Application Secret

The application secret endpoints are available to users or worker applications only when the following conditions are met:

The actor has the requisite permission: applications:read:secret, applications:update:secret,applications:delete:secret, or applications:set:secret (for imported secrets). See PingOne permissions by identifier for more information.
The actor does not see any of the application’s role assignments as readOnly. See the readOnly property in the Applications role assignments data model table.

An actor’s ability to access application secrets is restricted to prevent permission escalation. Permission escalation is when an actor can perform operations indirectly through the application that they’d be unable to perform directly.

Best practices

Do not store an application secret in applications that are publicly available.
For security purposes, regenerate application secrets regularly.
If you suspect an application secret has been compromised, generate a new application secret immediately.

Applications secret data model

Property Type Required Mutable Description

Property	Type	Required	Mutable	Description
`environment.id`	String		Read-only	The environment associated with the application.
`previous`	Object	Optional	Read only	An object that specifies the previous secret, when it expires, and when it was last used.
`previous.secret`	String	N/A	Read only	A string that specifies the previous application secret. This property is returned in the response if the previous secret is not expired.
`previous.expiresAt`	Timestamp	Optional	Read only	A timestamp that specifies how long this secret is saved (and can be used) before it expires. Supported time range is 1 minute to 90 days.
`previous.lastUsed`	Timestamp	Optional	Read only	A timestamp that specifies when the previous secret was last used.
`secret`	String	Required	Read-only	The application secret ID used to authenticate to the authorization server. For secrets originating in PingOne, the secret has a minimum length of 64 characters per SHA-512 requirements when using the HS512 algorithm to sign ID tokens using the secret as the key. For imported secrets, the secret must have a minimum length of 8 characters.

environment.id

String

Read-only

The environment associated with the application.

previous

Object

Optional

Read only

An object that specifies the previous secret, when it expires, and when it was last used.

previous.secret

String

N/A

Read only

A string that specifies the previous application secret. This property is returned in the response if the previous secret is not expired.

previous.expiresAt

Timestamp

Optional

Read only

A timestamp that specifies how long this secret is saved (and can be used) before it expires. Supported time range is 1 minute to 90 days.

previous.lastUsed

Timestamp

Optional

Read only

A timestamp that specifies when the previous secret was last used.

secret

String

Required

Read-only

The application secret ID used to authenticate to the authorization server. For secrets originating in PingOne, the secret has a minimum length of 64 characters per SHA-512 requirements when using the HS512 algorithm to sign ID tokens using the secret as the key. For imported secrets, the secret must have a minimum length of 8 characters.

Response codes

The /v1/environments/{{envID}}/applications/{{appID}}/secret endpoint returns a 404 NOT FOUND if the application’s type property is set to PING_ONE_ADMIN_CONSOLE, PING_ONE_SELF_SERVICE, PING_ONE_PORTAL, or the MCP server application type.

Code	Message
200	Successful operation.
201	Successfully created.
400	The request could not be completed.
401	You do not have access to this resource.
403	You do not have permissions or are not licensed to make this request.
404	The requested resource was not found.
500	An unexpected error occurred.

Application secret errors

In addition to the general error codes, application secret operations can return the following errors:

HTTP status Top‑level code Detail code When it happens and what the response contains

HTTP status	Top‑level code	Detail code	When it happens and what the response contains
400	`INVALID_DATA`	`INVALID_VALUE`	Message: `The request could not be completed. One or more validation errors were in the request.` When and details When: A `POST` with `application/vnd.pingidentity.secret+json` supplies an admin‑defined secret that is shorter than 8 or longer than 1024 characters Details: `Validation Error : [clientSecret size must be between 8 and 1024]` with target `client_secret`
400	`INVALID_DATA`	`INVALID_VALUE`	Message: `The request could not be completed. One or more validation errors were in the request.` When and details When: A `POST` with `application/vnd.pingidentity.secret+json` supplies an admin‑defined secret containing characters outside the allowed set, or the application does not have an admin‑defined client ID Details: `Invalid application, invalid client secret.` with target `client_secret`, or `Invalid application, admin-defined client id is required.` with target `client_id`
400	`INVALID_DATA`	`INVALID_VALUE`	Message: `The request could not be completed. One or more validation errors were in the request.` When and details When: A `POST` with `application/vnd.pingidentity.secret+json` omits the `secret` property, or supplies a null/empty `secret` Details: `Invalid request, admin-defined client secret is required.` with target `secret`
400	`INVALID_DATA`	`INVALID_VALUE`	Message: `Validation Error : [previous.expiresAt Invalid secret expiry date]` When and details When: A `POST` request (the generate operation or the admin‑defined secret update operation) supplies a `previous.expiresAt` value that is earlier than 1 minute from now or later than 30 days from now (90 days when the environment has the extended secret‑retention feature flag enabled) Details: `Invalid secret expiry date`
403	`ACCESS_FAILED`	`INSUFFICIENT_PERMISSIONS`	Message: `The request could not be completed. You do not have access to this resource.` When and details When: A WORKER application attempts to read, generate, or update its own secret (applies to all application secret operations) Details: `Actor does not have permissions to access worker application client secrets`
403	`ACCESS_FAILED`	None	Message: `The actor attempting to perform the request is not authorized.` When and details When: The actor lacks the required permission for the operation, such as reading or generating a secret in an environment the actor is not authorized for Details: None.
404	`NOT_FOUND`	None	Message: `The request could not be completed. The requested resource was not found.` When and details When: The application does not exist in the environment, or is a self‑service, admin console, application portal, or MCP server application. Applies to all application secret operations Details: None.
404	`NOT_FOUND`	None	Message: `The request could not be completed. The requested resource was not found.` When and details When: The `POST` operation with `application/vnd.pingidentity.secret+json` is used while the environment does not have the admin‑defined secret update feature enabled Details: None.

400

INVALID_DATA

INVALID_VALUE

Message: The request could not be completed. One or more validation errors were in the request.

When and details

When: A POST with application/vnd.pingidentity.secret+json supplies an admin‑defined secret that is shorter than 8 or longer than 1024 characters

Details: Validation Error : [clientSecret size must be between 8 and 1024] with target client_secret

400

INVALID_DATA

INVALID_VALUE

Message: The request could not be completed. One or more validation errors were in the request.

When and details

When: A POST with application/vnd.pingidentity.secret+json supplies an admin‑defined secret containing characters outside the allowed set, or the application does not have an admin‑defined client ID

Details: Invalid application, invalid client secret. with target client_secret, or Invalid application, admin-defined client id is required. with target client_id

400

INVALID_DATA

INVALID_VALUE

Message: The request could not be completed. One or more validation errors were in the request.

When and details

When: A POST with application/vnd.pingidentity.secret+json omits the secret property, or supplies a null/empty secret

Details: Invalid request, admin-defined client secret is required. with target secret

400

INVALID_DATA

INVALID_VALUE

Message: Validation Error : [previous.expiresAt Invalid secret expiry date]

When and details

When: A POST request (the generate operation or the admin‑defined secret update operation) supplies a previous.expiresAt value that is earlier than 1 minute from now or later than 30 days from now (90 days when the environment has the extended secret‑retention feature flag enabled)

Details: Invalid secret expiry date

403

ACCESS_FAILED

INSUFFICIENT_PERMISSIONS

Message: The request could not be completed. You do not have access to this resource.

When and details

When: A WORKER application attempts to read, generate, or update its own secret (applies to all application secret operations)

Details: Actor does not have permissions to access worker application client secrets

403

ACCESS_FAILED

None

Message: The actor attempting to perform the request is not authorized.

When and details

When: The actor lacks the required permission for the operation, such as reading or generating a secret in an environment the actor is not authorized for

Details: None.

404

NOT_FOUND

None

Message: The request could not be completed. The requested resource was not found.

When and details

When: The application does not exist in the environment, or is a self‑service, admin console, application portal, or MCP server application. Applies to all application secret operations

Details: None.

404

NOT_FOUND

None

Message: The request could not be completed. The requested resource was not found.

When and details

When: The POST operation with application/vnd.pingidentity.secret+json is used while the environment does not have the admin‑defined secret update feature enabled

Details: None.

PingOne Platform APIs

Application Secret

Best practices

Applications secret data model

Response codes

Application secret errors