---
title: "PUT /core/transactional/applications/"
method: PUT
path: "/core/transactional/applications/"
tags: ["core"]
---

# PUT /core/transactional/applications/

`PUT /core/transactional/applications/`

Convert data into a blueprint, validate it and apply it

## Request body

- TransactionApplicationRequest — Serializer for creating a provider and an application in one transaction
  - `app` ApplicationRequest, required — Application Serializer
    - `name` string, required — Application's display Name.
    - `slug` string, required — Internal application name, used in URLs.
    - `provider` integer, nullable
    - `backchannel_providers` integer[]
    - `open_in_new_tab` boolean — Open launch URL in a new browser tab or window.
    - `meta_launch_url` string, uri
    - `meta_icon` string
    - `meta_description` string
    - `meta_publisher` string
    - `policy_engine_mode` 'all' | 'any'
    - `group` string
    - `meta_hide` boolean — Hide this application from the user's My applications page.
  - `provider_model` 'authentik_providers_google_workspace.googleworkspaceprovider' | 'authentik_providers_ldap.ldapprovider' | 'authentik_providers_microsoft_entra.microsoftentraprovider' | 'authentik_providers_oauth2.oauth2provider' | 'authentik_providers_proxy.proxyprovider' | 'authentik_providers_rac.racprovider' | 'authentik_providers_radius.radiusprovider' | 'authentik_providers_saml.samlprovider' | 'authentik_providers_scim.scimprovider' | 'authentik_providers_ssf.ssfprovider' | 'authentik_providers_ws_federation.wsfederationprovider', required
  - `provider` union, required
    - GoogleWorkspaceProviderRequest — GoogleWorkspaceProvider Serializer
      - `name` string, required
      - `property_mappings` string[]
      - `property_mappings_group` string[] — Property mappings used for group creation/updating.
      - `delegated_subject` string, email, required
      - `credentials` object, required
      - `scopes` string
      - `exclude_users_service_account` boolean
      - `filter_group` string, uuid, nullable
      - `user_delete_action` 'do_nothing' | 'delete' | 'suspend'
      - `group_delete_action` 'do_nothing' | 'delete' | 'suspend'
      - `default_group_email_domain` string, required
      - `sync_page_size` integer — Controls the number of objects synced in a single task
      - `sync_page_timeout` string — Timeout for synchronization of a single page
      - `dry_run` boolean — When enabled, provider will not modify or create objects in the remote system.
      - `discovery_enabled` boolean — When enabled, authentik will attempt to discover existing resources in the remote system.
    - LDAPProviderRequest — LDAPProvider Serializer
      - `name` string, required
      - `authentication_flow` string, uuid, nullable — Flow used for authentication when the associated application is accessed by an un-authenticated user.
      - `authorization_flow` string, uuid, required — Flow used when authorizing this provider.
      - `invalidation_flow` string, uuid, required — Flow used ending the session from a provider.
      - `property_mappings` string[]
      - `base_dn` string — DN under which objects are accessible.
      - `certificate` string, uuid, nullable
      - `tls_server_name` string
      - `uid_start_number` integer — The start for uidNumbers, this number is added to the user.pk to make sure that the numbers aren't too low for POSIX users. Default is 2000 to ensure that we don't collide with local users uidNumber
      - `gid_start_number` integer — The start for gidNumbers, this number is added to a number generated from the group.pk to make sure that the numbers aren't too low for POSIX groups. Default is 4000 to ensure that we don't collide with local groups or users primary groups gidNumber
      - `search_mode` 'direct' | 'cached'
      - `bind_mode` 'direct' | 'cached'
      - `mfa_support` boolean — When enabled, code-based multi-factor authentication can be used by appending a semicolon and the TOTP code to the password. This should only be enabled if all users that will bind to this provider have a TOTP device configured, as otherwise a password may incorrectly be rejected if it contains a semicolon.
    - MicrosoftEntraProviderRequest — MicrosoftEntraProvider Serializer
      - `name` string, required
      - `property_mappings` string[]
      - `property_mappings_group` string[] — Property mappings used for group creation/updating.
      - `client_id` string, required
      - `client_secret` string, required
      - `tenant_id` string, required
      - `exclude_users_service_account` boolean
      - `filter_group` string, uuid, nullable
      - `user_delete_action` 'do_nothing' | 'delete' | 'suspend'
      - `group_delete_action` 'do_nothing' | 'delete' | 'suspend'
      - `sync_page_size` integer — Controls the number of objects synced in a single task
      - `discovery_enabled` boolean — When enabled, authentik will attempt to discover existing resources in the remote system.
      - `sync_page_timeout` string — Timeout for synchronization of a single page
      - `dry_run` boolean — When enabled, provider will not modify or create objects in the remote system.
    - OAuth2ProviderRequest — OAuth2Provider Serializer
      - `name` string, required
      - `authentication_flow` string, uuid, nullable — Flow used for authentication when the associated application is accessed by an un-authenticated user.
      - `authorization_flow` string, uuid, required — Flow used when authorizing this provider.
      - `invalidation_flow` string, uuid, required — Flow used ending the session from a provider.
      - `property_mappings` string[]
      - `client_type` 'confidential' | 'public'
      - `grant_types` GrantTypeEnum[]
      - `client_id` string
      - `client_secret` string
      - `access_code_validity` string — Access codes not valid on or after current time + this value (Format: hours=1;minutes=2;seconds=3).
      - `access_token_validity` string — Tokens not valid on or after current time + this value (Format: hours=1;minutes=2;seconds=3).
      - `refresh_token_validity` string — Tokens not valid on or after current time + this value (Format: hours=1;minutes=2;seconds=3).
      - `refresh_token_threshold` string — When refreshing a token, if the refresh token is valid for less than this duration, it will be renewed. When set to seconds=0, token will always be renewed. (Format: hours=1;minutes=2;seconds=3).
      - `include_claims_in_id_token` boolean — Include User claims from scopes in the id_token, for applications that don't access the userinfo endpoint.
      - `signing_key` string, uuid, nullable — Key used to sign the tokens.
      - `encryption_key` string, uuid, nullable — Key used to encrypt the tokens. When set, tokens will be encrypted and returned as JWEs.
      - `redirect_uris` RedirectURIRequest[], required
        - `matching_mode` 'strict' | 'regex', required
        - `url` string, required
        - `redirect_uri_type` 'authorization' | 'logout'
      - `logout_uri` string, uri
      - `logout_method` 'backchannel' | 'frontchannel'
      - `sub_mode` 'hashed_user_id' | 'user_id' | 'user_uuid' | 'user_username' | 'user_email' | 'user_upn'
      - `issuer_mode` 'global' | 'per_provider'
      - `jwt_federation_sources` string[]
      - `jwt_federation_providers` integer[]
    - ProxyProviderRequest — ProxyProvider Serializer
      - `name` string, required
      - `authentication_flow` string, uuid, nullable — Flow used for authentication when the associated application is accessed by an un-authenticated user.
      - `authorization_flow` string, uuid, required — Flow used when authorizing this provider.
      - `invalidation_flow` string, uuid, required — Flow used ending the session from a provider.
      - `property_mappings` string[]
      - `internal_host` string, uri
      - `external_host` string, uri, required
      - `internal_host_ssl_validation` boolean — Validate SSL Certificates of upstream servers
      - `certificate` string, uuid, nullable
      - `skip_path_regex` string — Regular expressions for which authentication is not required. Each new line is interpreted as a new Regular Expression.
      - `basic_auth_enabled` boolean — Set a custom HTTP-Basic Authentication header based on values from authentik.
      - `basic_auth_password_attribute` string — User/Group Attribute used for the password part of the HTTP-Basic Header.
      - `basic_auth_user_attribute` string — User/Group Attribute used for the user part of the HTTP-Basic Header. If not set, the user's Email address is used.
      - `mode` 'proxy' | 'forward_single' | 'forward_domain'
      - `intercept_header_auth` boolean — When enabled, this provider will intercept the authorization header and authenticate requests based on its value.
      - `cookie_domain` string
      - `jwt_federation_sources` string[]
      - `jwt_federation_providers` integer[]
      - `access_token_validity` string — Tokens not valid on or after current time + this value (Format: hours=1;minutes=2;seconds=3).
      - `refresh_token_validity` string — Tokens not valid on or after current time + this value (Format: hours=1;minutes=2;seconds=3).
    - RACProviderRequest — RACProvider Serializer
      - `name` string, required
      - `authentication_flow` string, uuid, nullable — Flow used for authentication when the associated application is accessed by an un-authenticated user.
      - `authorization_flow` string, uuid, required — Flow used when authorizing this provider.
      - `property_mappings` string[]
      - `settings` object
      - `connection_expiry` string — Determines how long a session lasts. Default of 0 means that the sessions lasts until the browser is closed. (Format: hours=-1;minutes=-2;seconds=-3)
      - `delete_token_on_disconnect` boolean — When set to true, connection tokens will be deleted upon disconnect.
    - RadiusProviderRequest — RadiusProvider Serializer
      - `name` string, required
      - `authentication_flow` string, uuid, nullable — Flow used for authentication when the associated application is accessed by an un-authenticated user.
      - `authorization_flow` string, uuid, required — Flow used when authorizing this provider.
      - `invalidation_flow` string, uuid, required — Flow used ending the session from a provider.
      - `property_mappings` string[]
      - `client_networks` string — List of CIDRs (comma-separated) that clients can connect from. A more specific CIDR will match before a looser one. Clients connecting from a non-specified CIDR will be dropped.
      - `shared_secret` string — Shared secret between clients and server to hash packets.
      - `mfa_support` boolean — When enabled, code-based multi-factor authentication can be used by appending a semicolon and the TOTP code to the password. This should only be enabled if all users that will bind to this provider have a TOTP device configured, as otherwise a password may incorrectly be rejected if it contains a semicolon.
      - `certificate` string, uuid, nullable
    - SAMLProviderRequest — SAMLProvider Serializer
      - `name` string, required
      - `authentication_flow` string, uuid, nullable — Flow used for authentication when the associated application is accessed by an un-authenticated user.
      - `authorization_flow` string, uuid, required — Flow used when authorizing this provider.
      - `invalidation_flow` string, uuid, required — Flow used ending the session from a provider.
      - `property_mappings` string[]
      - `acs_url` string, uri, required
      - `sls_url` string, uri — Single Logout Service URL where the logout response should be sent.
      - `audience` string — Value of the audience restriction field of the assertion. When left empty, no audience restriction will be added.
      - `issuer_override` string — Also known as EntityID. Providing a value overrides the default issuer generated by authentik.
      - `assertion_valid_not_before` string — Assertion valid not before current time + this value (Format: hours=-1;minutes=-2;seconds=-3).
      - `assertion_valid_not_on_or_after` string — Assertion not valid on or after current time + this value (Format: hours=1;minutes=2;seconds=3).
      - `session_valid_not_on_or_after` string — Session not valid on or after current time + this value (Format: hours=1;minutes=2;seconds=3).
      - `name_id_mapping` string, uuid, nullable — Configure how the NameID value will be created. When left empty, the NameIDPolicy of the incoming request will be considered
      - `authn_context_class_ref_mapping` string, uuid, nullable — Configure how the AuthnContextClassRef value will be created. When left empty, the AuthnContextClassRef will be set based on which authentication methods the user used to authenticate.
      - `digest_algorithm` 'http://www.w3.org/2000/09/xmldsig#sha1' | 'http://www.w3.org/2001/04/xmlenc#sha256' | 'http://www.w3.org/2001/04/xmldsig-more#sha384' | 'http://www.w3.org/2001/04/xmlenc#sha512'
      - `signature_algorithm` 'http://www.w3.org/2000/09/xmldsig#rsa-sha1' | 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha256' | 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha384' | 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha512' | 'http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha1' | 'http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha256' | 'http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha384' | 'http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha512' | 'http://www.w3.org/2000/09/xmldsig#dsa-sha1'
      - `signing_kp` string, uuid, nullable — Keypair used to sign outgoing Responses going to the Service Provider.
      - `verification_kp` string, uuid, nullable — When selected, incoming assertion's Signatures will be validated against this certificate. To allow unsigned Requests, leave on default.
      - `encryption_kp` string, uuid, nullable — When selected, incoming assertions are encrypted by the IdP using the public key of the encryption keypair. The assertion is decrypted by the SP using the the private key.
      - `sign_assertion` boolean
      - `sign_response` boolean
      - `sign_logout_request` boolean
      - `sign_logout_response` boolean
      - `sp_binding` 'redirect' | 'post'
      - `sls_binding` 'redirect' | 'post'
      - `logout_method` 'frontchannel_iframe' | 'frontchannel_native' | 'backchannel'
      - `default_relay_state` string — Default relay_state value for IDP-initiated logins
      - `default_name_id_policy` 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress' | 'urn:oasis:names:tc:SAML:2.0:nameid-format:persistent' | 'urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName' | 'urn:oasis:names:tc:SAML:2.0:nameid-format:WindowsDomainQualifiedName' | 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient' | 'urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified'
    - SCIMProviderRequest — SCIMProvider Serializer
      - `name` string, required
      - `property_mappings` string[]
      - `property_mappings_group` string[] — Property mappings used for group creation/updating.
      - `url` string, required — Base URL to SCIM requests, usually ends in /v2
      - `verify_certificates` boolean
      - `token` string — Authentication token
      - `auth_mode` 'token' | 'oauth' | 'oauth_interactive'
      - `auth_oauth` string, uuid, nullable — OAuth Source used for authentication
      - `auth_oauth_params` object — Additional OAuth parameters, such as grant_type
      - `compatibility_mode` 'default' | 'aws' | 'slack' | 'sfdc' | 'gitlab' | 'webex' | 'vcenter'
      - `service_provider_config_cache_timeout` string — Cache duration for ServiceProviderConfig responses. Set minutes=0 to disable.
      - `exclude_users_service_account` boolean
      - `sync_page_size` integer — Controls the number of objects synced in a single task
      - `sync_page_timeout` string — Timeout for synchronization of a single page
      - `discovery_enabled` boolean — When enabled, authentik will attempt to discover existing resources in the remote system.
      - `group_filters` string[] — Group filters used to define sync-scope for groups.
      - `dry_run` boolean — When enabled, provider will not modify or create objects in the remote system.
    - SSFProviderRequest — SSFProvider Serializer
      - `name` string, required
      - `signing_key` string, uuid, required — Key used to sign the SSF Events.
      - `oidc_auth_providers` integer[]
      - `event_retention` string
      - `push_verify_certificates` boolean
    - WSFederationProviderRequest — WSFederationProvider Serializer
      - `name` string, required
      - `authentication_flow` string, uuid, nullable — Flow used for authentication when the associated application is accessed by an un-authenticated user.
      - `authorization_flow` string, uuid, required — Flow used when authorizing this provider.
      - `invalidation_flow` string, uuid, required — Flow used ending the session from a provider.
      - `property_mappings` string[]
      - `reply_url` string, uri, required
      - `wtrealm` string, required
      - `assertion_valid_not_before` string — Assertion valid not before current time + this value (Format: hours=-1;minutes=-2;seconds=-3).
      - `assertion_valid_not_on_or_after` string — Assertion not valid on or after current time + this value (Format: hours=1;minutes=2;seconds=3).
      - `session_valid_not_on_or_after` string — Session not valid on or after current time + this value (Format: hours=1;minutes=2;seconds=3).
      - `name_id_mapping` string, uuid, nullable — Configure how the NameID value will be created. When left empty, the NameIDPolicy of the incoming request will be considered
      - `authn_context_class_ref_mapping` string, uuid, nullable — Configure how the AuthnContextClassRef value will be created. When left empty, the AuthnContextClassRef will be set based on which authentication methods the user used to authenticate.
      - `saml_version` '1.1' | '2.0'
      - `digest_algorithm` 'http://www.w3.org/2000/09/xmldsig#sha1' | 'http://www.w3.org/2001/04/xmlenc#sha256' | 'http://www.w3.org/2001/04/xmldsig-more#sha384' | 'http://www.w3.org/2001/04/xmlenc#sha512'
      - `signature_algorithm` 'http://www.w3.org/2000/09/xmldsig#rsa-sha1' | 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha256' | 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha384' | 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha512' | 'http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha1' | 'http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha256' | 'http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha384' | 'http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha512' | 'http://www.w3.org/2000/09/xmldsig#dsa-sha1'
      - `signing_kp` string, uuid, nullable — Keypair used to sign outgoing Responses going to the Service Provider.
      - `encryption_kp` string, uuid, nullable — When selected, incoming assertions are encrypted by the IdP using the public key of the encryption keypair. The assertion is decrypted by the SP using the the private key.
      - `sign_assertion` boolean
      - `sign_logout_request` boolean
      - `default_name_id_policy` 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress' | 'urn:oasis:names:tc:SAML:2.0:nameid-format:persistent' | 'urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName' | 'urn:oasis:names:tc:SAML:2.0:nameid-format:WindowsDomainQualifiedName' | 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient' | 'urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified'
  - `policy_bindings` TransactionPolicyBindingRequest[]
    - `policy` string, uuid, nullable
    - `group` string, uuid, nullable
    - `user` integer, nullable
    - `negate` boolean — Negates the outcome of the policy. Messages are unaffected.
    - `enabled` boolean
    - `order` integer, required
    - `timeout` integer — Timeout after which Policy execution is terminated.
    - `failure_result` boolean — Result if the Policy execution fails.

## Response `200`

- TransactionApplicationResponse — Transactional creation response
  - `applied` boolean, required
  - `logs` string[], required

## Other responses

- `400`
- `403`

---

[API](https://skmtc.dev/goauthentik/apis/authentik.md) · [All operations](https://skmtc.dev/goauthentik/apis/authentik/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/goauthentik/authentik/revisions/4e42e86021d7/schema)