Update a application

PATCH

/applications/{client_id}

Applies a partial update to the specified application. Only fields included in the request are updated.

Authorization

API-Key

headerX-API-KEY<token>

MonoCloud APIs require authentication with an API key. Retrieve your key from the Tenant Settings section of the MonoCloud dashboard and include it in the request header as: X-API-Key: <your_api_key>

Path Parameters

client_id*string

The unique identifier of the application.

Request Body

application/json

The request payload used to update a application.

TypeScript Definitions

Use the request body type in TypeScript.

Patch Application Request: Used to update one or more properties of an existing client.

enabled?boolean

Indicates whether the client is enabled.

app_type?ApplicationTypes

Preferred application type for the client.

values

custom
General-purpose or custom application type
spa
Single Page Application (browser-based, running entirely in the user’s browser)
web_app
Traditional web application with a backend server
native
Native desktop or mobile application
m2m
Machine-to-machine or backend service
device
Device or console that authenticates using the device authorization flow

tech_type?TechTypes

Preferred technology stack for the client.

values

unknown
Technology not specified or unknown
react
React single-page application
react_native
React Native mobile application
angular
Angular web application
vue
Vue.js web application
next_js
Next.js full-stack application
node_js
Node.js server-side application
dotnet
.NET application
spring_boot
Spring Boot application
javascript
JavaScript application without a specific framework
laravel
Laravel (PHP) application
django
Django (Python) application
rails
Ruby on Rails application
go
Go (Golang) application
android
Native Android application
kotlin
Kotlin-based application
swift
Swift-based iOS or macOS application
flutter
Flutter cross-platform application
expo
Expo-managed React Native application
device
Device-based or embedded application
mtls
mTLS or certificate-based integration
svelte
Svelte application
aws_lambda
AWS Lambda function
curl
cURL or script-based integration
ios
iOS application
fastify
Fastify Node.js server
express_js
Express.js application
espressif
Espressif microcontroller platform
arduino
Arduino-based device
astro
Astro static / hybrid web application

require_client_secret?boolean

Requires confidential clients to present a client secret when requesting tokens.

Only disable for public clients (e.g., SPA / mobile).

client_name?string

Human-readable name for the client application, displayed to users on the login and consent screens.

Length1 <= length <= 50

description?|

Description that explains the purpose of the client application.

Lengthlength <= 200

client_uri?|

Public URL that provides additional information about the client application.

Formaturi

Lengthlength <= 400

logo_uri?|

URL of the client application logo, displayed on the consent screen to help users identify the application.

Formaturi

Lengthlength <= 400

enable_consent?boolean

Indicates whether the consents are enabled for the client.

Secure+ subscription required to use consents.

require_consent?boolean

Controls whether users are prompted to review and approve requested permissions.

Secure+ subscription required to use consents.

always_require_consent_for_offline_access?boolean

Always prompts users for consent when requesting offline (refresh token) access.

Secure+ subscription required to use consents. This setting applies even if the user previously chose to remember their consent.

remember_consent?RememberConsentTypes

Controls how consent decisions are remembered for future sign-ins.

Secure+ subscription required to use consents.

values

never
Consent is never remembered. Users are prompted every time.
always
Consent is always remembered automatically and never prompted again.
user_selected
Users may choose whether their consent decision should be remembered.

show_consent_scope_selection?boolean

Allows end users to choose which requested scopes to grant on the consent screen.

Secure+ subscription required to use consents.

always_include_user_claims_in_id_token?boolean

Always embeds user claims in the ID token instead of requiring calls to the userinfo endpoint.

Enabling this increases the ID token size and may expose more user data to applications than necessary.

allowed_grant_types?array<>

Defines which OAuth / OIDC grant types this client is permitted to use.

Only valid and secure grant combinations are supported.

Itemsitems <= 10

require_pkce?boolean

Requires Proof Key for Code Exchange (PKCE) for authorization code flows.

Strongly recommended for public clients such as SPAs and mobile applications.

allow_plain_text_pkce?boolean

Allows Proof Key for Code Exchange (PKCE) verification using the plain (unhashed) method.

Use only for legacy compatibility — strongly discouraged for production.

require_request_object?boolean

Requires authorization requests to be sent as signed JWT request objects.

Secure+ subscription required to use JWT request objects (JAR).

require_pushed_authorization_requests?boolean

Requires clients to use Pushed Authorization Requests (PAR) instead of sending parameters directly to the authorization endpoint.

Secure+ subscription required to use Pushed Authorization Requests (PAR).

allow_any_pushed_authorization_redirect_uri?boolean

Allows the client to use any redirect URI when using Pushed Authorization Requests (PAR), instead of being limited to the configured redirect URI list.

Secure+ subscription required to use Pushed Authorization Requests (PAR).

authorization_request_lifetime?integer

Lifetime of the authorization request (in seconds). Controls how long the request data is considered valid during the authorization flow.

Formatint32

Range1 <= value <= 3600

allow_access_tokens_via_browser?boolean

Controls whether access tokens may be transmitted via the browser for this client.

Enable only when absolutely necessary. Returning access tokens to the browser increases the risk of leakage through logs, plugins, redirects, or malicious scripts. Recommended to keep disabled and prefer the Authorization Code + PKCE flow.

redirect_uris?array<>

List of approved redirect URIs where authorization codes or tokens may be sent.

Only exact, fully-qualified matches are allowed.

Itemsitems <= 50

post_logout_redirect_uris?array<>

List of approved URIs users can be redirected to after a successful logout.

Only exact, fully-qualified matches are allowed.

Itemsitems <= 50

front_channel_logout_uri?|

Browser-based (front-channel) endpoint on the client that receives user logout notifications from MonoCloud.

Pro plan subscription required to use front-channel logout.

Formaturi

Lengthlength <= 400

front_channel_logout_session_required?boolean

Indicates whether the user’s session identifier should be included when invoking the front-channel logout URI.

Pro plan subscription required to use front-channel logout.

back_channel_logout_uri?|

Server-side (back-channel) endpoint that MonoCloud calls to notify the application of a user logout.

Secure+ subscription required to use back-channel logout.

Formaturi

Lengthlength <= 400

back_channel_logout_session_required?boolean

Indicates whether the user’s session identifier should be included when invoking the back-channel logout URI.

Secure+ subscription required to use back-channel logout.

bind_refresh_tokens_to_session?boolean

Binds refresh tokens issued for the client to the user's session. When enabled, refresh tokens are automatically revoked when the user signs out or the session expires.

ScaleX subscription required to use session binding.

allow_offline_access?boolean

Allows the client to obtain refresh tokens using the offline_access scope.

Use only for trusted applications that can securely store long-lived tokens.

allowed_identity_scopes?array<>

Defines the approved identity scopes that this client is authorized to request.

Itemsitems <= 50

identity_token_lifetime?integer

Specifies how long an ID token remains valid (in seconds).

Formatint32

Range5 <= value <= 2592000

access_token_lifetime?integer

Specifies how long access tokens issued without API resource scopes remain valid (in seconds). These tokens may only be used with the UserInfo endpoint.

Formatint32

Range5 <= value <= 2592000

authorization_code_lifetime?integer

Specifies how long an authorization code remains valid (in seconds).

Formatint32

Range1 <= value <= 600

consent_lifetime?integer

Specifies the validity period for stored user consent (in seconds). Set to 0 to allow consent to remain valid indefinitely.

Secure+ subscription required to use consents.

Formatint32

Range0 <= value <= 2147483647

absolute_refresh_token_lifetime?integer

Specifies the maximum lifetime of a refresh token (in seconds), regardless of how often it is used.

ScaleX subscription required to configure refresh token lifetimes longer than a month.

Formatint32

Range5 <= value <= 157788000

sliding_refresh_token_lifetime?integer

Defines the sliding expiration window for refresh tokens (in seconds). Token expiry is extended on each valid refresh, subject to the absolute refresh token lifetime.

Formatint32

Range5 <= value <= 157788000

refresh_token_usage?RefreshTokenUsageTypes

Controls whether refresh tokens are single-use (rotated) or reusable.

values

reuse
The same refresh token can be used repeatedly to obtain new tokens.
one_time_only
A new refresh token is issued on every refresh, and the previous one becomes invalid.

update_access_token_claims_on_refresh?boolean

Controls whether access token claims are recalculated and reissued when refreshing a token.

emit_offline_access_scope_in_access_token?boolean

Includes the offline_access scope in issued access tokens when requested by the client.

refresh_token_expiration?RefreshTokenExpirationTypes

Controls whether refresh tokens expire at a fixed time or are extended with continued use.

values

sliding
Refresh tokens use a sliding expiration model. Each successful refresh extends the token lifetime (up to the configured absolute refresh token lifetime).
absolute
Refresh tokens expire at a fixed point in time, based on the configured absolute refresh token lifetime — regardless of usage.

access_token_type?AccessTokenTypes

Specifies whether access tokens issued without API resource scopes are issued as self-contained JWTs or opaque reference tokens. These tokens may only be used with the UserInfo endpoint.

ScaleX subscription required to use reference tokens. Reference tokens improve revocation control and reduce exposure risk, but require token introspection by protected resources.

values

jwt
A self-contained JWT access token.
reference
An opaque reference token stored and validated server-side.

authenticator_restrictions?array<>

Defines the authenticators users may use to sign in with this client. Leave empty to inherit the global authenticator policy.

Pro plan subscription required to enable authenticator restrictions.

claims?

Defines custom claims issued to this client and embedded into access tokens for downstream APIs and resources.

always_send_client_claims?boolean

Controls whether client claims are always emitted in access tokens, or only when using the client credentials flow.

client_claims_prefix?|

Configures a prefix for client claims, helping avoid naming collisions across tokens and downstream APIs.

Match^[a-zA-Z0-9][a-zA-Z0-9_]*$

Lengthlength <= 50

allowed_cors_origins?array<>

Configures the set of trusted origins permitted to perform cross-origin requests for this client.

Itemsitems <= 50

user_sso_lifetime?integer

Maximum allowed SSO duration (in seconds). After this window, users must sign in again to confirm identity. Set to 0 to disable the limit.

Formatint32

Range0 <= value <= 31557600

device_code_length?integer

Specifies the length of the user verification code generated for the device flow.

Formatint32

Range4 <= value <= 16

device_code_lifetime?integer

Specifies the lifetime of the device authorization code (in seconds).

Formatint32

Range30 <= value <= 3600

Response Body

200

application/json

The application was updated successfully

TypeScript Definitions

Use the response body type in TypeScript.

Application: Represents an OAuth 2.0 / OIDC client application configuration.

id*string

The unique identifier of the client.

enabled*boolean

Indicates whether the client is enabled.

app_type*ApplicationTypes

Preferred application type for the client.

values

custom
General-purpose or custom application type
spa
Single Page Application (browser-based, running entirely in the user’s browser)
web_app
Traditional web application with a backend server
native
Native desktop or mobile application
m2m
Machine-to-machine or backend service
device
Device or console that authenticates using the device authorization flow

tech_type*TechTypes

Preferred technology stack for the client.

values

unknown
Technology not specified or unknown
react
React single-page application
react_native
React Native mobile application
angular
Angular web application
vue
Vue.js web application
next_js
Next.js full-stack application
node_js
Node.js server-side application
dotnet
.NET application
spring_boot
Spring Boot application
javascript
JavaScript application without a specific framework
laravel
Laravel (PHP) application
django
Django (Python) application
rails
Ruby on Rails application
go
Go (Golang) application
android
Native Android application
kotlin
Kotlin-based application
swift
Swift-based iOS or macOS application
flutter
Flutter cross-platform application
expo
Expo-managed React Native application
device
Device-based or embedded application
mtls
mTLS or certificate-based integration
svelte
Svelte application
aws_lambda
AWS Lambda function
curl
cURL or script-based integration
ios
iOS application
fastify
Fastify Node.js server
express_js
Express.js application
espressif
Espressif microcontroller platform
arduino
Arduino-based device
astro
Astro static / hybrid web application

require_client_secret*boolean

Requires confidential clients to present a client secret when requesting tokens.

Only disable for public clients (e.g., SPA / mobile).

client_name*string

Human-readable name for the client application, displayed to users on the login and consent screens.

description?|

Description that explains the purpose of the client application.

client_uri?|

Public URL that provides additional information about the client application.

logo_uri?|

URL of the client application logo, displayed on the consent screen to help users identify the application.

enable_consent*boolean

Indicates whether the consents are enabled for the client.

Secure+ subscription required to use consents.

require_consent*boolean

Controls whether users are prompted to review and approve requested permissions.

Secure+ subscription required to use consents.

always_require_consent_for_offline_access*boolean

Always prompts users for consent when requesting offline (refresh token) access.

This setting applies even if the user previously chose to remember their consent. Secure+ subscription required to use consents.

remember_consent*RememberConsentTypes

Controls how consent decisions are remembered for future sign-ins.

values

never
Consent is never remembered. Users are prompted every time.
always
Consent is always remembered automatically and never prompted again.
user_selected
Users may choose whether their consent decision should be remembered.

show_consent_scope_selection*boolean

Allows end users to choose which requested scopes to grant on the consent screen.

Secure+ subscription required to use consents.

always_include_user_claims_in_id_token*boolean

Always embeds user claims in the ID token instead of requiring calls to the UserInfo endpoint.

Enabling this increases the ID token size and may expose more user data to applications than necessary.

allowed_grant_types*array<>

Defines which OAuth / OIDC grant types this client is permitted to use.

Only valid and secure grant combinations are supported.

require_pkce*boolean

Requires Proof Key for Code Exchange (PKCE) for authorization code flows.

Strongly recommended for public clients such as SPAs and mobile applications.

allow_plain_text_pkce*boolean

Allows Proof Key for Code Exchange (PKCE) verification using the plain (unhashed) method.

Use only for legacy compatibility — strongly discouraged for production.

require_request_object*boolean

Requires authorization requests to be sent as signed JWT request objects (JAR).

Secure+ subscription required to use JWT request objects (JAR).

require_pushed_authorization_requests*boolean

Requires clients to use Pushed Authorization Requests (PAR) instead of sending parameters directly to the authorization endpoint.

Secure+ subscription required to use Pushed Authorization Requests (PAR).

allow_any_pushed_authorization_redirect_uri*boolean

Allows the client to use any redirect URI when using Pushed Authorization Requests (PAR), instead of being limited to the configured redirect URI list.

Secure+ subscription required to use Pushed Authorization Requests (PAR).

authorization_request_lifetime*integer

Lifetime of the authorization request (in seconds). Controls how long the request data is considered valid during the authorization flow.

Formatint32

allow_access_tokens_via_browser*boolean

Controls whether access tokens may be transmitted via the browser for this client.

redirect_uris*array<string>

List of approved redirect URIs where authorization codes or tokens may be sent.

Only exact, fully-qualified matches are allowed.

post_logout_redirect_uris*array<string>

List of approved URIs users can be redirected to after a successful logout.

Only exact, fully-qualified matches are allowed.

front_channel_logout_uri?|

Browser-based (front-channel) endpoint on the client that receives user logout notifications from MonoCloud.

Pro plan subscription required to use front-channel logout.

front_channel_logout_session_required*boolean

Indicates whether the user’s session identifier should be included when invoking the front-channel logout URI.

Pro plan subscription required to use front-channel logout.

back_channel_logout_uri?|

Server-side (back-channel) endpoint that MonoCloud calls to notify the application of a user logout.

Secure+ subscription required to use back-channel logout.

back_channel_logout_session_required*boolean

Indicates whether the user’s session identifier should be included when invoking the back-channel logout URI.

Secure+ subscription required to use back-channel logout.

bind_refresh_tokens_to_session*boolean

Binds refresh tokens issued for the client to the user's session. When enabled, refresh tokens are automatically revoked when the user signs out or the session expires.

ScaleX subscription required to use session binding.

allow_offline_access*boolean

Allows the client to obtain refresh tokens using the offline_access scope.

Use only for trusted applications that can securely store long-lived tokens.

allowed_identity_scopes*array<string>

Defines the approved identity scopes that this client is authorized to request.

identity_token_lifetime*integer

Specifies how long an ID token remains valid (in seconds).

Formatint32

access_token_lifetime*integer

Specifies how long access tokens issued without API resource scopes remain valid (in seconds). These tokens may only be used with the UserInfo endpoint.

Formatint32

authorization_code_lifetime*integer

Specifies how long an authorization code remains valid (in seconds).

Formatint32

consent_lifetime*integer

Specifies the validity period for stored user consent (in seconds). Set to 0 to allow consent to remain valid indefinitely.

Secure+ subscription required to use consents.

Formatint32

absolute_refresh_token_lifetime*integer

Specifies the maximum lifetime of a refresh token (in seconds), regardless of how often it is used.

ScaleX subscription required to configure refresh token lifetimes longer than a month.

Formatint32

sliding_refresh_token_lifetime*integer

Defines the sliding expiration window for refresh tokens (in seconds). Token expiry is extended on each valid refresh, subject to the absolute refresh token lifetime.

Formatint32

refresh_token_usage*RefreshTokenUsageTypes

Controls whether refresh tokens are single-use (rotated) or reusable.

values

reuse
The same refresh token can be used repeatedly to obtain new tokens.
one_time_only
A new refresh token is issued on every refresh, and the previous one becomes invalid.

update_access_token_claims_on_refresh*boolean

Controls whether access token claims are recalculated and reissued when refreshing a token.

emit_offline_access_scope_in_access_token*boolean

Includes the offline_access scope in issued access tokens when requested by the client.

refresh_token_expiration*RefreshTokenExpirationTypes

Controls whether refresh tokens expire at a fixed time or are extended with continued use.

values

sliding
Refresh tokens use a sliding expiration model. Each successful refresh extends the token lifetime (up to the configured absolute refresh token lifetime).
absolute
Refresh tokens expire at a fixed point in time, based on the configured absolute refresh token lifetime — regardless of usage.

access_token_type*AccessTokenTypes

Specifies whether access tokens issued without API resource scopes are issued as self-contained JWTs or opaque reference tokens. These tokens may only be used with the UserInfo endpoint.

values

jwt
A self-contained JWT access token.
reference
An opaque reference token stored and validated server-side.

authenticator_restrictions*array<string>

Defines the authenticators users may use to sign in with this client. Leave empty to inherit the global authenticator policy.

Pro plan subscription required to enable authenticator restrictions.

claims*

Defines custom claims issued to this client and embedded into access tokens for downstream APIs and resources.

always_send_client_claims*boolean

Controls whether client claims are always emitted in access tokens, or only when using the client credentials flow.

client_claims_prefix?|

Configures a prefix for client claims, helping avoid naming collisions across tokens and downstream APIs.

allowed_cors_origins*array<string>

Configures the set of trusted origins permitted to perform cross-origin requests for this client.

user_sso_lifetime*integer

Maximum allowed SSO duration (in seconds). After this window, users must sign in again to confirm identity. Set to 0 to disable the limit.

Formatint32

device_code_length*integer

Specifies the length of the user verification code generated for the device flow.

Formatint32

device_code_lifetime*integer

Specifies the lifetime of the device authorization code (in seconds).

Formatint32

creation_time*integer

Specifies the creation time of the client (in Epoch).

Formatdate-time

last_updated*integer

Specifies the last update time of the client (in Epoch).

Formatdate-time

Errors

401Unauthorized

403Forbidden

curl -X PATCH "https://your-domain.us.monocloud.com/api/applications/eCOGRJYpnNwwAAuCeReEW" \  -H "X-API-KEY: <token>" \  -H "Content-Type: application/json" \  -d '{}'

{  "id": "string",  "enabled": true,  "app_type": "spa",  "tech_type": "javascript",  "require_client_secret": true,  "client_name": "string",  "description": null,  "client_uri": null,  "logo_uri": null,  "enable_consent": true,  "require_consent": true,  "always_require_consent_for_offline_access": true,  "remember_consent": "user_selected",  "show_consent_scope_selection": true,  "always_include_user_claims_in_id_token": true,  "allowed_grant_types": [    "implicit"  ],  "require_pkce": true,  "allow_plain_text_pkce": true,  "require_request_object": true,  "require_pushed_authorization_requests": true,  "allow_any_pushed_authorization_redirect_uri": true,  "authorization_request_lifetime": 0,  "allow_access_tokens_via_browser": true,  "redirect_uris": [    "string"  ],  "post_logout_redirect_uris": [    "string"  ],  "front_channel_logout_uri": null,  "front_channel_logout_session_required": true,  "back_channel_logout_uri": null,  "back_channel_logout_session_required": true,  "bind_refresh_tokens_to_session": true,  "allow_offline_access": true,  "allowed_identity_scopes": [    "string"  ],  "identity_token_lifetime": 0,  "access_token_lifetime": 0,  "authorization_code_lifetime": 0,  "consent_lifetime": 0,  "absolute_refresh_token_lifetime": 0,  "sliding_refresh_token_lifetime": 0,  "refresh_token_usage": "one_time_only",  "update_access_token_claims_on_refresh": true,  "emit_offline_access_scope_in_access_token": true,  "refresh_token_expiration": "absolute",  "access_token_type": "jwt",  "authenticator_restrictions": [    "string"  ],  "claims": {    "property1": null,    "property2": null  },  "always_send_client_claims": true,  "client_claims_prefix": null,  "allowed_cors_origins": [    "string"  ],  "user_sso_lifetime": 0,  "device_code_length": 0,  "device_code_lifetime": 0,  "creation_time": 0,  "last_updated": 0}

AuthorizationCopy Anchor Link

Path ParametersCopy Anchor Link

Request BodyCopy Anchor Link

Response BodyCopy Anchor Link

ErrorsCopy Anchor Link

400Bad Request

402Payment Required

404Not Found

422Unprocessable Entity

Authorization

Path Parameters

Request Body

Response Body

Errors