Applications

Create an application

Registers a new Keycloak client in the realm.

Required scope: applications:write

post/clusters/{cluster_id}/realms/{realm_name}/applications

Request

  • Base URL: http://localhost:8000
  • URL: http://localhost:8000/clusters/{cluster_id}/realms/{realm_name}/applications
  • Auth: API key in header API-Key

Path parameters

cluster_idstring uuid required
realm_namestring required

Keycloak realm name (not ID). Must start with a letter; allows letters, digits, and hyphens.

Example:customer-portal

Headers

API-Version'2026-06-01.beta' required

Request body

client_idstring required

OAuth 2.0 client identifier. Used as the stable resource identifier in this API and in Keycloak realm URLs.

namestring required

Human-readable display name.

descriptionstring

Optional description.

type'confidential' | 'public'

OAuth 2.0 client type. Confidential clients can hold a secret; public clients cannot.

protocol'openid-connect' | 'saml'

Authentication protocol used by the application.

status'active' | 'inactive'

Whether the application is accepting logins.

redirect_urisstring[]

Allowed redirect URIs. Required when grant_types includes authorization_code.

grant_typesGrantType[] required

Enabled OAuth 2.0 grant types.

pkce_requiredboolean

Whether PKCE is required. Defaults to false.

consent_requiredboolean

Whether user consent is required. Defaults to false.

Response

The request has succeeded and a new resource has been created as a result.

client_idstring required

OAuth 2.0 client identifier. Used as the stable resource identifier in this API and in Keycloak realm URLs.

namestring required

Human-readable display name.

descriptionstring

Optional description of the application.

type'confidential' | 'public' required

OAuth 2.0 client type. Confidential clients can hold a secret; public clients cannot.

protocol'openid-connect' | 'saml' required

Authentication protocol used by the application.

status'active' | 'inactive' required

Whether the application is accepting logins.

redirect_urisstring[] required

Allowed redirect URIs for authorization-code flows. Required for authorization_code grant.

grant_typesGrantType[] required

Enabled OAuth 2.0 grant types.

pkce_requiredboolean required

Whether PKCE (Proof Key for Code Exchange) is required.

consent_requiredboolean required

Whether user consent is required before issuing tokens.

service_account_enabledboolean required

Whether this application has a service account for machine-to-machine flows. Derived from the client_credentials grant type.

client_secretstring password

Client secret. Present only immediately after creation or secret rotation; store it securely as it will not be returned again.

web_originsstring[]

Browser origins allowed to call this application (CORS). ["*"] allows any origin.

post_logout_redirect_urisstring[]

URIs a user may be redirected to after signing out. Falls back to redirect_uris when empty.

root_urlstring

Root URL. Prefixed to any relative redirect URI.

base_urlstring

Home URL. Where Keycloak sends a user opening the application from the account console.

admin_urlstring

Admin URL. Where Keycloak sends back-channel logout and admin callbacks.

created_atstring date-time required
updated_atstring date-time required

Changes

No recorded changes to this operation across all 1 revision of this API.