API Reference
Getting Started
Core Concepts
Backend API — Guides
Frontend API — Guides
OAuth & OpenID Connect — Guides
Enterprise: SSO & SCIM — Guides
Webhooks — Guides
SDKs
Backend API (BAPI)
Frontend API (FAPI)
Dashboard API
Public API
SCIM
OIDC
Platform
API Explorer

PLATFORM

AdminUpdated Sep 12, 2026
GEThttps://{apiHost}/v1/platform/apps
List the apps (instances) this platform owns. Never returns any secret.
Responses
200 Success
400 Validation failed
{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}
401 Unauthenticated
{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}
403 Forbidden or missing scope
{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}
404 Not found
{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}
409 Conflict
{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}
429 Rate limited
{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}
Example request
curl -X GET "https://{apiHost}/v1/platform/apps"
POSThttps://{apiHost}/v1/platform/apps
Provision a new app (instance) owned by the platform: mints its publishable key, signing key and first secret key. The secret is revealed exactly once.
Parameters
NameInTypeRequiredDescription
Idempotency-KeyheaderstringnoReplays the first response for 24h. Reusing a key with different parameters is a 409.
Responses
200 Success
400 Validation failed
{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}
401 Unauthenticated
{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}
403 Forbidden or missing scope
{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}
404 Not found
{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}
409 Conflict
{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}
429 Rate limited
{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}
Example request
curl -X POST "https://{apiHost}/v1/platform/apps" \
  -H "Idempotency-Key: <value>"
GEThttps://{apiHost}/v1/platform/apps/{id}
Fetch one owned app. Another platform's app id is 404, never 403. Never a secret.
Parameters
NameInTypeRequiredDescription
idpathstringyes
Responses
200 Success
400 Validation failed
{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}
401 Unauthenticated
{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}
403 Forbidden or missing scope
{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}
404 Not found
{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}
409 Conflict
{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}
429 Rate limited
{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}
Example request
curl -X GET "https://{apiHost}/v1/platform/apps/{id}"
DELETEhttps://{apiHost}/v1/platform/apps/{id}
Disable an owned app: refuse sign-ins and sign-ups via its kill switches. Soft and reversible — never a hard drop of user data. Not owned is 404.
Parameters
NameInTypeRequiredDescription
idpathstringyes
Responses
200 Success
400 Validation failed
{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}
401 Unauthenticated
{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}
403 Forbidden or missing scope
{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}
404 Not found
{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}
409 Conflict
{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}
429 Rate limited
{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}
Example request
curl -X DELETE "https://{apiHost}/v1/platform/apps/{id}"
PATCHhttps://{apiHost}/v1/platform/apps/{id}
Update an owned app's safe config subset (name, allowed_origins). Not owned is 404.
Parameters
NameInTypeRequiredDescription
idpathstringyes
Responses
200 Success
400 Validation failed
{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}
401 Unauthenticated
{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}
403 Forbidden or missing scope
{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}
404 Not found
{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}
409 Conflict
{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}
429 Rate limited
{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}
Example request
curl -X PATCH "https://{apiHost}/v1/platform/apps/{id}"
POSThttps://{apiHost}/v1/platform/apps/{id}/rotate_secret
Rotate an owned app's secret key: revoke its prior keys and mint a new one, revealed exactly once. Not owned is 404.
Parameters
NameInTypeRequiredDescription
Idempotency-Keyheaderstringno
idpathstringyes
Responses
200 Success
400 Validation failed
{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}
401 Unauthenticated
{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}
403 Forbidden or missing scope
{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}
404 Not found
{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}
409 Conflict
{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}
429 Rate limited
{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}
Example request
curl -X POST "https://{apiHost}/v1/platform/apps/{id}/rotate_secret" \
  -H "Idempotency-Key: <value>"
GEThttps://{apiHost}/v1/platform/apps/{id}/instances
List every instance under an owned app — its development/production siblings. Never returns any secret. Not owned is 404.
Parameters
NameInTypeRequiredDescription
idpathstringyes
Responses
200 Success
400 Validation failed
{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}
401 Unauthenticated
{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}
403 Forbidden or missing scope
{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}
404 Not found
{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}
409 Conflict
{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}
429 Rate limited
{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}
Example request
curl -X GET "https://{apiHost}/v1/platform/apps/{id}/instances"
POSThttps://{apiHost}/v1/platform/apps/{id}/instances
Provision an additional instance (e.g. development beside production) under an owned app. Returns the new instance id and its first secret key, revealed exactly once. Not owned is 404.
Parameters
NameInTypeRequiredDescription
Idempotency-Keyheaderstringno
idpathstringyes
Responses
200 Success
400 Validation failed
{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}
401 Unauthenticated
{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}
403 Forbidden or missing scope
{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}
404 Not found
{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}
409 Conflict
{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}
429 Rate limited
{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}
Example request
curl -X POST "https://{apiHost}/v1/platform/apps/{id}/instances" \
  -H "Idempotency-Key: <value>"
POSThttps://{apiHost}/v1/platform/apps/{id}/instances/{instanceId}/rotate_secret
Rotate one specific instance's secret under an owned app: revoke its prior keys and mint a new one, revealed once. Not owned is 404.
Parameters
NameInTypeRequiredDescription
Idempotency-Keyheaderstringno
idpathstringyes
instanceIdpathstringyes
Responses
200 Success
400 Validation failed
{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}
401 Unauthenticated
{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}
403 Forbidden or missing scope
{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}
404 Not found
{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}
409 Conflict
{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}
429 Rate limited
{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}
Example request
curl -X POST "https://{apiHost}/v1/platform/apps/{id}/instances/{instanceId}/rotate_secret" \
  -H "Idempotency-Key: <value>"
POSThttps://{apiHost}/v1/platform/accountless_apps
Mint an app owned by no platform and return a one-time claim_token (hashed at rest, single-use, expiring). The provision-then-hand-over agency flow — no secret is minted until the app is claimed.
Parameters
NameInTypeRequiredDescription
Idempotency-KeyheaderstringnoReplays the first response for 24h. Reusing a key with different parameters is a 409.
Responses
200 Success
400 Validation failed
{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}
401 Unauthenticated
{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}
403 Forbidden or missing scope
{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}
404 Not found
{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}
409 Conflict
{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}
429 Rate limited
{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}
Example request
curl -X POST "https://{apiHost}/v1/platform/accountless_apps" \
  -H "Idempotency-Key: <value>"
POSThttps://{apiHost}/v1/platform/apps/claim
Claim an accountless app into the calling platform by its claim_token. Single-use and expiring; sets ownership and mints the first secret key, revealed once. A consumed, expired or unknown token is 4xx.
Parameters
NameInTypeRequiredDescription
Idempotency-KeyheaderstringnoReplays the first response for 24h. Reusing a key with different parameters is a 409.
Responses
200 Success
400 Validation failed
{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}
401 Unauthenticated
{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}
403 Forbidden or missing scope
{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}
404 Not found
{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}
409 Conflict
{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}
429 Rate limited
{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}
Example request
curl -X POST "https://{apiHost}/v1/platform/apps/claim" \
  -H "Idempotency-Key: <value>"
POSThttps://{apiHost}/v1/platform/apps/{id}/transfer
Initiate a transfer of an owned app: returns a one-time transfer_token bound to it (hashed, single-use, expiring). Only the current owner can initiate; a non-owned app is 404.
Parameters
NameInTypeRequiredDescription
Idempotency-Keyheaderstringno
idpathstringyes
Responses
200 Success
400 Validation failed
{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}
401 Unauthenticated
{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}
403 Forbidden or missing scope
{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}
404 Not found
{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}
409 Conflict
{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}
429 Rate limited
{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}
Example request
curl -X POST "https://{apiHost}/v1/platform/apps/{id}/transfer" \
  -H "Idempotency-Key: <value>"
POSThttps://{apiHost}/v1/platform/apps/accept_transfer
Accept a transfer by transfer_token: move the app's ownership to the calling platform and re-parent it to its account. The previous owner loses access immediately. Single-use and expiring; a consumed/expired/unknown token is 4xx.
Parameters
NameInTypeRequiredDescription
Idempotency-KeyheaderstringnoReplays the first response for 24h. Reusing a key with different parameters is a 409.
Responses
200 Success
400 Validation failed
{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}
401 Unauthenticated
{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}
403 Forbidden or missing scope
{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}
404 Not found
{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}
409 Conflict
{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}
429 Rate limited
{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}
Example request
curl -X POST "https://{apiHost}/v1/platform/apps/accept_transfer" \
  -H "Idempotency-Key: <value>"
Was this page helpful?