# Retrieve a application (/docs/apis/management/clients/FindApplicationById)

`GET /applications/{client_id}`

Retrieves detailed information for the specified application.

Base URL: `https://{tenant}.{region}.monocloud.com/api`, where `{tenant}`, `{region}` (one of us, eu, in) come from your tenant. Authentication: send your Management API key in the `X-API-KEY` header.

## Parameters

- `client_id` (path) (string, required) The unique identifier of the application.

## Response body

`200`, JSON. The application was retrieved successfully

Returns `Application`.

- `id` (string, required) The unique identifier of the client.
- `enabled` (boolean, required) Indicates whether the client is enabled.
- `app_type` (string, required) Preferred application type for the client. One of: `custom`, `spa`, `web_app`, `native`, `m2m`, `device`.
- `tech_type` (string, required) Preferred technology stack for the client. One of: `unknown`, `react`, `react_native`, `angular`, `vue`, `next_js`, `node_js`, `dotnet`, `spring_boot`, `javascript`, `laravel`, `django`, `rails`, `go`, `android`, `kotlin`, `swift`, `flutter`, `expo`, `device`, `mtls`, `svelte`, `aws_lambda`, `curl`, `ios`, `fastify`, `express_js`, `espressif`, `arduino`, `astro`.
- `require_client_secret` (boolean, required) Requires confidential clients to present a client secret when requesting tokens. Only disable for public clients (e.g., SPA / mobile).
- `client_name` (string, required) Human-readable name for the client application, displayed to users on the login and consent screens.
- `description` (string) Description that explains the purpose of the client application.
- `client_uri` (string) Public URL that provides additional information about the client application.
- `logo_uri` (string) URL of the client application logo, displayed on the consent screen to help users identify the application.
- `enable_consent` (boolean, required) Indicates whether the consents are enabled for the client. Secure+ subscription required to use consents.
- `require_consent` (boolean, required) Controls whether users are prompted to review and approve requested permissions. Secure+ subscription required to use consents.
- `always_require_consent_for_offline_access` (boolean, required) Always prompts users for consent when requesting offline (refresh token) access. This setting applies even if the user previously chose to remember their consent. Secure+ subscription required to use consents.
- `remember_consent` (string, required) Controls how consent decisions are remembered for future sign-ins. One of: `never`, `always`, `user_selected`.
- `show_consent_scope_selection` (boolean, required) Allows end users to choose which requested scopes to grant on the consent screen. Secure+ subscription required to use consents.
- `always_include_user_claims_in_id_token` (boolean, required) Always embeds user claims in the ID token instead of requiring calls to the `UserInfo` endpoint. Enabling this increases the ID token size and may expose more user data to applications than necessary.
- `allowed_grant_types` (string[], required) Defines which OAuth / OIDC grant types this client is permitted to use. Only valid and secure grant combinations are supported. One of: `implicit`, `hybrid`, `authorization_code`, `client_credentials`, `resource_owner_password`, `device_code`.
- `require_pkce` (boolean, required) Requires Proof Key for Code Exchange (PKCE) for authorization code flows. Strongly recommended for public clients such as SPAs and mobile applications.
- `allow_plain_text_pkce` (boolean, required) Allows Proof Key for Code Exchange (PKCE) verification using the plain (unhashed) method. Use only for legacy compatibility — strongly discouraged for production.
- `require_request_object` (boolean, required) Requires authorization requests to be sent as signed JWT request objects (JAR). Secure+ subscription required to use JWT request objects (JAR).
- `require_pushed_authorization_requests` (boolean, required) Requires clients to use Pushed Authorization Requests (PAR) instead of sending parameters directly to the authorization endpoint. Secure+ subscription required to use Pushed Authorization Requests (PAR).
- `allow_any_pushed_authorization_redirect_uri` (boolean, required) Allows the client to use any redirect URI when using Pushed Authorization Requests (PAR), instead of being limited to the configured redirect URI list. Secure+ subscription required to use Pushed Authorization Requests (PAR).
- `authorization_request_lifetime` (integer, required, int32) Lifetime of the authorization request (in seconds). Controls how long the request data is considered valid during the authorization flow.
- `allow_access_tokens_via_browser` (boolean, required) Controls whether access tokens may be transmitted via the browser for this client. Enable only when absolutely necessary. Returning access tokens to the browser increases the risk of leakage through logs, plugins, redirects, or malicious scripts. Recommended to keep disabled and prefer the Authorization Code + PKCE flow.
- `redirect_uris` (string[], required) List of approved redirect URIs where authorization codes or tokens may be sent. Only exact, fully-qualified matches are allowed.
- `post_logout_redirect_uris` (string[], required) List of approved URIs users can be redirected to after a successful logout. Only exact, fully-qualified matches are allowed.
- `front_channel_logout_uri` (string) Browser-based (front-channel) endpoint on the client that receives user logout notifications from MonoCloud. Pro plan subscription required to use front-channel logout.
- `front_channel_logout_session_required` (boolean, required) Indicates whether the user’s session identifier should be included when invoking the front-channel logout URI. Pro plan subscription required to use front-channel logout.
- `back_channel_logout_uri` (string) Server-side (back-channel) endpoint that MonoCloud calls to notify the application of a user logout. Secure+ subscription required to use back-channel logout.
- `back_channel_logout_session_required` (boolean, required) Indicates whether the user’s session identifier should be included when invoking the back-channel logout URI. Secure+ subscription required to use back-channel logout.
- `bind_refresh_tokens_to_session` (boolean, required) Binds refresh tokens issued for the client to the user's session. When enabled, refresh tokens are automatically revoked when the user signs out or the session expires. ScaleX subscription required to use session binding.
- `allow_offline_access` (boolean, required) Allows the client to obtain refresh tokens using the `offline_access` scope. Use only for trusted applications that can securely store long-lived tokens.
- `allowed_identity_scopes` (string[], required) Defines the approved identity scopes that this client is authorized to request.
- `identity_token_lifetime` (integer, required, int32) Specifies how long an ID token remains valid (in seconds).
- `access_token_lifetime` (integer, required, int32) Specifies how long access tokens issued without API resource scopes remain valid (in seconds). These tokens may only be used with the UserInfo endpoint.
- `authorization_code_lifetime` (integer, required, int32) Specifies how long an authorization code remains valid (in seconds).
- `consent_lifetime` (integer, required, int32) Specifies the validity period for stored user consent (in seconds). Set to `0` to allow consent to remain valid indefinitely. Secure+ subscription required to use consents.
- `absolute_refresh_token_lifetime` (integer, required, int32) Specifies the maximum lifetime of a refresh token (in seconds), regardless of how often it is used. ScaleX subscription required to configure refresh token lifetimes longer than a month.
- `sliding_refresh_token_lifetime` (integer, required, int32) Defines the sliding expiration window for refresh tokens (in seconds). Token expiry is extended on each valid refresh, subject to the absolute refresh token lifetime.
- `refresh_token_usage` (string, required) Controls whether refresh tokens are single-use (rotated) or reusable. One of: `reuse`, `one_time_only`.
- `update_access_token_claims_on_refresh` (boolean, required) Controls whether access token claims are recalculated and reissued when refreshing a token.
- `emit_offline_access_scope_in_access_token` (boolean, required) Includes the `offline_access` scope in issued access tokens when requested by the client.
- `refresh_token_expiration` (string, required) Controls whether refresh tokens expire at a fixed time or are extended with continued use. One of: `sliding`, `absolute`.
- `access_token_type` (string, required) Specifies whether access tokens issued without API resource scopes are issued as self-contained JWTs or opaque reference tokens. These tokens may only be used with the UserInfo endpoint. One of: `jwt`, `reference`.
- `authenticator_restrictions` (string[], required) Defines the authenticators users may use to sign in with this client. Leave empty to inherit the global authenticator policy. Pro plan subscription required to enable authenticator restrictions.
- `claims` (Record<string, any>, required) Defines custom claims issued to this client and embedded into access tokens for downstream APIs and resources.
- `always_send_client_claims` (boolean, required) Controls whether client claims are always emitted in access tokens, or only when using the client credentials flow.
- `client_claims_prefix` (string) Configures a prefix for client claims, helping avoid naming collisions across tokens and downstream APIs.
- `allowed_cors_origins` (string[], required) Configures the set of trusted origins permitted to perform cross-origin requests for this client.
- `user_sso_lifetime` (integer, required, int32) Maximum allowed SSO duration (in seconds). After this window, users must sign in again to confirm identity. Set to `0` to disable the limit.
- `device_code_length` (integer, required, int32) Specifies the length of the user verification code generated for the device flow.
- `device_code_lifetime` (integer, required, int32) Specifies the lifetime of the device authorization code (in seconds).
- `creation_time` (integer, required, date-time) Specifies the creation time of the client (in Epoch).
- `last_updated` (integer, required, date-time) Specifies the last update time of the client (in Epoch).

## Errors

- `401` Unauthorized
- `403` Forbidden
- `404` Not Found
  - `type` (string, required) A URI reference that identifies the error type. When accessed, it may provide human-readable documentation.
  - `title` (string, required) A short, human-readable summary of the error.
  - `status` (integer, required, int32) The HTTP status code associated with this error response.
  - `trace_id` (string, required) A unique identifier for the request, used for tracing and diagnostics.
  - `detail` (string) A human-readable explanation specific to this occurrence of the error.
  - `instance` (string) A URI reference that identifies the specific occurrence of the error.
- `422` Unprocessable Entity
  - `type` (string, required) A URI reference that identifies the error type. When accessed, it may provide human-readable documentation.
  - `title` (string, required) A short, human-readable summary of the error.
  - `status` (integer, required, int32) The HTTP status code associated with this error response.
  - `trace_id` (string, required) A unique identifier for the request, used for tracing and diagnostics.
  - `detail` (string) A human-readable explanation specific to this occurrence of the error.
  - `instance` (string) A URI reference that identifies the specific occurrence of the error.
  - `errors` (Record<string, string[]>, required) A key-value map of validation errors, where each key represents a request field and the value contains one or more messages describing why the request could not be processed.

## Example (MonoCloud .NET SDK)

```csharp
using MonoCloud.Management;
using MonoCloud.Management.Core.Base;

var apiClient = new MonoCloudManagementClient(new MonoCloudConfig("<your-domain>", "[[API-Key]]"));


var clientId = "eCOGRJYpnNwwAAuCeReEW";


var result = await apiClient.Clients.FindApplicationByIdAsync(clientId);
```

## Example (MonoCloud Javascript SDK)

```javascript
import { MonoCloudManagementClient } from '@monocloud/management';

const apiClient = MonoCloudManagementClient.init({ domain: '<your-domain>', apiKey: '[[API-Key]]' });

const clientId = 'eCOGRJYpnNwwAAuCeReEW';

const result = apiClient.clients.findApplicationById(clientId);
```