---
title: "Get an application"
method: GET
path: "/clusters/{cluster_id}/realms/{realm_name}/applications/{client_id}"
tags: ["Applications"]
---

# Get an application

`GET /clusters/{cluster_id}/realms/{realm_name}/applications/{client_id}`

## Request

- Base URL: `http://localhost:8000`
- URL: `http://localhost:8000/clusters/{cluster_id}/realms/{realm_name}/applications/{client_id}`
- Auth: API key in header `API-Key`

Required scope: `applications:read`

## Path parameters

- `cluster_id` string, uuid, required
- `realm_name` string, required: Keycloak realm name (not ID). Must start with a letter; allows letters, digits, and hyphens.
- `client_id` string, required: OAuth 2.0 client identifier. Used as the stable resource identifier in this API and in Keycloak realm URLs.

## Headers

- `API-Version` '2026-06-01.beta', required

## Response `200`

The request has succeeded.

- Application: A Keycloak client (application) registered in a realm.
  - `client_id` string, required: OAuth 2.0 client identifier. Used as the stable resource identifier in this API and in Keycloak realm URLs.
  - `name` string, required: Human-readable display name.
  - `description` string: Optional description of the application.
  - `type` 'confidential' | 'public', required: OAuth 2.0 client type. Confidential clients can hold a secret; public clients cannot.
  - `protocol` 'openid-connect' | 'saml', required: Authentication protocol used by the application.
  - `status` 'active' | 'inactive', required: Whether the application is accepting logins.
  - `redirect_uris` string[], required: Allowed redirect URIs for authorization-code flows. Required for `authorization_code` grant.
  - `grant_types` GrantType[], required: Enabled OAuth 2.0 grant types.
  - `pkce_required` boolean, required: Whether PKCE (Proof Key for Code Exchange) is required.
  - `consent_required` boolean, required: Whether user consent is required before issuing tokens.
  - `service_account_enabled` boolean, required: Whether this application has a service account for machine-to-machine flows. Derived from the `client_credentials` grant type.
  - `client_secret` string, password: Client secret. Present only immediately after creation or secret rotation; store it securely as it will not be returned again.
  - `web_origins` string[]: Browser origins allowed to call this application (CORS). `["*"]` allows any origin.
  - `post_logout_redirect_uris` string[]: URIs a user may be redirected to after signing out. Falls back to `redirect_uris` when empty.
  - `root_url` string: Root URL. Prefixed to any relative redirect URI.
  - `base_url` string: Home URL. Where Keycloak sends a user opening the application from the account console.
  - `admin_url` string: Admin URL. Where Keycloak sends back-channel logout and admin callbacks.
  - `saml_config` SAMLConfiguration: SAML 2.0 configuration for a SAML application.
    - `entity_id` string: SAML entity ID (SP Entity ID / Issuer).
    - `assertion_consumer_urls` string[]: Assertion Consumer Service URLs (ACS endpoints).
    - `single_logout_service_url` string: Single Logout Service URL.
    - `name_id_format` 'urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified' | 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress' | 'urn:oasis:names:tc:SAML:2.0:nameid-format:persistent' | 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient': SAML NameID format.
    - `sign_documents` boolean: Whether to sign SAML documents.
    - `sign_assertions` boolean: Whether to sign SAML assertions.
    - `encrypt_assertions` boolean: Whether to encrypt SAML assertions.
    - `force_authn` boolean: Whether to force re-authentication on each request.
    - `force_post_binding` boolean: Whether to force HTTP POST binding for responses.
    - `include_authn_statement` boolean: Whether to include the AuthnStatement in assertions.
    - `attribute_statements` object: Static SAML attribute statements to include in assertions. Keys are attribute names; values are attribute values.
  - `created_at` string, date-time, required
  - `updated_at` string, date-time, required

## Other responses

- `401`: Access is unauthorized.
- `404`: The server cannot find the requested resource.
- `429`: Client error
- `500`: Server error
- `501`: Server error

---

[API](https://skmtc.dev/skycloak/apis/skycloak-public-api.md) · [All operations](https://skmtc.dev/skycloak/apis/skycloak-public-api/llms.txt) · [OpenAPI document](https://skmtc.dev/skycloak/apis/skycloak-public-api/revisions/33a69e2ce35f?raw)