---
title: "Create Application"
method: POST
path: "/v3/portals/{portalId}/applications"
tags: ["Applications"]
---

# Create Application

`POST /v3/portals/{portalId}/applications`

Creates a new application for this portal. The application must be assigned to a developer or a team. An application can be registered for various APIs, issuing credentials for API access. If using DCR, an application will be linked to an Identity Provider's application by its `client_id`.

## Path parameters

- `portalId` string, uuid, required

## Request body

- CreateApplicationRequest
  - `name` string, required — The name of the application.
  - `description` string — A description of the application.
  - `labels` LabelsUpdate, nullable — Labels store metadata of an entity that can be used for filtering an entity list or for searching across entity types. Labels are intended to store **INTERNAL** metadata. Keys must be of length 1-63 characters, and cannot start with "kong", "konnect", "mesh", "kic", or "_".
  - `dcr_client_id` string — If using a DCR auth strategy, set this property to link the portal application to an existing client from the DCR provider, instead of having Konnect create a new client. This allows importing existing clients from an Identity Provider into Konnect, allowing them to be controlled through DCR flows in the portal and use existing client secrets for API access. The value must be a valid client ID in the DCR provider associated with the auth strategy. For some DCR providers, if the client ID is invalid, the application may still be created but will not function properly. Note: For AzureAD auth strategies, the client ID must resolve to an accessible Microsoft Entra application using the configured DCR provider credentials. Otherwise, application creation fails.
  - `client_id` string — An identifier to correlate the application with an external system. Cannot be set when using Dynamic Client Registration.
  - `auth_strategy_id` string, uuid — The ID of the authentication strategy the application will use when making requests to registered APIs.
  - `owner` ApplicationOwner, required
    - `type` 'developer' | 'team', required — The type of the owner of the application. Can be `developer` (individual developer) or `team`.
    - `id` string, uuid, required — The ID of the owner of the application. When type is `developer`, this is the developer ID. When type is `team`, this is the team ID.

## Response `201`

Details about an application in a portal.

- GetApplicationResponse
  - `id` string, uuid, required — Contains a unique identifier used for this resource.
  - `created_at` string, date-time, required — An ISO-8601 timestamp representation of entity creation date.
  - `updated_at` string, date-time, required — An ISO-8601 timestamp representation of entity update date.
  - `name` string, required — The name of the application.
  - `description` string, nullable, required — A description of the application.
  - `labels` LabelsUpdate, nullable, required — Labels store metadata of an entity that can be used for filtering an entity list or for searching across entity types. Labels are intended to store **INTERNAL** metadata. Keys must be of length 1-63 characters, and cannot start with "kong", "konnect", "mesh", "kic", or "_".
  - `client_id` string — The ID used to linked the portal application to an Identity Provider application.
  - `registration_count` number, required — The number of API registrations that are associated with the application. Registrations of any status are included in the count.
  - `dcr_provider` object — Information about the DCR provider this application uses, if using DCR.
    - `id` string, uuid, required — Contains a unique identifier used for this resource.
  - `portal` object, required — Information about the portal the application is in.
    - `id` string, uuid, required — Contains a unique identifier used for this resource.
  - `auth_strategy` object, required
    - `id` string, uuid, required — The Application Auth Strategy ID.
    - `name` string, required
    - `credential_type` 'key_auth' | 'client_credentials' | 'self_managed_client_credentials', required
    - `key_names` string[]
    - `ttl` object — Default maximum Time-To-Live for keys created under this strategy.
      - `value` integer
      - `unit` 'days' | 'weeks' | 'years'
    - `auth_methods` string[]
    - `available_scopes` string[] — Possible developer selectable scopes for an application. Only present when using DCR Provider that supports it.
  - `granted_scopes` string[], nullable — List of granted scopes for the application. Null if application type does not support returning granted scopes.
  - `owner` ApplicationOwner
    - `type` 'developer' | 'team', required — The type of the owner of the application. Can be `developer` (individual developer) or `team`.
    - `id` string, uuid, required — The ID of the owner of the application. When type is `developer`, this is the developer ID. When type is `team`, this is the team ID.

## Other responses

- `400` — Bad Request
- `401` — Unauthorized
- `403` — Forbidden

---

[API](https://skmtc.net/kong/apis/konnect-api.md) · [All operations](https://skmtc.net/kong/apis/konnect-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/kong/konnect-api/versions/06734a9c491f/schema)