Applications
Applications — /api/org/{slug}/applications
Section titled “Applications — /api/org/{slug}/applications”| Method · Route | Purpose | Source |
|---|---|---|
GET / | List applications | ApplicationEndpoints.cs:22 |
GET /{appId} | Get one application | :35 |
POST / | Create application | :49 |
PUT /{appId} | Update application (incl. OIDC/SAML client config) | :82 |
DELETE /{appId} | Delete application | :128 |
PATCH /{appId}/status | Toggle status | :160 |
POST /{appId}/rotate-secret | Rotate client secret | :187 |
An application’s public key is its client key (client_..., one per platform × environment) — it is what the SDK’s appKey and the hosted login URL carry. OIDC client config (PKCE requirement, allowed grant types, scopes, post-logout redirects) and SAML SP registration (EntityID, ACS URL) live on the Application — see OIDC and SAML.
App groups — /api/org/{slug}/app-groups
Section titled “App groups — /api/org/{slug}/app-groups”An App Group is the product axis: it holds hosted-login branding (colors, social providers, passkey/magic-link toggles, hero copy), the Passkey RP ID, and — when the group sells something — its storefront and payout links.
| Method · Route | Purpose | Source |
|---|---|---|
GET / · GET /{groupId} | List / get | AppGroupEndpoints.cs:24, :37 |
POST / · PUT /{groupId} · DELETE /{groupId} | App-group CRUD (branding, login methods, hero) | :51, :93, :245 |
POST /{groupId}/apps | Add app to group | :294 |
POST · DELETE /{groupId}/icon | App-group icon | AppGroupIconEndpoints.cs:17, :90 |
Commerce (owner-only, view.billing gate)
Section titled “Commerce (owner-only, view.billing gate)”These routes lead to money (payout accounts, prices), so they sit behind the same owner-only gate as billing — hiding a button in the dashboard is not enough.
| Method · Route | Purpose | Source |
|---|---|---|
POST /{groupId}/gateway-linkup | Register the app group as a brand with the partner storefront (Bullmark). The partner app comes from configuration, never from the request. Refused for a group with no products or on the plan floor. | AppGroupEndpoints.cs:349 |
POST /{groupId}/gateway-listing | One-time session to the brand’s listing screen (review status, voucher economy). No re-login; the destination is fixed server-side. | :441 |
POST /{groupId}/payout-session | Embedded payout onboarding (Stripe Connect) — returns a short-lived client secret, never cached. Brand slug is resolved server-side, not accepted from the caller. | :505 |
GET /{groupId}/payout-status | Onboarding progress and remaining requirements. | :632 |
POST /{groupId}/products · GET /{groupId}/products | Create a price / list what the group sells. Reading is open to any member who can see the group; writing a price is owner-only. | :731, :796 |
POST /{groupId}/products/{productId}/sync | Push a price to the partner storefront; idempotent (already-registered rows are not re-sent). | :843 |
POST /{groupId}/products/import | Import the partner’s existing prices; skips ones already present (by ProductKey, else name). | :907 |
POST /{groupId}/products/{productId}/reprice | Change a price; the new price is reported as “not registered” until re-synced. | :1010 |
DELETE /{groupId}/products/{productId} | Remove a price (owner-only). | :1099 |
Collection and settlement rules for what an app group sells are in Billing & Monetization.