How AI is applied across API Evangelist and APIs.io. Read my AI disclosure →
API Evangelist API Evangelist
Discovery
Learnings
Guidance
Toolbox
Alignment
API Evangelist LLC
Discovery
Learnings
Guidance
Toolbox
Alignment
API Evangelist LLC

Need help?

Contact us
FusionAuth

FusionAuth Application API

The Application API from FusionAuth — 8 operation(s) for application.

Documentation Provider Profile APIs.io OpenAPI GitHub

FusionAuth Application API is one of 37 APIs that FusionAuth publishes on the APIs.io network, described by a machine-readable OpenAPI specification.

Tagged areas include Application. The published artifact set on APIs.io includes an OpenAPI specification and API documentation.

This API exposes 20 operations across 8 paths, and defines 73 schemas. It is described by OpenAPI 3.2.0, at version 1.66.0.

Requests are made against 2 base URLs: http://localhost:9011, https://sandbox.fusionauth.io.

20 operations 8 paths 73 schemas 3 DELETE4 GET3 PATCH7 POST3 PUT

Metadata

The identity and technical contract details declared by the specification.

Specification
OpenAPI 3.2.0
API Version
1.66.0
Base URL
https://sandbox.fusionauth.io
Authentication
API Key, HTTP Bearer
License
Apache2
Resource Areas
1

Authentication & Security 2

FusionAuth Application API declares 2 security schemes for authenticating requests. An API key is passed in the header as Authorization (ApiKeyAuth). It accepts HTTP bearer tokens (JWT) (BearerAuth). By default, every request must be authenticated.

Paths & Operations 20

Across 8 paths, the API surfaces 20 operations — 3 DELETE, 4 GET, 3 PATCH, 7 POST, 3 PUT. Each is listed below with its method, path, parameters, and response codes.

Application 20
POST
/api/application
Creates an application. You can optionally specify an Id for the application, if not provided one will be generated.
createApplication 1 param body → 200default
GET
/api/application
Retrieves all the applications that are currently inactive. OR Retrieves the application for the given Id or all the applications if the Id is null.
retrieveApplication 2 params → 200default
POST
/api/application/search
Searches applications with the specified criteria and pagination.
searchApplicationsWithId body → 200default
POST
/api/application/{applicationId}
Creates an application. You can optionally specify an Id for the application, if not provided one will be generated.
createApplicationWithId 2 params body → 200default
DELETE
/api/application/{applicationId}
Hard deletes an application. This is a dangerous operation and should not be used in most circumstances. This will delete the application, any registrations for that application, metrics and reports…
deleteApplicationWithId 3 params → 200default
PATCH
/api/application/{applicationId}
Updates, via PATCH, the application with the given Id.
patchApplicationWithId 2 params body → 200default
PUT
/api/application/{applicationId}
Updates the application with the given Id. OR Reactivates the application with the given Id.
updateApplicationWithId 3 params body → 200default
GET
/api/application/{applicationId}
Retrieves the application for the given Id or all the applications if the Id is null.
retrieveApplicationWithId 2 params → 200default
GET
/api/application/{applicationId}/oauth-configuration
Retrieves the Oauth2 configuration for the application for the given Application Id.
retrieveOauthConfigurationWithId 2 params → 200default
POST
/api/application/{applicationId}/role
Creates a new role for an application. You must specify the Id of the application you are creating the role for. You can optionally specify an Id for the role inside the ApplicationRole object itself…
createApplicationRole 2 params body → 200default
POST
/api/application/{applicationId}/role/{roleId}
Creates a new role for an application. You must specify the Id of the application you are creating the role for. You can optionally specify an Id for the role inside the ApplicationRole object itself…
createApplicationRoleWithId 3 params body → 200default
DELETE
/api/application/{applicationId}/role/{roleId}
Hard deletes an application role. This is a dangerous operation and should not be used in most circumstances. This permanently removes the given role from all users that had it.
deleteApplicationRoleWithId 3 params → 200default
PATCH
/api/application/{applicationId}/role/{roleId}
Updates, via PATCH, the application role with the given Id for the application.
patchApplicationRoleWithId 3 params body → 200default
PUT
/api/application/{applicationId}/role/{roleId}
Updates the application role with the given Id for the application.
updateApplicationRoleWithId 3 params body → 200default
POST
/api/application/{applicationId}/scope
Creates a new custom OAuth scope for an application. You must specify the Id of the application you are creating the scope for. You can optionally specify an Id for the OAuth scope on the URL, if not…
createOAuthScope 2 params body → 200default
POST
/api/application/{applicationId}/scope/{scopeId}
Creates a new custom OAuth scope for an application. You must specify the Id of the application you are creating the scope for. You can optionally specify an Id for the OAuth scope on the URL, if not…
createOAuthScopeWithId 3 params body → 200default
DELETE
/api/application/{applicationId}/scope/{scopeId}
Hard deletes a custom OAuth scope. OAuth workflows that are still requesting the deleted OAuth scope may fail depending on the application's unknown scope policy.
deleteOAuthScopeWithId 3 params → 200default
PATCH
/api/application/{applicationId}/scope/{scopeId}
Updates, via PATCH, the custom OAuth scope with the given Id for the application.
patchOAuthScopeWithId 3 params body → 200default
GET
/api/application/{applicationId}/scope/{scopeId}
Retrieves a custom OAuth scope.
retrieveOAuthScopeWithId 3 params → 200default
PUT
/api/application/{applicationId}/scope/{scopeId}
Updates the OAuth scope with the given Id for the application.
updateOAuthScopeWithId 3 params body → 200default

Schemas 73

The contract defines 73 schemas that model the data the API accepts and returns. The most detailed are Application (33 properties), OAuth2Configuration (20 properties), SAMLv2Configuration (16 properties), ApplicationPhoneConfiguration (14 properties). Each schema is shown below with its type and property counts.

ApplicationFormConfiguration
object
3 properties
ProvidedScopePolicy
object
The handling policy for scopes provided by FusionAuth
4 properties
LoginHintConfiguration
object
2 properties
Errors
object
Standard error domain object that can also be used as the response from an API call.
2 properties
RegistrationConfiguration
object
13 properties
SelfServiceFormConfiguration
object
1 property
SAMLLogoutBehavior
string
Requirable
object
Something that can be required and thus also optional. This currently extends Enableable because anything that is requiredoptional is almost always enableable…
2 properties
LoginConfiguration
object
3 properties
XMLSignatureLocation
string
LoginIdType
string
This is separate from IdentityType.
OAuthScopeHandlingPolicy
string
Controls the policy for whether OAuth workflows will more strictly adhere to the OAuth and OIDC specification or run in backwards compatibility mode.
OAuthConfigurationResponse
object
3 properties
ApplicationExternalIdentifierConfiguration
object
1 property
VerificationStrategy
string
Location
object
Location information. Useful for IP addresses and other displayable data objects.
7 properties
Oauth2AuthorizedURLValidationPolicy
string
PasswordlessConfiguration
object
3 properties
ZonedDateTime
integer
The number of milliseconds since the unix epoch: January 1, 1970 00:00:00 UTC. This value is always in UTC.
JWTConfiguration
object
JWT Configuration. A JWT Configuration for an Application may not be active if it is using the global configuration, the configuration may be enabled = false .
10 properties
PasswordlessStrategy
string
ApplicationOAuthScope
object
A custom OAuth scope for a specific application.
10 properties
RefreshTokenExpirationPolicy
string
MultiFactorEmailTemplate
object
1 property
RefreshTokenUsagePolicy
string
OAuthScopeConsentMode
string
Controls the policy for requesting user permission to grant access to requested scopes during an OAuth workflow for a third-party application.
Error
object
Defines an error.
3 properties
EventInfo
object
Information about a user event (login, register, etc) that helps identify the source of the event (location, device type, OS, etc).
8 properties
RegistrationType
string
ApplicationRole
object
A role given to a user for a specific application.
7 properties
OAuth2Configuration
object
20 properties
ApplicationAccessControlConfiguration
object
1 property
ApplicationPhoneConfiguration
object
Hold application phone configuration for template overrides.
14 properties
SAMLv2SingleLogout
object
4 properties
ApplicationWebAuthnConfiguration
object
Application-level configuration for WebAuthn
3 properties
UsernameModeration
object
2 properties
SAMLv2AssertionEncryptionConfiguration
object
7 properties
ApplicationMultiFactorTrustPolicy
string
ProofKeyForCodeExchangePolicy
string
OAuthApplicationRelationship
string
The application's relationship to the authorization server. First-party applications will be granted implicit permission for requested scopes. Third-party appl…
ApplicationOAuthScopeResponse
object
The Application Scope API response.
1 property
TimeBasedDeletePolicy
object
A policy for deleting Users based upon some external criteria.
3 properties
UnverifiedBehavior
string
SAMLv2Logout
object
6 properties
ApplicationWebAuthnWorkflowConfiguration
object
1 property
ApplicationResponse
object
The Application API response.
3 properties
ApplicationOAuthScopeRequest
object
The Application Scope API request object.
1 property
ApplicationSearchResponse
object
Application search response
3 properties
RegistrationUnverifiedOptions
object
1 property
RefreshTokenOneTimeUseConfiguration
object
Refresh token one-time use configuration. This configuration is utilized when the usage policy is configured for one-time use.
1 property
SAMLv2Configuration
object
16 properties
UniversalApplicationConfiguration
object
1 property
RefreshTokenSlidingWindowConfiguration
object
1 property
MultiFactorVoiceTemplate
object
1 property
UnknownScopePolicy
string
Policy for handling unknown OAuth scopes in the request
ClientAuthenticationPolicy
string
ApplicationEmailConfiguration
object
14 properties
ApplicationSearchCriteria
object
Search criteria for Applications
7 properties
ApplicationRequest
object
The Application API request object.
4 properties
MultiFactorLoginPolicy
string
RefreshTokenRevocationPolicy
object
4 properties
ApplicationSearchRequest
object
Search request for Applications
2 properties
MultiFactorSMSTemplate
object
1 property
LambdaConfiguration
object
6 properties
LogoutBehavior
string
AuthenticationTokenConfiguration
object
1 property
CanonicalizationMethod
string
XML canonicalization method enumeration. This is used for the IdP and SP side of FusionAuth SAML.
Application
object
33 properties
ObjectState
string
ApplicationMultiFactorConfiguration
object
5 properties
ApplicationRegistrationDeletePolicy
object
A Application-level policy for deleting Users.
1 property
SAMLv2IdPInitiatedLoginConfiguration
object
IdP Initiated login configuration
2 properties
CleanSpeakConfiguration
object
CleanSpeak configuration at the system and application level.
5 properties

Specification

The full machine-readable OpenAPI contract behind this narrative.

Source

fusionauth-application-api-openapi.yml Raw ↑

Other APIs FusionAuth publishes across the network.

FusionAuth Api Key API
AE Profile APIs.io
FusionAuth Connector API
AE Profile APIs.io
FusionAuth Consent API
AE Profile APIs.io
FusionAuth Email API
AE Profile APIs.io
FusionAuth Entity API
AE Profile APIs.io
FusionAuth Form API
AE Profile APIs.io
FusionAuth Group API
AE Profile APIs.io
FusionAuth Health API
AE Profile APIs.io
FusionAuth Identity API
AE Profile APIs.io
FusionAuth Identity Provider API
AE Profile APIs.io
FusionAuth Integration API
AE Profile APIs.io
FusionAuth Ip Acl API
AE Profile APIs.io
#Application
← Back to F APIs
API Details
ID
fusionauth:fusionauth-application-api
Base URL
https://sandbox.fusionauth.io
Docs
https://fusionauth.io/docs/
Provider
FusionAuth
APIs.io →  GitHub →
Explore more
All APIs Providers APIs.io Network
Work with this as data

Every API here is available over the API and to AI agents over MCP. APIs is not yet its own endpoint on the v1 API. Reach this content through network search and the tag graph, or the MCP server below.

Installs https://mcp.apievangelist.com/mcp in Claude, Cursor, VS Code and the rest — one button, every client.

MCP tools for apis
4 tools reach this content
  • search_api_evangelistSearch every content type across the network at once.
  • find_relatedThe shared-tag relevance graph — what else covers this.
  • get_tagEverything one tag labels, across all content types.
  • guide_topicPRO — a curated bundle for a topic: area, guidance, rules, papers, stories, services.
All tools & prompts
Call it yourself
curl for this page
Search the network for this 
curl "https://api.apievangelist.com/v1/search?q=fusionauth-application-api&limit=10"
Everything under a tag 
curl "https://api.apievangelist.com/v1/tags/fusionauth-application-api"

Discovery needs no key. Full bodies and the synthesis endpoints are Pro.

Get an API key

Free tier, no email required. Sign in with whichever identity you already have.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have. Your account

Where this information came from

This is an independent, third-party profile of FusionAuth Application API, published by API Evangelist. We do not operate, host, resell, or support these APIs, and we are not affiliated with or endorsed by the company unless stated above. Everything here is built from publicly available information — the company's own site, developer portal, documentation, public repositories, and the specifications it publishes for public use. Nothing is obtained by breaching a system, defeating an access control, or using credentials.

The Kin Score and Agent Readiness rating are independently calculated assessments of a company's public API artifacts, scored against a published rubric. They are not certifications, endorsements, security assessments, or audits.

Corrections, re-scores, and removal are free — no partnership or purchase required, and you do not need to justify the request. A removed company is recorded as unrated, never scored zero for having asked. Acknowledgement within one business day; removal within two.

info@apievangelist.com · Read the full data-sourcing policy →
On a security or compliance team? Put security in the subject line and you will get a person, not a form — we will tell you exactly which public URLs this profile was built from.