openapi: 3.0.0
info:
  description: >
    This document specifies an **Application Management RESTful API** for **WSO2 Identity Server**.
  version: "v1"
  title: WSO2 Identity Server - Application Management Rest API
  termsOfService: 'http://swagger.io/terms/'
  contact:
    name: WSO2
    url: 'http://wso2.com/products/identity-server/'
    email: architecture@wso2.org
  license:
    name: Apache 2.0
    url: 'http://www.apache.org/licenses/LICENSE-2.0.html'
security:
  - OAuth2: []
  - BasicAuth: []
paths:
  /applications:
    get:
      tags:
        - Applications
      operationId: getAllApplications
      summary: |
        List applications.
      description: |
        This API provides the capability to retrieve the list of applications. <br>
          <b>Scope(Permission) required:</b> `internal_application_mgt_view`
      parameters:
        - $ref: '#/components/parameters/limitQueryParam'
        - $ref: '#/components/parameters/offsetQueryParam'
        - $ref: '#/components/parameters/filterQueryParam'
        - $ref: '#/components/parameters/sortOrderQueryParam'
        - $ref: '#/components/parameters/sortByQueryParam'
        - $ref: '#/components/parameters/attributesQueryParam'
        - $ref: '#/components/parameters/excludeSystemPortalsQueryParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApplicationListResponse'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '501':
          description: Not Implemented
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
    post:
      tags:
        - Applications
      summary: |
        Add application.
      operationId: createApplication
      description: >
        This API provides the capability to store the application information that is provided by users. <br>
          <b>Scope(Permission) required:</b> `internal_application_mgt_create`
      parameters:
        - in: query
          name: template
          required: false
          description: |
            Pre-defined template to use when creating the application.
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ApplicationModel'
        description: This represents the application to be created.
        required: true
      responses:
        '201':
          description: Successful response.
          headers:
            Location:
              description: This denotes the location of the newly-created application.
              schema:
                type: string
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '409':
          description: Conflict
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '501':
          description: Not Implemented
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /applications/import:
    post:
      tags:
        - Applications
      summary: |
        Create application from an exported XML, YAML, or JSON file.
      operationId: importApplication
      description: >
        This API provides the capability to create an application based on the
        information provided in an XML, YAML, or JSON file. <br>
          <b>Scope(Permission) required:</b> `internal_application_mgt_create`
      requestBody:
        content:
          multipart/form-data:
            schema:
              $ref: '#/components/schemas/FileUpload'
        description: This represents the application to be created.
      responses:
        '201':
          description: Successfully created.
          headers:
            Location:
              description: Location of the newly created application.
              schema:
                type: string
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '409':
          description: Conflict
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
    put:
      tags:
        - Applications
      summary: |
        Update application from an exported XML, YAML, or JSON file.
      operationId: importApplicationForUpdate
      description: >
        This API provides the capability to update an application based on the
        information provided in an XML, YAML, or JSON file. <br>
          <b>Scope(Permission) required:</b> `internal_application_mgt_update`
      requestBody:
        content:
          multipart/form-data:
            schema:
              $ref: '#/components/schemas/FileUpload'
        description: This represents the application to be updated.
      responses:
        '200':
          description: Successfully Updated.
          headers:
            Location:
              description: Location of the updated application.
              schema:
                type: string
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '409':
          description: Conflict
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /applications/{applicationId}:
    get:
      tags:
        - Applications
      summary: |
        Retrieve application by ID.
      operationId: getApplication
      description: >
        This API provides the capability to retrieve the application information by ID. <br>
          <b>Scope(Permission) required:</b> `internal_application_mgt_view`
      parameters:
        - name: applicationId
          in: path
          description: ID of the application.
          required: true
          schema:
            type: string
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApplicationResponseModel'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
            application/xml:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
            application/xml:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
            application/xml:
              schema:
                $ref: '#/components/schemas/Error'
    patch:
      tags:
        - Applications
      summary: |
        Partially update application by ID.
      operationId: patchApplication
      description: |
        This API provides the capability to partially update an application by ID. <br>
          <b>Scope(Permission) required:</b> `internal_application_mgt_update`
      parameters:
        - name: applicationId
          in: path
          description: ID of the application.
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ApplicationPatchModel'
        description: This represents the application details to be updated.
        required: true
      responses:
        '200':
          description: Successfully Updated
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '409':
          description: Conflict
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
    delete:
      tags:
        - Applications
      summary: |
        Delete application by ID.
      operationId: deleteApplication
      description: |
        This API provides the capability to delete an application by ID. <br>
          <b>Scope(Permission) required:</b> `internal_application_mgt_delete`
      parameters:
        - name: applicationId
          in: path
          description: ID of the application.
          required: true
          schema:
            type: string
      responses:
        '204':
          description: Successfully Deleted
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /applications/{applicationId}/export:
    get:
      tags:
        - Applications
      operationId: exportApplication
      summary: |
        Export application as an XML file.
      description: |
        This API provides the capability to retrieve the application as an XML file. <br>
          <b>Scope(Permission) required:</b> `internal_application_mgt_view`
      parameters:
        - name: applicationId
          in: path
          description: ID of the application.
          required: true
          schema:
            type: string
        - $ref: '#/components/parameters/exportSecretsQueryParam'
      responses:
        '200':
          description: OK
          content:
            application/octet-stream:
              schema:
                example: 'Sample application configuration xml as a string'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /applications/{applicationId}/exportFile:
    get:
      tags:
        - Applications
      operationId: exportApplicationAsFile
      summary: |
        Export application in XML, YAML, or JSON file formats.
      description: |
        This API provides the capability to retrieve the application in XML, YAML, or JSON format. <br>
          <b>Scope(Permission) required:</b> `internal_application_mgt_view`
      parameters:
        - name: applicationId
          in: path
          description: ID of the application.
          required: true
          schema:
            type: string
        - $ref: '#/components/parameters/exportSecretsQueryParam'
        - $ref: '#/components/parameters/fileTypeHeaderParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: string
              example: 'Sample application configuration in the requested format'
            application/yaml:
              schema:
                type: string
              example: 'Sample application configuration in the requested format'
            application/xml:
              schema:
                type: string
              example: 'Sample application configuration in the requested format'
            application/octet-stream:
              schema:
                type: string
              example: 'Sample application configuration in the requested format'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /applications/{applicationId}/owner:
    put:
      tags:
        - Applications
      operationId: changeApplicationOwner
      summary: |
        Change application owner.
      description: |
        This API provides the capability to change the application owner. <br>
          <b>Scope(Permission) required:</b> `internal_organization_admin`
      parameters:
        - name: applicationId
          in: path
          description: ID of the application.
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ApplicationOwner'
      responses:
        '200':
          description: Successfully Updated
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /applications/{applicationId}/authenticationSequence/script:
    put:
      tags:
        - Applications
      operationId: updateAuthenticationScript
      summary: Update authentication script of the application
      description: |
        This API provides the capability to update the authentication script of the application. <br>
          <b>Scope(Permission) required:</b> `internal_application_script_update` </br>
      parameters:
        - name: applicationId
          in: path
          description: ID of the application.
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ScriptUpdateModel'
        description: This represents the authentication script to be updated.
        required: true
      responses:
        '200':
          description: Successfully Updated
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '500':
          description: Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /applications/{applicationId}/authenticators:
    get:
      tags:
        - Authenticators
      summary: |
        Get configured authenticators.
      operationId: getConfiguredAuthenticators
      description: |
        This API provides the capability to retrieve the configured authenticators. <br>
          <b>Scope(Permission) required:</b> `internal_application_mgt_view`
      parameters:
        - name: applicationId
          in: path
          description: ID of the application.
          required: true
          schema:
            type: string
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/ConfiguredAuthenticatorsModal'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /applications/{applicationId}/authorized-apis:
    get:
      tags:
        - Authorized APIs
      summary: |
        Get authorized APIs of the application.
      operationId: getAuthorizedAPIs
      description: |
        This API provides the capability to retrieve all the authorized APIs of the application. <br>
          <b>Scope(Permission) required:</b> `internal_application_mgt_view`
      parameters:
        - name: applicationId
          in: path
          description: ID of the application.
          required: true
          schema:
            type: string
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/AuthorizedAPIResponse'
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
        '500':
          description: Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
    post:
      tags:
        - Authorized APIs
      summary: |
        Authorized an API to the application.
      operationId: addAuthorizedAPI
      description: |
        This API provides the capability to authorized an API to the application. <br>
          <b>Scope(Permission) required:</b> `internal_application_mgt_update`
      parameters:
        - name: applicationId
          in: path
          description: ID of the application.
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AuthorizedAPICreationModel'
      responses:
        '201':
          description: Created
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
        '500':
          description: Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /applications/{applicationId}/authorized-apis/{apiId}:
    patch:
      tags:
        - Authorized APIs
      summary: |
        Update authorized API scopes.
      operationId: patchAuthorizedAPI
      description: |
        This API provides the capability to update an authorized API of the application. <br>
          <b>Scope(Permission) required:</b> `internal_application_mgt_update`
      parameters:
        - name: applicationId
          in: path
          description: ID of the application.
          required: true
          schema:
            type: string
        - name: apiId
          in: path
          description: ID of the API resource.
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AuthorizedAPIPatchModel'
      responses:
        '200':
          description: OK
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
        '500':
          description: Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
    delete:
      tags:
        - Authorized APIs
      summary: |
        Remove API authorization from the application.
      operationId: deleteAuthorizedAPI
      description: |
        This API provides the capability to delete an authorized API of the application. <br>
          <b>Scope(Permission) required:</b> `internal_application_mgt_update`
      parameters:
        - name: applicationId
          in: path
          description: ID of the application.
          required: true
          schema:
            type: string
        - name: apiId
          in: path
          description: ID of the API resource.
          required: true
          schema:
            type: string
      responses:
        '204':
          description: No Content
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '500':
          description: Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /applications/resident:
    get:
      tags:
        - Resident Application
      summary: |
        Get resident application.
      operationId: getResidentApplication
      description: |
        This API provides the capability to retrieve the resident application information. <br>
          <b>Scope(Permission) required:</b> `internal_application_mgt_view`
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResidentApplication'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
    put:
      tags:
        - Resident Application
      summary: |
        Update resident application.
      operationId: updateResidentApplication
      description: >
        This API provides the capability to update the resident application configuration. <br>
          <b>Scope(Permission) required:</b> `internal_application_mgt_update`
      responses:
        '200':
          description: Successful
        '201':
          description: Successful response.
          headers:
            Location:
              description: >-
                Location of the provisioning configuration of the resident
                application.
              schema:
                type: string
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '409':
          description: Conflict
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ProvisioningConfiguration'
        description: >-
          This represents the provisioning configuration of the resident
          application.
        required: true
  /applications/{applicationId}/inbound-protocols/:
    get:
      tags:
        - Inbound Protocols
      summary: |
        Retrieve inbound protocol configurations.
      operationId: getInboundAuthenticationConfigurations
      description: >
        This API provides the capability to retrieve authentication protocol configurations of an application. <br>
          <b>Scope(Permission) required:</b> `internal_application_mgt_view`
      parameters:
        - name: applicationId
          in: path
          description: ID of the application.
          required: true
          schema:
            type: string
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InboundProtocolsListResponse'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /applications/{applicationId}/inbound-protocols/saml:
    get:
      tags:
        - Inbound Protocols - SAML
      summary: |
        Retrieve SAML2 authentication protocol parameters.
      operationId: getInboundSAMLConfiguration
      description: >
        This API provides the capability to retrieve SAML2 authentication protocol parameters of an application. <br>
          <b>Scope(Permission) required:</b> `internal_application_mgt_view`
      parameters:
        - name: applicationId
          in: path
          description: ID of the application.
          required: true
          schema:
            type: string
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SAML2ServiceProvider'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
    put:
      tags:
        - Inbound Protocols - SAML
      summary: |
        Update SAML2 authentication protocol parameters.
      operationId: updateInboundSAMLConfiguration
      description: >
        This API provides the capability to store SAML2 authentication protocol parameters of an application. <br>
          <b>Scope(Permission) required:</b> `internal_application_mgt_update`

        - There are three methods to create/update SAML2 authentication protocol configuration.
            1. Metadata File (by sending the Base64 encoded content of the metadata file.)
            2. Metadata URL
            3. Manual configuration
      parameters:
        - name: applicationId
          in: path
          description: ID of the application.
          required: true
          schema:
            type: string
      responses:
        '200':
          description: Successful
        '201':
          description: Successful response.
          headers:
            Location:
              description: Location of the newly created SAML Inbound configuration.
              schema:
                type: string
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '409':
          description: Conflict
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SAML2Configuration'
        description: This represents the SAML2 protocol attributes of the application.
        required: true
    delete:
      tags:
        - Inbound Protocols - SAML
      summary: |
        Delete SAML2 authentication protocol parameters.
      operationId: deleteInboundSAMLConfiguration
      description: >
        This API provides the capability to delete SAML2 authentication protocol parameters of an application. <br>
          <b>Scope(Permission) required:</b> `internal_application_mgt_delete`
      parameters:
        - name: applicationId
          in: path
          description: ID of the application.
          required: true
          schema:
            type: string
      responses:
        '204':
          description: Delete successful
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /applications/{applicationId}/inbound-protocols/oidc:
    get:
      tags:
        - Inbound Protocols - OAuth / OIDC
      summary: |
        Retrieve OIDC authentication protocol parameters.
      description: >
        This API provides the capability to retrieve OIDC authentication protocol parameters of an application. <br>
          <b>Scope(Permission) required:</b> `internal_application_mgt_view`
      operationId: getInboundOAuthConfiguration
      parameters:
        - name: applicationId
          in: path
          description: ID of the application
          required: true
          schema:
            type: string
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OpenIDConnectConfiguration'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
    put:
      tags:
        - Inbound Protocols - OAuth / OIDC
      summary: |
        Update OIDC authentication protocol parameters.
      description: >
        This API provides the capability to store OIDC authentication protocol parameters of an application. <br>
          <b>Scope(Permission) required:</b> `internal_application_mgt_update`
      operationId: updateInboundOAuthConfiguration
      parameters:
        - name: applicationId
          in: path
          description: ID of the application.
          required: true
          schema:
            type: string
      responses:
        '200':
          description: Successful
        '201':
          description: Created
          headers:
            Location:
              description: This is the location of the newly created OIDC Authentication Configuration.
              schema:
                type: string
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '409':
          description: Conflict
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/OpenIDConnectConfiguration'
        description: >-
          This represents the OIDC authentication protocol parameters of an
          application.
        required: true
    delete:
      tags:
        - Inbound Protocols - OAuth / OIDC
      summary: |
        Delete OIDC authentication protocol parameters.
      description: >
        This API provides the capability to delete OIDC authentication protocol parameters of an application. <br>
          <b>Scope(Permission) required:</b> `internal_application_mgt_delete`
      operationId: deleteInboundOAuthConfiguration
      parameters:
        - name: applicationId
          in: path
          description: ID of the application.
          required: true
          schema:
            type: string
      responses:
        '204':
          description: Delete Success
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /applications/{applicationId}/inbound-protocols/oidc/regenerate-secret:
    post:
      tags:
        - Inbound Protocols - OAuth / OIDC
      summary: |
        Regenerate the OAuth2/OIDC client secret.
      description: |
        This API regenerates the OAuth2/OIDC client secret. <br>
          <b>Scope(Permission) required:</b> `internal_application_mgt_create`
      operationId: regenerateOAuthClientSecret
      parameters:
        - name: applicationId
          in: path
          description: ID of the application
          required: true
          schema:
            type: string
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OpenIDConnectConfiguration'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /applications/{applicationId}/inbound-protocols/oidc/revoke:
    post:
      tags:
        - Inbound Protocols - OAuth / OIDC
      summary: |
        Revoke the OAuth2/OIDC client of application.
      description: |
        This API revokes the OAuth2/OIDC client secret.
        To re-activate the client, the client secret needs to be regenerated. <br>
          <b>Scope(Permission) required:</b> `internal_application_mgt_create`
      operationId: revokeOAuthClient
      parameters:
        - name: applicationId
          in: path
          description: ID of the application
          required: true
          schema:
            type: string
      responses:
        '200':
          description: Application Revoked
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /applications/{applicationId}/inbound-protocols/passive-sts:
    get:
      tags:
        - Inbound Protocols - Passive STS
      summary: >
        Retrieve Passive STS authentication protocol parameters.
      description: >
        This API provides the capability to retrieve Passive STS authentication
        protocol parameters of an application. <br>
          <b>Scope(Permission) required:</b> `internal_application_mgt_view`
      operationId: getPassiveStsConfiguration
      parameters:
        - name: applicationId
          in: path
          description: ID of the application
          required: true
          schema:
            type: string
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PassiveStsConfiguration'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
    put:
      tags:
        - Inbound Protocols - Passive STS
      summary: |
        Update Passive STS authentication protocol parameters.
      description: >
        This API provides the capability to store passive STS authentication protocol parameters of an application. <br>
          <b>Scope(Permission) required:</b> `internal_application_mgt_update`
      operationId: updatePassiveStsConfiguration
      parameters:
        - name: applicationId
          in: path
          description: ID of the application.
          required: true
          schema:
            type: string
      responses:
        '200':
          description: Successful
        '201':
          description: Successful response.
          headers:
            Location:
              description: >-
                Location of the newly created Passive STS Authentication
                Configuration.
              schema:
                type: string
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '409':
          description: Conflict
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PassiveStsConfiguration'
        description: >-
          This represents the Passive STS authentication protocol parameters of
          an application.
        required: true
    delete:
      tags:
        - Inbound Protocols - Passive STS
      summary: |
        Delete Passive STS authentication protocol parameters.
      description: >
        This API provides the capability to delete Passive STS authentication
        protocol parameters of an application. <br>
          <b>Scope(Permission) required:</b> `internal_application_mgt_delete`
      operationId: deletePassiveStsConfiguration
      parameters:
        - name: applicationId
          in: path
          description: ID of the application.
          required: true
          schema:
            type: string
      responses:
        '204':
          description: Delete Success
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /applications/{applicationId}/inbound-protocols/ws-trust:
    get:
      tags:
        - Inbound Protocols - WS Trust
      summary: |
        Retrieve WS Trust authentication protocol parameters.
      description: >
        This API provides the capability to retrieve Passive STS authentication
        protocol parameters of an application. <br>
          <b>Scope(Permission) required:</b> `internal_application_mgt_view`
      operationId: getWSTrustConfiguration
      parameters:
        - name: applicationId
          in: path
          description: ID of the application
          required: true
          schema:
            type: string
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WSTrustConfiguration'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
    put:
      tags:
        - Inbound Protocols - WS Trust
      summary: |
        Update WS Trust authentication protocol parameters.
      description: >
        This API provides the capability to store WS Trust authentication protocol parameters of an application. <br>
          <b>Scope(Permission) required:</b> `internal_application_mgt_update`
      operationId: updateWSTrustConfiguration
      parameters:
        - name: applicationId
          in: path
          description: ID of the application.
          required: true
          schema:
            type: string
      responses:
        '200':
          description: Successful
        '201':
          description: Successful response.
          headers:
            Location:
              description: >-
                Location of the newly created WS Trust Authentication
                Configuration.
              schema:
                type: string
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '409':
          description: Conflict
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/WSTrustConfiguration'
        description: >-
          This represents the Passive STS authentication protocol parameters of
          an application.
        required: true
    delete:
      tags:
        - Inbound Protocols - WS Trust
      summary: |
        Delete WS Trust authentication protocol parameters.
      description: >
        This API provides the capability to delete WS Trust authentication protocol parameters of an application. <br>
          <b>Scope(Permission) required:</b> `internal_application_mgt_delete`
      operationId: deleteWSTrustConfiguration
      parameters:
        - name: applicationId
          in: path
          description: ID of the application.
          required: true
          schema:
            type: string
      responses:
        '204':
          description: Delete Success
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /applications/{applicationId}/inbound-protocols/{inboundProtocolId}:
    get:
      tags:
        - Inbound Protocols - Custom
      summary: >
        Retrieve custom inbound authentication protocol parameters.
      description: >
        This API provides the capability to retrieve custom inbound
        authentication protocol parameters of an application. <br>
          <b>Scope(Permission) required:</b> `internal_application_mgt_view`
      operationId: getCustomInboundConfiguration
      parameters:
        - name: applicationId
          in: path
          description: ID of the application
          required: true
          schema:
            type: string
        - name: inboundProtocolId
          in: path
          description: Inbound Authentication Protocol ID
          required: true
          schema:
            type: string
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CustomInboundProtocolConfiguration'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
    put:
      tags:
        - Inbound Protocols - Custom
      summary: |
        Update the custom inbound authentication protocol parameters.
      description: >
        This API provides the capability to store custom inbound authentication
        protocol parameters of an application. <br>
          <b>Scope(Permission) required:</b> `internal_application_mgt_update`
      operationId: updateCustomInboundConfiguration
      parameters:
        - name: applicationId
          in: path
          description: ID of the application.
          required: true
          schema:
            type: string
        - name: inboundProtocolId
          in: path
          description: Inbound Authentication Protocol ID
          required: true
          schema:
            type: string
      responses:
        '200':
          description: Successful
        '201':
          description: Successful response.
          headers:
            Location:
              description: >-
                Location of the newly created Custom Inbound authentication
                protocol Configuration.
              schema:
                type: string
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '409':
          description: Conflict
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CustomInboundProtocolConfiguration'
        description: >-
          This represents the Custom Inbound authentication protocol parameters
          of an application.
        required: true
    delete:
      tags:
        - Inbound Protocols - Custom
      summary: >
        Delete custom inbound authentication protocol parameters.
      description: >
        This API provides the capability to delete custom inbound authentication protocol of an application. <br>
          <b>Scope(Permission) required:</b> `internal_application_mgt_delete`
      operationId: deleteCustomInboundConfiguration
      parameters:
        - name: applicationId
          in: path
          description: ID of the application.
          required: true
          schema:
            type: string
        - name: inboundProtocolId
          in: path
          description: Inbound Authentication Protocol ID
          required: true
          schema:
            type: string
      responses:
        '204':
          description: Delete Success
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /applications/meta/inbound-protocols:
    get:
      tags:
        - Application Metadata
      summary: |
        Retrieve the list of inbound authentication protocols available.
      description: >
        This API provides the capability to retrieve the list of inbound authentication protocols available.
        If the query parameter 'customOnly' is set to true, only custom inbound protocols will be listed. <br>
          <b>Scope(Permission) required:</b> `internal_application_mgt_view`
      operationId: getInboundProtocols
      parameters:
        - $ref: '#/components/parameters/inboundProtocolsCustomOnly'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/AuthProtocolMetadata'
                example:
                  - name: "saml"
                    displayName: "SAML2 Web SSO Configuration"
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /applications/meta/inbound-protocols/saml:
    get:
      tags:
        - Application Metadata
      summary: |
        Retrieve all the metadata related to the auth protocol SAML.
      description: >
        This API provides the capability to retrieve all the metadata related to the auth protocol SAML. <br>
          <b>Scope(Permission) required:</b> `internal_application_mgt_view`
      operationId: getSAMLMetadata
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SAMLMetaData'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /applications/meta/inbound-protocols/oidc:
    get:
      tags:
        - Application Metadata
      summary: |
        Retrieve all the metadata related to the authentication protocol OAuth / OIDC.
      description: >
        This API provides the capability to retrieve all the metadata related
        to the authentication protocol OAuth / OIDC. <br>
          <b>Scope(Permission) required:</b> `internal_application_mgt_view`
      operationId: getOIDCMetadata
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OIDCMetaData'
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /applications/meta/inbound-protocols/ws-trust:
    get:
      tags:
        - Application Metadata
      summary: |
        Retrieve all the metadata related to the auth protocol WS Trust.
      description: >
        This API provides the capability to retrieve all the metadata related to the auth protocol WS_Trust. <br>
          <b>Scope(Permission) required:</b> `internal_application_mgt_view`
      operationId: getWSTrustMetadata
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WSTrustMetaData'
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /applications/meta/inbound-protocols/{inboundProtocolId}:
    get:
      tags:
        - Application Metadata
      summary: |
        Retrieve all the metadata related to the custom auth protocol identified by the inboundProtocolId.
      description: >
        This API provides the capability to retrieve all the metadata related to the custom auth protocol
        identified by the inboundProtocolId. The URL encoded inbound protocol name is used as inboundProtocolId. <br>
          <b>Scope(Permission) required:</b> `internal_application_mgt_view`
      operationId: getCustomProtocolMetadata
      parameters:
        - name: inboundProtocolId
          in: path
          description: Inbound Authentication Protocol ID
          required: true
          schema:
            type: string
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CustomInboundProtocolMetaData'
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /applications/meta/adaptive-auth-templates:
    get:
      tags:
        - Application Metadata
      summary: |
        Retrieve adaptive authentication sample templates.
      description: >
        This API provides the capability to retrieve the sample adaptive authentication templates. <br>
          <b>Scope(Permission) required:</b> `internal_application_mgt_view`
      operationId: getAdaptiveAuthTemplates
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AdaptiveAuthTemplates'
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /applications/meta/groups:
    get:
      tags:
        - Application Metadata
      summary: |
        Retrieve the list of groups available for the application.
      description: >
        This API provides the capability to retrieve the list of groups available for the application. <br>
          <b>Permission required:</b> <br>
              * /permission/admin/manage/identity/applicationmgt/view <br>
          <b>Scope required:</b> <br>
              * internal_application_mgt_view
      parameters:
        - $ref: '#/components/parameters/domainQueryParam'
        - $ref: '#/components/parameters/filterQueryParam'
      operationId: getGroups
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/GroupBasicInfo'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /applications/templates:
    get:
      tags:
        - Application Templates
      operationId: getAllApplicationTemplates
      summary: |
        List application templates.
      description: |
        This API provides the capability to retrieve the list of templates available. <br>
          <b>Scope(Permission) required:</b> `internal_application_mgt_view`
      parameters:
        - $ref: '#/components/parameters/limitWithoutDefaultQueryParam'
        - $ref: '#/components/parameters/offsetWithoutDefaultQueryParam'
        - $ref: '#/components/parameters/filterQueryParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApplicationTemplatesList'
        '400':
          description: "Bad Request"
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: "Unauthorized"
        '403':
          description: "Forbidden"
        '404':
          description: "Not Found"
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: "Server Error"
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '501':
          description: "Not Implemented"
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
    post:
      tags:
        - Application Templates
      summary: |
        Add application template.
      operationId: createApplicationTemplate
      description: >
        This API provides the capability to store the application template provided by users. <br>
          <b>Scope(Permission) required:</b> `internal_application_mgt_create`
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ApplicationTemplateModel'
        description: "This represents the application template to be created."
        required: true
      responses:
        '201':
          description: "Successful response."
          headers:
            Location:
              description: "Location of the newly created application template."
              schema:
                type: string
                example: "/t/wso2.com/api/server/v1/applications/templates/85e3f4b8-0d22-4181-b1e3-1651f71b88bd"
        '400':
          description: "Bad Request"
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: "Unauthorized"
        '403':
          description: "Forbidden"
        '409':
          description: "Conflict"
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: "Server Error"
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '501':
          description: "Not Implemented"
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /applications/templates/{template-id}:
    get:
      tags:
        - Application Templates
      summary: |
        Retrieve application template by ID.
      operationId: getApplicationTemplate
      description: >
        This API provides the capability to retrieve the application template from the template id. <br>
          <b>Scope(Permission) required:</b> `internal_application_mgt_view`
      parameters:
        - $ref: '#/components/parameters/templateIdPathParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApplicationTemplateModel'
        '400':
          description: "Bad Request"
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
            application/xml:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: "Unauthorized"
        '403':
          description: "Forbidden"
        '404':
          description: "Not Found"
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
            application/xml:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: "Server Error"
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
            application/xml:
              schema:
                $ref: '#/components/schemas/Error'
    put:
      tags:
        - Application Templates
      summary: |
        Update the application template by the template ID.
      operationId: updateApplicationTemplate
      description: |
        This API provides the capability to update an application template by the template ID. <br>
          <b>Scope(Permission) required:</b> `internal_application_mgt_update`
      parameters:
        - $ref: '#/components/parameters/templateIdPathParam'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ApplicationTemplateModel'
        description: "This represents the new application template."
        required: true
      responses:
        '200':
          description: "Successfully Updated"
        '400':
          description: "Bad Request"
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: "Unauthorized"
        '403':
          description: "Forbidden"
        '404':
          description: "Not Found"
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '409':
          description: "Conflict"
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: "Server Error"
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
    delete:
      tags:
        - Application Templates
      summary: |
        Delete application template by template ID.
      operationId: deleteApplicationTemplate
      description: |
        This API provides the capability to delete an application template by template ID. <br>
          <b>Scope(Permission) required:</b> `internal_application_mgt_delete`
      parameters:
        - $ref: '#/components/parameters/templateIdPathParam'
      responses:
        '204':
          description: "Successfully Deleted"
        '400':
          description: "Bad Request"
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: "Unauthorized"
        '403':
          description: "Forbidden"
        '404':
          description: "Not Found"
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
            application/xml:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: "Server Error"
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /applications/{applicationId}/share:
    post:
      deprecated: true
      summary: |
        Share the application from the root organization to the given organization(s).
      description: |
        This API provides the capability to share an application with organizations. <br>
          <b>Scope(Permission) required:</b> `internal_shared_application_create`
      operationId: shareOrgApplication
      parameters:
        - name: applicationId
          in: path
          description: ID of the application which will be shared to organizations.
          required: true
          schema:
            type: string
            example: c75e27f9-98c7-4518-a968-c6cd59f0ac6b
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ApplicationSharePOSTRequest'
        required: true
      responses:
        '200':
          description: Ok
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      tags:
        - Application Sharing
    get:
      summary: |
        List of organizations that the application is shared to.
      description: |
        This API returns the list of organizations that the application is shared to. <br>
          <b>Scope(Permission) required:</b> `internal_shared_application_view`
      operationId: shareOrgApplicationGet
      parameters:
        - name: applicationId
          in: path
          description: ID of the application which is shared to organizations.
          required: true
          schema:
            type: string
        - $ref: '#/components/parameters/before'
        - $ref: '#/components/parameters/after'
        - $ref: '#/components/parameters/filter'
        - $ref: '#/components/parameters/sharedOrganizationsLimit'
        - $ref: '#/components/parameters/recursiveQueryParam'
        - $ref: '#/components/parameters/applicationShareExcludedQueryParam'
        - $ref: '#/components/parameters/applicationShareAttributesQueryParam'
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SharedOrganizationsResponse'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      tags:
        - Application Sharing
  /applications/{applicationId}/shared-apps:
    get:
      summary: |
        List of shared applications along with its organization.
      description: |
        This API returns the list of shared app ids along with the shared organization id. <br>
          <b>Scope(Permission) required:</b> `internal_shared_application_view`
      operationId: sharedApplicationsGet
      parameters:
        - name: applicationId
          in: path
          description: ID of the application which is shared to organizations.
          required: true
          schema:
            type: string
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SharedApplicationsResponse'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      tags:
        - Application Sharing
    delete:
      description: |
        This API provides the capability to stop sharing an application to all organizations
        the application is shared to. <br>
          <b>Scope(Permission) required:</b> `internal_shared_application_delete`
      summary: |
        Stop sharing an application with all organizations.
      operationId: sharedApplicationsAllDelete
      parameters:
        - name: applicationId
          in: path
          description: ID of the application.
          required: true
          schema:
            type: string
      responses:
        '204':
          description: Successfully deleted
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      tags:
        - Application Sharing
  /applications/{applicationId}/share/{shared-organization-id}:
    delete:
      deprecated: true
      description: |
        This API provides the capability to stop sharing an application to an organization by providing its ID. <br>
          <b>Scope(Permission) required:</b> `internal_shared_application_delete`
      summary: |
        Stop sharing an application to a organization.
      operationId: shareOrgApplicationDelete
      parameters:
        - name: applicationId
          in: path
          description: ID of the application.
          required: true
          schema:
            type: string
        - name: shared-organization-id
          in: path
          description: ID of the organization to stop sharing.
          required: true
          schema:
            type: string
      responses:
        '204':
          description: Successfully deleted
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      tags:
        - Organization Application Sharing
  /applications/share:
    post:
      tags: [ Application Sharing ]
      summary: Share a single application with specific organizations
      operationId: shareApplicationWithSelected
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/ApplicationShareSelectedRequestBody"
      responses:
        "202":
          description: Sharing process triggered successfully
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ProcessSuccessResponse"
    patch:
      tags: [ Application Sharing ]
      summary: Perform incremental sharing operations on an already shared application.
      operationId: patchApplicationSharing
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ApplicationSharingPatchRequest'
            examples:
              addRolesToOrg:
                summary: Add roles to an organization
                value:
                  applicationId: "app-123"
                  Operations:
                    - op: "add"
                      path: "organizations[orgId eq \"13b92afa-e7ee-4b01-bee0-2afb503b4d15\"].roles"
                      value:
                        - displayName: "App Viewer"
                          audience:
                            display: "My Org 1"
                            type: "organization"
                        - displayName: "App Admin"
                          audience:
                            display: "My Org 1"
                            type: "organization"
              removeRolesFromOrg:
                summary: Remove roles from an organization
                value:
                  applicationId: "app-123"
                  Operations:
                    - op: "remove"
                      path: "organizations[orgId eq \"org-2\"].roles"
                      value:
                        - displayName: "App Viewer"
                          audience:
                            display: "My Org 2"
                            type: "organization"
      responses:
        '202':
          description: Operation processed successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProcessSuccessResponse'

  /applications/share-with-all:
    post:
      tags: [ Application Sharing ]
      summary: Share a single application with all organizations
      operationId: shareApplicationWithAll
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/ApplicationShareAllRequestBody"
      responses:
        "202":
          description: Sharing process triggered successfully
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ProcessSuccessResponse"

  /applications/unshare:
    post:
      tags: [ Application Sharing ]
      summary: Unshare an application from specific orgs
      operationId: unshareApplicationFromSelected
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/ApplicationUnshareSelectedRequestBody"
      responses:
        "202":
          description: Unsharing process triggered successfully
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ProcessSuccessResponse"

  /applications/unshare-with-all:
    post:
      tags: [ Application Sharing ]
      summary: Unshare an application from all organizations
      operationId: unshareApplicationFromAll
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/ApplicationUnshareAllRequestBody"
      responses:
        "202":
          description: Unsharing process triggered successfully
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ProcessSuccessResponse"

  /applications/loginflow/generate:
    post:
      tags:
        - LoginFlow
      summary: Initiate login flow generation
      description: >
        This API provides the capability to initiate the generation of a login flow.
        <br>
        <b>Scope required:</b>
        * internal_application_mgt_update
      operationId: generateLoginFlow
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/LoginFlowGenerateRequest'
      responses:
        '202':
          description: Accepted
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/LoginFlowGenerateResponse'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'

  /applications/loginflow/status/{operation_id}:
    get:
      tags:
        - LoginFlow
      summary: Get the status of the login flow generation process
      description: >
        This API provides the capability to retrieve the status of the login flow generation process.
        <br>
        <b>Scope required:</b>
        * internal_application_mgt_update
      operationId: getLoginFlowGenerationStatus
      parameters:
        - name: operation_id
          in: path
          required: true
          schema:
            type: string
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/LoginFlowStatusResponse'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'

  /applications/loginflow/result/{operation_id}:
    get:
      tags:
        - LoginFlow
      summary: Get the final login flow result
      description: >
        This API provides the capability to retrieve the final login flow result.
        <br>
        <b>Scope required:</b>
        * internal_application_mgt_update
      operationId: getLoginFlowGenerationResult
      parameters:
        - name: operation_id
          in: path
          required: true
          schema:
            type: string
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/LoginFlowResultResponse'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
components:
  parameters:
    limitQueryParam:
      in: query
      name: limit
      required: false
      description: |
        Maximum number of records to return.
      schema:
        type: integer
        minimum: 1
        default: 30
    limitWithoutDefaultQueryParam:
      in: query
      name: limit
      required: false
      description: |
        Maximum number of records to return.
      schema:
        type: integer
    offsetQueryParam:
      in: query
      name: offset
      required: false
      description: |
        Number of records to skip for pagination.
      schema:
        type: integer
        default: 0
    offsetWithoutDefaultQueryParam:
      in: query
      name: offset
      required: false
      description: |
        Number of records to skip for pagination.
      schema:
        type: integer
    filterQueryParam:
      in: query
      name: filter
      required: false
      description: |
        Condition to filter the retrieval of records.
        Supports 'sw', 'co', 'ew', and 'eq' operations with 'and', 'or' logical operators.
        Note that 'and' and 'or' operators in filters follow the general precedence of logical operators.
        For example, A and B or C and D = (A and B) or (C and D)).
        Currently supports only filtering based on the 'name', the 'clientId', and the 'issuer' attributes.

        /applications?filter=name+eq+user_portal
        <br>
        /applications?filter=name+co+prod+or+clientId+co+123
      schema:
        type: string
    sortOrderQueryParam:
      in: query
      name: sortOrder
      required: false
      description: |
        Define the order in which the retrieved records should be sorted.
        _This parameter is not supported yet._
      schema:
        type: string
        enum:
          - ASC
          - DESC
    sortByQueryParam:
      in: query
      name: sortBy
      required: false
      description: |
        Attribute by which the retrieved records should be sorted.
        _This parameter is not supported yet._
      schema:
        type: string
    attributesQueryParam:
      in: query
      name: attributes
      required: false
      description: |
        Specifies the required parameters in the response.
        Only 'advancedConfigurations', 'templateId', 'templateVersion', 'clientId', 'issuer',
        and 'associatedRoles.allowedAudience' attributes are currently supported.

        /applications?attributes=advancedConfigurations,templateId,templateVersion,clientId,issuer,
        associatedRoles.allowedAudience
      schema:
        type: string
    excludeSystemPortalsQueryParam:
      in: query
      name: excludeSystemPortals
      required: false
      description: |
        Specifies whether to include or exclude system portals in the response. 
        Default will be treated as false if parameter is not preset in the request.

        /applications?excludeSystemPortals=true
      schema:
        type: boolean
    exportSecretsQueryParam:
      in: query
      name: exportSecrets
      required: false
      description: |
        Specifies whether to export secrets when exporting an application.
      schema:
        type: boolean
        default: false
    fileTypeHeaderParam:
      in: header
      name: Accept
      required: false
      description: |
        Content type of the file.
      schema:
        type: string
        default: application/xml
        enum:
          - application/json
          - application/xml
          - application/yaml
          - application/x-yaml
          - text/yaml
    inboundProtocolsCustomOnly:
      in: query
      name: customOnly
      required: false
      description: |
        Send only the custom inbound protocols.
      schema:
        type: boolean
        example: true
        default: false
    templateIdPathParam:
      in: path
      name: template-id
      required: true
      description: |
        Application template ID. This should be a valid locale.
      schema:
        type: string
    domainQueryParam:
      in: query
      name: domain
      required: false
      description: |
        The domain name of the user store used to filter the groups.

        /applications/meta/groups?domain=PRIMARY
      schema:
        type: string
    before:
      name: before
      in: query
      required: false
      description: |
        Base64 encoded cursor value for backward pagination.
      schema:
        type: string
      example: Ng==
    after:
      name: after
      in: query
      required: false
      description: |
        Base64 encoded cursor value for forward pagination.
      schema:
        type: string
      example: Ng==
    filter:
      name: filter
      in: query
      required: false
      description: |
        Condition to filter the retrieval of records. Supports 'sw', 'co', 'ew' and 'eq' operations.
      schema:
        type: string
      example: id+eq+088fb49c-46fa-48c1-a0a8-5538ee4b7ec5
    sharedOrganizationsLimit:
      name: limit
      in: query
      required: false
      description: |
        Maximum number of records to return.
      schema:
        type: integer
      example: 10
    recursiveQueryParam:
      in: query
      name: recursive
      required: false
      description: |
        Determines whether a recursive search should happen.
        If set to true, will include shared organizations in all levels of the hierarchy; If set to false, includes only shared organizations in the next level of the hierarchy.
      schema:
        type: boolean
    applicationShareExcludedQueryParam:
      in: query
      name: excludedAttributes
      description: | 
        excludedAttribute parameter.
      required: false
      schema:
        type: string
    applicationShareAttributesQueryParam:
      in: query
      name: attributes
      required: false
      description: |
        Specifies the required parameters in the response.
        Only 'sharingMode' attribute is currently supported.

        /applications/{applicationId}/share?attributes=sharingMode
      schema:
        type: string

  securitySchemes:
    BasicAuth:
      type: http
      scheme: basic
    OAuth2:
      type: oauth2
      flows:
        authorizationCode:
          authorizationUrl: 'https://localhost:9443/oauth2/authorize'
          tokenUrl: 'http://localhost:9443/oauth2/token'
          scopes: {}
  schemas:
    Link:
      type: object
      properties:
        href:
          type: string
          example: "applications?offset=10&limit=10"
        rel:
          type: string
          example: "next"
    ApplicationListResponse:
      type: object
      properties:
        totalResults:
          type: integer
          description: "Number of results that match the listing operation."
          example: 1
        startIndex:
          type: integer
          description: "Index of the first element of the page, which will be equal to offset + 1."
          example: 1
        count:
          type: integer
          description: "Number of elements in the returned page."
          example: 10
        applications:
          type: array
          items:
            $ref: '#/components/schemas/ApplicationListItem'
        links:
          type: array
          items:
            $ref: '#/components/schemas/Link'
    ApplicationListItem:
      type: object
      properties:
        id:
          type: string
          example: "85e3f4b8-0d22-4181-b1e3-1651f71b88bd"
        name:
          type: string
          example: "user-portal"
        description:
          type: string
          example: Application representing user portal
        applicationVersion:
          type: string
          example: "v1.0.0"
        image:
          type: string
          example: 'https://example.com/logo/my-logo.png'
        accessUrl:
          type: string
          example: 'https://example.com/app/login'
        clientId:
          type: string
          example: 'SmrrDNXRYf1lMmDlnleeHTuXx_Ea'
        issuer:
          type: string
          example: 'http://idp.example.com/metadata.php'
        realm:
          type: string
          example: 'PassiveSTSSampleApp'
        access:
          type: string
          enum:
            - READ
            - WRITE
          default: READ
        self:
          type: string
          example: "/t/wso2.com/api/server/v1/applications/85e3f4b8-0d22-4181-b1e3-1651f71b88bd"
        advancedConfigurations:
          $ref: '#/components/schemas/AdvancedApplicationConfiguration'
        templateId:
          type: string
          example: "980b8tester24c64a8a09a0d80abf8c337bd2555"
        templateVersion:
          type: string
          example: "v1.0.0"
          description: Version of the template used to create the application.
        associatedRoles:
          type: object
          $ref: '#/components/schemas/AssociatedRolesConfig'
        applicationEnabled:
          type: boolean
          example: true
    ApplicationModel:
      type: object
      required:
        - name
      properties:
        id:
          type: string
          example: "394b8adcce24c64a8a09a0d80abf8c337bd253de"
          readOnly: true
        name:
          type: string
          example: pickup
        description:
          type: string
          example: This is the configuration for Pickup application.
        imageUrl:
          type: string
          example: 'https://example.com/logo/my-logo.png'
        accessUrl:
          type: string
          example: 'https://example.com/login'
        logoutReturnUrl:
          type: string
          example: 'https://example.com/app/logout'
        templateId:
          type: string
          example: "980b8tester24c64a8a09a0d80abf8c337bd2555"
        templateVersion:
          type: string
          example: "v1.0.0"
          description: Version of the template used to create the application.
        isManagementApp:
          default: false
          type: boolean
          example: false
          description: Decides whether the application used to access System APIs
        isB2BSelfServiceApp:
          default: false
          type: boolean
          example: false
          description: Decides whether the application used to for B2B self service
        applicationEnabled:
          default: true
          type: boolean
          example: true
          description: Decides whether the application is enabled.
        associatedRoles:
          $ref: '#/components/schemas/AssociatedRolesConfig'
        claimConfiguration:
          $ref: '#/components/schemas/ClaimConfiguration'
        inboundProtocolConfiguration:
          $ref: '#/components/schemas/InboundProtocols'
        authenticationSequence:
          $ref: '#/components/schemas/AuthenticationSequence'
        advancedConfigurations:
          $ref: '#/components/schemas/AdvancedApplicationConfiguration'
        provisioningConfigurations:
          $ref: '#/components/schemas/ProvisioningConfiguration'
    ApplicationResponseModel:
      type: object
      required:
        - name
      properties:
        id:
          type: string
          example: "394b8adcce24c64a8a09a0d80abf8c337bd253de"
          readOnly: true
        name:
          type: string
          example: pickup
        description:
          type: string
          example: This is the configuration for Pickup application.
        applicationVersion:
          type: string
          example: "v1.0.0"
        imageUrl:
          type: string
          example: 'https://example.com/logo/my-logo.png'
        accessUrl:
          type: string
          example: 'https://example.com/login'
        logoutReturnUrl:
          type: string
          example: 'https://example.com/app/logout'
        clientId:
          type: string
          example: 'SmrrDNXRYf1lMmDlnleeHTuXx_Ea'
        issuer:
          type: string
          example: 'http://idp.example.com/metadata.php'
        realm:
          type: string
          example: 'PassiveSTSSampleApp'
        templateId:
          type: string
          example: "adwefi2429asdfdf94444rraf44"
        templateVersion:
          type: string
          example: "v1.0.0"
          description: Version of the template used to create the application.
        isManagementApp:
          type: boolean
          example: false
          description: Decides whether the application used to access System APIs
        isB2BSelfServiceApp:
          type: boolean
          example: false
          description: Decides whether the application used to for B2B self service
        applicationEnabled:
          type: boolean
          example: true
          description: Decides whether the application is enabled.
        associatedRoles:
          $ref: '#/components/schemas/AssociatedRolesConfig'
        claimConfiguration:
          $ref: '#/components/schemas/ClaimConfiguration'
        inboundProtocols:
          $ref: '#/components/schemas/InboundProtocolsListResponse'
        authenticationSequence:
          $ref: '#/components/schemas/AuthenticationSequence'
        advancedConfigurations:
          $ref: '#/components/schemas/AdvancedApplicationConfiguration'
        provisioningConfigurations:
          $ref: '#/components/schemas/ProvisioningConfiguration'
        access:
          type: string
          enum:
            - READ
            - WRITE
          default: READ
    ApplicationPatchModel:
      type: object
      properties:
        name:
          type: string
          example: pickup
        description:
          type: string
          example: This is the configuration for Pickup application.
        applicationVersion:
          type: string
          example: "v1.0.0"
        imageUrl:
          type: string
          example: 'https://example.com/logo/my-logo.png'
        accessUrl:
          type: string
          example: 'https://example.com/login'
        logoutReturnUrl:
          type: string
          example: 'https://example.com/app/logout'
        templateId:
          type: string
          example: "adwefi2429asdfdf94444rraf44"
        templateVersion:
          type: string
          example: "v1.0.1"
          description: Version of the template used to create the application.
        applicationEnabled:
          type: boolean
          example: true
          description: Decides whether the application is enabled.
        associatedRoles:
          $ref: '#/components/schemas/AssociatedRolesConfig'
        claimConfiguration:
          $ref: '#/components/schemas/ClaimConfiguration'
        authenticationSequence:
          $ref: '#/components/schemas/AuthenticationSequence'
        advancedConfigurations:
          $ref: '#/components/schemas/AdvancedApplicationConfiguration'
        provisioningConfigurations:
          $ref: '#/components/schemas/ProvisioningConfiguration'
    ResidentApplication:
      type: object
      properties:
        provisioningConfigurations:
          $ref: '#/components/schemas/ProvisioningConfiguration'
    ProvisioningConfiguration:
      type: object
      properties:
        inboundProvisioning:
          $ref: '#/components/schemas/InboundSCIMProvisioningConfiguration'
        outboundProvisioningIdps:
          type: array
          items:
            $ref: '#/components/schemas/OutboundProvisioningConfiguration'
    InboundSCIMProvisioningConfiguration:
      type: object
      properties:
        proxyMode:
          type: boolean
          example: false
        provisioningUserstoreDomain:
          type: string
          example: PRIMARY
          description: >-
            This property becomes only applicable if the proxy-mode config is
            set to false
    OutboundProvisioningConfiguration:
      type: object
      properties:
        idp:
          type: string
          example: Google
        connector:
          type: string
          example: googleapps
        blocking:
          type: boolean
          example: false
        rules:
          type: boolean
          example: false
        jit:
          type: boolean
          example: false
      description: >-
        This property is disabled by default as of Identity Server version 7.0 onwards.
    ScriptUpdateModel:
      type: object
      required:
        - script
      properties:
        script:
          type: string
          example: "var onLoginRequest = function(context) {\n    executeStep(1);\n};\n"
          description: Authentication Script to be updated.
    ConfiguredAuthenticatorsModal:
      type: object
      properties:
        stepId:
          type: integer
          example: 1
        localAuthenticators:
          type: array
          items:
            $ref: '#/components/schemas/ConfiguredAuthenticator'
        federatedAuthenticators:
          type: array
          items:
            $ref: '#/components/schemas/ConfiguredAuthenticator'
    ConfiguredAuthenticator:
      type: object
      properties:
        name:
          type: string
          example: sampleIdP
        type:
          type: string
          example: SampleAuthenticator
    AdvancedApplicationConfiguration:
      type: object
      properties:
        saas:
          type: boolean
          example: false
          description: Decides whether the application is accessible across tenants.
        discoverableByEndUsers:
          type: boolean
          example: false
          description: Decides whether the application is visible for end users.
        discoverableGroups:
          type: array
          items:
            $ref: '#/components/schemas/DiscoverableGroup'
          description: List of groups from user stores where users in those groups can discover the application.
        certificate:
          $ref: '#/components/schemas/Certificate'
        skipLoginConsent:
          type: boolean
          example: false
          description: Decides whether user consent needs to be skipped during login flows.
        skipLogoutConsent:
          type: boolean
          example: false
          description: Decides whether user consent needs to be skipped during logout flows.
        useExternalConsentPage:
          type: boolean
          example: false
          description: Decides whether users should be presented with an external consent page.
        returnAuthenticatedIdpList:
          type: boolean
          example: false
          description: Decides whether the list of authenticated identity providers need to be returned in the authentication response.
        enableAuthorization:
          type: boolean
          description: Decides whether authorization policies needs to be engaged during authentication flows.
          example: true
        fragment:
          type: boolean
          description: Decides whether application is a fragment application.
          example: false
        enableAPIBasedAuthentication:
          type: boolean
          description: Decides whether API Based Authentication is enabled for this application.
          example: false
        attestationMetaData:
          type: object
          description: Decides the client attestation meta data for the application.
          properties:
            enableClientAttestation:
              type: boolean
              description: Decides whether client attestation enabled for this application.
              example: false
            androidPackageName:
              type: string
              description: Decides the android package name of the application.
              example: "com.wso2.mobile.sample"
            androidAttestationServiceCredentials:
              type: object
              description: Decides the credentials for the service account to access Google Play Integrity Service.
            appleAppId:
              type: string
              description: Decides the apple app id which denotes {apple-teamId}.{bundleId}.
              example: "APPLETEAMID.com.wso2.mobile.sample"
        trustedAppConfiguration:
          $ref: '#/components/schemas/TrustedAppConfiguration'
        additionalSpProperties:
          $ref: '#/components/schemas/AdditionalProperties'
    AdditionalProperties:
      type: array
      description: Denotes additional properties of the application. It is only supported by getApplication and getAllApplications request.
      items:
        $ref: "#/components/schemas/AdditionalSpProperty"
    AdditionalSpProperty:
      type: object
      required:
        - name
        - value
      properties:
        name:
          type: string
          example: "isInternalApp"
        value:
          type: string
          example: "true"
        displayName:
          type: string
          example: "Internal Application"
    TrustedAppConfiguration:
      type: object
      description: Decides the trusted app configurations for the application.
      properties:
        isFIDOTrustedApp:
          type: boolean
          description: Decides whether the application is a FIDO trusted app.
          example: false
        isConsentGranted:
          type: boolean
          description: Decides whether consent is granted for the trusted app.
          example: false
        androidPackageName:
          type: string
          description: Decides the android package name for the application.
          example: "com.wso2.mobile.sample"
        androidThumbprints:
          type: array
          items:
            type: string
            example:
              - "18:94:0A:DE:63:77:B6:84:43:1E:85:8F:03:CF:8A:14:87:9C:DE:DF:EA:7A:25:53:CD:53:5A:AF:C3:54:A5:56"
          description: Decides the android thumbprints for the application.
        appleAppId:
          type: string
          description: Decides the apple app id for the application.
          example: "APPLETEAMID.com.org.mobile.sample"
    DiscoverableGroup:
      type: object
      required:
        - userStore
        - groups
      properties:
        userStore:
          type: string
          description: The user store domain to which the groups belong.
          example: "PRIMARY"
        groups:
          type: array
          items:
            $ref: '#/components/schemas/GroupBasicInfo'
          minItems: 1
          description: List of groups configured for discoverability.
    GroupBasicInfo:
      type: object
      required:
        - id
      properties:
        id:
          type: string
          description: The unique identifier of the group.
          example: "bf5abd05-3667-4a2a-a6c2-2fb9f4d26e47"
        name:
          type: string
          description: The name of the group.
          example: "GroupA"
    Certificate:
      type: object
      properties:
        type:
          type: string
          description: >-
            Certificate type. This should be either JWKS or PEM.
        value:
          type: string
          description: >-
            Certificate value. If type is JWKS, value should be jwks URL. If
            type is PEM, value should be the certificate in PEM format.
    InboundProtocols:
      type: object
      properties:
        saml:
          $ref: '#/components/schemas/SAML2Configuration'
        oidc:
          $ref: '#/components/schemas/OpenIDConnectConfiguration'
        passiveSts:
          $ref: '#/components/schemas/PassiveStsConfiguration'
        wsTrust:
          $ref: '#/components/schemas/WSTrustConfiguration'
        custom:
          type: array
          items:
            $ref: '#/components/schemas/CustomInboundProtocolConfiguration'
    InboundProtocolsListResponse:
      type: array
      items:
        $ref: '#/components/schemas/InboundProtocolListItem'
    InboundProtocolListItem:
      type: object
      required:
        - type
        - name
        - self
      properties:
        type:
          type: string
          example: "samlsso"
        name:
          type: string
          example: "SAML2 Inbound"
        self:
          type: string
          example: "/api/server/v1/applications/29048810-1447-4ea0-a348-30d15ab65fa3/inbound-protocols/saml"
    ClaimConfiguration:
      type: object
      properties:
        dialect:
          type: string
          enum:
            - CUSTOM
            - LOCAL
          default: LOCAL
        claimMappings:
          type: array
          items:
            $ref: '#/components/schemas/ClaimMappings'
        requestedClaims:
          type: array
          items:
            $ref: '#/components/schemas/RequestedClaimConfiguration'
        subject:
          $ref: '#/components/schemas/SubjectConfig'
        role:
          $ref: '#/components/schemas/RoleConfig'
    SubjectConfig:
      type: object
      properties:
        claim:
          $ref: '#/components/schemas/Claim'
        includeUserDomain:
          type: boolean
          example: false
        includeTenantDomain:
          type: boolean
          example: false
        useMappedLocalSubject:
          type: boolean
          example: false
        mappedLocalSubjectMandatory:
          type: boolean
          example: false
    RoleConfig:
      type: object
      properties:
        mappings:
          type: array
          items:
            $ref: '#/components/schemas/RoleMapping'
        includeUserDomain:
          type: boolean
          example: true
        claim:
          $ref: '#/components/schemas/Claim'
    RoleMapping:
      type: object
      required:
        - localRole
        - applicationRole
      properties:
        localRole:
          type: string
          example: admin
        applicationRole:
          type: string
          example: Administrator
    AssociatedRolesConfig:
      type: object
      required:
        - allowedAudience
      properties:
        allowedAudience:
          type: string
          example: "ORGANIZATION"
          enum:
            - ORGANIZATION
            - APPLICATION
          default: ORGANIZATION
        roles:
          type: array
          items:
            $ref: '#/components/schemas/Role'
    Role:
      type: object
      required:
        - id
      properties:
        id:
          type: string
          example: "bf5abd05-3667-4a2a-a6c2-2fb9f4d26e47"
        name:
          type: string
          example: "RoleA"
    RequestedClaimConfiguration:
      type: object
      required:
        - claim
      description: >-
        User claims that need to be sent back to the application. If the
        claim mappings are local, use local claim URIs. If the custom claim
        mappings are configured, use the mapped application claim URI
      properties:
        claim:
          $ref: '#/components/schemas/Claim'
        mandatory:
          type: boolean
          example: false
    ClaimMappings:
      type: object
      required:
        - applicationClaim
        - localClaim
      properties:
        applicationClaim:
          type: string
          description: "Claim URI recieved by the application"
          example: firstname
        localClaim:
          $ref: '#/components/schemas/Claim'
    Claim:
      type: object
      required:
        - uri
      properties:
        id:
          type: string
          example: aHR0cDovL3dzbzIub3JnL2NsYWltcy91c2VybmFtZQ
          readOnly: true
        uri:
          type: string
          example: 'http://wso2.org/claims/username'
        displayName:
          type: string
          example: Username
          readOnly: true
    SAML2Configuration:
      type: object
      properties:
        metadataFile:
          type: string
          example: 'Base64 encoded metadata file content'
        metadataURL:
          type: string
          example: 'https://example.com/samlsso/meta'
        manualConfiguration:
          $ref: '#/components/schemas/SAML2ServiceProvider'
    SingleSignOnProfile:
      type: object
      properties:
        bindings:
          type: array
          items:
            type: string
            enum:
              - HTTP_POST
              - HTTP_REDIRECT
              - ARTIFACT
        enableSignatureValidationForArtifactBinding:
          type: boolean
          description: Enables Signature validation for SAML Artifact Binding. Applicable only if SAML Artifact binding is enabled through the bindings option.
          default: false
        attributeConsumingServiceIndex:
          type: string
          readOnly: true
        enableIdpInitiatedSingleSignOn:
          type: boolean
          default: false
        assertion:
          $ref: '#/components/schemas/SAMLAssertionConfiguration'
    SAMLAttributeProfile:
      type: object
      properties:
        enabled:
          type: boolean
          default: false
        alwaysIncludeAttributesInResponse:
          type: boolean
          default: false
        nameFormat:
          type: string
          default: 'urn:oasis:names:tc:SAML:2.0:attrname-format:basic'
          description: The name format of attributes in the SAML assertion attribute statement.
    SingleLogoutProfile:
      type: object
      properties:
        enabled:
          type: boolean
          default: true
        logoutRequestUrl:
          type: string
          description: Single logout request accepting endpoint
        logoutResponseUrl:
          type: string
          description: Single logout response accepting endpoint
        logoutMethod:
          type: string
          enum:
            - BACKCHANNEL
            - FRONTCHANNEL_HTTP_REDIRECT
            - FRONTCHANNEL_HTTP_POST
        idpInitiatedSingleLogout:
          $ref: '#/components/schemas/IdpInitiatedSingleLogout'
    IdpInitiatedSingleLogout:
      type: object
      properties:
        enabled:
          type: boolean
          default: false
        returnToUrls:
          type: array
          items:
            type: string
    SAMLAssertionConfiguration:
      type: object
      properties:
        nameIdFormat:
          type: string
          default: 'urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified'
          example: 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress'
        audiences:
          type: array
          description: Additional audience values to be added to the SAML Assertions
          example:
            - 'https://app.example.com/saml'
          items:
            type: string
        recipients:
          type: array
          description: Additional recipient values to be added to the SAML Assertions
          example:
            - 'https://app.example.com/saml'
          items:
            type: string
        digestAlgorithm:
          type: string
          default: "http://www.w3.org/2000/09/xmldsig#sha1"
          example: "http://www.w3.org/2000/09/xmldsig#sha1"
        encryption:
          $ref: '#/components/schemas/AssertionEncryptionConfiguration'
    AssertionEncryptionConfiguration:
      type: object
      properties:
        enabled:
          type: boolean
          default: false
        assertionEncryptionAlgorithm:
          type: string
          default: "http://www.w3.org/2001/04/xmlenc#aes256-cbc"
        keyEncryptionAlgorithm:
          type: string
          default: "http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p"
    SAMLRequestValidation:
      type: object
      properties:
        enableSignatureValidation:
          type: boolean
          default: true
        signatureValidationCertAlias:
          type: string
    SAMLResponseSigning:
      type: object
      properties:
        enabled:
          type: boolean
          default: true
        signingAlgorithm:
          type: string
    SAML2ServiceProvider:
      type: object
      required:
        - issuer
        - assertionConsumerUrls
      properties:
        issuer:
          type: string
        serviceProviderQualifier:
          type: string
        assertionConsumerUrls:
          type: array
          items:
            type: string
          minItems: 1
        defaultAssertionConsumerUrl:
          type: string
          description: "If not provided, the first assertion consumer URL on the assertionConsumerUrls will be picked as the default assertion consumer URL."
        idpEntityIdAlias:
          type: string
          description: "Default value is the IdP Entity ID value specified in Resident IdP."
        singleSignOnProfile:
          $ref: '#/components/schemas/SingleSignOnProfile'
        attributeProfile:
          $ref: '#/components/schemas/SAMLAttributeProfile'
        singleLogoutProfile:
          $ref: '#/components/schemas/SingleLogoutProfile'
        requestValidation:
          $ref: '#/components/schemas/SAMLRequestValidation'
        responseSigning:
          $ref: '#/components/schemas/SAMLResponseSigning'
        enableAssertionQueryProfile:
          type: boolean
          default: false
    OpenIDConnectConfiguration:
      type: object
      required:
        - grantTypes
      properties:
        clientId:
          type: string
        clientSecret:
          type: string
        state:
          type: string
          enum:
            - ACTIVE
            - REVOKED
          readOnly: true
          default: ACTIVE
        grantTypes:
          type: array
          example:
            - authorization_code
            - password
          items:
            type: string
          minItems: 1
        callbackURLs:
          type: array
          description: Authorized redirect URIs
          example:
            - 'regexp=(https://app.example.com/callback1|https://app.example.com/callback2)'
          items:
            type: string
        allowedOrigins:
          type: array
          description: Authorized JavaScript origins. CORS requests will be allowed to these origins.
          example:
            - 'https://app.example.com'
          items:
            type: string
        publicClient:
          type: boolean
          default: false
          description: >-
            Enabling this option will allow the client to authenticate without a
            client secret.
          example: false
        pkce:
          $ref: '#/components/schemas/OAuth2PKCEConfiguration'
        accessToken:
          $ref: '#/components/schemas/AccessTokenConfiguration'
        hybridFlow:
          $ref: '#/components/schemas/HybridFlowConfiguration'
        refreshToken:
          $ref: '#/components/schemas/RefreshTokenConfiguration'
        subjectToken:
          $ref: '#/components/schemas/SubjectTokenConfiguration'
        idToken:
          $ref: '#/components/schemas/IdTokenConfiguration'
        logout:
          $ref: '#/components/schemas/OIDCLogoutConfiguration'
        validateRequestObjectSignature:
          type: boolean
          default: false
          example: false
        scopeValidators:
          type: array
          example:
            - Role based scope validator
            - XACML Scope Validator
          items:
            type: string
        clientAuthentication:
          $ref: '#/components/schemas/ClientAuthenticationConfiguration'
        requestObject:
          $ref: '#/components/schemas/RequestObjectConfiguration'
        pushAuthorizationRequest:
          $ref: '#/components/schemas/PushAuthorizationRequestConfiguration'
        subject:
          $ref: '#/components/schemas/SubjectConfiguration'
        isFAPIApplication:
          type: boolean
          default: false
          description: Enabling this option will make the application FAPI conformant.
          example: false
        cibaAuthenticationRequest:
          $ref: '#/components/schemas/CIBAAuthenticationRequestConfiguration'
        issuer:
          $ref: '#/components/schemas/AllowedIssuer'
    OAuth2PKCEConfiguration:
      type: object
      properties:
        mandatory:
          type: boolean
          example: false
        supportPlainTransformAlgorithm:
          type: boolean
          example: true
    HybridFlowConfiguration:
      type: object
      properties:
        enable:
          type: boolean
          description: "Indicates whether the hybrid flow is enabled."
          example: true
        responseType:
          type: string
          description: "Specifies the allowed response types for the hybrid flow, provided as a comma-separated string. 
          The supported combinations are: 'code token', 'code id_token token', and 'code id_token'."
          example: code id_token,code token
    AccessTokenConfiguration:
      type: object
      properties:
        type:
          type: string
          example: JWT
        userAccessTokenExpiryInSeconds:
          type: integer
          format: int64
          example: 3600
        applicationAccessTokenExpiryInSeconds:
          type: integer
          format: int64
          example: 3600
        bindingType:
          type: string
          description: "OAuth2 access token and refresh token can be bound to an external attribute during the token
          generation so that it can be optionally validated during the API invocation."
          default: "None"
          example: cookie
        revokeTokensWhenIDPSessionTerminated:
          type: boolean
          description: "If enabled, when the IDP session is terminated, all the access tokens bound to the session
          will get revoked."
        validateTokenBinding:
          type: boolean
          description: "If enabled, both access token and the token binding needs to be present for a successful API
          invocation."
        accessTokenAttributes:
          type: array
          items:
            type: string
        enableJwtScopeAsArray:
          type: boolean
          description: If enabled, the scope claim in JWT access tokens will be formatted as a JSON array.
    RefreshTokenConfiguration:
      type: object
      properties:
        expiryInSeconds:
          type: integer
          format: int64
          example: 86400
        extendRenewedRefreshTokenExpiryTime:
          description: "Decides whether the expiry time of the renewed refresh token needs to be extended based on the
            refresh token expiry time configured."
          type: boolean
          example: false
        renewRefreshToken:
          description: Decides whether the refresh token needs to be renewed during refresh grant flow.
          type: boolean
          example: true
    SubjectTokenConfiguration:
      type: object
      properties:
        enable:
          type: boolean
          description: "If enabled, subject token can be issued for token exchange grant type."
        applicationSubjectTokenExpiryInSeconds:
          type: integer
          example: 3600
    IdTokenConfiguration:
      type: object
      properties:
        expiryInSeconds:
          type: integer
          format: int64
          example: 3600
        audience:
          type: array
          example:
            - 'http://idp.xyz.com'
            - 'http://idp.abc.com'
          items:
            type: string
        idTokenSignedResponseAlg:
          type: string
          example: 'PS256'
        encryption:
          $ref: '#/components/schemas/IdTokenEncryptionConfiguration'
    IdTokenEncryptionConfiguration:
      type: object
      properties:
        enabled:
          type: boolean
          default: false
          example: false
        algorithm:
          type: string
          example: RSA-OAEP
        method:
          type: string
          example: A128CBC+HS256
    ClientAuthenticationConfiguration:
      type: object
      properties:
        tokenEndpointAuthMethod:
          type: string
          example: 'client_secret_basic'
        tokenEndpointAllowReusePvtKeyJwt:
          type: boolean
          example: false
        tokenEndpointAuthSigningAlg:
          type: string
          example: 'PS256'
        tlsClientAuthSubjectDn:
          type: string
          example: 'CN=John Doe,OU=OrgUnit,O=Organization,L=Colombo,ST=Western,C=LK'
    RequestObjectConfiguration:
      type: object
      properties:
        requestObjectSigningAlg:
          type: string
          example: 'PS256'
        encryption:
          $ref: '#/components/schemas/RequestObjectEncryptionConfiguration'
    RequestObjectEncryptionConfiguration:
      type: object
      properties:
        algorithm:
          type: string
          example: RSA-OAEP
        method:
          type: string
          example: A128CBC+HS256
    PushAuthorizationRequestConfiguration:
      type: object
      properties:
        requirePushAuthorizationRequest:
          type: boolean
          example: false
    SubjectConfiguration:
      type: object
      properties:
        subjectType:
          type: string
          example: 'public'
        sectorIdentifierUri:
          type: string
          example: 'https://app.example.com'
    OIDCLogoutConfiguration:
      type: object
      properties:
        backChannelLogoutUrl:
          type: string
          example: 'https://app.example.com/backchannel/callback'
        frontChannelLogoutUrl:
          type: string
          example: 'https://app.example.com/frontchannel/callback'
    PassiveStsConfiguration:
      type: object
      required:
        - realm
        - replyTo
      properties:
        realm:
          type: string
        replyTo:
          type: string
        replyToLogout:
          type: string
    WSTrustConfiguration:
      type: object
      required:
        - audience
        - certificateAlias
      properties:
        audience:
          type: string
          description: Audience value of the trusted service
          example: https://wstrust.endpoint.com
        certificateAlias:
          type: string
          example: "wso2carbon"
    CustomInboundProtocolConfiguration:
      type: object
      required:
        - name
        - configName
      properties:
        name:
          type: string
          example: cas
        configName:
          type: string
          example: cas
        properties:
          type: array
          items:
            $ref: '#/components/schemas/PropertyModel'
    PropertyModel:
      type: object
      properties:
        key:
          type: string
          example: app-identifier
        value:
          type: string
          example: 'http://app.wso2.com/employeeApp'
        friendlyName:
          type: string
          example: Application Identifier
    AuthenticationSequence:
      type: object
      properties:
        type:
          type: string
          description: "
          - DEFAULT type indicates that the application will use the default authentication sequence specified at the tenant level. When the DEFAULT type is used, the information given in the other fields of the AuthenticationSequence will be ignored and overriden with values defined at the tenant level.

           - USER_DEFINED type indicates that the application will use a user-defined authentication sequence."
          enum:
            - DEFAULT
            - USER_DEFINED
          default: DEFAULT
        steps:
          type: array
          items:
            $ref: '#/components/schemas/AuthenticationStepModel'
        requestPathAuthenticators:
          type: array
          items:
            type: string
        script:
          type: string
        subjectStepId:
          type: integer
          default: 1
          example: 1
        attributeStepId:
          type: integer
          default: 1
          example: 1
    AuthenticationStepModel:
      type: object
      required:
        - id
        - options
      properties:
        id:
          type: integer
          minimum: 1
          example: 1
        options:
          type: array
          items:
            $ref: '#/components/schemas/Authenticator'
          minItems: 1
    Authenticator:
      type: object
      required:
        - idp
        - authenticator
      properties:
        idp:
          type: string
          example: LOCAL
        authenticator:
          type: string
          example: basic
    AuthProtocolMetadata:
      type: object
      properties:
        name:
          type: string
        displayName:
          type: string
    MetadataProperty:
      type: object
      properties:
        options:
          type: array
          items:
            type: string
          example:
            - 'Option 1'
            - 'Option 2'
        defaultValue:
          type: string
          example: 'Option 1'
    ClientAuthenticationMethodMetadata:
      type: object
      properties:
        options:
          type: array
          items:
            $ref: '#/components/schemas/ClientAuthenticationMethod'
    FapiMetadata:
      type: object
      properties:
        allowedSignatureAlgorithms:
          $ref: '#/components/schemas/MetadataProperty'
        allowedEncryptionAlgorithms:
          $ref: '#/components/schemas/MetadataProperty'
        tokenEndpointAuthMethod:
          $ref: '#/components/schemas/ClientAuthenticationMethodMetadata'
    CIBAMetadata:
      type: object
      properties:
        supportedNotificationChannels:
          type: array
          items:
            $ref: '#/components/schemas/CIBANotificationChannel'
    CIBANotificationChannel:
      type: object
      properties:
        name:
          type: string
          example: email
        displayName:
          type: string
          example: Email
    AllowedIssuers:
      type: array
      items:
        $ref: '#/components/schemas/AllowedIssuer'
    AllowedIssuer:
      type: object
      properties:
        value:
          type: string
          readOnly: true
          description: Issuer detail that can be used for tokens.
          example: "https://localhost:9443/oauth2/token"
        organizationId:
          type: string
          description: Organization ID of the allowed issuer.
          example: "bdece142-646b-45c0-9385-a4159f1ea219"
        tenantDomain:
          type: string
          readOnly: true
          description: Tenant domain of the allowed issuer.
          example: "wso2.com"
    ClientAuthenticationMethod:
      type: object
      properties:
        name:
          type: string
          example: private_key_jwt
        displayName:
          type: string
          example: Private Key JWT
    GrantTypeMetaData:
      type: object
      properties:
        options:
          type: array
          items:
            $ref: '#/components/schemas/GrantType'
    GrantType:
      type: object
      properties:
        name:
          type: string
          example: authorization_code
        displayName:
          type: string
          example: Code
        publicClientAllowed:
          type: boolean
          example: false
    SAMLMetaData:
      type: object
      properties:
        defaultNameIdFormat:
          type: string
          example: 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress'
        certificateAlias:
          $ref: '#/components/schemas/MetadataProperty'
        responseSigningAlgorithm:
          $ref: '#/components/schemas/MetadataProperty'
        responseDigestAlgorithm:
          $ref: '#/components/schemas/MetadataProperty'
        assertionEncryptionAlgorithm:
          $ref: '#/components/schemas/MetadataProperty'
        keyEncryptionAlgorithm:
          $ref: '#/components/schemas/MetadataProperty'
    OIDCMetaData:
      type: object
      properties:
        allowedGrantTypes:
          $ref: '#/components/schemas/GrantTypeMetaData'
        defaultUserAccessTokenExpiryTime:
          type: string
          example: '3600'
        defaultApplicationAccessTokenExpiryTime:
          type: string
          example: '3600'
        defaultRefreshTokenExpiryTime:
          type: string
          example: '86400'
        defaultIdTokenExpiryTime:
          type: string
          example: '3600'
        idTokenEncryptionAlgorithm:
          $ref: '#/components/schemas/MetadataProperty'
        idTokenEncryptionMethod:
          $ref: '#/components/schemas/MetadataProperty'
        scopeValidators:
          $ref: '#/components/schemas/MetadataProperty'
        accessTokenType:
          $ref: '#/components/schemas/MetadataProperty'
        accessTokenBindingType:
          $ref: '#/components/schemas/MetadataProperty'
        tokenEndpointAuthMethod:
          $ref: '#/components/schemas/ClientAuthenticationMethodMetadata'
        tokenEndpointAllowReusePvtKeyJwt:
          type: boolean
          default: false
        tokenEndpointSignatureAlgorithm:
          $ref: '#/components/schemas/MetadataProperty'
        idTokenSignatureAlgorithm:
          $ref: '#/components/schemas/MetadataProperty'
        requestObjectSignatureAlgorithm:
          $ref: '#/components/schemas/MetadataProperty'
        requestObjectEncryptionAlgorithm:
          $ref: '#/components/schemas/MetadataProperty'
        requestObjectEncryptionMethod:
          $ref: '#/components/schemas/MetadataProperty'
        subjectType:
          $ref: '#/components/schemas/MetadataProperty'
        fapiMetadata:
          $ref: '#/components/schemas/FapiMetadata'
        cibaMetadata:
          $ref: '#/components/schemas/CIBAMetadata'
        allowedIssuers:
          $ref: '#/components/schemas/AllowedIssuers'
    WSTrustMetaData:
      type: object
      properties:
        certificateAlias:
          $ref: '#/components/schemas/MetadataProperty'
    CustomInboundProtocolMetaData:
      type: object
      properties:
        displayName:
          type: string
          example: 'My Custom Protocol'
        configName:
          type: string
          example: 'Custom Protocol'
        properties:
          type: array
          items:
            $ref: '#/components/schemas/CustomInboundProtocolProperty'
    CustomInboundProtocolProperty:
      type: object
      properties:
        name:
          type: string
          example: 'encryptionAlgorithm'
        displayName:
          type: string
          example: 'Encryption Algorithm'
        type:
          type: string
          enum:
            - STRING
            - BOOLEAN
            - INTEGER
          example: STRING
        required:
          type: boolean
          example: true
        availableValues:
          type: array
          items:
            type: string
            example:
              - 'http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p'
              - 'http://www.w3.org/2001/04/xmlenc#rsa-1_5'
        defaultValue:
          type: string
          example: 'http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p'
        validationRegex:
          type: string
          example: '^[a-b][A-B]*'
        displayOrder:
          type: integer
          example: 1
        isConfidential:
          type: boolean
          default: false
    AdaptiveAuthTemplates:
      type: object
      properties:
        templatesJSON:
          type: string
          example: 'Adaptive Auth Templates JSON'
    FileUpload:
      type: object
      properties:
        file:
          type: string
          format: binary
          description: file to upload
    ApplicationTemplatesList:
      type: object
      properties:
        templates:
          type: array
          items:
            $ref: '#/components/schemas/ApplicationTemplatesListItem'
    ApplicationTemplatesListItem:
      type: object
      properties:
        id:
          type: string
          example: "85e3f4b8-0d22-4181-b1e3-1651f71b88bd"
        name:
          type: string
          example: "OIDC Protocol Template"
        description:
          type: string
          example: "Template to be used for Single Page Applications"
        image:
          type: string
          example: "https://example.com/logo/my-logo.png"
        authenticationProtocol:
          type: string
          example: "oidc"
        types:
          type: array
          items:
            type: string
            example:
              - react
              - angular
        category:
          type: string
          enum: [DEFAULT, VENDOR]
          example: 'DEFAULT'
        displayOrder:
          type: integer
          example: 2
        templateGroup:
          type: string
          example: "web-application"
        self:
          type: string
          example: "/t/wso2.com/api/server/v1/applications/templates/85e3f4b8-0d22-4181-b1e3-1651f71b88bd"
    ApplicationTemplateModel:
      type: object
      properties:
        id:
          type: string
          readOnly: true
          example: "85e3f4b8-0d22-4181-b1e3-1651f71b88bd"
        name:
          type: string
          example: "OIDC Protocol Template"
        description:
          type: string
          example: "Template to be used for Single Page Applications"
        image:
          type: string
          example: "https://example.com/logo/my-logo.png"
        authenticationProtocol:
          type: string
          example: "oidc"
        types:
          type: array
          items:
            type: string
          example:
            - react
            - angular
        category:
          type: string
          enum: [DEFAULT, VENDOR]
          example: 'DEFAULT'
        templateGroup:
          type: string
          example: "web-application"
        displayOrder:
          type: integer
          example: 2
        application:
          $ref: '#/components/schemas/ApplicationModel'
      required:
        - name
        - application
    ApplicationOwner:
      type: object
      properties:
        id:
          type: string
          example: "85e3f4b8-0d22-4181-b1e3-1651f71b88bd"
      required:
        - id
    AuthorizedAPIResponse:
      type: object
      properties:
        id:
          type: string
          example: 65b52595-9ca1-4539-aca2-56178643c58b
        identifier:
          type: string
          example: https://greetings.io/v1/greet
        displayName:
          type: string
          example: Greetings API
        policyId:
          type: string
          example: RBAC
        type:
          type: string
          example: BUSINESS
        authorizedScopes:
          type: array
          items:
            $ref: '#/components/schemas/AuthorizedScope'
        authorizedAuthorizationDetailsTypes:
          type: array
          items:
            $ref: '#/components/schemas/AuthorizedAuthorizationDetailsTypes'
    AuthorizedScope:
      type: object
      properties:
        id:
          type: string
          example: 65b52595-9ca1-4539-aca2-56178643c58b
        name:
          type: string
          example: bookings:read
        displayName:
          type: string
          example: Read Bookings
    AuthorizedAuthorizationDetailsTypes:
      type: object
      required:
        - type
        - name
      properties:
        id:
          type: string
          example: a9403470-dd11-46b4-8db9-aaa31f1d4423
          description: an unique id of the registered authorization details type
        type:
          type: string
          example: payment_initiation
          description: an unique type of the authorization details type
        name:
          type: string
          minLength: 3
          maxLength: 255
          description: display name of the authorization details type
          example: Payment Initiation
    AuthorizedAPICreationModel:
      type: object
      properties:
        id :
          type: string
          example: 65b52595-9ca1-4539-aca2-56178643c58b
        policyIdentifier:
          type: string
          example: RBAC
        scopes:
          type: array
          items:
            type: string
            example: bookings:read
        authorizationDetailsTypes:
          type: array
          items:
            type: string
            example: payment_initiation
    AuthorizedAPIPatchModel:
      type: object
      properties:
        addedScopes:
          type: array
          items:
            type: string
            example: bookings:write
        removedScopes:
          type: array
          items:
            type: string
            example: bookings:read
        addedAuthorizationDetailsTypes:
          type: array
          items:
            type: string
            example: payment_initiation
        removedAuthorizationDetailsTypes:
          type: array
          items:
            type: string
            example: account_information
    Error:
      type: object
      properties:
        code:
          type: string
          example: AAA-00000
        message:
          type: string
          example: Some error message.
        description:
          type: string
          example: Some error description.
        traceId:
          type: string
          example: e0fbcfeb-3617-43c4-8dd0-7b7d38e13047
    ApplicationSharePOSTRequest:
      type: object
      properties:
        shareWithAllChildren:
          type: boolean
          default: false
        sharedOrganizations:
          type: array
          items:
            type: string
          example:
            - 682edf68-4835-4bb8-961f-0a16bc6cc866
            - ghfbctgf-4318-46d4-8ee1-7t3s38e23098
    SharedOrganizationsResponse:
      type: object
      properties:
        links:
          type: array
          items:
            $ref: '#/components/schemas/Link'
          example:
            [
              {
                "href": "/api/server/v1/applications/67f5a202-48c4-4313-9327-016da5f08f17/share?limit=10&recursive=false&next=MTA=",
                "rel": "next",
              },
              {
                "href": "/api/server/v1/applications/67f5a202-48c4-4313-9327-016da5f08f17/share?limit=10&recursive=false&before=MTA=",
                "rel": "previous",
              }
            ]
        sharingMode:
          $ref: '#/components/schemas/SharingMode'
        organizations:
          type: array
          items:
            $ref: '#/components/schemas/BasicOrganizationResponse'
    SharedApplicationsResponse:
      type: object
      properties:
        sharedApplications:
          type: array
          items:
            $ref: '#/components/schemas/SharedApplicationResponse'
    SharedApplicationResponse:
      type: object
      properties:
        applicationId:
          type: string
          description: Shared application's id.
          example: 'ca322554-fe79-4c04-9c94-492855ef92a3'
        organizationId:
          type: string
          description: Shared application residing organization id.
          example: '682edf68-4835-4bb8-961f-0a16bc6cc866'
    SharingMode:
      type: object
      required: [ roleSharing ]
      properties:
        policy:
          type: string
          enum: [ "ALL_EXISTING_AND_FUTURE_ORGS", "SELECTED_ORG_WITH_ALL_EXISTING_AND_FUTURE_CHILDREN" ]
          description: |
            - ALL_EXISTING_AND_FUTURE_ORGS: Share with all current and any newly created organizations in future.
            - SELECTED_ORG_WITH_ALL_EXISTING_AND_FUTURE_CHILDREN: Share with this organization and its current & future children.
        roleSharing:
          $ref: "#/components/schemas/RoleSharing"
    BasicOrganizationResponse:
      type: object
      required:
        - id
        - name
        - orgHandle
        - parentId
        - status
        - ref
        - hasChildren
        - depthFromRoot
        - roles
      properties:
        id:
          type: string
          example: 'b4526d91-a8bf-43d2-8b14-c548cf73065b'
        name:
          type: string
          example: 'ABC Builders'
        orgHandle:
          type: string
          example: 'abcbuilders'
        parentId:
          type: string
          example: '08f8c1d2-4b3e-4c5a-9f6b-7d8e9f0a1b2c'
          description: |
              The parent organization ID.
        status:
          type: string
          enum: [ ACTIVE, DISABLED ]
          example: ACTIVE
        ref:
          type: string
          example: '/t/wso2.com/api/server/v1/organizations/b4526d91-a8bf-43d2-8b14-c548cf73065b'
        hasChildren:
          type: boolean
          example: true
        depthFromRoot:
          type: integer
          example: 1
        sharingMode:
          $ref: '#/components/schemas/SharingMode'
        roles:
          type: array
          items:
              $ref: '#/components/schemas/RoleShareConfig'
          description: "List of roles that are shared with the application in this organization."
    ApplicationShareSelectedRequestBody:
      type: object
      required: [ applicationId, organizations ]
      properties:
        applicationId:
          type: string
        organizations:
          type: array
          items:
            $ref: "#/components/schemas/OrgShareConfig"

    OrgShareConfig:
      type: object
      required: [ orgId, policy, roleSharing ]
      properties:
        orgId:
          type: string
        policy:
          type: string
          enum: [ "SELECTED_ORG_ONLY",
                  "SELECTED_ORG_WITH_ALL_EXISTING_AND_FUTURE_CHILDREN",
                  "NO_ORG" ] # This NO_ORG is added due to an issue with our generator. This is not a valid policy.
          description: |
            - SELECTED_ORG_ONLY: Share app with only this specific organizations.
            - SELECTED_ORG_WITH_ALL_EXISTING_AND_FUTURE_CHILDREN: Share with this organization and its current & future children.
        roleSharing:
          $ref: "#/components/schemas/RoleSharing"

    ApplicationShareAllRequestBody:
      type: object
      required: [ applicationId, policy, roleSharing ]
      properties:
        applicationId:
          type: string
        policy:
          type: string
          enum: [ "ALL_EXISTING_ORGS_ONLY",
                  "ALL_EXISTING_AND_FUTURE_ORGS",
                  "NO_ORGS" ] # This NO_ORG is added due to an issue with our generator. This is not a valid policy.
          description: |
            - ALL_EXISTING_ORGS_ONLY: Share with all organizations currently present.
            - ALL_EXISTING_AND_FUTURE_ORGS: Share with all current and any newly created organizations in future.
        roleSharing:
          $ref: "#/components/schemas/RoleSharing"

    ApplicationUnshareSelectedRequestBody:
      type: object
      required: [ applicationId, orgIds ]
      properties:
        applicationId:
          type: string
        orgIds:
          type: array
          items:
            type: string

    ApplicationUnshareAllRequestBody:
      type: object
      required: [ applicationId ]
      properties:
        applicationId:
          type: string

    ApplicationSharingPatchRequest:
      type: object
      required: [ applicationId, Operations ]
      properties:
        applicationId:
          type: string
        Operations:
          type: array
          items:
            $ref: "#/components/schemas/ApplicationSharingPatchOperation"

    ApplicationSharingPatchOperation:
      type: object
      required: [ op, path ]
      properties:
        op:
          type: string
          description: "Patch operation type (like SCIM): Currently only 'add' and 'remove' are supported."
        path:
          type: string
          description: "Path in the format 'organizations[orgId eq \"abc123\"].roles'"
        value:
          type: array
          description: "List of roles to add/remove"
          items:
            type: object
            example:
              - "displayName": "App Viewer"
                "audience":
                  - "display": "My Org 1"
                    "type": "organization"

    RoleSharing:
      type: object
      required: [ mode ]
      properties:
        mode:
          type: string
          enum: [ ALL, NONE, SELECTED ]
        roles:
          type: array
          description: "List of roles (required when mode=SELECTED)"
          items:
            $ref: "#/components/schemas/RoleShareConfig"
      description: |-
        - ALL => share all roles
        - NONE => share no roles
        - SELECTED => provide a list of specific roles

    RoleShareConfig:
      type: object
      required: [ displayName, audience ]
      properties:
        displayName:
          type: string
          description: "The human-readable name of the role"
        audience:
          type: object
          required: [ display, type ]
          properties:
            display:
              type: string
              description: "Display name of the audience (e.g., organization or application name)"
            type:
              type: string
              description: |
                The type of the role audience:
                - `organization`: Role is scoped at organization level.
                - `application`: Role is scoped at application level.

    ProcessSuccessResponse:
      type: object
      properties:
        status:
          type: string
          example: "Processing"
        details:
          type: string
          example: "Application sharing process triggered successfully."
    LoginFlowGenerateRequest:
      type: object
      properties:
        available_authenticators:
          type: object
          additionalProperties: true
          description: |
            Available authenticators of the organization.
            It's expected to provide the authenticator name, description, and the IDP.
        user_claims:
          type: array
          items:
            type: object
            additionalProperties: true
          description: |
            Metadata of the available user claims for the organization. 
            Provide the claim URI and a human-readable description of the claim.
        user_query:
          type: string
      example: {
        "available_authenticators": {
          "local": [
            {
              "description": "Login users with username and password credentials.",
              "idp": "LOCAL",
              "name": "BasicAuthenticator"
            },
            {
              "description": "Two-factor authentication using SMS one-time passcode.",
              "idp": "LOCAL",
              "name": "sms-otp-authenticator"
            }
          ],
          "social": [
            {
              "description": "Login users with existing Google accounts.",
              "idp": "Google",
              "name": "GoogleOIDCAuthenticator"
            }
          ]
        },
        "user_claims": [
          {
            "claimURI": "http://example.com/claims/email",
            "description": "Email address of the user."
          },
          {
            "claimURI": "http://example.com/claims/role",
            "description": "Role of the user in the application."
          }
        ],
        "user_query": "GoogleOIDCAuthenticator followed by SMS-OTP if user has admin role."
      }
    LoginFlowGenerateResponse:
      type: object
      properties:
        operation_id:
          type: string
    StatusEnum:
      type: string
      enum:
        - IN_PROGRESS
        - COMPLETED
        - FAILED
    LoginFlowStatusResponse:
      type: object
      properties:
        operation_id:
          type: string
        status:
          type: object
          description: A generic object representing the status
          example: {
            "retrieving_examples": true,
            "optimization_and_validation_complete": true,
            "login_flow_generation_complete": false,
            "optimizing_and_validating_user_query": true,
            "generating_authentication_sequence": true,
            "retrieval_of_examples_complete": true,
            "optimizing_and_validating_final_login_flow": false,
            "generation_of_authentication_sequence_complete": true
          }
    LoginFlowResultResponse:
      type: object
      properties:
        status:
          $ref: '#/components/schemas/StatusEnum'
        data:
          type: object
          description: |
            The payload of the response, which varies based on the operation status.
            - For IN_PROGRESS status, an empty JSON object is returned.
            - For COMPLETED status, the authentication sequence is returned.
            - For FAILED status, an error message is returned.
    CIBAAuthenticationRequestConfiguration:
      type: object
      properties:
        authReqExpiryTime:
          type: integer
          format: int64
          description: "CIBA authentication request expiry time in seconds."
          example: 600
        notificationChannels:
          type: array
          items:
            type: string
          description: "List of allowed notification channels."
          example:
            - "email"
            - "sms"
servers:
  - url: 'https://{server-url}/t/{tenant-domain}/api/server/v1'
    variables:
      tenant-domain:
        default: "carbon.super"
      server-url:
        default: "localhost:9443"
