Skip to main content
POST
Register a draft application

Authorizations

Authorization
string
header
required

OAuth 2.0 client credentials flow. Contact timeback@trilogy.com to request credentials for your application.

Body

application/json

Request body for POST /applications/1.0/drafts.

name
string
required

Display name of the App; must be unique across the developer platform.

Required string length: 1 - 256
description
string
required

Short description (max 1024 chars).

Required string length: 1 - 1024
launchUrl
string<uri>
required

URL to which LTI launch messages will be posted.

Maximum string length: 512
applicationType
enum<string>

Type of the LTI application

Available options:
learning_app,
assessment,
internal
publisherId
string<uuid> | null

Optional Publisher ID. Omit when the caller belongs to zero or one Publisher. Required when multiple memberships exist; the service returns 400 with a nextAction otherwise.

Response

Draft App registered

Response from POST /applications/1.0/drafts. Returns the non-secret production-draft credentials and, on the happy path, the non-secret sandbox credentials. No clientSecret is returned inline (ITD 9): the secret(s) are revealed once via the single SSO-gated secretClaimUrl.

On a sandbox transient failure the production side still commits: sandboxCredentials is null and sandboxStatus is pending; the App is reconciled by the hourly sandbox-provisioning reconciler.

appUrn
string
required

Canonical URN identifying your registered application.

Format: urn:uuid:{applicationId} (RFC 4122). Use this value as Caliper edApp.id when emitting events from your app.

Pattern: ^urn:uuid:[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$
Example:

"urn:uuid:53f0d94d-786d-409a-b5eb-7a6c1db8957b"

applicationId
string<uuid>
required

Unique identifier of the newly registered draft application.

publisherId
string<uuid>
required

Publisher that owns this application (assigned automatically or from your request).

productionCredentials
object
required

One non-secret OAuth credential set (client credentials flow). The clientSecret is NOT returned inline (ITD 9): it is revealed once via the SSO-gated secretClaimUrl on the parent response.

sandboxStatus
enum<string>
required

provisioned when both credential sets are returned; pending when this response carries no sandbox credentials — either the sandbox side has not completed (the hourly sandbox-provisioning reconciler finishes it) or it was provisioned concurrently and the secret must be claimed via rotate_credentials (get_app_credentials then reports awaiting_secret_claim).

Available options:
provisioned,
pending
secretClaimUrl
string<uri>
required

Single signed, single-use URL that reveals every minted client secret once, behind a Google-IdP SSO gate. The developer must open it in their own browser.

securityNote
string
required

Warning that the agent must not open secretClaimUrl on the developer's behalf; the secret is shown only to the authenticated developer and never returned through the API.

sandboxCredentials
object | null

Sandbox credentials valid against sandbox.platform.timeback.com. Null when sandboxStatus is pending.