HERE Application Management API is one of 139 APIs that HERE publishes on the APIs.io network, described by a machine-readable OpenAPI specification.
Tagged areas include Application Management. The published artifact set on APIs.io includes an OpenAPI specification, API documentation, and an API reference.
This API exposes
11 operations
across 4 paths,
and defines 40 schemas.
It is described by OpenAPI 3.2.0, at version 1.1.x.
Requests are made against a single base URL, Use API Lookup for a base URL.
11 operations4 paths40 schemas3 DELETE4 GET1 PATCH1 POST2 PUT
Metadata
The identity and technical contract details declared by the specification.
Specification
OpenAPI 3.2.0
API Version
1.1.x
Base URL
https://account.api.here.com
Authentication
HTTP Bearer, HTTP Bearer
Resource Areas
1
Authentication & Security 2
HERE Application Management API declares
2 security schemes
for authenticating requests.
It accepts HTTP bearer tokens (UserOrClientBearerToken).
It accepts HTTP bearer tokens (JWT) (Bearer).
UserOrClientBearerToken — Bearer Token issued to either User or Client.
Bearer — A HERE access token obtained from one of the supported OAuth 2.0 authorization flows. For more information on how to get a bearer token, see the [https://www.h…
Paths & Operations 11
Across 4 paths, the API surfaces 11 operations — 3 DELETE, 4 GET, 1 PATCH, 1 POST, 2 PUT. Each is listed below with its method, path, parameters, and response codes.
Application Management 11
Application Management APIs enable HERE users to create applications and authorized identities (user/another app) to manage such applications.
The contract defines 40 schemas that model the data the API accepts and returns. The most detailed are CreateAppRequest (14 properties), AppInfo (11 properties), Error403Response (9 properties), GenericError404Response (9 properties). Each schema is shown below with its type and property counts.
CreatedTime
integer
Timestamp (milliseconds since the Unix epoch) of when the app was created.
ApplicationType
string
Whether it's an application or a trusted back-end service.
AllowedRealmTypes
array
List of realmTypes from which this client is allowed to request user access tokens when using either the OAuth2 or OpenID protocols.
HRN
string
HRN of the application.
AppCodeVisible
boolean
Identifies if app code is available via the /apps/{app}/appCode API.
Realm
string
Realm the application belongs to.
RateLimitTier
string
Rate limit tier to configure application for. If no rate limit tier is specified, created application will be configured with 'global' rate limit tier.
GenericError404Response
object
9 properties6 required
Error401Response
object
8 properties6 required
CreateAppRequest
object
14 properties1 required
PageWithToken
object
3 properties3 required
AllowedScopes
array
List of Strings representing the scopes. This field is required when the response types is non-empty. For more details [see here](http://openid.net/specs/openi…
RedirectUris
array
List of redirect Uris. should be fully qualified HTTPS URIs without any fragments (HTTP is only supported for localhost development). At least one Redirect URI…
AppInfo
object
11 properties
ErrorResponse
object
8 properties6 required
Error403Response
object
9 properties6 required
ResponseTypes
array
Valid value is "code". If the responseTypes value is "idtoken" or ["token", "idtoken"], then the allowedScopes value must contain "openid". For more details se…
App
object
AlwaysProjectScope
boolean
Indicates whether or not the given application is locked to the default scope. When this value is set to true, both API Keys and Access Tokens for this app are…
AppPageWithToken
object
Referrers
array
List Referrer URLs to register/registered with Application On create/update: if the parameter is not present, the current value(s) are unchanged. If empty list…
DefaultScope
string
The default requested scope for the given application.
DeviceTokenCreationEnabled
boolean
If the application allows token creation for linked anonymous devices.
ClientId
string
Identifier for the client/application. If provided, identifier should be present and active in Druid.
IsRestrictedScope
boolean
Boolean value indicating whether or not the given application should be restricted from requesting a client token with a different scope from the default value…
AppCreationEnabled
boolean
If the application is allowed to create an App.
TokenDuration
integer
default duration in seconds for the token issued to this application. It has be a non-zero value, less than or equal to 24 hours (86400) or the max allowed for…
PlatformTier
integer
The platform rate limit tier assigned to this realm. Must be an integer 0. All identities in the realm are associated with this tier unless otherwise individua…
TokenEndpointAuthMethod
string
The default value will be "clientsecretjwt" if the field is not included in the request body.Please check [here](http://openid.net/specs/openid-connect-core-10…
AppDefaultScope
object
3 properties1 required
PatchAppRequest
object
DobRequired
boolean
Flag indicating whether or not application users are required to provide their date of birth. true - the user must supply their DOB false - the user can use se…
DeviceApiCallRateLimitPer15Minutes
integer
The rate limit per 15 minutes for linked anonymous devices. Property deviceTokenCreationEnabled needs to be true and a value needs to be set for property devic…
Name
string
Human readable name of the client. This field is required unless a clientId is provided.
AppCodeEnabled
boolean
Identifies if app codes are enabled.
ErrorDetail
object
5 properties
Status
string
Status of the application.
TokenEndpointAuthMethodReason
string
This needs to be included only if "tokenEndpointAuthMethod" is not equal to clientsecretjwt. The reason for choosing a less secure tokenEndpoint auth method ne…
AppDefaultScopeResponse
object
5 properties
Description
string
Prose description of the client
Specification
The full machine-readable OpenAPI contract behind this narrative.
Every API here is available over the API and to AI agents over MCP. APIs is not yet its own endpoint on the v1 API. Reach this content through network search and the tag graph, or the MCP server below.
Installs https://mcp.apievangelist.com/mcp in Claude, Cursor, VS Code and the rest — one button, every client.
MCP tools for apis
4 tools reach this content
search_api_evangelistSearch every content type across the network at once.
find_relatedThe shared-tag relevance graph — what else covers this.
get_tagEverything one tag labels, across all content types.
guide_topicPRO — a curated bundle for a topic: area, guidance, rules, papers, stories, services.
A second provider on the same verified email joins the account you already have.
Your account
ⓘWhere this information came from
This is an independent, third-party profile of HERE Application Management API, published by
API Evangelist. We do not operate, host, resell, or
support these APIs, and we are not affiliated with or endorsed by the company unless stated above.
Everything here is built from publicly available information — the company's own site,
developer portal, documentation, public repositories, and the specifications it publishes for public use.
Nothing is obtained by breaching a system, defeating an access control, or using credentials.
The Kin Score and Agent Readiness rating are independently calculated assessments of a company's
public API artifacts, scored against a published rubric. They are not certifications,
endorsements, security assessments, or audits.
Corrections, re-scores, and removal are free — no partnership or purchase required, and
you do not need to justify the request. A removed company is recorded as unrated, never scored
zero for having asked. Acknowledgement within one business day; removal within two.
info@apievangelist.com
·
Read the full data-sourcing policy → On a security or compliance team? Put security in the subject line and
you will get a person, not a form — we will tell you exactly which public URLs this profile was built from.
