Step 1: Create the application connection

POST {{apiPath}}/environments/{{envID}}/applications

The POST {{apiPath}}/environments/{{envID}}/applications endpoint creates the application connection and sets the pkceEnforcement property to one of the REQUIRED options.

The response returns a 201 Created message and shows the application connection data. In this request, the pkceEnforcement property value is set to S256_REQUIRED, which specifies that a PKCE code_challenge parameter is required in the authorize request and the code_challenge_method is also required and must specify S256 (a SHA2 256-bit hash).

In this activity, the tokenEndpointAuthMethod in the application’s OIDC properties is set to NONE, which specifies that no authentication credentials are required in the request. Conversely, if the application’s tokenEndpointAuthMethod is set to CLIENT_SECRET_BASIC or CLIENT_SECRET_POST, authentication credentials would be required in the request. For example, if the tokenEndpointAuthMethod value is set to CLIENT_SECRET_BASIC, the client_id and client_secret attribute values are needed but cannot be part of the request body. In these cases, the client_id and client_secret are passed in as a Base64 encoded authorization header in the request, like this --user 'client_id:client_secret'.

Headers

Authorization Bearer {{accessToken}}

Content-Type application/json

Body

raw ( application/json )

{
    "name": "UseCasePKCEApp",
    "description": "this is my use case PKCE application",
    "pkceEnforcement": "S256_REQUIRED",
    "enabled": true,
    "type": "NATIVE_APP",
    "protocol": "OPENID_CONNECT",
    "responseTypes": [
        "CODE",
        "TOKEN",
        "ID_TOKEN"
    ],
    "grantTypes": [
        "AUTHORIZATION_CODE",
        "IMPLICIT"
    ],
    "tokenEndpointAuthMethod": "NONE",
    "postLogoutRedirectUris": [
        "https://www.example.com"
    ],
    "redirectUris": [
        "https://www.example.com"
    ]
}

Example Request

curl --location --globoff '{{apiPath}}/environments/{{envID}}/applications' \
--header 'Content-Type: application/json' \
--header 'Authorization: Bearer {{accessToken}}' \
--data '{
    "name": "UseCasePKCEApp",
    "description": "this is my use case PKCE application",
    "pkceEnforcement": "S256_REQUIRED",
    "enabled": true,
    "type": "NATIVE_APP",
    "protocol": "OPENID_CONNECT",
    "responseTypes": [
        "CODE",
        "TOKEN",
        "ID_TOKEN"
    ],
    "grantTypes": [
        "AUTHORIZATION_CODE",
        "IMPLICIT"
    ],
    "tokenEndpointAuthMethod": "NONE",
    "postLogoutRedirectUris": [
        "https://www.example.com"
    ],
    "redirectUris": [
        "https://www.example.com"
    ]
}'

var options = new RestClientOptions("{{apiPath}}/environments/{{envID}}/applications")
{
  MaxTimeout = -1,
};
var client = new RestClient(options);
var request = new RestRequest("", Method.Post);
request.AddHeader("Content-Type", "application/json");
request.AddHeader("Authorization", "Bearer {{accessToken}}");
var body = @"{" + "\n" +
@"    ""name"": ""UseCasePKCEApp""," + "\n" +
@"    ""description"": ""this is my use case PKCE application""," + "\n" +
@"    ""pkceEnforcement"": ""S256_REQUIRED""," + "\n" +
@"    ""enabled"": true," + "\n" +
@"    ""type"": ""NATIVE_APP""," + "\n" +
@"    ""protocol"": ""OPENID_CONNECT""," + "\n" +
@"    ""responseTypes"": [" + "\n" +
@"        ""CODE""," + "\n" +
@"        ""TOKEN""," + "\n" +
@"        ""ID_TOKEN""" + "\n" +
@"    ]," + "\n" +
@"    ""grantTypes"": [" + "\n" +
@"        ""AUTHORIZATION_CODE""," + "\n" +
@"        ""IMPLICIT""" + "\n" +
@"    ]," + "\n" +
@"    ""tokenEndpointAuthMethod"": ""NONE""," + "\n" +
@"    ""postLogoutRedirectUris"": [" + "\n" +
@"        ""https://www.example.com""" + "\n" +
@"    ]," + "\n" +
@"    ""redirectUris"": [" + "\n" +
@"        ""https://www.example.com""" + "\n" +
@"    ]" + "\n" +
@"}";
request.AddStringBody(body, DataFormat.Json);
RestResponse response = await client.ExecuteAsync(request);
Console.WriteLine(response.Content);

package main

import (
  "fmt"
  "strings"
  "net/http"
  "io"
)

func main() {

  url := "{{apiPath}}/environments/{{envID}}/applications"
  method := "POST"

  payload := strings.NewReader(`{
    "name": "UseCasePKCEApp",
    "description": "this is my use case PKCE application",
    "pkceEnforcement": "S256_REQUIRED",
    "enabled": true,
    "type": "NATIVE_APP",
    "protocol": "OPENID_CONNECT",
    "responseTypes": [
        "CODE",
        "TOKEN",
        "ID_TOKEN"
    ],
    "grantTypes": [
        "AUTHORIZATION_CODE",
        "IMPLICIT"
    ],
    "tokenEndpointAuthMethod": "NONE",
    "postLogoutRedirectUris": [
        "https://www.example.com"
    ],
    "redirectUris": [
        "https://www.example.com"
    ]
}`)

  client := &http.Client {
  }
  req, err := http.NewRequest(method, url, payload)

  if err != nil {
    fmt.Println(err)
    return
  }
  req.Header.Add("Content-Type", "application/json")
  req.Header.Add("Authorization", "Bearer {{accessToken}}")

  res, err := client.Do(req)
  if err != nil {
    fmt.Println(err)
    return
  }
  defer res.Body.Close()

  body, err := io.ReadAll(res.Body)
  if err != nil {
    fmt.Println(err)
    return
  }
  fmt.Println(string(body))
}

POST /environments/{{envID}}/applications HTTP/1.1
Host: {{apiPath}}
Content-Type: application/json
Authorization: Bearer {{accessToken}}

{
    "name": "UseCasePKCEApp",
    "description": "this is my use case PKCE application",
    "pkceEnforcement": "S256_REQUIRED",
    "enabled": true,
    "type": "NATIVE_APP",
    "protocol": "OPENID_CONNECT",
    "responseTypes": [
        "CODE",
        "TOKEN",
        "ID_TOKEN"
    ],
    "grantTypes": [
        "AUTHORIZATION_CODE",
        "IMPLICIT"
    ],
    "tokenEndpointAuthMethod": "NONE",
    "postLogoutRedirectUris": [
        "https://www.example.com"
    ],
    "redirectUris": [
        "https://www.example.com"
    ]
}

OkHttpClient client = new OkHttpClient().newBuilder()
  .build();
MediaType mediaType = MediaType.parse("application/json");
RequestBody body = RequestBody.create(mediaType, "{\n    \"name\": \"UseCasePKCEApp\",\n    \"description\": \"this is my use case PKCE application\",\n    \"pkceEnforcement\": \"S256_REQUIRED\",\n    \"enabled\": true,\n    \"type\": \"NATIVE_APP\",\n    \"protocol\": \"OPENID_CONNECT\",\n    \"responseTypes\": [\n        \"CODE\",\n        \"TOKEN\",\n        \"ID_TOKEN\"\n    ],\n    \"grantTypes\": [\n        \"AUTHORIZATION_CODE\",\n        \"IMPLICIT\"\n    ],\n    \"tokenEndpointAuthMethod\": \"NONE\",\n    \"postLogoutRedirectUris\": [\n        \"https://www.example.com\"\n    ],\n    \"redirectUris\": [\n        \"https://www.example.com\"\n    ]\n}");
Request request = new Request.Builder()
  .url("{{apiPath}}/environments/{{envID}}/applications")
  .method("POST", body)
  .addHeader("Content-Type", "application/json")
  .addHeader("Authorization", "Bearer {{accessToken}}")
  .build();
Response response = client.newCall(request).execute();

var settings = {
  "url": "{{apiPath}}/environments/{{envID}}/applications",
  "method": "POST",
  "timeout": 0,
  "headers": {
    "Content-Type": "application/json",
    "Authorization": "Bearer {{accessToken}}"
  },
  "data": JSON.stringify({
    "name": "UseCasePKCEApp",
    "description": "this is my use case PKCE application",
    "pkceEnforcement": "S256_REQUIRED",
    "enabled": true,
    "type": "NATIVE_APP",
    "protocol": "OPENID_CONNECT",
    "responseTypes": [
      "CODE",
      "TOKEN",
      "ID_TOKEN"
    ],
    "grantTypes": [
      "AUTHORIZATION_CODE",
      "IMPLICIT"
    ],
    "tokenEndpointAuthMethod": "NONE",
    "postLogoutRedirectUris": [
      "https://www.example.com"
    ],
    "redirectUris": [
      "https://www.example.com"
    ]
  }),
};

$.ajax(settings).done(function (response) {
  console.log(response);
});

var request = require('request');
var options = {
  'method': 'POST',
  'url': '{{apiPath}}/environments/{{envID}}/applications',
  'headers': {
    'Content-Type': 'application/json',
    'Authorization': 'Bearer {{accessToken}}'
  },
  body: JSON.stringify({
    "name": "UseCasePKCEApp",
    "description": "this is my use case PKCE application",
    "pkceEnforcement": "S256_REQUIRED",
    "enabled": true,
    "type": "NATIVE_APP",
    "protocol": "OPENID_CONNECT",
    "responseTypes": [
      "CODE",
      "TOKEN",
      "ID_TOKEN"
    ],
    "grantTypes": [
      "AUTHORIZATION_CODE",
      "IMPLICIT"
    ],
    "tokenEndpointAuthMethod": "NONE",
    "postLogoutRedirectUris": [
      "https://www.example.com"
    ],
    "redirectUris": [
      "https://www.example.com"
    ]
  })

};
request(options, function (error, response) {
  if (error) throw new Error(error);
  console.log(response.body);
});

import requests
import json

url = "{{apiPath}}/environments/{{envID}}/applications"

payload = json.dumps({
  "name": "UseCasePKCEApp",
  "description": "this is my use case PKCE application",
  "pkceEnforcement": "S256_REQUIRED",
  "enabled": True,
  "type": "NATIVE_APP",
  "protocol": "OPENID_CONNECT",
  "responseTypes": [
    "CODE",
    "TOKEN",
    "ID_TOKEN"
  ],
  "grantTypes": [
    "AUTHORIZATION_CODE",
    "IMPLICIT"
  ],
  "tokenEndpointAuthMethod": "NONE",
  "postLogoutRedirectUris": [
    "https://www.example.com"
  ],
  "redirectUris": [
    "https://www.example.com"
  ]
})
headers = {
  'Content-Type': 'application/json',
  'Authorization': 'Bearer {{accessToken}}'
}

response = requests.request("POST", url, headers=headers, data=payload)

print(response.text)

<?php
require_once 'HTTP/Request2.php';
$request = new HTTP_Request2();
$request->setUrl('{{apiPath}}/environments/{{envID}}/applications');
$request->setMethod(HTTP_Request2::METHOD_POST);
$request->setConfig(array(
  'follow_redirects' => TRUE
));
$request->setHeader(array(
  'Content-Type' => 'application/json',
  'Authorization' => 'Bearer {{accessToken}}'
));
$request->setBody('{\n    "name": "UseCasePKCEApp",\n    "description": "this is my use case PKCE application",\n    "pkceEnforcement": "S256_REQUIRED",\n    "enabled": true,\n    "type": "NATIVE_APP",\n    "protocol": "OPENID_CONNECT",\n    "responseTypes": [\n        "CODE",\n        "TOKEN",\n        "ID_TOKEN"\n    ],\n    "grantTypes": [\n        "AUTHORIZATION_CODE",\n        "IMPLICIT"\n    ],\n    "tokenEndpointAuthMethod": "NONE",\n    "postLogoutRedirectUris": [\n        "https://www.example.com"\n    ],\n    "redirectUris": [\n        "https://www.example.com"\n    ]\n}');
try {
  $response = $request->send();
  if ($response->getStatus() == 200) {
    echo $response->getBody();
  }
  else {
    echo 'Unexpected HTTP status: ' . $response->getStatus() . ' ' .
    $response->getReasonPhrase();
  }
}
catch(HTTP_Request2_Exception $e) {
  echo 'Error: ' . $e->getMessage();
}

require "uri"
require "json"
require "net/http"

url = URI("{{apiPath}}/environments/{{envID}}/applications")

http = Net::HTTP.new(url.host, url.port);
request = Net::HTTP::Post.new(url)
request["Content-Type"] = "application/json"
request["Authorization"] = "Bearer {{accessToken}}"
request.body = JSON.dump({
  "name": "UseCasePKCEApp",
  "description": "this is my use case PKCE application",
  "pkceEnforcement": "S256_REQUIRED",
  "enabled": true,
  "type": "NATIVE_APP",
  "protocol": "OPENID_CONNECT",
  "responseTypes": [
    "CODE",
    "TOKEN",
    "ID_TOKEN"
  ],
  "grantTypes": [
    "AUTHORIZATION_CODE",
    "IMPLICIT"
  ],
  "tokenEndpointAuthMethod": "NONE",
  "postLogoutRedirectUris": [
    "https://www.example.com"
  ],
  "redirectUris": [
    "https://www.example.com"
  ]
})

response = http.request(request)
puts response.read_body

let parameters = "{\n    \"name\": \"UseCasePKCEApp\",\n    \"description\": \"this is my use case PKCE application\",\n    \"pkceEnforcement\": \"S256_REQUIRED\",\n    \"enabled\": true,\n    \"type\": \"NATIVE_APP\",\n    \"protocol\": \"OPENID_CONNECT\",\n    \"responseTypes\": [\n        \"CODE\",\n        \"TOKEN\",\n        \"ID_TOKEN\"\n    ],\n    \"grantTypes\": [\n        \"AUTHORIZATION_CODE\",\n        \"IMPLICIT\"\n    ],\n    \"tokenEndpointAuthMethod\": \"NONE\",\n    \"postLogoutRedirectUris\": [\n        \"https://www.example.com\"\n    ],\n    \"redirectUris\": [\n        \"https://www.example.com\"\n    ]\n}"
let postData = parameters.data(using: .utf8)

var request = URLRequest(url: URL(string: "{{apiPath}}/environments/{{envID}}/applications")!,timeoutInterval: Double.infinity)
request.addValue("application/json", forHTTPHeaderField: "Content-Type")
request.addValue("Bearer {{accessToken}}", forHTTPHeaderField: "Authorization")

request.httpMethod = "POST"
request.httpBody = postData

let task = URLSession.shared.dataTask(with: request) { data, response, error in
  guard let data = data else {
    print(String(describing: error))
    return
  }
  print(String(data: data, encoding: .utf8)!)
}

task.resume()

Example Response

201 Created

{
    "_links": {
        "self": {
            "href": "https://api.pingone.com/v1/environments/abfba8f6-49eb-49f5-a5d9-80ad5c98f9f6/applications/6d980d36-6977-46b7-9358-37f4d520a81b"
        },
        "environment": {
            "href": "https://api.pingone.com/v1/environments/abfba8f6-49eb-49f5-a5d9-80ad5c98f9f6"
        },
        "attributes": {
            "href": "https://api.pingone.com/v1/environments/abfba8f6-49eb-49f5-a5d9-80ad5c98f9f6/applications/6d980d36-6977-46b7-9358-37f4d520a81b/attributes"
        },
        "pushCredentials": {
            "href": "https://api.pingone.com/v1/environments/abfba8f6-49eb-49f5-a5d9-80ad5c98f9f6/applications/6d980d36-6977-46b7-9358-37f4d520a81b/pushCredentials"
        },
        "secret": {
            "href": "https://api.pingone.com/v1/environments/abfba8f6-49eb-49f5-a5d9-80ad5c98f9f6/applications/6d980d36-6977-46b7-9358-37f4d520a81b/secret"
        },
        "grants": {
            "href": "https://api.pingone.com/v1/environments/abfba8f6-49eb-49f5-a5d9-80ad5c98f9f6/applications/6d980d36-6977-46b7-9358-37f4d520a81b/grants"
        }
    },
    "environment": {
        "id": "abfba8f6-49eb-49f5-a5d9-80ad5c98f9f6"
    },
    "id": "6d980d36-6977-46b7-9358-37f4d520a81b",
    "name": "UseCasePKCEApp",
    "description": "this is my use case PKCE application",
    "enabled": true,
    "type": "NATIVE_APP",
    "protocol": "OPENID_CONNECT",
    "createdAt": "2021-03-31T16:17:39.223Z",
    "updatedAt": "2021-03-31T16:17:39.223Z",
    "assignActorRoles": false,
    "mobile": {
        "integrityDetection": {
            "mode": "DISABLED"
        }
    },
    "responseTypes": [
        "CODE",
        "ID_TOKEN",
        "TOKEN"
    ],
    "grantTypes": [
        "AUTHORIZATION_CODE",
        "IMPLICIT"
    ],
    "tokenEndpointAuthMethod": "NONE",
    "pkceEnforcement": "S256_REQUIRED",
    "postLogoutRedirectUris": [
        "https://www.example.com"
    ],
    "redirectUris": [
        "https://www.example.com"
    ]
}

PingOne Platform APIs

Step 1: Create the application connection

Headers

Body

Example Request

Example Response