---
title: "Create application"
method: POST
path: "/zones/{zoneId}/applications"
tags: ["Applications"]
---

# Create application

`POST /zones/{zoneId}/applications`

## Request

- Base URL: `https://docs.keycard.ai` (the document declares no server; this is the origin it was published from)
- URL: `https://docs.keycard.ai/zones/{zoneId}/applications`
- Auth: one of:
  - HTTP bearer
  - OAuth 2
    - Client credentials
    - Token URL: `/service-account-token`

Creates a new Application - a software system with an identity that can access Resources

## Path parameters

- `zoneId` string, required

## Request body

- IamApplicationCreate: Schema for creating a new application
  - `name` string, safe-text, required: Human-readable name. Must not contain HTML tags (e.g. `<script>`, `<div>`) or control characters.
  - `identifier` string, safe-text, required: User specified identifier, unique within the zone. Must not contain HTML tags (e.g. `<script>`, `<div>`) or control characters.
  - `description` string, safe-text, nullable: Human-readable description. Must not contain HTML tags (e.g. `<script>`, `<div>`) or control characters.
  - `dependencies` object[]: Dependencies of the application
    - `id` string, required: Resource identifier
    - `type` string
  - `metadata` IamMetadata: Entity metadata
    - `docs_url` string, uri: Documentation URL
    - `icon_url` string, uri: Icon URL
  - `protocols` IamApplicationProtocolCreate: Protocol-specific configuration for application creation
    - `oauth2` IamApplicationOAuth2ProtocolCreate: OAuth 2.0 protocol configuration for application creation
      - `redirect_uris` string[]: OAuth 2.0 redirect URIs for this application
      - `post_logout_redirect_uris` string[]: OAuth 2.0 post-logout redirect URIs for this application
  - `consent` 'implicit' | 'required': Consent mode for the application. Defaults to 'required'.

## Response `200`

An Application is a software system with an associated identity that can access Resources. It may act on its own behalf (machine-to-machine) or on behalf of a user (delegated access).

- IamApplication: An Application is a software system with an associated identity that can access Resources. It may act on its own behalf (machine-to-machine) or on behalf of a user (delegated access).
  - `id` string, required: Unique identifier of the application
  - `organization_id` string, required: Organization that owns this application
  - `zone_id` string, required: Zone this application belongs to
  - `slug` string, required: URL-safe identifier, unique within the zone
  - `identifier` string, required: User specified identifier, unique within the zone
  - `name` string, required: Human-readable name
  - `description` string, nullable: Human-readable description
  - `metadata` IamMetadata: Entity metadata
    - `docs_url` string, uri: Documentation URL
    - `icon_url` string, uri: Icon URL
  - `protocols` object, nullable: Protocol-specific configuration
    - `oauth2` IamApplicationOAuth2Protocol, nullable: OAuth 2.0 protocol configuration
      - `redirect_uris` string[], nullable: OAuth 2.0 redirect URIs for this application
      - `post_logout_redirect_uris` string[], nullable: OAuth 2.0 post-logout redirect URIs for this application
  - `dependencies_count` integer, required: Number of resource dependencies
  - `owner_type` 'platform' | 'customer', required: Who owns this application. Platform-owned applications cannot be modified via API.
  - `consent` 'implicit' | 'required', required: Consent mode for the application. 'implicit' means consent is automatically granted, 'required' means explicit user consent is needed.
  - `created_at` string, date-time, required: Entity creation timestamp
  - `updated_at` string, date-time, required: Entity update timestamp

## Other responses

- `400`: Error response
- `403`: Error response
- `409`: Error response
- `default`: Error response

## Changes

- **2026-08-26** `d65d51379d93`: 3 info
  - added the non-success response with the status `400`
  - added the non-success response with the status `403`
  - added the non-success response with the status `409`
- **2026-07-01** `2f5033ed4491`: 2 info
  - added the new optional request property `metadata/icon_url`
  - added the optional property `metadata/icon_url` to the response with the `200` status
- **2026-04-20** `932699a5ea16`: 3 breaking, 2 info
  - the `description` request property format changed from no format to `safe-text`
  - the `identifier` request property format changed from no format to `safe-text`
  - the `name` request property format changed from no format to `safe-text`
  - added the new optional request property `consent`
  - …1 more
- **2026-03-16** `d3d69f45bfed`: 2 warning, 3 info
  - removed the request property `traits`
  - removed the optional property `traits` from the response with the `200` status
  - the endpoint scheme security `OAuth2` was added to the API
  - the endpoint scheme security `bearerAuth` was added to the API
  - …1 more
- **2026-03-09** `cb43483cd1b3`: 1 info
  - added the required property `owner_type` to the response with the `200` status

[Operation history](https://skmtc.dev/keycardai/apis/keycard-ai-keycard-api/changes/zones/:zoneId/applications/post.md)

---

[API](https://skmtc.dev/keycardai/apis/keycard-ai-keycard-api.md) - [All operations](https://skmtc.dev/keycardai/apis/keycard-ai-keycard-api/llms.txt) - [OpenAPI document](https://skmtc.dev/keycardai/apis/keycard-ai-keycard-api/revisions/0dee67e0a73a?raw)