---
title: "Create application"
method: POST
path: "/api/v1/org/{orgId}/app"
tags: ["Applications"]
---

# Create application

`POST /api/v1/org/{orgId}/app`

## Create Application
Creates a new Stackhawk Application for this organization.

Applications group scan results from HawkScan, and coordinate settings to influence HawkScan behavior. The application may also contain a specific environment name and id.
For more information, see [Applications](https://docs.stackhawk.com/web-app/applications.html).

| Parameter | Default | Description |
|:---:|:---:|:---:|
|applicationId|""|The UUID identifier of this application.|
|name|""|The name of this application.|
|env|""|The name of this environment. Only set when requesting Application Environments.|
|envId|""|The UUID identifier of this environment.|
|applicationStatus|"ACTIVE"|The status of this application. Either ACTIVE or ENV_INCOMPLETE.|
|organizationId|""|The UUID identifier of the organization that owns this application.|
|applicationType|"STANDARD"|The type of this application.|
|cloudScanTarget|{}|Optional Cloud Scan Target configuration.|

The `env` and `envId` fields are not populated on the response with this endpoint.
A name is not required to create an application, but it is strongly encouraged.

> 👥 Teams Supported
> If the user belongs to a StackHawk [Team](https://docs.stackhawk.com/web-app/teams.html), a created application will belong to the user's Team.

> 🧾 Audited
> This is recorded as `APPLICATION_ADDED` [User Activity](https://apidocs.stackhawk.com/reference/listauditactivity#user-activity-types).


> Requires `write:application` permission.

## Path parameters

- `orgId` string, uuid, required

## Request body

- ApplicationNewApplicationRequest — Request to create a new application. openapi: {"required": ["name", "env"] }
  - `applicationStatus` 'ACTIVE' | 'ENV_INCOMPLETE' — A specified status for this new application.
  - `applicationType` 'STANDARD' | 'CLOUD' — A specified status for this new application.
  - `cloudScanTargetURL` string — Optional Cloud Scanning Target URL.
  - `dataType` 'NONE' | 'PII' | 'PCI' | 'FIN' | 'PKI' | 'HIPAA' | 'FERPA' — A specified data type for this new application.
  - `env` string, required — The initial environment for this new application.
  - `host` string — The host specified when creating a new application
  - `name` string, required — The name of this new application.
  - `organizationId` string — The UUID identifier of the organization that will own this application.
  - `riskLevel` 'LOW' | 'MEDIUM' | 'HIGH' | 'CRITICAL' — A specified risk level for this new application.
  - `teamId` string — The UUID identifier of the team that this application belongs to.

## Response `200`

Applications group scan results from HawkScan, and coordinate settings to influence HawkScan behavior. The application may also contain a specific environment name and id.
For more information, see [Applications](https://docs.stackhawk.com/web-app/applications.html).

- ApplicationApplication — Applications group scan results from HawkScan, and coordinate settings to influence HawkScan behavior. The application may also contain a specific environment name and id. For more information, see [Applications](https://docs.stackhawk.com/web-app/applications.html).
  - `applicationId` string — The UUID identifier of this application.
  - `applicationStatus` 'ACTIVE' | 'ENV_INCOMPLETE' — The status of this application. Either ACTIVE or ENV_INCOMPLETE.
  - `applicationType` 'STANDARD' | 'CLOUD' — The type of this application.
  - `cloudScanTarget` ApplicationCloudScanTarget — Cloud Scan Target Configuration.
    - `isDomainVerified` boolean — Indicates if the domain is verified or not.
    - `targetURL` string — The target URL.
  - `dataType` 'NONE' | 'PII' | 'PCI' | 'FIN' | 'PKI' | 'HIPAA' | 'FERPA' — The perceived dataType of this application. Currently unused.
  - `env` string — The name of this environment. Only set when requesting Application Environments.
  - `envId` string — The UUID identifier of this environment.
  - `name` string — The name of this application.
  - `organizationId` string — The UUID identifier of the organization that owns this application.
  - `riskLevel` 'LOW' | 'MEDIUM' | 'HIGH' | 'CRITICAL' — The perceived riskLevel of this application. Currently unused.

## Other responses

- `400` — Bad Request
- `401` — Unauthorized

---

[API](https://skmtc.net/stackhawk/apis/stackhawk-public-api.md) · [All operations](https://skmtc.net/stackhawk/apis/stackhawk-public-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/stackhawk/stackhawk-public-api/versions/ad3dfd54cb63/schema)