---
title: "Change an application"
description: "kind, oidc.applicationType and ezgh.product can't change. Changing jwksUri drops the keys fetched from the old one."
---

> Documentation Index
> Fetch the complete documentation index at: https://docs.ezghcloud.com/llms.txt
> Use this file to discover all available pages before exploring further.

Path: EZGH SSO API

`PATCH /v1/organizations/{orgId}/sso/applications/{appId}`

kind, oidc.applicationType and ezgh.product can't change. Changing jwksUri drops the keys fetched from the old one.

## Authentication

Requires one of the following:

- `apiKey`, http, header `Authorization`
- `oauth`, http, header `Authorization`
- `sessionCookie`, apiKey, in cookie

## Path parameters

- `UpdateApplication.path.orgId` (string, required)
  - format `uuid`
- `UpdateApplication.path.appId` (string, required)
  - format `uuid`

## Request body

_Required._

- `UpdateApplication.description` (string, optional)
  - maxLength 1024
- `UpdateApplication.ezgh` (object, optional)
  - `UpdateApplication.ezgh.consoleSessionSeconds` (integer, optional) — The console application only: the federated console session lifetime in seconds, 900–43200, default 43200.
    - min 900; max 43200
  - `UpdateApplication.ezgh.launchUrl` (string | null, optional) — Accepted for compatibility, under https://mcpcentral.ezghcloud.com/…, but unused: an mcpcentral tile opens MCP Central's portal on the directory's current alias (https://<alias>.mcp.ezgh.app/). Not for the console application (only null is accepted).
    - format `uri`
  - `UpdateApplication.ezgh.product` (string, optional) — The EZGH product: mcpcentral (MCP Central), or console (the console application: at most one per directory, 409 console_application_exists on a second). Can't change.
    - one of `"mcpcentral"`, `"console"`
  - `UpdateApplication.ezgh.resourceTokenLifetimeSeconds` (integer, optional) — Lifetime of the opaque ezgh_sat_ resource tokens EZGH SSO issues for the product (stage 4). Default 3600. Not for the console application.
    - min 300; max 3600
- `UpdateApplication.kind` (string, optional) — Must be the application's own.
  - one of `"oidc"`, `"ezgh"`, `"saml"`
- `UpdateApplication.name` (string, optional)
  - minLength 1; maxLength 100
- `UpdateApplication.oidc` (object, optional) — On create, applicationType and redirectUris are required; on update, only the fields sent change (null clears a nullable one).
  - `UpdateApplication.oidc.accessTokenAudience` (string | null, optional) — The access token's aud; null is the client ID.
    - maxLength 256
  - `UpdateApplication.oidc.accessTokenLifetimeSeconds` (integer, optional) — The RFC 9068 JWT access token's lifetime. Default 900.
    - min 300; max 3600
  - `UpdateApplication.oidc.applicationType` (string, optional) — web is confidential; spa and native are public clients that must use PKCE (S256). Can't change.
    - one of `"web"`, `"spa"`, `"native"`
  - `UpdateApplication.oidc.backchannelLogoutUri` (string | null, optional) — A public https URL that receives OpenID Connect back-channel logout tokens, through hardened egress.
    - format `uri`
  - `UpdateApplication.oidc.groupsClaim` (string, optional) — With the groups scope: the user's groups that are assigned to this application (the default), or all of them.
    - one of `"assigned"`, `"all"`
  - `UpdateApplication.oidc.idTokenSignedResponseAlg` (string, optional) — Signs the ID token and the access token. Default RS256.
    - one of `"RS256"`, `"ES256"`
  - `UpdateApplication.oidc.initiateLoginUri` (string | null, optional) — https; the portal tile opens it with ?iss=<issuer> (OpenID Connect third-party-initiated login).
    - format `uri`
  - `UpdateApplication.oidc.jwks` (object | null, optional) — The client's public keys by value, a JWK set ({ keys: [...] }), for private_key_jwt. 1–10 RSA (2048+ bits) or EC (P-256/384/521) signing keys, a kid on each when there are several.
  - `UpdateApplication.oidc.jwksUri` (string | null, optional) — A public https URL of the client's JWK set, for private_key_jwt; fetched through hardened egress and stored.
    - format `uri`
  - `UpdateApplication.oidc.postLogoutRedirectUris` (array<string>, optional)
    - format `uri`
  - `UpdateApplication.oidc.redirectUris` (array<string>, optional) — Exact URIs. https, or http on loopback; a native application may use a reverse-domain private scheme, and its loopback IP redirects match any port (RFC 8252).
    - format `uri`
  - `UpdateApplication.oidc.tokenEndpointAuthMethod` (string, optional) — web: client_secret_basic (the default), client_secret_post or private_key_jwt; spa and native: none.
    - one of `"client_secret_basic"`, `"client_secret_post"`, `"private_key_jwt"`, `"none"`
- `UpdateApplication.saml` (object, optional) — On create, entityId and acsUrls are required unless metadata gives them; on update, only the fields sent change (null clears a nullable one).
  - `UpdateApplication.saml.acsUrls` (array<string>, optional) — Exact assertion consumer service URLs (HTTP-POST binding), https (http only on loopback); the first is the default. A response only ever goes to one of these, never to a URL taken from a request.
    - format `uri`
  - `UpdateApplication.saml.attributes` (array<object>, optional)
    - `UpdateApplication.saml.attributes.name` (string, required) — The attribute's Name, as the service provider expects it.
      - minLength 1; maxLength 256
    - `UpdateApplication.saml.attributes.value` (string, required) — A template: literal text with ${user.id}, ${user.email}, ${user.name}, ${user.givenName}, ${user.familyName} or ${user.department}; or exactly ${user.groups}, one value per group (filtered by groupsFilter). A value that is a single variable the user has no value for is left out.
      - minLength 1; maxLength 1024
    - `UpdateApplication.saml.attributes.nameFormat` (string, optional) — The attribute's NameFormat. Default unspecified.
      - one of `"unspecified"`, `"uri"`, `"basic"`
  - `UpdateApplication.saml.defaultRelayState` (string | null, optional) — The RelayState sent with IdP-initiated sign-in (where the service provider lands).
    - maxLength 1024
  - `UpdateApplication.saml.encryptAssertions` (boolean, optional) — Encrypt the assertion to the service provider's encryption certificate. Default false.
  - `UpdateApplication.saml.encryptionAlgorithm` (string, optional) — The content encryption (the key is transported with RSA-OAEP). Default aes128-gcm.
    - one of `"aes128-gcm"`, `"aes256-cbc"`
  - `UpdateApplication.saml.entityId` (string, optional) — The service provider's entity ID: the assertion's audience, and the Issuer its AuthnRequests must carry.
    - minLength 1; maxLength 1024
  - `UpdateApplication.saml.groupsFilter` (string, optional) — ${user.groups}: only the groups assigned to the application (the default), or all of the user's groups.
    - one of `"assigned"`, `"all"`
  - `UpdateApplication.saml.idpInitiated` (boolean, optional) — Allow IdP-initiated sign-in (a portal tile). Default true.
  - `UpdateApplication.saml.metadataUrl` (string, optional) — Import the service provider's metadata from this https URL now (through the hardened egress; imported once, not refreshed): its entity ID, HTTP-POST ACS URLs, single logout endpoint and certificates. Fields sent alongside win.
    - format `uri`
  - `UpdateApplication.saml.metadataXml` (string, optional) — The service provider's metadata by value, imported as metadataUrl is.
    - maxLength 262144
  - `UpdateApplication.saml.nameIdFormat` (string, optional) — email (the default), persistent (the user's ID) or transient (new for every assertion).
    - one of `"email"`, `"persistent"`, `"transient"`
  - `UpdateApplication.saml.signAssertion` (boolean, optional) — Sign the Assertion. Default true. At least one of the two is signed.
  - `UpdateApplication.saml.signResponse` (boolean, optional) — Sign the Response. Default true.
  - `UpdateApplication.saml.sloBinding` (string, optional) — Default HTTP-Redirect.
    - one of `"HTTP-Redirect"`, `"HTTP-POST"`
  - `UpdateApplication.saml.sloUrl` (string | null, optional) — The service provider's single logout endpoint, where logout responses go.
    - format `uri`
  - `UpdateApplication.saml.spCertificates` (array<object>, optional)
    - `UpdateApplication.saml.spCertificates.certificate` (string, required) — The X.509 certificate, base64 DER (PEM is accepted on input).
    - `UpdateApplication.saml.spCertificates.use` (string, required)
      - one of `"signing"`, `"encryption"`
    - `UpdateApplication.saml.spCertificates.fingerprintSha256` (string, optional) — Read-only: the certificate's SHA-256 fingerprint, hex.
    - `UpdateApplication.saml.spCertificates.notAfter` (string, optional) — Read-only.
      - format `date-time`
    - `UpdateApplication.saml.spCertificates.subject` (string, optional) — Read-only.
- `UpdateApplication.tags` (map<string>, optional)

## Example request

```json
{
  "description": "string",
  "ezgh": {
    "consoleSessionSeconds": 900,
    "launchUrl": "http://example.com",
    "product": "mcpcentral",
    "resourceTokenLifetimeSeconds": 300
  },
  "kind": "oidc",
  "name": "string",
  "oidc": {
    "accessTokenAudience": "string",
    "accessTokenLifetimeSeconds": 300,
    "applicationType": "web",
    "backchannelLogoutUri": "http://example.com",
    "groupsClaim": "assigned",
    "idTokenSignedResponseAlg": "RS256",
    "initiateLoginUri": "http://example.com",
    "jwks": {},
    "jwksUri": "http://example.com",
    "postLogoutRedirectUris": [
      "http://example.com"
    ],
    "redirectUris": [
      "http://example.com"
    ],
    "tokenEndpointAuthMethod": "client_secret_basic"
  },
  "saml": {
    "acsUrls": [
      "http://example.com"
    ],
    "attributes": [
      {
        "name": "string",
        "nameFormat": "unspecified",
        "value": "string"
      }
    ],
    "defaultRelayState": "string",
    "encryptAssertions": true,
    "encryptionAlgorithm": "aes128-gcm",
    "entityId": "string",
    "groupsFilter": "assigned",
    "idpInitiated": true,
    "metadataUrl": "http://example.com",
    "metadataXml": "string",
    "nameIdFormat": "email",
    "signAssertion": true,
    "signResponse": true,
    "sloBinding": "HTTP-Redirect",
    "sloUrl": "http://example.com",
    "spCertificates": [
      {
        "certificate": "string",
        "fingerprintSha256": "string",
        "notAfter": "2019-08-24T14:15:22Z",
        "subject": "string",
        "use": "signing"
      }
    ]
  },
  "tags": {
    "property1": "string",
    "property2": "string"
  }
}
```

## Code samples

### cURL

```curl
curl --request PATCH \
  --url https://sso.ezghcloud.com/v1/organizations/497f6eca-6276-4993-bfeb-53cbbbba6f08/sso/applications/497f6eca-6276-4993-bfeb-53cbbbba6f08 \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "description": "string",
  "ezgh": {
    "consoleSessionSeconds": 900,
    "launchUrl": "http://example.com",
    "product": "mcpcentral",
    "resourceTokenLifetimeSeconds": 300
  },
  "kind": "oidc",
  "name": "string",
  "oidc": {
    "accessTokenAudience": "string",
    "accessTokenLifetimeSeconds": 300,
    "applicationType": "web",
    "backchannelLogoutUri": "http://example.com",
    "groupsClaim": "assigned",
    "idTokenSignedResponseAlg": "RS256",
    "initiateLoginUri": "http://example.com",
    "jwks": {},
    "jwksUri": "http://example.com",
    "postLogoutRedirectUris": [
      "http://example.com"
    ],
    "redirectUris": [
      "http://example.com"
    ],
    "tokenEndpointAuthMethod": "client_secret_basic"
  },
  "saml": {
    "acsUrls": [
      "http://example.com"
    ],
    "attributes": [
      {
        "name": "string",
        "nameFormat": "unspecified",
        "value": "string"
      }
    ],
    "defaultRelayState": "string",
    "encryptAssertions": true,
    "encryptionAlgorithm": "aes128-gcm",
    "entityId": "string",
    "groupsFilter": "assigned",
    "idpInitiated": true,
    "metadataUrl": "http://example.com",
    "metadataXml": "string",
    "nameIdFormat": "email",
    "signAssertion": true,
    "signResponse": true,
    "sloBinding": "HTTP-Redirect",
    "sloUrl": "http://example.com",
    "spCertificates": [
      {
        "certificate": "string",
        "fingerprintSha256": "string",
        "notAfter": "2019-08-24T14:15:22Z",
        "subject": "string",
        "use": "signing"
      }
    ]
  },
  "tags": {
    "property1": "string",
    "property2": "string"
  }
}
'
```

### TypeScript

```typescript
const url = 'https://sso.ezghcloud.com/v1/organizations/497f6eca-6276-4993-bfeb-53cbbbba6f08/sso/applications/497f6eca-6276-4993-bfeb-53cbbbba6f08';
const options = {
  method: 'PATCH',
  headers: {'Content-Type': 'application/json', Authorization: 'Bearer <token>'},
  body: JSON.stringify({
    description: 'string',
    ezgh: {
      consoleSessionSeconds: 900,
      launchUrl: 'http://example.com',
      product: 'mcpcentral',
      resourceTokenLifetimeSeconds: 300
    },
    kind: 'oidc',
    name: 'string',
    oidc: {
      accessTokenAudience: 'string',
      accessTokenLifetimeSeconds: 300,
      applicationType: 'web',
      backchannelLogoutUri: 'http://example.com',
      groupsClaim: 'assigned',
      idTokenSignedResponseAlg: 'RS256',
      initiateLoginUri: 'http://example.com',
      jwks: {},
      jwksUri: 'http://example.com',
      postLogoutRedirectUris: ['http://example.com'],
      redirectUris: ['http://example.com'],
      tokenEndpointAuthMethod: 'client_secret_basic'
    },
    saml: {
      acsUrls: ['http://example.com'],
      attributes: [{name: 'string', nameFormat: 'unspecified', value: 'string'}],
      defaultRelayState: 'string',
      encryptAssertions: true,
      encryptionAlgorithm: 'aes128-gcm',
      entityId: 'string',
      groupsFilter: 'assigned',
      idpInitiated: true,
      metadataUrl: 'http://example.com',
      metadataXml: 'string',
      nameIdFormat: 'email',
      signAssertion: true,
      signResponse: true,
      sloBinding: 'HTTP-Redirect',
      sloUrl: 'http://example.com',
      spCertificates: [
        {
          certificate: 'string',
          fingerprintSha256: 'string',
          notAfter: '2019-08-24T14:15:22Z',
          subject: 'string',
          use: 'signing'
        }
      ]
    },
    tags: {property1: 'string', property2: 'string'}
  })
};

fetch(url, options)
  .then(res => res.json())
  .then(json => console.log(json))
  .catch(err => console.error(err));
```

### Python

```python
import requests

url = "https://sso.ezghcloud.com/v1/organizations/497f6eca-6276-4993-bfeb-53cbbbba6f08/sso/applications/497f6eca-6276-4993-bfeb-53cbbbba6f08"

payload = {
    "description": "string",
    "ezgh": {
        "consoleSessionSeconds": 900,
        "launchUrl": "http://example.com",
        "product": "mcpcentral",
        "resourceTokenLifetimeSeconds": 300
    },
    "kind": "oidc",
    "name": "string",
    "oidc": {
        "accessTokenAudience": "string",
        "accessTokenLifetimeSeconds": 300,
        "applicationType": "web",
        "backchannelLogoutUri": "http://example.com",
        "groupsClaim": "assigned",
        "idTokenSignedResponseAlg": "RS256",
        "initiateLoginUri": "http://example.com",
        "jwks": {},
        "jwksUri": "http://example.com",
        "postLogoutRedirectUris": ["http://example.com"],
        "redirectUris": ["http://example.com"],
        "tokenEndpointAuthMethod": "client_secret_basic"
    },
    "saml": {
        "acsUrls": ["http://example.com"],
        "attributes": [
            {
                "name": "string",
                "nameFormat": "unspecified",
                "value": "string"
            }
        ],
        "defaultRelayState": "string",
        "encryptAssertions": True,
        "encryptionAlgorithm": "aes128-gcm",
        "entityId": "string",
        "groupsFilter": "assigned",
        "idpInitiated": True,
        "metadataUrl": "http://example.com",
        "metadataXml": "string",
        "nameIdFormat": "email",
        "signAssertion": True,
        "signResponse": True,
        "sloBinding": "HTTP-Redirect",
        "sloUrl": "http://example.com",
        "spCertificates": [
            {
                "certificate": "string",
                "fingerprintSha256": "string",
                "notAfter": "2019-08-24T14:15:22Z",
                "subject": "string",
                "use": "signing"
            }
        ]
    },
    "tags": {
        "property1": "string",
        "property2": "string"
    }
}
headers = {
    "Content-Type": "application/json",
    "Authorization": "Bearer <token>"
}

response = requests.patch(url, json=payload, headers=headers)

print(response.text)
```

## Responses

### 200

The application, changed.

#### Example

```json
{
  "createdAt": "2019-08-24T14:15:22Z",
  "description": "string",
  "directoryId": "786c2ec1-fb9a-4593-b705-005b34c18c18",
  "ezgh": {
    "consoleSessionSeconds": 900,
    "launchUrl": "http://example.com",
    "product": "mcpcentral",
    "resourceTokenLifetimeSeconds": 300
  },
  "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
  "kind": "oidc",
  "logoUrl": "http://example.com",
  "managedBy": "string",
  "name": "string",
  "oidc": {
    "accessTokenAudience": "string",
    "accessTokenLifetimeSeconds": 300,
    "applicationType": "web",
    "backchannelLogoutUri": "http://example.com",
    "clientId": "string",
    "clientSecrets": [
      {
        "createdAt": "2019-08-24T14:15:22Z",
        "createdBy": {
          "id": "string",
          "type": "string"
        },
        "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
        "lastUsedAt": "2019-08-24T14:15:22Z",
        "prefix": "string"
      }
    ],
    "groupsClaim": "assigned",
    "idTokenSignedResponseAlg": "RS256",
    "initiateLoginUri": "http://example.com",
    "issuer": "http://example.com",
    "jwks": {},
    "jwksFetchError": "string",
    "jwksFetchedAt": "2019-08-24T14:15:22Z",
    "jwksUri": "http://example.com",
    "postLogoutRedirectUris": [
      "http://example.com"
    ],
    "redirectUris": [
      "http://example.com"
    ],
    "tokenEndpointAuthMethod": "client_secret_basic"
  },
  "organizationId": "7bc05553-4b68-44e8-b7bc-37be63c6d9e9",
  "projectId": null,
  "region": "string",
  "resourceName": "string",
  "saml": {
    "acsUrls": [
      "http://example.com"
    ],
    "attributes": [
      {
        "name": "string",
        "nameFormat": "unspecified",
        "value": "string"
      }
    ],
    "defaultRelayState": "string",
    "encryptAssertions": true,
    "encryptionAlgorithm": "aes128-gcm",
    "entityId": "string",
    "groupsFilter": "assigned",
    "idp": {
      "certificates": [
        {
          "activatesAt": "2019-08-24T14:15:22Z",
          "certificate": "string",
          "fingerprintSha256": "string",
          "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
          "notAfter": "2019-08-24T14:15:22Z",
          "notBefore": "2019-08-24T14:15:22Z",
          "status": "active",
          "subject": "string",
          "warnAt": "2019-08-24T14:15:22Z"
        }
      ],
      "entityId": "string",
      "initiateUrl": "http://example.com",
      "metadataUrl": "http://example.com",
      "sloUrl": "http://example.com",
      "ssoUrl": "http://example.com"
    },
    "idpInitiated": true,
    "metadataImportedAt": "2019-08-24T14:15:22Z",
    "metadataUrl": "http://example.com",
    "nameIdFormat": "email",
    "signAssertion": true,
    "signResponse": true,
    "sloBinding": "HTTP-Redirect",
    "sloUrl": "http://example.com",
    "spCertificates": [
      {
        "certificate": "string",
        "fingerprintSha256": "string",
        "notAfter": "2019-08-24T14:15:22Z",
        "subject": "string",
        "use": "signing"
      }
    ]
  },
  "slug": "string",
  "status": "active",
  "tags": {
    "property1": "string",
    "property2": "string"
  },
  "updatedAt": "2019-08-24T14:15:22Z"
}
```

- `UpdateApplication.response.200.createdAt` (string, required)
  - format `date-time`
- `UpdateApplication.response.200.description` (string, required)
- `UpdateApplication.response.200.directoryId` (string, required)
  - format `uuid`
- `UpdateApplication.response.200.ezgh` (one of, required)
  - one of: [EzghSettings](/sso-api/schemas/EzghSettings/), `null`
- `UpdateApplication.response.200.id` (string, required)
  - format `uuid`
- `UpdateApplication.response.200.kind` (string, required)
  - one of `"oidc"`, `"ezgh"`, `"saml"`
- `UpdateApplication.response.200.logoUrl` (string | null, required) — Read-only: where sso-edge serves the application's uploaded logo (its portal tile's icon) on the directory's host, https://<alias>.sso.ezgh.app/branding/applications/<id>/logo?v=…, or null. A replaced logo is a new URL. Upload it with PUT …/applications/{appId}/logo; create and update refuse logoUrl.
  - format `uri`
- `UpdateApplication.response.200.managedBy` (string | null, required) — The EZGH product that manages this ezgh application through its own internal routes (MCP Central's, created when EZGH SSO is associated with it), or null. A managed application is read-only here: updating or deleting it, or changing its assignments, is 409 managed_by_product, and creating another ezgh application of its product in the directory is refused the same way.
- `UpdateApplication.response.200.name` (string, required)
- `UpdateApplication.response.200.oidc` (one of, required)
  - one of: [OidcSettings](/sso-api/schemas/OidcSettings/), `null`
- `UpdateApplication.response.200.organizationId` (string, required)
  - format `uuid`
- `UpdateApplication.response.200.projectId` (null, required)
- `UpdateApplication.response.200.region` (string, required)
- `UpdateApplication.response.200.resourceName` (string, required)
- `UpdateApplication.response.200.saml` (one of, required)
  - one of: [SamlSettings](/sso-api/schemas/SamlSettings/), `null`
- `UpdateApplication.response.200.slug` (string, required)
- `UpdateApplication.response.200.status` (string, required)
  - one of `"active"`
- `UpdateApplication.response.200.tags` (map<string>, required)
- `UpdateApplication.response.200.updatedAt` (string, required)
  - format `date-time`

### 400

invalid_request (with issues), invalid_cursor, or the endpoint's own 400 codes.

#### Example

```json
{
  "error": {
    "code": "string",
    "issues": [
      {
        "message": "string",
        "path": "string"
      }
    ],
    "message": "string",
    "quota": {
      "id": "string",
      "inFlight": 0,
      "kind": "allocation",
      "limit": 0,
      "periodStart": "2019-08-24T14:15:22Z",
      "region": "string",
      "resetsAt": "2019-08-24T14:15:22Z",
      "scope": "organization",
      "scopeResourceName": "string",
      "used": 0,
      "window": "string"
    }
  }
}
```

- `UpdateApplication.response.400.error` (object, required)
  - `UpdateApplication.response.400.error.code` (string, required)
    - maxLength 64; pattern `^[a-z][a-z0-9_]*$`
  - `UpdateApplication.response.400.error.message` (string, required)
    - maxLength 1024
  - `UpdateApplication.response.400.error.issues` (array<object>, optional) — invalid_request: one entry per problem, at a dotted path.
    - `UpdateApplication.response.400.error.issues.message` (string, required)
    - `UpdateApplication.response.400.error.issues.path` (string, required)
  - `UpdateApplication.response.400.error.quota` (object, optional) — quota_exceeded: the quota that refused the request. Never with Retry-After.
    - `UpdateApplication.response.400.error.quota.id` (string, required)
    - `UpdateApplication.response.400.error.quota.kind` (unknown, required)
      - one of `"allocation"`, `"rate"`, `"usage"`, `"concurrency"`
    - `UpdateApplication.response.400.error.quota.limit` (integer, required)
      - min 0
    - `UpdateApplication.response.400.error.quota.scope` (unknown, required)
      - one of `"organization"`, `"project"`, `"resource"`
    - `UpdateApplication.response.400.error.quota.inFlight` (integer, optional)
      - min 0
    - `UpdateApplication.response.400.error.quota.periodStart` (string, optional)
      - format `date-time`
    - `UpdateApplication.response.400.error.quota.region` (string, optional)
    - `UpdateApplication.response.400.error.quota.resetsAt` (string, optional)
      - format `date-time`
    - `UpdateApplication.response.400.error.quota.scopeResourceName` (string, optional)
    - `UpdateApplication.response.400.error.quota.used` (integer, optional)
      - min 0
    - `UpdateApplication.response.400.error.quota.window` (string, optional) — rate only: an ISO 8601 duration, PT1S to PT1H.

### 401

unauthenticated: no credential, or one that doesn't check out.

#### Example

```json
{
  "error": {
    "code": "string",
    "issues": [
      {
        "message": "string",
        "path": "string"
      }
    ],
    "message": "string",
    "quota": {
      "id": "string",
      "inFlight": 0,
      "kind": "allocation",
      "limit": 0,
      "periodStart": "2019-08-24T14:15:22Z",
      "region": "string",
      "resetsAt": "2019-08-24T14:15:22Z",
      "scope": "organization",
      "scopeResourceName": "string",
      "used": 0,
      "window": "string"
    }
  }
}
```

- `UpdateApplication.response.401.error` (object, required)
  - `UpdateApplication.response.401.error.code` (string, required)
    - maxLength 64; pattern `^[a-z][a-z0-9_]*$`
  - `UpdateApplication.response.401.error.message` (string, required)
    - maxLength 1024
  - `UpdateApplication.response.401.error.issues` (array<object>, optional) — invalid_request: one entry per problem, at a dotted path.
    - `UpdateApplication.response.401.error.issues.message` (string, required)
    - `UpdateApplication.response.401.error.issues.path` (string, required)
  - `UpdateApplication.response.401.error.quota` (object, optional) — quota_exceeded: the quota that refused the request. Never with Retry-After.
    - `UpdateApplication.response.401.error.quota.id` (string, required)
    - `UpdateApplication.response.401.error.quota.kind` (unknown, required)
      - one of `"allocation"`, `"rate"`, `"usage"`, `"concurrency"`
    - `UpdateApplication.response.401.error.quota.limit` (integer, required)
      - min 0
    - `UpdateApplication.response.401.error.quota.scope` (unknown, required)
      - one of `"organization"`, `"project"`, `"resource"`
    - `UpdateApplication.response.401.error.quota.inFlight` (integer, optional)
      - min 0
    - `UpdateApplication.response.401.error.quota.periodStart` (string, optional)
      - format `date-time`
    - `UpdateApplication.response.401.error.quota.region` (string, optional)
    - `UpdateApplication.response.401.error.quota.resetsAt` (string, optional)
      - format `date-time`
    - `UpdateApplication.response.401.error.quota.scopeResourceName` (string, optional)
    - `UpdateApplication.response.401.error.quota.used` (integer, optional)
      - min 0
    - `UpdateApplication.response.401.error.quota.window` (string, optional) — rate only: an ISO 8601 duration, PT1S to PT1H.

### 403

access_denied: the caller's policies don't allow the action; forbidden_origin: a cookie-authenticated write from an origin that isn't allowed; spend_limit_reached.

#### Example

```json
{
  "error": {
    "code": "string",
    "issues": [
      {
        "message": "string",
        "path": "string"
      }
    ],
    "message": "string",
    "quota": {
      "id": "string",
      "inFlight": 0,
      "kind": "allocation",
      "limit": 0,
      "periodStart": "2019-08-24T14:15:22Z",
      "region": "string",
      "resetsAt": "2019-08-24T14:15:22Z",
      "scope": "organization",
      "scopeResourceName": "string",
      "used": 0,
      "window": "string"
    }
  }
}
```

- `UpdateApplication.response.403.error` (object, required)
  - `UpdateApplication.response.403.error.code` (string, required)
    - maxLength 64; pattern `^[a-z][a-z0-9_]*$`
  - `UpdateApplication.response.403.error.message` (string, required)
    - maxLength 1024
  - `UpdateApplication.response.403.error.issues` (array<object>, optional) — invalid_request: one entry per problem, at a dotted path.
    - `UpdateApplication.response.403.error.issues.message` (string, required)
    - `UpdateApplication.response.403.error.issues.path` (string, required)
  - `UpdateApplication.response.403.error.quota` (object, optional) — quota_exceeded: the quota that refused the request. Never with Retry-After.
    - `UpdateApplication.response.403.error.quota.id` (string, required)
    - `UpdateApplication.response.403.error.quota.kind` (unknown, required)
      - one of `"allocation"`, `"rate"`, `"usage"`, `"concurrency"`
    - `UpdateApplication.response.403.error.quota.limit` (integer, required)
      - min 0
    - `UpdateApplication.response.403.error.quota.scope` (unknown, required)
      - one of `"organization"`, `"project"`, `"resource"`
    - `UpdateApplication.response.403.error.quota.inFlight` (integer, optional)
      - min 0
    - `UpdateApplication.response.403.error.quota.periodStart` (string, optional)
      - format `date-time`
    - `UpdateApplication.response.403.error.quota.region` (string, optional)
    - `UpdateApplication.response.403.error.quota.resetsAt` (string, optional)
      - format `date-time`
    - `UpdateApplication.response.403.error.quota.scopeResourceName` (string, optional)
    - `UpdateApplication.response.403.error.quota.used` (integer, optional)
      - min 0
    - `UpdateApplication.response.403.error.quota.window` (string, optional) — rate only: an ISO 8601 duration, PT1S to PT1H.

### 404

not_found: unknown, malformed, or in an organization the caller isn't in.

#### Example

```json
{
  "error": {
    "code": "string",
    "issues": [
      {
        "message": "string",
        "path": "string"
      }
    ],
    "message": "string",
    "quota": {
      "id": "string",
      "inFlight": 0,
      "kind": "allocation",
      "limit": 0,
      "periodStart": "2019-08-24T14:15:22Z",
      "region": "string",
      "resetsAt": "2019-08-24T14:15:22Z",
      "scope": "organization",
      "scopeResourceName": "string",
      "used": 0,
      "window": "string"
    }
  }
}
```

- `UpdateApplication.response.404.error` (object, required)
  - `UpdateApplication.response.404.error.code` (string, required)
    - maxLength 64; pattern `^[a-z][a-z0-9_]*$`
  - `UpdateApplication.response.404.error.message` (string, required)
    - maxLength 1024
  - `UpdateApplication.response.404.error.issues` (array<object>, optional) — invalid_request: one entry per problem, at a dotted path.
    - `UpdateApplication.response.404.error.issues.message` (string, required)
    - `UpdateApplication.response.404.error.issues.path` (string, required)
  - `UpdateApplication.response.404.error.quota` (object, optional) — quota_exceeded: the quota that refused the request. Never with Retry-After.
    - `UpdateApplication.response.404.error.quota.id` (string, required)
    - `UpdateApplication.response.404.error.quota.kind` (unknown, required)
      - one of `"allocation"`, `"rate"`, `"usage"`, `"concurrency"`
    - `UpdateApplication.response.404.error.quota.limit` (integer, required)
      - min 0
    - `UpdateApplication.response.404.error.quota.scope` (unknown, required)
      - one of `"organization"`, `"project"`, `"resource"`
    - `UpdateApplication.response.404.error.quota.inFlight` (integer, optional)
      - min 0
    - `UpdateApplication.response.404.error.quota.periodStart` (string, optional)
      - format `date-time`
    - `UpdateApplication.response.404.error.quota.region` (string, optional)
    - `UpdateApplication.response.404.error.quota.resetsAt` (string, optional)
      - format `date-time`
    - `UpdateApplication.response.404.error.quota.scopeResourceName` (string, optional)
    - `UpdateApplication.response.404.error.quota.used` (integer, optional)
      - min 0
    - `UpdateApplication.response.404.error.quota.window` (string, optional) — rate only: an ISO 8601 duration, PT1S to PT1H.

### 409

quota_exceeded (an allocation quota, with quota), idempotency_conflict, idempotency_in_progress (with Retry-After), organization_deletion_pending, operation_in_progress, or the endpoint's own 409 codes.

#### Example

```json
{
  "error": {
    "code": "string",
    "issues": [
      {
        "message": "string",
        "path": "string"
      }
    ],
    "message": "string",
    "quota": {
      "id": "string",
      "inFlight": 0,
      "kind": "allocation",
      "limit": 0,
      "periodStart": "2019-08-24T14:15:22Z",
      "region": "string",
      "resetsAt": "2019-08-24T14:15:22Z",
      "scope": "organization",
      "scopeResourceName": "string",
      "used": 0,
      "window": "string"
    }
  }
}
```

- `UpdateApplication.response.409.error` (object, required)
  - `UpdateApplication.response.409.error.code` (string, required)
    - maxLength 64; pattern `^[a-z][a-z0-9_]*$`
  - `UpdateApplication.response.409.error.message` (string, required)
    - maxLength 1024
  - `UpdateApplication.response.409.error.issues` (array<object>, optional) — invalid_request: one entry per problem, at a dotted path.
    - `UpdateApplication.response.409.error.issues.message` (string, required)
    - `UpdateApplication.response.409.error.issues.path` (string, required)
  - `UpdateApplication.response.409.error.quota` (object, optional) — quota_exceeded: the quota that refused the request. Never with Retry-After.
    - `UpdateApplication.response.409.error.quota.id` (string, required)
    - `UpdateApplication.response.409.error.quota.kind` (unknown, required)
      - one of `"allocation"`, `"rate"`, `"usage"`, `"concurrency"`
    - `UpdateApplication.response.409.error.quota.limit` (integer, required)
      - min 0
    - `UpdateApplication.response.409.error.quota.scope` (unknown, required)
      - one of `"organization"`, `"project"`, `"resource"`
    - `UpdateApplication.response.409.error.quota.inFlight` (integer, optional)
      - min 0
    - `UpdateApplication.response.409.error.quota.periodStart` (string, optional)
      - format `date-time`
    - `UpdateApplication.response.409.error.quota.region` (string, optional)
    - `UpdateApplication.response.409.error.quota.resetsAt` (string, optional)
      - format `date-time`
    - `UpdateApplication.response.409.error.quota.scopeResourceName` (string, optional)
    - `UpdateApplication.response.409.error.quota.used` (integer, optional)
      - min 0
    - `UpdateApplication.response.409.error.quota.window` (string, optional) — rate only: an ISO 8601 duration, PT1S to PT1H.

### 413

payload_too_large: the body is over the endpoint's limit (1 MiB unless it says otherwise).

#### Example

```json
{
  "error": {
    "code": "string",
    "issues": [
      {
        "message": "string",
        "path": "string"
      }
    ],
    "message": "string",
    "quota": {
      "id": "string",
      "inFlight": 0,
      "kind": "allocation",
      "limit": 0,
      "periodStart": "2019-08-24T14:15:22Z",
      "region": "string",
      "resetsAt": "2019-08-24T14:15:22Z",
      "scope": "organization",
      "scopeResourceName": "string",
      "used": 0,
      "window": "string"
    }
  }
}
```

- `UpdateApplication.response.413.error` (object, required)
  - `UpdateApplication.response.413.error.code` (string, required)
    - maxLength 64; pattern `^[a-z][a-z0-9_]*$`
  - `UpdateApplication.response.413.error.message` (string, required)
    - maxLength 1024
  - `UpdateApplication.response.413.error.issues` (array<object>, optional) — invalid_request: one entry per problem, at a dotted path.
    - `UpdateApplication.response.413.error.issues.message` (string, required)
    - `UpdateApplication.response.413.error.issues.path` (string, required)
  - `UpdateApplication.response.413.error.quota` (object, optional) — quota_exceeded: the quota that refused the request. Never with Retry-After.
    - `UpdateApplication.response.413.error.quota.id` (string, required)
    - `UpdateApplication.response.413.error.quota.kind` (unknown, required)
      - one of `"allocation"`, `"rate"`, `"usage"`, `"concurrency"`
    - `UpdateApplication.response.413.error.quota.limit` (integer, required)
      - min 0
    - `UpdateApplication.response.413.error.quota.scope` (unknown, required)
      - one of `"organization"`, `"project"`, `"resource"`
    - `UpdateApplication.response.413.error.quota.inFlight` (integer, optional)
      - min 0
    - `UpdateApplication.response.413.error.quota.periodStart` (string, optional)
      - format `date-time`
    - `UpdateApplication.response.413.error.quota.region` (string, optional)
    - `UpdateApplication.response.413.error.quota.resetsAt` (string, optional)
      - format `date-time`
    - `UpdateApplication.response.413.error.quota.scopeResourceName` (string, optional)
    - `UpdateApplication.response.413.error.quota.used` (integer, optional)
      - min 0
    - `UpdateApplication.response.413.error.quota.window` (string, optional) — rate only: an ISO 8601 duration, PT1S to PT1H.

### 429

too_many_requests, with Retry-After; or quota_exceeded (a rate, usage or concurrency quota, with quota), never with Retry-After.

#### Example

```json
{
  "error": {
    "code": "string",
    "issues": [
      {
        "message": "string",
        "path": "string"
      }
    ],
    "message": "string",
    "quota": {
      "id": "string",
      "inFlight": 0,
      "kind": "allocation",
      "limit": 0,
      "periodStart": "2019-08-24T14:15:22Z",
      "region": "string",
      "resetsAt": "2019-08-24T14:15:22Z",
      "scope": "organization",
      "scopeResourceName": "string",
      "used": 0,
      "window": "string"
    }
  }
}
```

- `UpdateApplication.response.429.error` (object, required)
  - `UpdateApplication.response.429.error.code` (string, required)
    - maxLength 64; pattern `^[a-z][a-z0-9_]*$`
  - `UpdateApplication.response.429.error.message` (string, required)
    - maxLength 1024
  - `UpdateApplication.response.429.error.issues` (array<object>, optional) — invalid_request: one entry per problem, at a dotted path.
    - `UpdateApplication.response.429.error.issues.message` (string, required)
    - `UpdateApplication.response.429.error.issues.path` (string, required)
  - `UpdateApplication.response.429.error.quota` (object, optional) — quota_exceeded: the quota that refused the request. Never with Retry-After.
    - `UpdateApplication.response.429.error.quota.id` (string, required)
    - `UpdateApplication.response.429.error.quota.kind` (unknown, required)
      - one of `"allocation"`, `"rate"`, `"usage"`, `"concurrency"`
    - `UpdateApplication.response.429.error.quota.limit` (integer, required)
      - min 0
    - `UpdateApplication.response.429.error.quota.scope` (unknown, required)
      - one of `"organization"`, `"project"`, `"resource"`
    - `UpdateApplication.response.429.error.quota.inFlight` (integer, optional)
      - min 0
    - `UpdateApplication.response.429.error.quota.periodStart` (string, optional)
      - format `date-time`
    - `UpdateApplication.response.429.error.quota.region` (string, optional)
    - `UpdateApplication.response.429.error.quota.resetsAt` (string, optional)
      - format `date-time`
    - `UpdateApplication.response.429.error.quota.scopeResourceName` (string, optional)
    - `UpdateApplication.response.429.error.quota.used` (integer, optional)
      - min 0
    - `UpdateApplication.response.429.error.quota.window` (string, optional) — rate only: an ISO 8601 duration, PT1S to PT1H.

### 500

internal_error: a bug; the details are in the logs, under the request ID.

#### Example

```json
{
  "error": {
    "code": "string",
    "issues": [
      {
        "message": "string",
        "path": "string"
      }
    ],
    "message": "string",
    "quota": {
      "id": "string",
      "inFlight": 0,
      "kind": "allocation",
      "limit": 0,
      "periodStart": "2019-08-24T14:15:22Z",
      "region": "string",
      "resetsAt": "2019-08-24T14:15:22Z",
      "scope": "organization",
      "scopeResourceName": "string",
      "used": 0,
      "window": "string"
    }
  }
}
```

- `UpdateApplication.response.500.error` (object, required)
  - `UpdateApplication.response.500.error.code` (string, required)
    - maxLength 64; pattern `^[a-z][a-z0-9_]*$`
  - `UpdateApplication.response.500.error.message` (string, required)
    - maxLength 1024
  - `UpdateApplication.response.500.error.issues` (array<object>, optional) — invalid_request: one entry per problem, at a dotted path.
    - `UpdateApplication.response.500.error.issues.message` (string, required)
    - `UpdateApplication.response.500.error.issues.path` (string, required)
  - `UpdateApplication.response.500.error.quota` (object, optional) — quota_exceeded: the quota that refused the request. Never with Retry-After.
    - `UpdateApplication.response.500.error.quota.id` (string, required)
    - `UpdateApplication.response.500.error.quota.kind` (unknown, required)
      - one of `"allocation"`, `"rate"`, `"usage"`, `"concurrency"`
    - `UpdateApplication.response.500.error.quota.limit` (integer, required)
      - min 0
    - `UpdateApplication.response.500.error.quota.scope` (unknown, required)
      - one of `"organization"`, `"project"`, `"resource"`
    - `UpdateApplication.response.500.error.quota.inFlight` (integer, optional)
      - min 0
    - `UpdateApplication.response.500.error.quota.periodStart` (string, optional)
      - format `date-time`
    - `UpdateApplication.response.500.error.quota.region` (string, optional)
    - `UpdateApplication.response.500.error.quota.resetsAt` (string, optional)
      - format `date-time`
    - `UpdateApplication.response.500.error.quota.scopeResourceName` (string, optional)
    - `UpdateApplication.response.500.error.quota.used` (integer, optional)
      - min 0
    - `UpdateApplication.response.500.error.quota.window` (string, optional) — rate only: an ISO 8601 duration, PT1S to PT1H.

### 503

unavailable: a dependency the request needs is down. Retry after Retry-After.

#### Example

```json
{
  "error": {
    "code": "string",
    "issues": [
      {
        "message": "string",
        "path": "string"
      }
    ],
    "message": "string",
    "quota": {
      "id": "string",
      "inFlight": 0,
      "kind": "allocation",
      "limit": 0,
      "periodStart": "2019-08-24T14:15:22Z",
      "region": "string",
      "resetsAt": "2019-08-24T14:15:22Z",
      "scope": "organization",
      "scopeResourceName": "string",
      "used": 0,
      "window": "string"
    }
  }
}
```

- `UpdateApplication.response.503.error` (object, required)
  - `UpdateApplication.response.503.error.code` (string, required)
    - maxLength 64; pattern `^[a-z][a-z0-9_]*$`
  - `UpdateApplication.response.503.error.message` (string, required)
    - maxLength 1024
  - `UpdateApplication.response.503.error.issues` (array<object>, optional) — invalid_request: one entry per problem, at a dotted path.
    - `UpdateApplication.response.503.error.issues.message` (string, required)
    - `UpdateApplication.response.503.error.issues.path` (string, required)
  - `UpdateApplication.response.503.error.quota` (object, optional) — quota_exceeded: the quota that refused the request. Never with Retry-After.
    - `UpdateApplication.response.503.error.quota.id` (string, required)
    - `UpdateApplication.response.503.error.quota.kind` (unknown, required)
      - one of `"allocation"`, `"rate"`, `"usage"`, `"concurrency"`
    - `UpdateApplication.response.503.error.quota.limit` (integer, required)
      - min 0
    - `UpdateApplication.response.503.error.quota.scope` (unknown, required)
      - one of `"organization"`, `"project"`, `"resource"`
    - `UpdateApplication.response.503.error.quota.inFlight` (integer, optional)
      - min 0
    - `UpdateApplication.response.503.error.quota.periodStart` (string, optional)
      - format `date-time`
    - `UpdateApplication.response.503.error.quota.region` (string, optional)
    - `UpdateApplication.response.503.error.quota.resetsAt` (string, optional)
      - format `date-time`
    - `UpdateApplication.response.503.error.quota.scopeResourceName` (string, optional)
    - `UpdateApplication.response.503.error.quota.used` (integer, optional)
      - min 0
    - `UpdateApplication.response.503.error.quota.window` (string, optional) — rate only: an ISO 8601 duration, PT1S to PT1H.


Source: https://docs.ezghcloud.com/sso-api/UpdateApplication/index.md