Skip to main content

SetAppMapping

PUT 
/admin/v1/customers/:customer_id/app-mappings

Map an app to the one project it reaches. The app is the value of the claim that names the app in tokens of issuer (azp on Entra v2.0 tokens and Keycloak, appid on Entra v1.0 tokens, client_id on PingFederate, cid on Okta). Each app of an issuer maps to exactly one project: a second call for the same issuer and app replaces the project and returns the one it replaced. In directory identity mode the data plane takes a token call's project from this mapping alone and refuses a call through an app with no mapping (decision record 104). A built-in install may hold mappings, for example while it prepares the move to directory mode, and its data planes do not read them. Each change writes an audit row with the old and the new project. An organization holds at most 100 mappings and 24 KiB of rendered rows, because every data plane that hosts a gateway of the organization receives the whole mapping in its configuration; a call past either limit fails with RESOURCE_EXHAUSTED, and a call that replaces an existing mapping works at the limit.

Request​

Responses​

Success