---
title: "Update OAuth application"
method: PUT
path: "/api/v1/sso/applications/{clientId}"
tags: ["SSO - Applications"]
---

# Update OAuth application

`PUT /api/v1/sso/applications/{clientId}`

**Rate limit:** 60 requests per 60 seconds. This is the **default shared quota** — it is shared with every other endpoint that has no dedicated limit, so requests across those endpoints all draw from the same budget.

---

Updates one or more modifiable fields of an existing OAuth application. Only the application's admin (the caller's GCID must be in `adminGcids`) can perform updates. Non-admins receive `404 Not Found` (opaque authorization - the gateway does not disclose whether the application exists). At least one field must be provided in the body; omitted fields are left unchanged. Uniqueness and length constraints match the create endpoint.

## Path parameters

- `clientId` string, uuid, required

## Headers

- `x-request-id` string, uuid, required
- `x-api-key` string, password, required
- `x-user-key` string, password, required

## Request body

- UpdateApplicationBody — At least one field must be provided. Omitted fields are left unchanged.
  - `applicationName` string — Updated display name.
  - `applicationIconUrl` string, uri — Updated icon URL.
  - `scopes` ScopeItem[] — Replacement set of scopes. Each `scopeId` must be positive and present in the cached catalog; no duplicates.
    - `scopeId` integer, required — Scope identifier. Must be a known scope from `GET /api/v1/sso/scopes`.
    - `isMandatory` boolean, required — When true, the user cannot deselect this scope on the consent screen.
  - `redirectUris` string[] — Replacement set of redirect URIs.

## Response `200`

Application updated successfully.

- UpdateApplicationResponse
  - `application` ApplicationItem — Full application record. The `clientSecret` is intentionally excluded.
    - `applicationId` integer — Internal numeric identifier of the application.
    - `applicationName` string — Display name of the application.
    - `applicationIconUrl` string, uri — URL of the application icon.
    - `clientId` string, uuid — OAuth client identifier. Stable across the lifetime of the application.
    - `audience` string — OAuth audience claim issued for tokens minted for this application.
    - `applicationType` string — OAuth application type (e.g. `public`, `confidential`).
    - `scopes` ApplicationScopeItem[] — Scopes assigned to the application, including which are mandatory at consent time.
      - `scopeId` integer — Scope identifier.
      - `isMandatory` boolean — When true, the user cannot deselect this scope on the consent screen.
    - `redirectUris` string[] — Registered OAuth redirect URIs.
    - `supportedFlows` string[] — OAuth flows supported by the application (e.g. `authorization_code`, `refresh_token`).
    - `supportedCodeChallengeMethods` string[] — PKCE code-challenge methods supported by the application (e.g. `S256`).
    - `ssoIdTokenExpirationInMinutes` integer — Lifetime of issued SSO id tokens, in minutes.
    - `ssoRefreshTokenExpirationInMinutes` integer — Lifetime of issued SSO refresh tokens, in minutes.
    - `ssoAccessTokenExpirationInMinutes` integer — Lifetime of issued SSO access tokens, in minutes.
    - `adminGcids` integer[] — GCIDs of users who can administer this application.

## Other responses

- `400` — Validation error.
- `401` — Missing or invalid STS access token.
- `404` — Application not found, or the caller is not an admin of the application.
- `429` — Too Many Requests — the shared rate limit (60 requests / 60s) was exceeded.
- `500` — Backend sts-metadata-api unavailable.

---

[API](https://skmtc.net/etoro/apis/etoro-api.md) · [All operations](https://skmtc.net/etoro/apis/etoro-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/etoro/etoro-api/revisions/69c1fb266c35/schema)