Register a draft application
Registers a new application in draft status and provisions OAuth client credentials for the client credentials flow.
The response includes applicationId, appUrn, publisherId, the
non-secret productionCredentials (and, on the happy path,
sandboxCredentials), and a single secretClaimUrl. No clientSecret
is returned inline (ITD 9): opening secretClaimUrl forces a Google-IdP
SSO sign-in and reveals every minted secret once. The accompanying
securityNote warns agents not to open the URL on the developer’s
behalf.
If your account is linked to more than one publisher, include publisherId
in the request body. If you belong to zero or one publisher, omit
publisherId and the platform assigns or creates the appropriate publisher.
Authorizations
OAuth 2.0 client credentials flow. Contact timeback@trilogy.com to request credentials for your application.
Body
Request body for POST /applications/1.0/drafts.
Display name of the App; must be unique across the developer platform.
1 - 256Short description (max 1024 chars).
1 - 1024URL to which LTI launch messages will be posted.
512Type of the LTI application
learning_app, assessment, internal Optional Publisher ID. Omit when the caller belongs to zero or one Publisher. Required when multiple memberships exist; the service returns 400 with a nextAction otherwise.
Response
Draft App registered
Response from POST /applications/1.0/drafts. Returns the non-secret
production-draft credentials and, on the happy path, the non-secret
sandbox credentials. No clientSecret is returned inline (ITD 9): the
secret(s) are revealed once via the single SSO-gated secretClaimUrl.
On a sandbox transient failure the production side still commits:
sandboxCredentials is null and sandboxStatus is pending; the App
is reconciled by the hourly sandbox-provisioning reconciler.
Canonical URN identifying your registered application.
Format: urn:uuid:{applicationId} (RFC 4122). Use this value as Caliper
edApp.id when emitting events from your app.
^urn:uuid:[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$"urn:uuid:53f0d94d-786d-409a-b5eb-7a6c1db8957b"
Unique identifier of the newly registered draft application.
Publisher that owns this application (assigned automatically or from your request).
One non-secret OAuth credential set (client credentials flow). The
clientSecret is NOT returned inline (ITD 9): it is revealed once via
the SSO-gated secretClaimUrl on the parent response.
provisioned when both credential sets are returned; pending when this response carries no sandbox credentials — either the sandbox side has not completed (the hourly sandbox-provisioning reconciler finishes it) or it was provisioned concurrently and the secret must be claimed via rotate_credentials (get_app_credentials then reports awaiting_secret_claim).
provisioned, pending Single signed, single-use URL that reveals every minted client secret once, behind a Google-IdP SSO gate. The developer must open it in their own browser.
Warning that the agent must not open secretClaimUrl on the developer's behalf; the secret is shown only to the authenticated developer and never returned through the API.
Sandbox credentials valid against sandbox.platform.timeback.com. Null when sandboxStatus is pending.