply Chain Security
group: Authentication
info: To determine the technical writer assigned to the Stage/Group associated with this page, see https://handbook.gitlab.com/handbook/product/ux/technical-writing/#assignments
---
# Applications API
DETAILS:
**Tier:** Free, Premium, Ultimate
**Offering:** GitLab.com, Self-managed, GitLab Dedicated
The Applications API operates on instance-wide OAuth applications for:
- [Using GitLab as an authentication provider](../integration/oauth_provider.md).
- [Allowing access to GitLab resources on a user's behalf](oauth2.md).
The Applications API cannot be used to manage group applications or applications of individual users.
NOTE:
Only administrator users can use the Applications API.
## Create an application
Create an application by posting a JSON payload.
Returns `200` if the request succeeds.
```plaintext
POST /applications
```
Supported attributes:
| Attribute | Type | Required | Description |
|:---------------|:--------|:---------|:---------------------------------|
| `name` | string | yes | Name of the application. |
| `redirect_uri` | string | yes | Redirect URI of the application. |
| `scopes` | string | yes | Scopes of the application. You can specify multiple scopes by separating each scope using a space. |
| `confidential` | boolean | no | The application is used where the client secret can be kept confidential. Native mobile apps and Single Page Apps are considered non-confidential. Defaults to `true` if not supplied |
Example request:
```shell
curl --request POST --header "PRIVATE-TOKEN: <your_access_token>" \
--data "name=MyApplication&redirect_uri=http://redirect.uri&scopes=api read_user email" \
"https://gitlab.example.com/api/v4/applications"
```
Example response:
```json
{
"id":1,
"application_id": "5832fc6e14300a0d962240a8144466eef4ee93ef0d218477e55f11cf12fc3737",
"application_name": "MyApplication",
"secret": "ee1dd64b6adc89cf7e2c23099301ccc2c61b441064e9324d963c46902a85ec34",
"callback_url": "http://redirect.uri",
"confidential": true
}
```
## List all applications
List all registered applications.
```plaintext
GET /applications
```
Example request:
```shell
curl --header "PRIVATE-TOKEN: <your_access_token>" "https://gitlab.example.com/api/v4/applications"
```
Example response:
```json
[
{
"id":1,
"application_id": "5832fc6e14300a0d962240a8144466eef4ee93ef0d218477e55f11cf12fc3737",
"application_name": "MyApplication",
"callback_url": "http://redirect.uri",
"confidential": true
}
]
```
NOTE:
The `secret` value is not exposed by this API.
## Delete an application
Delete a specific application.
Returns `204` if the request succeeds.
```plaintext
DELETE /applications/:id
```
Supported attributes:
| Attribute | Type | Required | Description |
|:----------|:--------|:---------|:----------------------------------------------------|
| `id` | integer | yes | The ID of the application (not the `application_id`). |
Example request:
```shell
curl --request DELETE --header "PRIVATE-TOKEN: <your_access_token>" "https://gitlab.example.com/api/v4/applications/:id"
```
## Renew an application secret
> - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/422420) in GitLab 16.11.
Renews an application secret. Returns `200` if the request succeeds.
```plaintext
POST /applications/:id/renew-secret
```
Supported attributes:
| Attribute | Type | Required | Description |
|:----------|:--------|:---------|:----------------------------------------------------|
| `id` | integer | yes | The ID of the application (not the `application_id`). |
Example request:
```shell
curl --request POST --header "PRIVATE-TOKEN: <your_access_token>" "https://gitlab.example.com/api/v4/applications/:id/renew-secret"
```
Example response:
```json
{
"id":1,
"application_id": "5832fc6e14300a0d962240a8144466eef4ee93ef0d218477e55f11cf12fc3737",
"application_name": "MyApplication",
"secret": "ee1dd64b6adc89cf7e2c23099301ccc2c61b441064e9324d963c46902a85ec34",
"callback_url": "http://redirect.uri",
"confidential": true
}
```
|
