PingOne Platform APIs

Application Resource Grants

Resources are the protected endpoints that applications request access to using OAuth 2 authorization services. A resource access grant specifies the identifier of the resource associated with the specified application.

Applications resource grant data model

Property Type Required Mutable Description

application.id

String

N/A

Read-only

The application resource ID associated with the resource grant.

createdAt

Date

N/A

Read-only

The time the resource was created.

id

String

N/A

Read-only

The application resource grant ID.

resource.id

String

N/A

Read-only

The ID of the protected resource associated with this grant.

scopes.id

String[]

Required

Mutable

The IDs of the scopes associated with this grant.

updatedAt

Date

N/A

Read only

The time the resource was last updated.

Refer also to Authorization flow by grant type.

Response codes

The /v1/environments/{{envID}}/applications/{{appID}}/grants endpoint returns a 404 NOT FOUND on GET, POST, PUT, and DELETE operations if the application’s type property is set to PING_ONE_ADMIN_CONSOLE or the MCP server application type.
Code Message

200

Successful operation.

201

Successfully created.

204

Successfully removed. No content.

400

The request could not be completed.

401

You do not have access to this resource.

403

You do not have permissions or are not licensed to make this request.

404

The requested resource was not found.

500

An unexpected error occurred.

Application resource grant errors

In addition to the general error codes, application resource grant operations can return the following errors:

HTTP status Top‑level code Detail code When it happens and what the response contains

400

INVALID_DATA

INVALID_VALUE

Message: The data provided was invalid.

When and details

When: A POST /grants request creates a grant for an application and resource pair that already has a grant

Details: grant to given resource already exists (target: resource), with existingId, appId, and resId inner errors

400

INVALID_DATA

INVALID_VALUE

Message: The request could not be completed. One or more validation errors were in the request.

When and details

When: A POST or PUT /grants/{ID} request references scopes that do not exist for the resource

Details: Unable to find scopes with the following IDs: <scopeIds> (target: scopes)

400

INVALID_DATA

INVALID_VALUE

Message: The request could not be completed. One or more validation errors were in the request.

When and details

When: A POST or PUT /grants/{ID} request adds a scope whose name is already granted to the application through a different resource

Details: Multiple scopes with the same name cannot be added to the same grant (target: scopes)

400

REQUEST_FAILED

CONSTRAINT_VIOLATION

Message: The request could not be completed. There was an issue processing the request.

When and details

When: A POST /grants request creates a grant for a resource other than the openid resource for an application of type WORKER

Details: Resource access grants for applications of type 'WORKER' can only be created for the 'openid' resource (target: resource.id)

400

INVALID_DATA

INVALID_VALUE

Message: The request could not be completed. One or more validation errors were in the request.

When and details

When: A PUT /grants/{ID} request changes the grant’s environment, application, or resource

Details: The attribute is immutable and can not be updated.

404

NOT_FOUND

None

Message: The request could not be completed. The requested resource was not found.

When and details

When: The application does not exist in the environment, or is an admin console or MCP server application. Applies to all application resource grant operations

Details: None.

404

NOT_FOUND

None

Message: The request could not be completed. The requested resource was not found.

When and details

When: GET, PUT, or DELETE /grants/{ID} references a grant that does not exist, or a POST or PUT request references a resource that does not exist in the environment

Details: None.

You need the Client Application Developer role to perform operations on application resources.