Skip to content
API Reference
API Reference
Zones

Application Credentials

List application credentials
zones.application_credentials.list(strzone_id, ApplicationCredentialListParams**kwargs) -> ApplicationCredentialListResponse
GET/zones/{zoneId}/application-credentials
Create application credential
zones.application_credentials.create(strzone_id, ApplicationCredentialCreateParams**kwargs) -> ApplicationCredentialCreateResponse
POST/zones/{zoneId}/application-credentials
Get application credential
zones.application_credentials.retrieve(strid, ApplicationCredentialRetrieveParams**kwargs) -> Credential
GET/zones/{zoneId}/application-credentials/{id}
Update application credential
zones.application_credentials.update(strid, ApplicationCredentialUpdateParams**kwargs) -> Credential
PATCH/zones/{zoneId}/application-credentials/{id}
Delete application credential
zones.application_credentials.delete(strid, ApplicationCredentialDeleteParams**kwargs)
DELETE/zones/{zoneId}/application-credentials/{id}
ModelsExpand Collapse
class BaseFields: …

Common fields shared by all application credential types

id: str

Unique identifier of the credential

application_id: str

ID of the application this credential belongs to

created_at: datetime

Entity creation timestamp

formatdate-time
organization_id: str

Organization that owns this credential

slug: str

URL-safe identifier, unique within the zone

minLength1
maxLength63
updated_at: datetime

Entity update timestamp

formatdate-time
zone_id: str

Zone this credential belongs to

Deprecatedapplication: Optional[Application]

An Application is a software system with an associated identity that can access Resources. It may act on its own behalf (machine-to-machine) or on behalf of a user (delegated access).

id: str

Unique identifier of the application

created_at: datetime

Entity creation timestamp

formatdate-time
dependencies_count: int

Number of resource dependencies

identifier: str

User specified identifier, unique within the zone

minLength1
maxLength2048
name: str

Human-readable name

minLength1
maxLength255
organization_id: str

Organization that owns this application

owner_type: Literal["platform", "customer"]

Who owns this application. Platform-owned applications cannot be modified via API.

Accepts one of the following:
"platform"
"customer"
slug: str

URL-safe identifier, unique within the zone

minLength1
maxLength63
updated_at: datetime

Entity update timestamp

formatdate-time
zone_id: str

Zone this application belongs to

description: Optional[str]

Human-readable description

maxLength2048
metadata: Optional[Metadata]

Entity metadata

docs_url: Optional[str]

Documentation URL

formaturi
maxLength2048
protocols: Optional[Protocols]

Protocol-specific configuration

oauth2: Optional[ProtocolsOauth2]

OAuth 2.0 protocol configuration

post_logout_redirect_uris: Optional[List[str]]

OAuth 2.0 post-logout redirect URIs for this application

redirect_uris: Optional[List[str]]

OAuth 2.0 redirect URIs for this application

Union[Token, Password, PublicKey, 2 more]

Credentials for accessing external services from applications

Accepts one of the following:
class Token: …

Token-based application credential

identifier: str

Identifier for this credential. For token type, this equals the subject value, or '*' when subject is not specified.

provider_id: str

ID of the provider issuing tokens verified by this credential

type: Literal["token"]
Deprecatedprovider: Optional[Provider]

A Provider is a system that supplies access to Resources and allows actors (Users or Applications) to authenticate.

id: str

Unique identifier of the provider

created_at: datetime

Entity creation timestamp

formatdate-time
identifier: str

User specified identifier, unique within the zone

minLength1
maxLength2048
name: str

Human-readable name

minLength1
maxLength255
organization_id: str

Organization that owns this provider

owner_type: Literal["platform", "customer"]

Who owns this provider. Platform-owned providers cannot be modified via API.

Accepts one of the following:
"platform"
"customer"
slug: str

URL-safe identifier, unique within the zone

minLength1
maxLength63
updated_at: datetime

Entity update timestamp

formatdate-time
zone_id: str

Zone this provider belongs to

client_id: Optional[str]

OAuth 2.0 client identifier

client_secret_set: Optional[bool]

Indicates whether a client secret is configured

description: Optional[str]

Human-readable description

maxLength2048
metadata: Optional[object]

Provider metadata

protocols: Optional[Protocols]

Protocol-specific configuration

oauth2: Optional[ProtocolsOauth2]

OAuth 2.0 protocol configuration

issuer: str

OIDC issuer URL used for discovery and token validation.

formaturi
authorization_endpoint: Optional[str]
formaturi
authorization_parameters: Optional[Dict[str, str]]

Custom query parameters appended to authorization redirect URLs. Use for non-standard providers (e.g. Google prompt=consent, access_type=offline).

authorization_resource_enabled: Optional[bool]

Whether to include the resource parameter in authorization requests.

authorization_resource_parameter: Optional[str]

The resource parameter value to include in authorization requests. Defaults to "resource" when authorization_resource_enabled is true.

code_challenge_methods_supported: Optional[List[str]]
jwks_uri: Optional[str]
formaturi
registration_endpoint: Optional[str]
formaturi
scope_parameter: Optional[str]

The query parameter name for scopes in authorization requests. Defaults to "scope". Slack v2 uses "user_scope".

scope_separator: Optional[str]

The separator character for scope values. Defaults to " " (space). Slack v2 uses ",".

scopes_supported: Optional[List[str]]
token_endpoint: Optional[str]
formaturi
token_response_access_token_pointer: Optional[str]

Dot-separated path to the access token in the token response body. Defaults to "access_token". Slack v2 uses "authed_user.access_token".

openid: Optional[ProtocolsOpenid]

OpenID Connect protocol configuration

userinfo_endpoint: Optional[str]
formaturi
type: Optional[Literal["external", "keycard-vault", "keycard-sts"]]
Accepts one of the following:
"external"
"keycard-vault"
"keycard-sts"
subject: Optional[str]

Subject identifier for the token. When null or omitted, any token from the provider is accepted without checking application-specific claims.

class Password: …

Password-based application credential

identifier: str

Username for password credential, also used as OAuth 2.0 client ID

type: Literal["password"]
password: Optional[str]

Password for credential (only returned on creation, store securely), also used as OAuth 2.0 client secret

class PublicKey: …

Public key-based application credential

identifier: str

Client ID for public key credential, also used as OAuth 2.0 client ID

jwks_uri: str

JWKS URI to retrieve public keys from

formaturi
type: Literal["public-key"]
class URL: …

URL-based application credential

identifier: str

URL of the credential (must be a valid URL)

formaturi
type: Literal["url"]
class Public: …

Public credential (no secret storage)

identifier: str

Identifier for public credential, also used as OAuth 2.0 client ID

type: Literal["public"]
class Password: …

Password-based application credential

identifier: str

Username for password credential, also used as OAuth 2.0 client ID

type: Literal["password"]
password: Optional[str]

Password for credential (only returned on creation, store securely), also used as OAuth 2.0 client secret

class Public: …

Public credential (no secret storage)

identifier: str

Identifier for public credential, also used as OAuth 2.0 client ID

type: Literal["public"]
class PublicKey: …

Public key-based application credential

identifier: str

Client ID for public key credential, also used as OAuth 2.0 client ID

jwks_uri: str

JWKS URI to retrieve public keys from

formaturi
type: Literal["public-key"]
class Token: …

Token-based application credential

identifier: str

Identifier for this credential. For token type, this equals the subject value, or '*' when subject is not specified.

provider_id: str

ID of the provider issuing tokens verified by this credential

type: Literal["token"]
Deprecatedprovider: Optional[Provider]

A Provider is a system that supplies access to Resources and allows actors (Users or Applications) to authenticate.

id: str

Unique identifier of the provider

created_at: datetime

Entity creation timestamp

formatdate-time
identifier: str

User specified identifier, unique within the zone

minLength1
maxLength2048
name: str

Human-readable name

minLength1
maxLength255
organization_id: str

Organization that owns this provider

owner_type: Literal["platform", "customer"]

Who owns this provider. Platform-owned providers cannot be modified via API.

Accepts one of the following:
"platform"
"customer"
slug: str

URL-safe identifier, unique within the zone

minLength1
maxLength63
updated_at: datetime

Entity update timestamp

formatdate-time
zone_id: str

Zone this provider belongs to

client_id: Optional[str]

OAuth 2.0 client identifier

client_secret_set: Optional[bool]

Indicates whether a client secret is configured

description: Optional[str]

Human-readable description

maxLength2048
metadata: Optional[object]

Provider metadata

protocols: Optional[Protocols]

Protocol-specific configuration

oauth2: Optional[ProtocolsOauth2]

OAuth 2.0 protocol configuration

issuer: str

OIDC issuer URL used for discovery and token validation.

formaturi
authorization_endpoint: Optional[str]
formaturi
authorization_parameters: Optional[Dict[str, str]]

Custom query parameters appended to authorization redirect URLs. Use for non-standard providers (e.g. Google prompt=consent, access_type=offline).

authorization_resource_enabled: Optional[bool]

Whether to include the resource parameter in authorization requests.

authorization_resource_parameter: Optional[str]

The resource parameter value to include in authorization requests. Defaults to "resource" when authorization_resource_enabled is true.

code_challenge_methods_supported: Optional[List[str]]
jwks_uri: Optional[str]
formaturi
registration_endpoint: Optional[str]
formaturi
scope_parameter: Optional[str]

The query parameter name for scopes in authorization requests. Defaults to "scope". Slack v2 uses "user_scope".

scope_separator: Optional[str]

The separator character for scope values. Defaults to " " (space). Slack v2 uses ",".

scopes_supported: Optional[List[str]]
token_endpoint: Optional[str]
formaturi
token_response_access_token_pointer: Optional[str]

Dot-separated path to the access token in the token response body. Defaults to "access_token". Slack v2 uses "authed_user.access_token".

openid: Optional[ProtocolsOpenid]

OpenID Connect protocol configuration

userinfo_endpoint: Optional[str]
formaturi
type: Optional[Literal["external", "keycard-vault", "keycard-sts"]]
Accepts one of the following:
"external"
"keycard-vault"
"keycard-sts"
subject: Optional[str]

Subject identifier for the token. When null or omitted, any token from the provider is accepted without checking application-specific claims.

class URL: …

URL-based application credential

identifier: str

URL of the credential (must be a valid URL)

formaturi
type: Literal["url"]