Create an application

An oidc application is an OpenID Connect client of the directory's issuer; its client ID is its id. A web application that authenticates with a secret gets its first ezgh_scs_ secret in this response, once. A saml application is a SAML 2.0 service provider; the directory gets its SAML signing certificate with its first one. Counts against sso.applications.count. An ezgh application with product console is the console application (directory users federating into the EZGH console by assuming bots): at most one per directory (409 console_application_exists), its tile opens the directory's /console/start, and the directory gets its SAML signing certificate with it.

POST

https://sso.ezghcloud.com/v1/organizations/{orgId}/sso/applications

View as Markdown

Authorization

apiKeyoptionalHTTP
oauthoptionalHTTP
sessionCookieoptionalAPI key in cookie

Path parameters

orgIdstringrequired
format: uuid

Header parameters

Idempotency-Keyoptionalstring
Makes a retry safe: the same key and request get the stored response.

pattern: ^[\x21-\x7e]{1,200}$

Request bodyJSONrequired

kindoidcorezghorsamlrequired
namestringrequired
maxLength: 100, minLength: 1
descriptionoptionalstring
maxLength: 1024
ezghoptionalobject
4 properties
- consoleSessionSecondsoptionalinteger
  The console application only: the federated console session lifetime in seconds, 900–43200, default 43200.
  
  maximum: 43200, minimum: 900
- launchUrloptionalstring | null
  Accepted for compatibility, under https://mcpcentral.ezghcloud.com/…, but unused: an mcpcentral tile opens MCP Central's portal on the directory's current alias (https://.mcp.ezgh.app/). Not for the console application (only null is accepted).
  
  format: uri
- productoptionalmcpcentralorconsole
  The EZGH product: mcpcentral (MCP Central), or console (the console application: at most one per directory, 409 console_application_exists on a second). Can't change.
- resourceTokenLifetimeSecondsoptionalinteger
  Lifetime of the opaque ezgh_sat_ resource tokens EZGH SSO issues for the product (stage 4). Default 3600. Not for the console application.
  
  maximum: 3600, minimum: 300
oidcoptionalobject
On create, applicationType and redirectUris are required; on update, only the fields sent change (null clears a nullable one).
12 properties
- accessTokenAudienceoptionalstring | null
  The access token's aud; null is the client ID.
  
  maxLength: 256
- accessTokenLifetimeSecondsoptionalinteger
  The RFC 9068 JWT access token's lifetime. Default 900.
  
  maximum: 3600, minimum: 300
- applicationTypeoptionalweborspaornative
  web is confidential; spa and native are public clients that must use PKCE (S256). Can't change.
- backchannelLogoutUrioptionalstring | null
  A public https URL that receives OpenID Connect back-channel logout tokens, through hardened egress.
  
  format: uri
- groupsClaimoptionalassignedorall
  With the groups scope: the user's groups that are assigned to this application (the default), or all of them.
- idTokenSignedResponseAlgoptionalRS256orES256
  Signs the ID token and the access token. Default RS256.
- initiateLoginUrioptionalstring | null
  https; the portal tile opens it with ?iss= (OpenID Connect third-party-initiated login).
  
  format: uri
- jwksoptionalobject | null
  The client's public keys by value, a JWK set ({ keys: [...] }), for private_key_jwt. 1–10 RSA (2048+ bits) or EC (P-256/384/521) signing keys, a kid on each when there are several.
- jwksUrioptionalstring | null
  A public https URL of the client's JWK set, for private_key_jwt; fetched through hardened egress and stored.
  
  format: uri
- postLogoutRedirectUrisoptionalarray ofstring
  format: uri
- redirectUrisoptionalarray ofstring
  Exact URIs. https, or http on loopback; a native application may use a reverse-domain private scheme, and its loopback IP redirects match any port (RFC 8252).
  
  format: uri
- tokenEndpointAuthMethodoptionalclient_secret_basicorclient_secret_postorprivate_key_jwtornone
  web: client_secret_basic (the default), client_secret_post or private_key_jwt; spa and native: none.
samloptionalobject
On create, entityId and acsUrls are required unless metadata gives them; on update, only the fields sent change (null clears a nullable one).
16 properties
- acsUrlsoptionalarray ofstring
  Exact assertion consumer service URLs (HTTP-POST binding), https (http only on loopback); the first is the default. A response only ever goes to one of these, never to a URL taken from a request.
  
  format: uri
- attributesoptionalarray ofobject
  3 properties
  namestringrequired
  The attribute's Name, as the service provider expects it.
  
  maxLength: 256, minLength: 1
  valuestringrequired
  A template: literal text with ${user.id}, ${user.email}, ${user.name}, ${user.givenName}, ${user.familyName} or ${user.department}; or exactly ${user.groups}, one value per group (filtered by groupsFilter). A value that is a single variable the user has no value for is left out.
  
  maxLength: 1024, minLength: 1
  nameFormatoptionalunspecifiedoruriorbasic
  The attribute's NameFormat. Default unspecified.
- defaultRelayStateoptionalstring | null
  The RelayState sent with IdP-initiated sign-in (where the service provider lands).
  
  maxLength: 1024
- encryptAssertionsoptionalboolean
  Encrypt the assertion to the service provider's encryption certificate. Default false.
- encryptionAlgorithmoptionalaes128-gcmoraes256-cbc
  The content encryption (the key is transported with RSA-OAEP). Default aes128-gcm.
- entityIdoptionalstring
  The service provider's entity ID: the assertion's audience, and the Issuer its AuthnRequests must carry.
  
  maxLength: 1024, minLength: 1
- groupsFilteroptionalassignedorall
  ${user.groups}: only the groups assigned to the application (the default), or all of the user's groups.
- idpInitiatedoptionalboolean
  Allow IdP-initiated sign-in (a portal tile). Default true.
- metadataUrloptionalstring
  Import the service provider's metadata from this https URL now (through the hardened egress; imported once, not refreshed): its entity ID, HTTP-POST ACS URLs, single logout endpoint and certificates. Fields sent alongside win.
  
  format: uri
- metadataXmloptionalstring
  The service provider's metadata by value, imported as metadataUrl is.
  
  maxLength: 262144
- nameIdFormatoptionalemailorpersistentortransient
  email (the default), persistent (the user's ID) or transient (new for every assertion).
- signAssertionoptionalboolean
  Sign the Assertion. Default true. At least one of the two is signed.
- signResponseoptionalboolean
  Sign the Response. Default true.
- sloBindingoptionalHTTP-RedirectorHTTP-POST
  Default HTTP-Redirect.
- sloUrloptionalstring | null
  The service provider's single logout endpoint, where logout responses go.
  
  format: uri
- spCertificatesoptionalarray ofobject
  5 properties
  certificatestringrequired
  The X.509 certificate, base64 DER (PEM is accepted on input).
  
  usesigningorencryptionrequired
  fingerprintSha256optionalstring
  Read-only: the certificate's SHA-256 fingerprint, hex.
  
  notAfteroptionalstring
  Read-only.
  
  format: date-time
  subjectoptionalstring
  Read-only.
tagsoptionalmap ofstring

Returns

201

The application, and its first client secret when it uses one.

JSON

applicationobjectrequired
An application. Exactly one of oidc, saml and ezgh is set, by kind. A saml application is a SAML 2.0 service provider of the directory's IdP. An ezgh application is a portal tile and its resource-token settings: using the product is an EZGH action that IAM decides, so its assignments only decide who sees the tile. The one a product manages (managedBy mcpcentral) is also its portal's OAuth client in the directory: its id is the client_id, it authenticates with private_key_jwt against the product's JWKS, and it gets only resource tokens bound to the product's per-organization label.
19 properties
- createdAtstringrequired
  format: date-time
- descriptionstringrequired
- directoryIdstringrequired
  format: uuid
- ezghEzghSettingsornullrequired
  2 variants
  One of the following:
  EzghSettings
  View EzghSettings schema →
  4 properties
  consoleSessionSecondsinteger | nullrequired
  The console application's federated console session lifetime (the assertion's SessionNotOnOrAfter, never past the SSO session's end): 900–43200, default 43200. null for every other product.
  
  maximum: 43200, minimum: 900
  launchUrlstring | nullrequired
  The portal tile's link. For mcpcentral it's always MCP Central's portal on the directory's current alias, https://.mcp.ezgh.app/, whatever was stored (read-only); for the console application, the directory's https://.sso.ezgh.app/console/start (read-only).
  
  format: uri
  productmcpcentralorconsolerequired
  The EZGH product: mcpcentral (MCP Central), or console (the console application: at most one per directory, 409 console_application_exists on a second). Can't change.
  
  resourceTokenLifetimeSecondsintegerrequired
  Lifetime of the opaque ezgh_sat_ resource tokens EZGH SSO issues for the product (stage 4). Default 3600. The console application issues no resource tokens: always 3600, inert.
  
  maximum: 3600, minimum: 300
  null
- idstringrequired
  format: uuid
- kindoidcorezghorsamlrequired
- logoUrlstring | nullrequired
  Read-only: where sso-edge serves the application's uploaded logo (its portal tile's icon) on the directory's host, https://.sso.ezgh.app/branding/applications//logo?v=…, or null. A replaced logo is a new URL. Upload it with PUT …/applications/{appId}/logo; create and update refuse logoUrl.
  
  format: uri
- managedBystring | nullrequired
  The EZGH product that manages this ezgh application through its own internal routes (MCP Central's, created when EZGH SSO is associated with it), or null. A managed application is read-only here: updating or deleting it, or changing its assignments, is 409 managed_by_product, and creating another ezgh application of its product in the directory is refused the same way.
- namestringrequired
- oidcOidcSettingsornullrequired
  2 variants
  One of the following:
  OidcSettings
  View OidcSettings schema →
  17 properties
  accessTokenAudiencestring | nullrequired
  The access token's aud; null is the client ID.
  
  maxLength: 256
  accessTokenLifetimeSecondsintegerrequired
  The RFC 9068 JWT access token's lifetime. Default 900.
  
  maximum: 3600, minimum: 300
  applicationTypeweborspaornativerequired
  web is confidential; spa and native are public clients that must use PKCE (S256). Can't change.
  
  backchannelLogoutUristring | nullrequired
  A public https URL that receives OpenID Connect back-channel logout tokens, through hardened egress.
  
  format: uri
  clientIdstringrequired
  clientSecretsarray ofobjectrequired
  Live client secrets' metadata, oldest first. Never a secret.
  
  5 properties
  createdAtstringrequired
  format: date-time
  createdByobjectrequired
  2 properties
  idstringrequired
  typestringrequired
  idstringrequired
  format: uuid
  lastUsedAtstring | nullrequired
  format: date-time
  prefixstringrequired
  The first 13 characters (ezgh_scs_ and four more).
  
  groupsClaimassignedorallrequired
  With the groups scope: the user's groups that are assigned to this application (the default), or all of them.
  
  idTokenSignedResponseAlgRS256orES256required
  Signs the ID token and the access token. Default RS256.
  
  initiateLoginUristring | nullrequired
  https; the portal tile opens it with ?iss= (OpenID Connect third-party-initiated login).
  
  format: uri
  issuerstringrequired
  format: uri
  jwksobject | nullrequired
  The client's public keys by value, a JWK set ({ keys: [...] }), for private_key_jwt. 1–10 RSA (2048+ bits) or EC (P-256/384/521) signing keys, a kid on each when there are several.
  
  jwksFetchErrorstring | nullrequired
  jwksFetchedAtstring | nullrequired
  format: date-time
  jwksUristring | nullrequired
  A public https URL of the client's JWK set, for private_key_jwt; fetched through hardened egress and stored.
  
  format: uri
  postLogoutRedirectUrisarray ofstringrequired
  format: uri
  redirectUrisarray ofstringrequired
  Exact URIs. https, or http on loopback; a native application may use a reverse-domain private scheme, and its loopback IP redirects match any port (RFC 8252).
  
  format: uri
  tokenEndpointAuthMethodclient_secret_basicorclient_secret_postorprivate_key_jwtornonerequired
  web: client_secret_basic (the default), client_secret_post or private_key_jwt; spa and native: none.
  
  null
- organizationIdstringrequired
  format: uuid
- projectIdnullrequired
- regionstringrequired
- resourceNamestringrequired
- samlSamlSettingsornullrequired
  2 variants
  One of the following:
  SamlSettings
  View SamlSettings schema →
  17 properties
  acsUrlsarray ofstringrequired
  Exact assertion consumer service URLs (HTTP-POST binding), https (http only on loopback); the first is the default. A response only ever goes to one of these, never to a URL taken from a request.
  
  format: uri
  attributesarray ofobjectrequired
  3 properties
  namestringrequired
  The attribute's Name, as the service provider expects it.
  
  maxLength: 256, minLength: 1
  valuestringrequired
  A template: literal text with ${user.id}, ${user.email}, ${user.name}, ${user.givenName}, ${user.familyName} or ${user.department}; or exactly ${user.groups}, one value per group (filtered by groupsFilter). A value that is a single variable the user has no value for is left out.
  
  maxLength: 1024, minLength: 1
  nameFormatoptionalunspecifiedoruriorbasic
  The attribute's NameFormat. Default unspecified.
  
  defaultRelayStatestring | nullrequired
  The RelayState sent with IdP-initiated sign-in (where the service provider lands).
  
  maxLength: 1024
  encryptAssertionsbooleanrequired
  Encrypt the assertion to the service provider's encryption certificate. Default false.
  
  encryptionAlgorithmaes128-gcmoraes256-cbcrequired
  The content encryption (the key is transported with RSA-OAEP). Default aes128-gcm.
  
  entityIdstringrequired
  The service provider's entity ID: the assertion's audience, and the Issuer its AuthnRequests must carry.
  
  maxLength: 1024, minLength: 1
  groupsFilterassignedorallrequired
  ${user.groups}: only the groups assigned to the application (the default), or all of the user's groups.
  
  idpobjectrequired
  The directory's identity provider for this application, on its host.
  
  6 properties
  certificatesarray ofobjectrequired
  9 properties
  activatesAtstringrequired
  format: date-time
  certificatestringrequired
  The X.509 certificate, base64 DER.
  
  fingerprintSha256stringrequired
  idstringrequired
  format: uuid
  notAfterstringrequired
  format: date-time
  notBeforestringrequired
  format: date-time
  statusactiveornextrequired
  active signs now; next is published and starts signing when the active certificate expires (made 90 days before).
  
  subjectstringrequired
  warnAtstringrequired
  60 days before notAfter: from then the console warns that service providers need the next certificate.
  
  format: date-time
  entityIdstringrequired
  The IdP's entity ID for this application (its metadata URL).
  
  initiateUrlstringrequired
  Opening it starts IdP-initiated sign-in (the portal tile), when idpInitiated is on.
  
  format: uri
  metadataUrlstringrequired
  format: uri
  sloUrlstringrequired
  Single logout, HTTP-Redirect and HTTP-POST bindings.
  
  format: uri
  ssoUrlstringrequired
  Single sign-on, HTTP-Redirect and HTTP-POST bindings.
  
  format: uri
  idpInitiatedbooleanrequired
  Allow IdP-initiated sign-in (a portal tile). Default true.
  
  metadataImportedAtstring | nullrequired
  format: date-time
  metadataUrlstring | nullrequired
  Where the service provider's metadata was imported from, if a URL.
  
  format: uri
  nameIdFormatemailorpersistentortransientrequired
  email (the default), persistent (the user's ID) or transient (new for every assertion).
  
  signAssertionbooleanrequired
  Sign the Assertion. Default true. At least one of the two is signed.
  
  signResponsebooleanrequired
  Sign the Response. Default true.
  
  sloBindingHTTP-RedirectorHTTP-POSTrequired
  Default HTTP-Redirect.
  
  sloUrlstring | nullrequired
  The service provider's single logout endpoint, where logout responses go.
  
  format: uri
  spCertificatesarray ofobjectrequired
  5 properties
  certificatestringrequired
  The X.509 certificate, base64 DER (PEM is accepted on input).
  
  usesigningorencryptionrequired
  fingerprintSha256optionalstring
  Read-only: the certificate's SHA-256 fingerprint, hex.
  
  notAfteroptionalstring
  Read-only.
  
  format: date-time
  subjectoptionalstring
  Read-only.
  
  null
- slugstringrequired
- statusactiverequired
- tagsmap ofstringrequired
- updatedAtstringrequired
  format: date-time
clientSecretstring | nullrequired
For client_secret_basic and client_secret_post: ezgh_scs_ + 43 base62 characters, shown in this response only (and its Idempotency-Key replays). Otherwise null.

400

invalid_request (with issues), invalid_cursor, or the endpoint's own 400 codes.

JSON

errorobjectrequired
4 properties
- codestringrequired
  maxLength: 64, pattern: ^[a-z][a-z0-9_]*$
- messagestringrequired
  maxLength: 1024
- issuesoptionalarray ofobject
  invalid_request: one entry per problem, at a dotted path.
  
  2 properties
  messagestringrequired
  pathstringrequired
- quotaoptionalobject
  quota_exceeded: the quota that refused the request. Never with Retry-After.
  
  11 properties
  idstringrequired
  kindallocationorrateorusageorconcurrencyrequired
  limitintegerrequired
  minimum: 0
  scopeorganizationorprojectorresourcerequired
  inFlightoptionalinteger
  minimum: 0
  periodStartoptionalstring
  format: date-time
  regionoptionalstring
  resetsAtoptionalstring
  format: date-time
  scopeResourceNameoptionalstring
  usedoptionalinteger
  minimum: 0
  windowoptionalstring
  rate only: an ISO 8601 duration, PT1S to PT1H.

401

unauthenticated: no credential, or one that doesn't check out.

JSON

errorobjectrequired
4 properties
- codestringrequired
  maxLength: 64, pattern: ^[a-z][a-z0-9_]*$
- messagestringrequired
  maxLength: 1024
- issuesoptionalarray ofobject
  invalid_request: one entry per problem, at a dotted path.
  
  2 properties
  messagestringrequired
  pathstringrequired
- quotaoptionalobject
  quota_exceeded: the quota that refused the request. Never with Retry-After.
  
  11 properties
  idstringrequired
  kindallocationorrateorusageorconcurrencyrequired
  limitintegerrequired
  minimum: 0
  scopeorganizationorprojectorresourcerequired
  inFlightoptionalinteger
  minimum: 0
  periodStartoptionalstring
  format: date-time
  regionoptionalstring
  resetsAtoptionalstring
  format: date-time
  scopeResourceNameoptionalstring
  usedoptionalinteger
  minimum: 0
  windowoptionalstring
  rate only: an ISO 8601 duration, PT1S to PT1H.

403

access_denied: the caller's policies don't allow the action; forbidden_origin: a cookie-authenticated write from an origin that isn't allowed; spend_limit_reached.

JSON

errorobjectrequired
4 properties
- codestringrequired
  maxLength: 64, pattern: ^[a-z][a-z0-9_]*$
- messagestringrequired
  maxLength: 1024
- issuesoptionalarray ofobject
  invalid_request: one entry per problem, at a dotted path.
  
  2 properties
  messagestringrequired
  pathstringrequired
- quotaoptionalobject
  quota_exceeded: the quota that refused the request. Never with Retry-After.
  
  11 properties
  idstringrequired
  kindallocationorrateorusageorconcurrencyrequired
  limitintegerrequired
  minimum: 0
  scopeorganizationorprojectorresourcerequired
  inFlightoptionalinteger
  minimum: 0
  periodStartoptionalstring
  format: date-time
  regionoptionalstring
  resetsAtoptionalstring
  format: date-time
  scopeResourceNameoptionalstring
  usedoptionalinteger
  minimum: 0
  windowoptionalstring
  rate only: an ISO 8601 duration, PT1S to PT1H.

404

not_found: unknown, malformed, or in an organization the caller isn't in.

JSON

errorobjectrequired
4 properties
- codestringrequired
  maxLength: 64, pattern: ^[a-z][a-z0-9_]*$
- messagestringrequired
  maxLength: 1024
- issuesoptionalarray ofobject
  invalid_request: one entry per problem, at a dotted path.
  
  2 properties
  messagestringrequired
  pathstringrequired
- quotaoptionalobject
  quota_exceeded: the quota that refused the request. Never with Retry-After.
  
  11 properties
  idstringrequired
  kindallocationorrateorusageorconcurrencyrequired
  limitintegerrequired
  minimum: 0
  scopeorganizationorprojectorresourcerequired
  inFlightoptionalinteger
  minimum: 0
  periodStartoptionalstring
  format: date-time
  regionoptionalstring
  resetsAtoptionalstring
  format: date-time
  scopeResourceNameoptionalstring
  usedoptionalinteger
  minimum: 0
  windowoptionalstring
  rate only: an ISO 8601 duration, PT1S to PT1H.

409

quota_exceeded (an allocation quota, with quota), idempotency_conflict, idempotency_in_progress (with Retry-After), organization_deletion_pending, operation_in_progress, or the endpoint's own 409 codes.

JSON

errorobjectrequired
4 properties
- codestringrequired
  maxLength: 64, pattern: ^[a-z][a-z0-9_]*$
- messagestringrequired
  maxLength: 1024
- issuesoptionalarray ofobject
  invalid_request: one entry per problem, at a dotted path.
  
  2 properties
  messagestringrequired
  pathstringrequired
- quotaoptionalobject
  quota_exceeded: the quota that refused the request. Never with Retry-After.
  
  11 properties
  idstringrequired
  kindallocationorrateorusageorconcurrencyrequired
  limitintegerrequired
  minimum: 0
  scopeorganizationorprojectorresourcerequired
  inFlightoptionalinteger
  minimum: 0
  periodStartoptionalstring
  format: date-time
  regionoptionalstring
  resetsAtoptionalstring
  format: date-time
  scopeResourceNameoptionalstring
  usedoptionalinteger
  minimum: 0
  windowoptionalstring
  rate only: an ISO 8601 duration, PT1S to PT1H.

413

payload_too_large: the body is over the endpoint's limit (1 MiB unless it says otherwise).

JSON

errorobjectrequired
4 properties
- codestringrequired
  maxLength: 64, pattern: ^[a-z][a-z0-9_]*$
- messagestringrequired
  maxLength: 1024
- issuesoptionalarray ofobject
  invalid_request: one entry per problem, at a dotted path.
  
  2 properties
  messagestringrequired
  pathstringrequired
- quotaoptionalobject
  quota_exceeded: the quota that refused the request. Never with Retry-After.
  
  11 properties
  idstringrequired
  kindallocationorrateorusageorconcurrencyrequired
  limitintegerrequired
  minimum: 0
  scopeorganizationorprojectorresourcerequired
  inFlightoptionalinteger
  minimum: 0
  periodStartoptionalstring
  format: date-time
  regionoptionalstring
  resetsAtoptionalstring
  format: date-time
  scopeResourceNameoptionalstring
  usedoptionalinteger
  minimum: 0
  windowoptionalstring
  rate only: an ISO 8601 duration, PT1S to PT1H.

429

too_many_requests, with Retry-After; or quota_exceeded (a rate, usage or concurrency quota, with quota), never with Retry-After.

JSON

errorobjectrequired
4 properties
- codestringrequired
  maxLength: 64, pattern: ^[a-z][a-z0-9_]*$
- messagestringrequired
  maxLength: 1024
- issuesoptionalarray ofobject
  invalid_request: one entry per problem, at a dotted path.
  
  2 properties
  messagestringrequired
  pathstringrequired
- quotaoptionalobject
  quota_exceeded: the quota that refused the request. Never with Retry-After.
  
  11 properties
  idstringrequired
  kindallocationorrateorusageorconcurrencyrequired
  limitintegerrequired
  minimum: 0
  scopeorganizationorprojectorresourcerequired
  inFlightoptionalinteger
  minimum: 0
  periodStartoptionalstring
  format: date-time
  regionoptionalstring
  resetsAtoptionalstring
  format: date-time
  scopeResourceNameoptionalstring
  usedoptionalinteger
  minimum: 0
  windowoptionalstring
  rate only: an ISO 8601 duration, PT1S to PT1H.

500

internal_error: a bug; the details are in the logs, under the request ID.

JSON

errorobjectrequired
4 properties
- codestringrequired
  maxLength: 64, pattern: ^[a-z][a-z0-9_]*$
- messagestringrequired
  maxLength: 1024
- issuesoptionalarray ofobject
  invalid_request: one entry per problem, at a dotted path.
  
  2 properties
  messagestringrequired
  pathstringrequired
- quotaoptionalobject
  quota_exceeded: the quota that refused the request. Never with Retry-After.
  
  11 properties
  idstringrequired
  kindallocationorrateorusageorconcurrencyrequired
  limitintegerrequired
  minimum: 0
  scopeorganizationorprojectorresourcerequired
  inFlightoptionalinteger
  minimum: 0
  periodStartoptionalstring
  format: date-time
  regionoptionalstring
  resetsAtoptionalstring
  format: date-time
  scopeResourceNameoptionalstring
  usedoptionalinteger
  minimum: 0
  windowoptionalstring
  rate only: an ISO 8601 duration, PT1S to PT1H.

503

unavailable: a dependency the request needs is down. Retry after Retry-After.

JSON

errorobjectrequired
4 properties
- codestringrequired
  maxLength: 64, pattern: ^[a-z][a-z0-9_]*$
- messagestringrequired
  maxLength: 1024
- issuesoptionalarray ofobject
  invalid_request: one entry per problem, at a dotted path.
  
  2 properties
  messagestringrequired
  pathstringrequired
- quotaoptionalobject
  quota_exceeded: the quota that refused the request. Never with Retry-After.
  
  11 properties
  idstringrequired
  kindallocationorrateorusageorconcurrencyrequired
  limitintegerrequired
  minimum: 0
  scopeorganizationorprojectorresourcerequired
  inFlightoptionalinteger
  minimum: 0
  periodStartoptionalstring
  format: date-time
  regionoptionalstring
  resetsAtoptionalstring
  format: date-time
  scopeResourceNameoptionalstring
  usedoptionalinteger
  minimum: 0
  windowoptionalstring
  rate only: an ISO 8601 duration, PT1S to PT1H.