--- title: "Replace App Auth Strategy" method: PUT path: "/v2/application-auth-strategies/{authStrategyId}" tags: ["App Auth Strategies"] --- # Replace App Auth Strategy `PUT /v2/application-auth-strategies/{authStrategyId}` Replaces an application auth strategy. ## Request body - union — Request body for creating an Application Auth Strategy - object — Request for creating a Key Auth Application Auth Strategy - `name` string, required — The name of the auth strategy. This is used to identify the auth strategy in the Konnect UI. - `display_name` string, required — The display name of the Auth strategy. This is used to identify the Auth strategy in the Portal UI. - `strategy_type` 'key_auth', required - `configs` object, required — JSON-B object containing the configuration for the Key Auth strategy - `key-auth` AppAuthStrategyConfigKeyAuth, required — The most basic mode to configure an Application Auth Strategy for an API Product Version. Using this mode will allow developers to generate API keys that will authenticate their application requests. Once authenticated, an application will be granted access to any Product Version it is registered for that is configured for Key Auth. - `key_names` string[] — The names of the headers containing the API key. You can specify multiple header names. - `ttl` object — Default maximum Time-To-Live for keys created under this strategy. - `value` integer, required - `unit` 'days' | 'weeks' | 'years', required - `labels` Labels — Labels store metadata of an entity that can be used for filtering an entity list or for searching across entity types. Keys must be of length 1-63 characters, and cannot start with "kong", "konnect", "mesh", "kic", or "_". - `principals` AuthStrategyPrincipals — Application principal settings for this auth strategy. Runtime effect applies to V3 API Catalog (ACE) portals and applications; stored values may be set for any auth strategy in the organization. - `enabled` boolean, required — Whether application principals are enabled for this auth strategy. - object — Payload for creating an OIDC Application Auth Strategy - `name` string, required — The name of the auth strategy. This is used to identify the auth strategy in the Konnect UI. - `display_name` string, required — The display name of the Auth strategy. This is used to identify the Auth strategy in the Portal UI. - `strategy_type` 'openid_connect', required - `configs` object, required — JSON-B object containing the configuration for the OIDC strategy - `openid-connect` AppAuthStrategyConfigOpenIDConnect, required — A more advanced mode to configure an API Product Version’s Application Auth Strategy. Using this mode will allow developers to use API credentials issued from an external IdP that will authenticate their application requests. Once authenticated, an application will be granted access to any Product Version it is registered for that is configured for the same Auth Strategy. An OIDC strategy may be used in conjunction with a DCR provider to automatically create the IdP application. - `issuer` string, url, required - `credential_claim` string[], required - `scopes` string[], required - `auth_methods` string[], required - `dcr_provider_id` string, uuid, nullable - `labels` Labels — Labels store metadata of an entity that can be used for filtering an entity list or for searching across entity types. Keys must be of length 1-63 characters, and cannot start with "kong", "konnect", "mesh", "kic", or "_". - `principals` AuthStrategyPrincipals — Application principal settings for this auth strategy. Runtime effect applies to V3 API Catalog (ACE) portals and applications; stored values may be set for any auth strategy in the organization. - `enabled` boolean, required — Whether application principals are enabled for this auth strategy. ## Response `201` A response containing the newly created application auth strategy object. - union — A set of plugin configurations that represent how the gateway will perform authentication and authorization for a Product Version. Called “Auth Strategy” for short in the context of portals/applications. The plugins are synced to any Gateway Service that is currently linked or becomes linked to the Product Version. - object — Response payload from creating or updating a Key Auth Application Auth Strategy - `id` string, uuid, required — Contains a unique identifier used for this resource. - `name` string, required — The name of the auth strategy. This is used to identify the auth strategy in the Konnect UI. - `display_name` string, required — The display name of the Auth strategy. This is used to identify the Auth strategy in the Portal UI. - `strategy_type` 'key_auth', required - `configs` object, required — JSON-B object containing the configuration for the Key Auth strategy - `key-auth` AppAuthStrategyConfigKeyAuth, required — The most basic mode to configure an Application Auth Strategy for an API Product Version. Using this mode will allow developers to generate API keys that will authenticate their application requests. Once authenticated, an application will be granted access to any Product Version it is registered for that is configured for Key Auth. - `key_names` string[] — The names of the headers containing the API key. You can specify multiple header names. - `ttl` object — Default maximum Time-To-Live for keys created under this strategy. - `value` integer, required - `unit` 'days' | 'weeks' | 'years', required - `active` boolean, required — At least one published entity is using this auth strategy. - `dcr_provider` object, nullable, required - `id` string, uuid, required — Contains a unique identifier used for this resource. - `name` string, required - `display_name` string — The display name of the DCR provider. This is used to identify the DCR provider in the Portal UI. - `provider_type` 'auth0' | 'azureAd' | 'curity' | 'okta' | 'http' | 'kongIdentity', required — The type of DCR provider. - `labels` Labels, required — Labels store metadata of an entity that can be used for filtering an entity list or for searching across entity types. Keys must be of length 1-63 characters, and cannot start with "kong", "konnect", "mesh", "kic", or "_". - `created_at` string, date-time, required — An ISO-8601 timestamp representation of entity creation date. - `updated_at` string, date-time, required — An ISO-8601 timestamp representation of entity update date. - `supports_multiple_credentials` boolean — Indicates whether this auth strategy supports multiple credentials. Always `true` for KEY_AUTH. - `principals` AuthStrategyPrincipals — Application principal settings for this auth strategy. Runtime effect applies to V3 API Catalog (ACE) portals and applications; stored values may be set for any auth strategy in the organization. - `enabled` boolean, required — Whether application principals are enabled for this auth strategy. - object — Response payload from creating an OIDC Application Auth Strategy - `id` string, uuid, required — Contains a unique identifier used for this resource. - `name` string, required — The name of the auth strategy. This is used to identify the auth strategy in the Konnect UI. - `display_name` string, required — The display name of the Auth strategy. This is used to identify the Auth strategy in the Portal UI. - `strategy_type` 'openid_connect', required - `configs` object, required — JSON-B object containing the configuration for the OIDC strategy - `openid-connect` AppAuthStrategyConfigOpenIDConnect, required — A more advanced mode to configure an API Product Version’s Application Auth Strategy. Using this mode will allow developers to use API credentials issued from an external IdP that will authenticate their application requests. Once authenticated, an application will be granted access to any Product Version it is registered for that is configured for the same Auth Strategy. An OIDC strategy may be used in conjunction with a DCR provider to automatically create the IdP application. - `issuer` string, url, required - `credential_claim` string[], required - `scopes` string[], required - `auth_methods` string[], required - `active` boolean, required — At least one published entity is using this auth strategy. - `dcr_provider` object, nullable, required - `id` string, uuid, required — Contains a unique identifier used for this resource. - `name` string, required - `display_name` string — The display name of the DCR provider. This is used to identify the DCR provider in the Portal UI. - `provider_type` 'auth0' | 'azureAd' | 'curity' | 'okta' | 'http' | 'kongIdentity', required — The type of DCR provider. - `labels` Labels, required — Labels store metadata of an entity that can be used for filtering an entity list or for searching across entity types. Keys must be of length 1-63 characters, and cannot start with "kong", "konnect", "mesh", "kic", or "_". - `created_at` string, date-time, required — An ISO-8601 timestamp representation of entity creation date. - `updated_at` string, date-time, required — An ISO-8601 timestamp representation of entity update date. - `supports_multiple_credentials` boolean — Indicates whether this auth strategy supports multiple credentials. - `true` for Key Auth strategies and when supported for Client Credentials strategies - `false` when not supported for Client Credentials strategies - `principals` AuthStrategyPrincipals — Application principal settings for this auth strategy. Runtime effect applies to V3 API Catalog (ACE) portals and applications; stored values may be set for any auth strategy in the organization. - `enabled` boolean, required — Whether application principals are enabled for this auth strategy. ## Other responses - `400` — Bad Request - `401` — Unauthorized - `403` — Forbidden --- [API](https://skmtc.net/kong/apis/konnect-api-go-sdk.md) · [All operations](https://skmtc.net/kong/apis/konnect-api-go-sdk/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/kong/konnect-api-go-sdk/versions/f920f418f552/schema)