Update an OAuth app's configuration. All body fields are optional — supply only what should change. URL fields (homepageUrl, privacyPolicyUrl, termsOfServiceUrl) accept null to clear them.

Adding client_credentials to allowedGrantTypes requires an organisation administrator, because it settles whose documents the application's tokens reach. A non-administrator answers 403, and that check runs first — so a member sees 403 whether or not a service account is bound.

For an administrator, it answers 400 when no service account is bound or the bound account is disabled, and 404 when the bound identity no longer exists or is not a service account — distinct from the 404 for an application this caller cannot see. Point the application at one first with PUT /oauth-clients/{appId}/token-identity. An application that already allows the grant without a service account predates this rule and can still be edited.

Creator-only: even org admins cannot edit apps owned by other users.

When modifying allowedScopes, the new set must remain a subset of the caller's role-aware scope list (same rule as GET /oauth-clients/scopes). The Zod refine on updateAppSchema only looks at the body: it refuses allowedGrantTypes containing authorization_code together with an empty redirectUris (400 VALIDATION_ERROR), but sending authorization_code without redirectUris is accepted even when the stored app has no redirect URI.

This endpoint never rotates the client secret — use POST /oauth-clients/{appId}/regenerate-secret for that.

{
  "message": "OAuth app updated successfully",
  "app": {
    "tokenIdentityUserId": "65f0c0ffee00000000000000"
  }
}