---
title: "Create an application"
description: "An oidc application is an OpenID Connect client of the directory's issuer; its client ID is its id. A web application that authenticates with a secret gets its first ezgh_scs_ secret in this response, once. A saml application is a SAML 2.0 service provider; the directory gets its SAML signing certificate with its first one. Counts against sso.applications.count. An ezgh application with product console is the console application (directory users federating into the EZGH console by assuming bots): at most one per directory (409 console_application_exists), its tile opens the directory's /console/start, and the directory gets its SAML signing certificate with it."
---

> Documentation Index
> Fetch the complete documentation index at: https://docs.ezghcloud.com/llms.txt
> Use this file to discover all available pages before exploring further.

Path: EZGH SSO API

`POST /v1/organizations/{orgId}/sso/applications`

An oidc application is an OpenID Connect client of the directory's issuer; its client ID is its id. A web application that authenticates with a secret gets its first ezgh_scs_ secret in this response, once. A saml application is a SAML 2.0 service provider; the directory gets its SAML signing certificate with its first one. Counts against sso.applications.count. An ezgh application with product console is the console application (directory users federating into the EZGH console by assuming bots): at most one per directory (409 console_application_exists), its tile opens the directory's /console/start, and the directory gets its SAML signing certificate with it.

## Authentication

Requires one of the following:

- `apiKey`, http, header `Authorization`
- `oauth`, http, header `Authorization`
- `sessionCookie`, apiKey, in cookie

## Path parameters

- `CreateApplication.path.orgId` (string, required)
  - format `uuid`

## Header parameters

- `CreateApplication.header.Idempotency-Key` (string, optional) — Makes a retry safe: the same key and request get the stored response.
  - pattern `^[\x21-\x7e]{1,200}$`

## Request body

_Required._

- `CreateApplication.kind` (string, required)
  - one of `"oidc"`, `"ezgh"`, `"saml"`
- `CreateApplication.name` (string, required)
  - minLength 1; maxLength 100
- `CreateApplication.description` (string, optional)
  - maxLength 1024
- `CreateApplication.ezgh` (object, optional)
  - `CreateApplication.ezgh.consoleSessionSeconds` (integer, optional) — The console application only: the federated console session lifetime in seconds, 900–43200, default 43200.
    - min 900; max 43200
  - `CreateApplication.ezgh.launchUrl` (string | null, optional) — Accepted for compatibility, under https://mcpcentral.ezghcloud.com/…, but unused: an mcpcentral tile opens MCP Central's portal on the directory's current alias (https://<alias>.mcp.ezgh.app/). Not for the console application (only null is accepted).
    - format `uri`
  - `CreateApplication.ezgh.product` (string, optional) — The EZGH product: mcpcentral (MCP Central), or console (the console application: at most one per directory, 409 console_application_exists on a second). Can't change.
    - one of `"mcpcentral"`, `"console"`
  - `CreateApplication.ezgh.resourceTokenLifetimeSeconds` (integer, optional) — Lifetime of the opaque ezgh_sat_ resource tokens EZGH SSO issues for the product (stage 4). Default 3600. Not for the console application.
    - min 300; max 3600
- `CreateApplication.oidc` (object, optional) — On create, applicationType and redirectUris are required; on update, only the fields sent change (null clears a nullable one).
  - `CreateApplication.oidc.accessTokenAudience` (string | null, optional) — The access token's aud; null is the client ID.
    - maxLength 256
  - `CreateApplication.oidc.accessTokenLifetimeSeconds` (integer, optional) — The RFC 9068 JWT access token's lifetime. Default 900.
    - min 300; max 3600
  - `CreateApplication.oidc.applicationType` (string, optional) — web is confidential; spa and native are public clients that must use PKCE (S256). Can't change.
    - one of `"web"`, `"spa"`, `"native"`
  - `CreateApplication.oidc.backchannelLogoutUri` (string | null, optional) — A public https URL that receives OpenID Connect back-channel logout tokens, through hardened egress.
    - format `uri`
  - `CreateApplication.oidc.groupsClaim` (string, optional) — With the groups scope: the user's groups that are assigned to this application (the default), or all of them.
    - one of `"assigned"`, `"all"`
  - `CreateApplication.oidc.idTokenSignedResponseAlg` (string, optional) — Signs the ID token and the access token. Default RS256.
    - one of `"RS256"`, `"ES256"`
  - `CreateApplication.oidc.initiateLoginUri` (string | null, optional) — https; the portal tile opens it with ?iss=<issuer> (OpenID Connect third-party-initiated login).
    - format `uri`
  - `CreateApplication.oidc.jwks` (object | null, optional) — The client's public keys by value, a JWK set ({ keys: [...] }), for private_key_jwt. 1–10 RSA (2048+ bits) or EC (P-256/384/521) signing keys, a kid on each when there are several.
  - `CreateApplication.oidc.jwksUri` (string | null, optional) — A public https URL of the client's JWK set, for private_key_jwt; fetched through hardened egress and stored.
    - format `uri`
  - `CreateApplication.oidc.postLogoutRedirectUris` (array<string>, optional)
    - format `uri`
  - `CreateApplication.oidc.redirectUris` (array<string>, optional) — Exact URIs. https, or http on loopback; a native application may use a reverse-domain private scheme, and its loopback IP redirects match any port (RFC 8252).
    - format `uri`
  - `CreateApplication.oidc.tokenEndpointAuthMethod` (string, optional) — web: client_secret_basic (the default), client_secret_post or private_key_jwt; spa and native: none.
    - one of `"client_secret_basic"`, `"client_secret_post"`, `"private_key_jwt"`, `"none"`
- `CreateApplication.saml` (object, optional) — On create, entityId and acsUrls are required unless metadata gives them; on update, only the fields sent change (null clears a nullable one).
  - `CreateApplication.saml.acsUrls` (array<string>, optional) — Exact assertion consumer service URLs (HTTP-POST binding), https (http only on loopback); the first is the default. A response only ever goes to one of these, never to a URL taken from a request.
    - format `uri`
  - `CreateApplication.saml.attributes` (array<object>, optional)
    - `CreateApplication.saml.attributes.name` (string, required) — The attribute's Name, as the service provider expects it.
      - minLength 1; maxLength 256
    - `CreateApplication.saml.attributes.value` (string, required) — A template: literal text with ${user.id}, ${user.email}, ${user.name}, ${user.givenName}, ${user.familyName} or ${user.department}; or exactly ${user.groups}, one value per group (filtered by groupsFilter). A value that is a single variable the user has no value for is left out.
      - minLength 1; maxLength 1024
    - `CreateApplication.saml.attributes.nameFormat` (string, optional) — The attribute's NameFormat. Default unspecified.
      - one of `"unspecified"`, `"uri"`, `"basic"`
  - `CreateApplication.saml.defaultRelayState` (string | null, optional) — The RelayState sent with IdP-initiated sign-in (where the service provider lands).
    - maxLength 1024
  - `CreateApplication.saml.encryptAssertions` (boolean, optional) — Encrypt the assertion to the service provider's encryption certificate. Default false.
  - `CreateApplication.saml.encryptionAlgorithm` (string, optional) — The content encryption (the key is transported with RSA-OAEP). Default aes128-gcm.
    - one of `"aes128-gcm"`, `"aes256-cbc"`
  - `CreateApplication.saml.entityId` (string, optional) — The service provider's entity ID: the assertion's audience, and the Issuer its AuthnRequests must carry.
    - minLength 1; maxLength 1024
  - `CreateApplication.saml.groupsFilter` (string, optional) — ${user.groups}: only the groups assigned to the application (the default), or all of the user's groups.
    - one of `"assigned"`, `"all"`
  - `CreateApplication.saml.idpInitiated` (boolean, optional) — Allow IdP-initiated sign-in (a portal tile). Default true.
  - `CreateApplication.saml.metadataUrl` (string, optional) — Import the service provider's metadata from this https URL now (through the hardened egress; imported once, not refreshed): its entity ID, HTTP-POST ACS URLs, single logout endpoint and certificates. Fields sent alongside win.
    - format `uri`
  - `CreateApplication.saml.metadataXml` (string, optional) — The service provider's metadata by value, imported as metadataUrl is.
    - maxLength 262144
  - `CreateApplication.saml.nameIdFormat` (string, optional) — email (the default), persistent (the user's ID) or transient (new for every assertion).
    - one of `"email"`, `"persistent"`, `"transient"`
  - `CreateApplication.saml.signAssertion` (boolean, optional) — Sign the Assertion. Default true. At least one of the two is signed.
  - `CreateApplication.saml.signResponse` (boolean, optional) — Sign the Response. Default true.
  - `CreateApplication.saml.sloBinding` (string, optional) — Default HTTP-Redirect.
    - one of `"HTTP-Redirect"`, `"HTTP-POST"`
  - `CreateApplication.saml.sloUrl` (string | null, optional) — The service provider's single logout endpoint, where logout responses go.
    - format `uri`
  - `CreateApplication.saml.spCertificates` (array<object>, optional)
    - `CreateApplication.saml.spCertificates.certificate` (string, required) — The X.509 certificate, base64 DER (PEM is accepted on input).
    - `CreateApplication.saml.spCertificates.use` (string, required)
      - one of `"signing"`, `"encryption"`
    - `CreateApplication.saml.spCertificates.fingerprintSha256` (string, optional) — Read-only: the certificate's SHA-256 fingerprint, hex.
    - `CreateApplication.saml.spCertificates.notAfter` (string, optional) — Read-only.
      - format `date-time`
    - `CreateApplication.saml.spCertificates.subject` (string, optional) — Read-only.
- `CreateApplication.tags` (map<string>, optional)

## Example request

```json
{
  "description": "string",
  "ezgh": {
    "consoleSessionSeconds": 900,
    "launchUrl": "http://example.com",
    "product": "mcpcentral",
    "resourceTokenLifetimeSeconds": 300
  },
  "kind": "oidc",
  "name": "string",
  "oidc": {
    "accessTokenAudience": "string",
    "accessTokenLifetimeSeconds": 300,
    "applicationType": "web",
    "backchannelLogoutUri": "http://example.com",
    "groupsClaim": "assigned",
    "idTokenSignedResponseAlg": "RS256",
    "initiateLoginUri": "http://example.com",
    "jwks": {},
    "jwksUri": "http://example.com",
    "postLogoutRedirectUris": [
      "http://example.com"
    ],
    "redirectUris": [
      "http://example.com"
    ],
    "tokenEndpointAuthMethod": "client_secret_basic"
  },
  "saml": {
    "acsUrls": [
      "http://example.com"
    ],
    "attributes": [
      {
        "name": "string",
        "nameFormat": "unspecified",
        "value": "string"
      }
    ],
    "defaultRelayState": "string",
    "encryptAssertions": true,
    "encryptionAlgorithm": "aes128-gcm",
    "entityId": "string",
    "groupsFilter": "assigned",
    "idpInitiated": true,
    "metadataUrl": "http://example.com",
    "metadataXml": "string",
    "nameIdFormat": "email",
    "signAssertion": true,
    "signResponse": true,
    "sloBinding": "HTTP-Redirect",
    "sloUrl": "http://example.com",
    "spCertificates": [
      {
        "certificate": "string",
        "fingerprintSha256": "string",
        "notAfter": "2019-08-24T14:15:22Z",
        "subject": "string",
        "use": "signing"
      }
    ]
  },
  "tags": {
    "property1": "string",
    "property2": "string"
  }
}
```

## Code samples

### cURL

```curl
curl --request POST \
  --url https://sso.ezghcloud.com/v1/organizations/497f6eca-6276-4993-bfeb-53cbbbba6f08/sso/applications \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "description": "string",
  "ezgh": {
    "consoleSessionSeconds": 900,
    "launchUrl": "http://example.com",
    "product": "mcpcentral",
    "resourceTokenLifetimeSeconds": 300
  },
  "kind": "oidc",
  "name": "string",
  "oidc": {
    "accessTokenAudience": "string",
    "accessTokenLifetimeSeconds": 300,
    "applicationType": "web",
    "backchannelLogoutUri": "http://example.com",
    "groupsClaim": "assigned",
    "idTokenSignedResponseAlg": "RS256",
    "initiateLoginUri": "http://example.com",
    "jwks": {},
    "jwksUri": "http://example.com",
    "postLogoutRedirectUris": [
      "http://example.com"
    ],
    "redirectUris": [
      "http://example.com"
    ],
    "tokenEndpointAuthMethod": "client_secret_basic"
  },
  "saml": {
    "acsUrls": [
      "http://example.com"
    ],
    "attributes": [
      {
        "name": "string",
        "nameFormat": "unspecified",
        "value": "string"
      }
    ],
    "defaultRelayState": "string",
    "encryptAssertions": true,
    "encryptionAlgorithm": "aes128-gcm",
    "entityId": "string",
    "groupsFilter": "assigned",
    "idpInitiated": true,
    "metadataUrl": "http://example.com",
    "metadataXml": "string",
    "nameIdFormat": "email",
    "signAssertion": true,
    "signResponse": true,
    "sloBinding": "HTTP-Redirect",
    "sloUrl": "http://example.com",
    "spCertificates": [
      {
        "certificate": "string",
        "fingerprintSha256": "string",
        "notAfter": "2019-08-24T14:15:22Z",
        "subject": "string",
        "use": "signing"
      }
    ]
  },
  "tags": {
    "property1": "string",
    "property2": "string"
  }
}
'
```

### TypeScript

```typescript
const url = 'https://sso.ezghcloud.com/v1/organizations/497f6eca-6276-4993-bfeb-53cbbbba6f08/sso/applications';
const options = {
  method: 'POST',
  headers: {'Content-Type': 'application/json', Authorization: 'Bearer <token>'},
  body: JSON.stringify({
    description: 'string',
    ezgh: {
      consoleSessionSeconds: 900,
      launchUrl: 'http://example.com',
      product: 'mcpcentral',
      resourceTokenLifetimeSeconds: 300
    },
    kind: 'oidc',
    name: 'string',
    oidc: {
      accessTokenAudience: 'string',
      accessTokenLifetimeSeconds: 300,
      applicationType: 'web',
      backchannelLogoutUri: 'http://example.com',
      groupsClaim: 'assigned',
      idTokenSignedResponseAlg: 'RS256',
      initiateLoginUri: 'http://example.com',
      jwks: {},
      jwksUri: 'http://example.com',
      postLogoutRedirectUris: ['http://example.com'],
      redirectUris: ['http://example.com'],
      tokenEndpointAuthMethod: 'client_secret_basic'
    },
    saml: {
      acsUrls: ['http://example.com'],
      attributes: [{name: 'string', nameFormat: 'unspecified', value: 'string'}],
      defaultRelayState: 'string',
      encryptAssertions: true,
      encryptionAlgorithm: 'aes128-gcm',
      entityId: 'string',
      groupsFilter: 'assigned',
      idpInitiated: true,
      metadataUrl: 'http://example.com',
      metadataXml: 'string',
      nameIdFormat: 'email',
      signAssertion: true,
      signResponse: true,
      sloBinding: 'HTTP-Redirect',
      sloUrl: 'http://example.com',
      spCertificates: [
        {
          certificate: 'string',
          fingerprintSha256: 'string',
          notAfter: '2019-08-24T14:15:22Z',
          subject: 'string',
          use: 'signing'
        }
      ]
    },
    tags: {property1: 'string', property2: 'string'}
  })
};

fetch(url, options)
  .then(res => res.json())
  .then(json => console.log(json))
  .catch(err => console.error(err));
```

### Python

```python
import requests

url = "https://sso.ezghcloud.com/v1/organizations/497f6eca-6276-4993-bfeb-53cbbbba6f08/sso/applications"

payload = {
    "description": "string",
    "ezgh": {
        "consoleSessionSeconds": 900,
        "launchUrl": "http://example.com",
        "product": "mcpcentral",
        "resourceTokenLifetimeSeconds": 300
    },
    "kind": "oidc",
    "name": "string",
    "oidc": {
        "accessTokenAudience": "string",
        "accessTokenLifetimeSeconds": 300,
        "applicationType": "web",
        "backchannelLogoutUri": "http://example.com",
        "groupsClaim": "assigned",
        "idTokenSignedResponseAlg": "RS256",
        "initiateLoginUri": "http://example.com",
        "jwks": {},
        "jwksUri": "http://example.com",
        "postLogoutRedirectUris": ["http://example.com"],
        "redirectUris": ["http://example.com"],
        "tokenEndpointAuthMethod": "client_secret_basic"
    },
    "saml": {
        "acsUrls": ["http://example.com"],
        "attributes": [
            {
                "name": "string",
                "nameFormat": "unspecified",
                "value": "string"
            }
        ],
        "defaultRelayState": "string",
        "encryptAssertions": True,
        "encryptionAlgorithm": "aes128-gcm",
        "entityId": "string",
        "groupsFilter": "assigned",
        "idpInitiated": True,
        "metadataUrl": "http://example.com",
        "metadataXml": "string",
        "nameIdFormat": "email",
        "signAssertion": True,
        "signResponse": True,
        "sloBinding": "HTTP-Redirect",
        "sloUrl": "http://example.com",
        "spCertificates": [
            {
                "certificate": "string",
                "fingerprintSha256": "string",
                "notAfter": "2019-08-24T14:15:22Z",
                "subject": "string",
                "use": "signing"
            }
        ]
    },
    "tags": {
        "property1": "string",
        "property2": "string"
    }
}
headers = {
    "Content-Type": "application/json",
    "Authorization": "Bearer <token>"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)
```

## Responses

### 201

The application, and its first client secret when it uses one.

#### Example

```json
{
  "application": {
    "createdAt": "2019-08-24T14:15:22Z",
    "description": "string",
    "directoryId": "786c2ec1-fb9a-4593-b705-005b34c18c18",
    "ezgh": {
      "consoleSessionSeconds": 900,
      "launchUrl": "http://example.com",
      "product": "mcpcentral",
      "resourceTokenLifetimeSeconds": 300
    },
    "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
    "kind": "oidc",
    "logoUrl": "http://example.com",
    "managedBy": "string",
    "name": "string",
    "oidc": {
      "accessTokenAudience": "string",
      "accessTokenLifetimeSeconds": 300,
      "applicationType": "web",
      "backchannelLogoutUri": "http://example.com",
      "clientId": "string",
      "clientSecrets": [
        {
          "createdAt": "2019-08-24T14:15:22Z",
          "createdBy": {
            "id": "string",
            "type": "string"
          },
          "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
          "lastUsedAt": "2019-08-24T14:15:22Z",
          "prefix": "string"
        }
      ],
      "groupsClaim": "assigned",
      "idTokenSignedResponseAlg": "RS256",
      "initiateLoginUri": "http://example.com",
      "issuer": "http://example.com",
      "jwks": {},
      "jwksFetchError": "string",
      "jwksFetchedAt": "2019-08-24T14:15:22Z",
      "jwksUri": "http://example.com",
      "postLogoutRedirectUris": [
        "http://example.com"
      ],
      "redirectUris": [
        "http://example.com"
      ],
      "tokenEndpointAuthMethod": "client_secret_basic"
    },
    "organizationId": "7bc05553-4b68-44e8-b7bc-37be63c6d9e9",
    "projectId": null,
    "region": "string",
    "resourceName": "string",
    "saml": {
      "acsUrls": [
        "http://example.com"
      ],
      "attributes": [
        {
          "name": "string",
          "nameFormat": "unspecified",
          "value": "string"
        }
      ],
      "defaultRelayState": "string",
      "encryptAssertions": true,
      "encryptionAlgorithm": "aes128-gcm",
      "entityId": "string",
      "groupsFilter": "assigned",
      "idp": {
        "certificates": [
          {
            "activatesAt": "2019-08-24T14:15:22Z",
            "certificate": "string",
            "fingerprintSha256": "string",
            "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
            "notAfter": "2019-08-24T14:15:22Z",
            "notBefore": "2019-08-24T14:15:22Z",
            "status": "active",
            "subject": "string",
            "warnAt": "2019-08-24T14:15:22Z"
          }
        ],
        "entityId": "string",
        "initiateUrl": "http://example.com",
        "metadataUrl": "http://example.com",
        "sloUrl": "http://example.com",
        "ssoUrl": "http://example.com"
      },
      "idpInitiated": true,
      "metadataImportedAt": "2019-08-24T14:15:22Z",
      "metadataUrl": "http://example.com",
      "nameIdFormat": "email",
      "signAssertion": true,
      "signResponse": true,
      "sloBinding": "HTTP-Redirect",
      "sloUrl": "http://example.com",
      "spCertificates": [
        {
          "certificate": "string",
          "fingerprintSha256": "string",
          "notAfter": "2019-08-24T14:15:22Z",
          "subject": "string",
          "use": "signing"
        }
      ]
    },
    "slug": "string",
    "status": "active",
    "tags": {
      "property1": "string",
      "property2": "string"
    },
    "updatedAt": "2019-08-24T14:15:22Z"
  },
  "clientSecret": "string"
}
```

- `CreateApplication.response.201.application` (object, required) — An application. Exactly one of oidc, saml and ezgh is set, by kind. A saml application is a SAML 2.0 service provider of the directory's IdP. An ezgh application is a portal tile and its resource-token settings: using the product is an EZGH action that IAM decides, so its assignments only decide who sees the tile. The one a product manages (managedBy mcpcentral) is also its portal's OAuth client in the directory: its id is the client_id, it authenticates with private_key_jwt against the product's JWKS, and it gets only resource tokens bound to the product's per-organization label.
  - `CreateApplication.response.201.application.createdAt` (string, required)
    - format `date-time`
  - `CreateApplication.response.201.application.description` (string, required)
  - `CreateApplication.response.201.application.directoryId` (string, required)
    - format `uuid`
  - `CreateApplication.response.201.application.ezgh` (one of, required)
    - one of: [EzghSettings](/sso-api/schemas/EzghSettings/), `null`
  - `CreateApplication.response.201.application.id` (string, required)
    - format `uuid`
  - `CreateApplication.response.201.application.kind` (string, required)
    - one of `"oidc"`, `"ezgh"`, `"saml"`
  - `CreateApplication.response.201.application.logoUrl` (string | null, required) — Read-only: where sso-edge serves the application's uploaded logo (its portal tile's icon) on the directory's host, https://<alias>.sso.ezgh.app/branding/applications/<id>/logo?v=…, or null. A replaced logo is a new URL. Upload it with PUT …/applications/{appId}/logo; create and update refuse logoUrl.
    - format `uri`
  - `CreateApplication.response.201.application.managedBy` (string | null, required) — The EZGH product that manages this ezgh application through its own internal routes (MCP Central's, created when EZGH SSO is associated with it), or null. A managed application is read-only here: updating or deleting it, or changing its assignments, is 409 managed_by_product, and creating another ezgh application of its product in the directory is refused the same way.
  - `CreateApplication.response.201.application.name` (string, required)
  - `CreateApplication.response.201.application.oidc` (one of, required)
    - one of: [OidcSettings](/sso-api/schemas/OidcSettings/), `null`
  - `CreateApplication.response.201.application.organizationId` (string, required)
    - format `uuid`
  - `CreateApplication.response.201.application.projectId` (null, required)
  - `CreateApplication.response.201.application.region` (string, required)
  - `CreateApplication.response.201.application.resourceName` (string, required)
  - `CreateApplication.response.201.application.saml` (one of, required)
    - one of: [SamlSettings](/sso-api/schemas/SamlSettings/), `null`
  - `CreateApplication.response.201.application.slug` (string, required)
  - `CreateApplication.response.201.application.status` (string, required)
    - one of `"active"`
  - `CreateApplication.response.201.application.tags` (map<string>, required)
  - `CreateApplication.response.201.application.updatedAt` (string, required)
    - format `date-time`
- `CreateApplication.response.201.clientSecret` (string | null, required) — For client_secret_basic and client_secret_post: ezgh_scs_ + 43 base62 characters, shown in this response only (and its Idempotency-Key replays). Otherwise null.

### 400

invalid_request (with issues), invalid_cursor, or the endpoint's own 400 codes.

#### Example

```json
{
  "error": {
    "code": "string",
    "issues": [
      {
        "message": "string",
        "path": "string"
      }
    ],
    "message": "string",
    "quota": {
      "id": "string",
      "inFlight": 0,
      "kind": "allocation",
      "limit": 0,
      "periodStart": "2019-08-24T14:15:22Z",
      "region": "string",
      "resetsAt": "2019-08-24T14:15:22Z",
      "scope": "organization",
      "scopeResourceName": "string",
      "used": 0,
      "window": "string"
    }
  }
}
```

- `CreateApplication.response.400.error` (object, required)
  - `CreateApplication.response.400.error.code` (string, required)
    - maxLength 64; pattern `^[a-z][a-z0-9_]*$`
  - `CreateApplication.response.400.error.message` (string, required)
    - maxLength 1024
  - `CreateApplication.response.400.error.issues` (array<object>, optional) — invalid_request: one entry per problem, at a dotted path.
    - `CreateApplication.response.400.error.issues.message` (string, required)
    - `CreateApplication.response.400.error.issues.path` (string, required)
  - `CreateApplication.response.400.error.quota` (object, optional) — quota_exceeded: the quota that refused the request. Never with Retry-After.
    - `CreateApplication.response.400.error.quota.id` (string, required)
    - `CreateApplication.response.400.error.quota.kind` (unknown, required)
      - one of `"allocation"`, `"rate"`, `"usage"`, `"concurrency"`
    - `CreateApplication.response.400.error.quota.limit` (integer, required)
      - min 0
    - `CreateApplication.response.400.error.quota.scope` (unknown, required)
      - one of `"organization"`, `"project"`, `"resource"`
    - `CreateApplication.response.400.error.quota.inFlight` (integer, optional)
      - min 0
    - `CreateApplication.response.400.error.quota.periodStart` (string, optional)
      - format `date-time`
    - `CreateApplication.response.400.error.quota.region` (string, optional)
    - `CreateApplication.response.400.error.quota.resetsAt` (string, optional)
      - format `date-time`
    - `CreateApplication.response.400.error.quota.scopeResourceName` (string, optional)
    - `CreateApplication.response.400.error.quota.used` (integer, optional)
      - min 0
    - `CreateApplication.response.400.error.quota.window` (string, optional) — rate only: an ISO 8601 duration, PT1S to PT1H.

### 401

unauthenticated: no credential, or one that doesn't check out.

#### Example

```json
{
  "error": {
    "code": "string",
    "issues": [
      {
        "message": "string",
        "path": "string"
      }
    ],
    "message": "string",
    "quota": {
      "id": "string",
      "inFlight": 0,
      "kind": "allocation",
      "limit": 0,
      "periodStart": "2019-08-24T14:15:22Z",
      "region": "string",
      "resetsAt": "2019-08-24T14:15:22Z",
      "scope": "organization",
      "scopeResourceName": "string",
      "used": 0,
      "window": "string"
    }
  }
}
```

- `CreateApplication.response.401.error` (object, required)
  - `CreateApplication.response.401.error.code` (string, required)
    - maxLength 64; pattern `^[a-z][a-z0-9_]*$`
  - `CreateApplication.response.401.error.message` (string, required)
    - maxLength 1024
  - `CreateApplication.response.401.error.issues` (array<object>, optional) — invalid_request: one entry per problem, at a dotted path.
    - `CreateApplication.response.401.error.issues.message` (string, required)
    - `CreateApplication.response.401.error.issues.path` (string, required)
  - `CreateApplication.response.401.error.quota` (object, optional) — quota_exceeded: the quota that refused the request. Never with Retry-After.
    - `CreateApplication.response.401.error.quota.id` (string, required)
    - `CreateApplication.response.401.error.quota.kind` (unknown, required)
      - one of `"allocation"`, `"rate"`, `"usage"`, `"concurrency"`
    - `CreateApplication.response.401.error.quota.limit` (integer, required)
      - min 0
    - `CreateApplication.response.401.error.quota.scope` (unknown, required)
      - one of `"organization"`, `"project"`, `"resource"`
    - `CreateApplication.response.401.error.quota.inFlight` (integer, optional)
      - min 0
    - `CreateApplication.response.401.error.quota.periodStart` (string, optional)
      - format `date-time`
    - `CreateApplication.response.401.error.quota.region` (string, optional)
    - `CreateApplication.response.401.error.quota.resetsAt` (string, optional)
      - format `date-time`
    - `CreateApplication.response.401.error.quota.scopeResourceName` (string, optional)
    - `CreateApplication.response.401.error.quota.used` (integer, optional)
      - min 0
    - `CreateApplication.response.401.error.quota.window` (string, optional) — rate only: an ISO 8601 duration, PT1S to PT1H.

### 403

access_denied: the caller's policies don't allow the action; forbidden_origin: a cookie-authenticated write from an origin that isn't allowed; spend_limit_reached.

#### Example

```json
{
  "error": {
    "code": "string",
    "issues": [
      {
        "message": "string",
        "path": "string"
      }
    ],
    "message": "string",
    "quota": {
      "id": "string",
      "inFlight": 0,
      "kind": "allocation",
      "limit": 0,
      "periodStart": "2019-08-24T14:15:22Z",
      "region": "string",
      "resetsAt": "2019-08-24T14:15:22Z",
      "scope": "organization",
      "scopeResourceName": "string",
      "used": 0,
      "window": "string"
    }
  }
}
```

- `CreateApplication.response.403.error` (object, required)
  - `CreateApplication.response.403.error.code` (string, required)
    - maxLength 64; pattern `^[a-z][a-z0-9_]*$`
  - `CreateApplication.response.403.error.message` (string, required)
    - maxLength 1024
  - `CreateApplication.response.403.error.issues` (array<object>, optional) — invalid_request: one entry per problem, at a dotted path.
    - `CreateApplication.response.403.error.issues.message` (string, required)
    - `CreateApplication.response.403.error.issues.path` (string, required)
  - `CreateApplication.response.403.error.quota` (object, optional) — quota_exceeded: the quota that refused the request. Never with Retry-After.
    - `CreateApplication.response.403.error.quota.id` (string, required)
    - `CreateApplication.response.403.error.quota.kind` (unknown, required)
      - one of `"allocation"`, `"rate"`, `"usage"`, `"concurrency"`
    - `CreateApplication.response.403.error.quota.limit` (integer, required)
      - min 0
    - `CreateApplication.response.403.error.quota.scope` (unknown, required)
      - one of `"organization"`, `"project"`, `"resource"`
    - `CreateApplication.response.403.error.quota.inFlight` (integer, optional)
      - min 0
    - `CreateApplication.response.403.error.quota.periodStart` (string, optional)
      - format `date-time`
    - `CreateApplication.response.403.error.quota.region` (string, optional)
    - `CreateApplication.response.403.error.quota.resetsAt` (string, optional)
      - format `date-time`
    - `CreateApplication.response.403.error.quota.scopeResourceName` (string, optional)
    - `CreateApplication.response.403.error.quota.used` (integer, optional)
      - min 0
    - `CreateApplication.response.403.error.quota.window` (string, optional) — rate only: an ISO 8601 duration, PT1S to PT1H.

### 404

not_found: unknown, malformed, or in an organization the caller isn't in.

#### Example

```json
{
  "error": {
    "code": "string",
    "issues": [
      {
        "message": "string",
        "path": "string"
      }
    ],
    "message": "string",
    "quota": {
      "id": "string",
      "inFlight": 0,
      "kind": "allocation",
      "limit": 0,
      "periodStart": "2019-08-24T14:15:22Z",
      "region": "string",
      "resetsAt": "2019-08-24T14:15:22Z",
      "scope": "organization",
      "scopeResourceName": "string",
      "used": 0,
      "window": "string"
    }
  }
}
```

- `CreateApplication.response.404.error` (object, required)
  - `CreateApplication.response.404.error.code` (string, required)
    - maxLength 64; pattern `^[a-z][a-z0-9_]*$`
  - `CreateApplication.response.404.error.message` (string, required)
    - maxLength 1024
  - `CreateApplication.response.404.error.issues` (array<object>, optional) — invalid_request: one entry per problem, at a dotted path.
    - `CreateApplication.response.404.error.issues.message` (string, required)
    - `CreateApplication.response.404.error.issues.path` (string, required)
  - `CreateApplication.response.404.error.quota` (object, optional) — quota_exceeded: the quota that refused the request. Never with Retry-After.
    - `CreateApplication.response.404.error.quota.id` (string, required)
    - `CreateApplication.response.404.error.quota.kind` (unknown, required)
      - one of `"allocation"`, `"rate"`, `"usage"`, `"concurrency"`
    - `CreateApplication.response.404.error.quota.limit` (integer, required)
      - min 0
    - `CreateApplication.response.404.error.quota.scope` (unknown, required)
      - one of `"organization"`, `"project"`, `"resource"`
    - `CreateApplication.response.404.error.quota.inFlight` (integer, optional)
      - min 0
    - `CreateApplication.response.404.error.quota.periodStart` (string, optional)
      - format `date-time`
    - `CreateApplication.response.404.error.quota.region` (string, optional)
    - `CreateApplication.response.404.error.quota.resetsAt` (string, optional)
      - format `date-time`
    - `CreateApplication.response.404.error.quota.scopeResourceName` (string, optional)
    - `CreateApplication.response.404.error.quota.used` (integer, optional)
      - min 0
    - `CreateApplication.response.404.error.quota.window` (string, optional) — rate only: an ISO 8601 duration, PT1S to PT1H.

### 409

quota_exceeded (an allocation quota, with quota), idempotency_conflict, idempotency_in_progress (with Retry-After), organization_deletion_pending, operation_in_progress, or the endpoint's own 409 codes.

#### Example

```json
{
  "error": {
    "code": "string",
    "issues": [
      {
        "message": "string",
        "path": "string"
      }
    ],
    "message": "string",
    "quota": {
      "id": "string",
      "inFlight": 0,
      "kind": "allocation",
      "limit": 0,
      "periodStart": "2019-08-24T14:15:22Z",
      "region": "string",
      "resetsAt": "2019-08-24T14:15:22Z",
      "scope": "organization",
      "scopeResourceName": "string",
      "used": 0,
      "window": "string"
    }
  }
}
```

- `CreateApplication.response.409.error` (object, required)
  - `CreateApplication.response.409.error.code` (string, required)
    - maxLength 64; pattern `^[a-z][a-z0-9_]*$`
  - `CreateApplication.response.409.error.message` (string, required)
    - maxLength 1024
  - `CreateApplication.response.409.error.issues` (array<object>, optional) — invalid_request: one entry per problem, at a dotted path.
    - `CreateApplication.response.409.error.issues.message` (string, required)
    - `CreateApplication.response.409.error.issues.path` (string, required)
  - `CreateApplication.response.409.error.quota` (object, optional) — quota_exceeded: the quota that refused the request. Never with Retry-After.
    - `CreateApplication.response.409.error.quota.id` (string, required)
    - `CreateApplication.response.409.error.quota.kind` (unknown, required)
      - one of `"allocation"`, `"rate"`, `"usage"`, `"concurrency"`
    - `CreateApplication.response.409.error.quota.limit` (integer, required)
      - min 0
    - `CreateApplication.response.409.error.quota.scope` (unknown, required)
      - one of `"organization"`, `"project"`, `"resource"`
    - `CreateApplication.response.409.error.quota.inFlight` (integer, optional)
      - min 0
    - `CreateApplication.response.409.error.quota.periodStart` (string, optional)
      - format `date-time`
    - `CreateApplication.response.409.error.quota.region` (string, optional)
    - `CreateApplication.response.409.error.quota.resetsAt` (string, optional)
      - format `date-time`
    - `CreateApplication.response.409.error.quota.scopeResourceName` (string, optional)
    - `CreateApplication.response.409.error.quota.used` (integer, optional)
      - min 0
    - `CreateApplication.response.409.error.quota.window` (string, optional) — rate only: an ISO 8601 duration, PT1S to PT1H.

### 413

payload_too_large: the body is over the endpoint's limit (1 MiB unless it says otherwise).

#### Example

```json
{
  "error": {
    "code": "string",
    "issues": [
      {
        "message": "string",
        "path": "string"
      }
    ],
    "message": "string",
    "quota": {
      "id": "string",
      "inFlight": 0,
      "kind": "allocation",
      "limit": 0,
      "periodStart": "2019-08-24T14:15:22Z",
      "region": "string",
      "resetsAt": "2019-08-24T14:15:22Z",
      "scope": "organization",
      "scopeResourceName": "string",
      "used": 0,
      "window": "string"
    }
  }
}
```

- `CreateApplication.response.413.error` (object, required)
  - `CreateApplication.response.413.error.code` (string, required)
    - maxLength 64; pattern `^[a-z][a-z0-9_]*$`
  - `CreateApplication.response.413.error.message` (string, required)
    - maxLength 1024
  - `CreateApplication.response.413.error.issues` (array<object>, optional) — invalid_request: one entry per problem, at a dotted path.
    - `CreateApplication.response.413.error.issues.message` (string, required)
    - `CreateApplication.response.413.error.issues.path` (string, required)
  - `CreateApplication.response.413.error.quota` (object, optional) — quota_exceeded: the quota that refused the request. Never with Retry-After.
    - `CreateApplication.response.413.error.quota.id` (string, required)
    - `CreateApplication.response.413.error.quota.kind` (unknown, required)
      - one of `"allocation"`, `"rate"`, `"usage"`, `"concurrency"`
    - `CreateApplication.response.413.error.quota.limit` (integer, required)
      - min 0
    - `CreateApplication.response.413.error.quota.scope` (unknown, required)
      - one of `"organization"`, `"project"`, `"resource"`
    - `CreateApplication.response.413.error.quota.inFlight` (integer, optional)
      - min 0
    - `CreateApplication.response.413.error.quota.periodStart` (string, optional)
      - format `date-time`
    - `CreateApplication.response.413.error.quota.region` (string, optional)
    - `CreateApplication.response.413.error.quota.resetsAt` (string, optional)
      - format `date-time`
    - `CreateApplication.response.413.error.quota.scopeResourceName` (string, optional)
    - `CreateApplication.response.413.error.quota.used` (integer, optional)
      - min 0
    - `CreateApplication.response.413.error.quota.window` (string, optional) — rate only: an ISO 8601 duration, PT1S to PT1H.

### 429

too_many_requests, with Retry-After; or quota_exceeded (a rate, usage or concurrency quota, with quota), never with Retry-After.

#### Example

```json
{
  "error": {
    "code": "string",
    "issues": [
      {
        "message": "string",
        "path": "string"
      }
    ],
    "message": "string",
    "quota": {
      "id": "string",
      "inFlight": 0,
      "kind": "allocation",
      "limit": 0,
      "periodStart": "2019-08-24T14:15:22Z",
      "region": "string",
      "resetsAt": "2019-08-24T14:15:22Z",
      "scope": "organization",
      "scopeResourceName": "string",
      "used": 0,
      "window": "string"
    }
  }
}
```

- `CreateApplication.response.429.error` (object, required)
  - `CreateApplication.response.429.error.code` (string, required)
    - maxLength 64; pattern `^[a-z][a-z0-9_]*$`
  - `CreateApplication.response.429.error.message` (string, required)
    - maxLength 1024
  - `CreateApplication.response.429.error.issues` (array<object>, optional) — invalid_request: one entry per problem, at a dotted path.
    - `CreateApplication.response.429.error.issues.message` (string, required)
    - `CreateApplication.response.429.error.issues.path` (string, required)
  - `CreateApplication.response.429.error.quota` (object, optional) — quota_exceeded: the quota that refused the request. Never with Retry-After.
    - `CreateApplication.response.429.error.quota.id` (string, required)
    - `CreateApplication.response.429.error.quota.kind` (unknown, required)
      - one of `"allocation"`, `"rate"`, `"usage"`, `"concurrency"`
    - `CreateApplication.response.429.error.quota.limit` (integer, required)
      - min 0
    - `CreateApplication.response.429.error.quota.scope` (unknown, required)
      - one of `"organization"`, `"project"`, `"resource"`
    - `CreateApplication.response.429.error.quota.inFlight` (integer, optional)
      - min 0
    - `CreateApplication.response.429.error.quota.periodStart` (string, optional)
      - format `date-time`
    - `CreateApplication.response.429.error.quota.region` (string, optional)
    - `CreateApplication.response.429.error.quota.resetsAt` (string, optional)
      - format `date-time`
    - `CreateApplication.response.429.error.quota.scopeResourceName` (string, optional)
    - `CreateApplication.response.429.error.quota.used` (integer, optional)
      - min 0
    - `CreateApplication.response.429.error.quota.window` (string, optional) — rate only: an ISO 8601 duration, PT1S to PT1H.

### 500

internal_error: a bug; the details are in the logs, under the request ID.

#### Example

```json
{
  "error": {
    "code": "string",
    "issues": [
      {
        "message": "string",
        "path": "string"
      }
    ],
    "message": "string",
    "quota": {
      "id": "string",
      "inFlight": 0,
      "kind": "allocation",
      "limit": 0,
      "periodStart": "2019-08-24T14:15:22Z",
      "region": "string",
      "resetsAt": "2019-08-24T14:15:22Z",
      "scope": "organization",
      "scopeResourceName": "string",
      "used": 0,
      "window": "string"
    }
  }
}
```

- `CreateApplication.response.500.error` (object, required)
  - `CreateApplication.response.500.error.code` (string, required)
    - maxLength 64; pattern `^[a-z][a-z0-9_]*$`
  - `CreateApplication.response.500.error.message` (string, required)
    - maxLength 1024
  - `CreateApplication.response.500.error.issues` (array<object>, optional) — invalid_request: one entry per problem, at a dotted path.
    - `CreateApplication.response.500.error.issues.message` (string, required)
    - `CreateApplication.response.500.error.issues.path` (string, required)
  - `CreateApplication.response.500.error.quota` (object, optional) — quota_exceeded: the quota that refused the request. Never with Retry-After.
    - `CreateApplication.response.500.error.quota.id` (string, required)
    - `CreateApplication.response.500.error.quota.kind` (unknown, required)
      - one of `"allocation"`, `"rate"`, `"usage"`, `"concurrency"`
    - `CreateApplication.response.500.error.quota.limit` (integer, required)
      - min 0
    - `CreateApplication.response.500.error.quota.scope` (unknown, required)
      - one of `"organization"`, `"project"`, `"resource"`
    - `CreateApplication.response.500.error.quota.inFlight` (integer, optional)
      - min 0
    - `CreateApplication.response.500.error.quota.periodStart` (string, optional)
      - format `date-time`
    - `CreateApplication.response.500.error.quota.region` (string, optional)
    - `CreateApplication.response.500.error.quota.resetsAt` (string, optional)
      - format `date-time`
    - `CreateApplication.response.500.error.quota.scopeResourceName` (string, optional)
    - `CreateApplication.response.500.error.quota.used` (integer, optional)
      - min 0
    - `CreateApplication.response.500.error.quota.window` (string, optional) — rate only: an ISO 8601 duration, PT1S to PT1H.

### 503

unavailable: a dependency the request needs is down. Retry after Retry-After.

#### Example

```json
{
  "error": {
    "code": "string",
    "issues": [
      {
        "message": "string",
        "path": "string"
      }
    ],
    "message": "string",
    "quota": {
      "id": "string",
      "inFlight": 0,
      "kind": "allocation",
      "limit": 0,
      "periodStart": "2019-08-24T14:15:22Z",
      "region": "string",
      "resetsAt": "2019-08-24T14:15:22Z",
      "scope": "organization",
      "scopeResourceName": "string",
      "used": 0,
      "window": "string"
    }
  }
}
```

- `CreateApplication.response.503.error` (object, required)
  - `CreateApplication.response.503.error.code` (string, required)
    - maxLength 64; pattern `^[a-z][a-z0-9_]*$`
  - `CreateApplication.response.503.error.message` (string, required)
    - maxLength 1024
  - `CreateApplication.response.503.error.issues` (array<object>, optional) — invalid_request: one entry per problem, at a dotted path.
    - `CreateApplication.response.503.error.issues.message` (string, required)
    - `CreateApplication.response.503.error.issues.path` (string, required)
  - `CreateApplication.response.503.error.quota` (object, optional) — quota_exceeded: the quota that refused the request. Never with Retry-After.
    - `CreateApplication.response.503.error.quota.id` (string, required)
    - `CreateApplication.response.503.error.quota.kind` (unknown, required)
      - one of `"allocation"`, `"rate"`, `"usage"`, `"concurrency"`
    - `CreateApplication.response.503.error.quota.limit` (integer, required)
      - min 0
    - `CreateApplication.response.503.error.quota.scope` (unknown, required)
      - one of `"organization"`, `"project"`, `"resource"`
    - `CreateApplication.response.503.error.quota.inFlight` (integer, optional)
      - min 0
    - `CreateApplication.response.503.error.quota.periodStart` (string, optional)
      - format `date-time`
    - `CreateApplication.response.503.error.quota.region` (string, optional)
    - `CreateApplication.response.503.error.quota.resetsAt` (string, optional)
      - format `date-time`
    - `CreateApplication.response.503.error.quota.scopeResourceName` (string, optional)
    - `CreateApplication.response.503.error.quota.used` (integer, optional)
      - min 0
    - `CreateApplication.response.503.error.quota.window` (string, optional) — rate only: an ISO 8601 duration, PT1S to PT1H.


Source: https://docs.ezghcloud.com/sso-api/CreateApplication/index.md