Applications

OAuth client registration and lifecycle — the convergence-target surface (create, patch, secret rotation with 24h overlap, token-usage observability).

Base URL: https://api.stg.thoryn.org

Operations

Method	Path	Summary	Scopes
GET	/api/v1/applications	Applications List	tenant:applications.read + tenant:clients.read
POST	/api/v1/applications	Applications Create	tenant:applications.write + tenant:clients.write
GET	/api/v1/applications/{clientId}	Applications Get	tenant:applications.read + tenant:clients.read
PATCH	/api/v1/applications/{clientId}	Applications Patch	tenant:applications.write + tenant:clients.write
DELETE	/api/v1/applications/{clientId}	Applications Delete	tenant:applications.write + tenant:clients.write
POST	/api/v1/applications/{clientId}/secret/rotate	Applications Rotate Secret	tenant:applications.write + tenant:clients.write
GET	/api/v1/applications/{clientId}/secrets/state	Applications Get Secrets State	tenant:applications.read + tenant:clients.read
GET	/api/v1/applications/{clientId}/usage	Applications Get Usage	tenant:applications.read + tenant:clients.read

Operation details

GET /api/v1/applications

Applications List

• Operation ID: applicationsList
• Required scopes: tenant:applications.read + tenant:clients.read

Parameters:

Name	In	Required	Type	Description
limit	query	no	integer
cursor	query	no	string

Responses:

Status	Description	Body
200	OK	object
401	Unauthorized — bearer token missing, expired, signed by an untrusted issuer, or missing the tnt tenant claim.	Problem (problem+json)
403	Forbidden — token lacks a required tenant:* scope, or the tnt claim does not match the tenant addressed by the request path.	Problem (problem+json)

POST /api/v1/applications

Applications Create

• Operation ID: applicationsCreate
• Required scopes: tenant:applications.write + tenant:clients.write

Request body (required): application/json → CreateApplicationRequest

Responses:

Status	Description	Body
200	OK	object
401	Unauthorized — bearer token missing, expired, signed by an untrusted issuer, or missing the tnt tenant claim.	Problem (problem+json)
403	Forbidden — token lacks a required tenant:* scope, or the tnt claim does not match the tenant addressed by the request path.	Problem (problem+json)

GET /api/v1/applications/{clientId}

Applications Get

• Operation ID: applicationsGet
• Required scopes: tenant:applications.read + tenant:clients.read

Parameters:

Name	In	Required	Type	Description
clientId	path	yes	string

Responses:

Status	Description	Body
200	OK	object
401	Unauthorized — bearer token missing, expired, signed by an untrusted issuer, or missing the tnt tenant claim.	Problem (problem+json)
403	Forbidden — token lacks a required tenant:* scope, or the tnt claim does not match the tenant addressed by the request path.	Problem (problem+json)

PATCH /api/v1/applications/{clientId}

Applications Patch

• Operation ID: applicationsPatch
• Required scopes: tenant:applications.write + tenant:clients.write

Parameters:

Name	In	Required	Type	Description
clientId	path	yes	string

Request body (required): application/json → UpdateApplicationRequest

Responses:

Status	Description	Body
200	OK	object
401	Unauthorized — bearer token missing, expired, signed by an untrusted issuer, or missing the tnt tenant claim.	Problem (problem+json)
403	Forbidden — token lacks a required tenant:* scope, or the tnt claim does not match the tenant addressed by the request path.	Problem (problem+json)

DELETE /api/v1/applications/{clientId}

Applications Delete

• Operation ID: applicationsDelete
• Required scopes: tenant:applications.write + tenant:clients.write

Parameters:

Name	In	Required	Type	Description
clientId	path	yes	string

Responses:

Status	Description	Body
200	OK	object
401	Unauthorized — bearer token missing, expired, signed by an untrusted issuer, or missing the tnt tenant claim.	Problem (problem+json)
403	Forbidden — token lacks a required tenant:* scope, or the tnt claim does not match the tenant addressed by the request path.	Problem (problem+json)

POST /api/v1/applications/{clientId}/secret/rotate

Applications Rotate Secret

• Operation ID: applicationsRotateSecret
• Required scopes: tenant:applications.write + tenant:clients.write

Parameters:

Name	In	Required	Type	Description
clientId	path	yes	string

Responses:

Status	Description	Body
200	OK	object
401	Unauthorized — bearer token missing, expired, signed by an untrusted issuer, or missing the tnt tenant claim.	Problem (problem+json)
403	Forbidden — token lacks a required tenant:* scope, or the tnt claim does not match the tenant addressed by the request path.	Problem (problem+json)

GET /api/v1/applications/{clientId}/secrets/state

Applications Get Secrets State

• Operation ID: applicationsGetSecretsState
• Required scopes: tenant:applications.read + tenant:clients.read

Parameters:

Name	In	Required	Type	Description
clientId	path	yes	string

Responses:

Status	Description	Body
200	OK	object
401	Unauthorized — bearer token missing, expired, signed by an untrusted issuer, or missing the tnt tenant claim.	Problem (problem+json)
403	Forbidden — token lacks a required tenant:* scope, or the tnt claim does not match the tenant addressed by the request path.	Problem (problem+json)

GET /api/v1/applications/{clientId}/usage

Applications Get Usage

• Operation ID: applicationsGetUsage
• Required scopes: tenant:applications.read + tenant:clients.read

Parameters:

Name	In	Required	Type	Description
clientId	path	yes	string
window	query	no	string

Responses:

Status	Description	Body
200	OK	object
401	Unauthorized — bearer token missing, expired, signed by an untrusted issuer, or missing the tnt tenant claim.	Problem (problem+json)
403	Forbidden — token lacks a required tenant:* scope, or the tnt claim does not match the tenant addressed by the request path.	Problem (problem+json)