Retrieve application OAuth credentials

curl --request GET \
  --url https://platform.dev.timeback.com/applications/1.0/{sourcedApplicationId}/credentials \
  --header 'Authorization: Bearer <token>'

import requests

url = "https://platform.dev.timeback.com/applications/1.0/{sourcedApplicationId}/credentials"

headers = {"Authorization": "Bearer <token>"}

response = requests.get(url, headers=headers)

print(response.text)

const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

fetch('https://platform.dev.timeback.com/applications/1.0/{sourcedApplicationId}/credentials', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://platform.dev.timeback.com/applications/1.0/{sourcedApplicationId}/credentials",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://platform.dev.timeback.com/applications/1.0/{sourcedApplicationId}/credentials"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://platform.dev.timeback.com/applications/1.0/{sourcedApplicationId}/credentials")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'

response = http.request(request)
puts response.read_body

{
  "appUrn": "urn:uuid:53f0d94d-786d-409a-b5eb-7a6c1db8957b",
  "applicationId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
  "productionCredentials": {
    "clientId": "<string>",
    "tokenUrl": "<string>",
    "scopes": [
      "<string>"
    ]
  },
  "sandboxCredentials": {
    "clientId": "<string>",
    "tokenUrl": "<string>",
    "scopes": [
      "<string>"
    ]
  },
  "sandboxStatus": "pending"
}

Applications

Retrieve application OAuth credentials

Returns the Cognito clientId, tokenUrl, and currently-authorized scopes for the App, wrapped under a productionCredentials envelope (and a sandboxCredentials envelope when provisioned), plus sandboxStatus. No secret is ever returned by this endpoint, by Cognito design.

sandboxStatus is pending when the sandbox side has not been provisioned, awaiting_secret_claim when the sandbox exists but the developer has not yet collected its secret (call POST /applications/1.0/{sourcedApplicationId}/credentials/rotate to receive a claim URL without rotating production), and provisioned when the sandbox credentials have been issued.

If you lost a client secret, call POST /applications/1.0/{sourcedApplicationId}/credentials/rotate, which mints a new client + secret and returns a fresh SSO-gated claim URL.

The clientId is stable across draft→active promotion: developers do NOT need to rotate credentials when their App is approved. Scopes expand on promotion; client identity does not. (Rotation is a separate, developer-initiated event where the clientId does change.)

The caller must hold the app:read_credentials grant on urn:app:<appId>. The grant is issued to the App’s creator at registration time.

GET

applications

1.0

{sourcedApplicationId}

credentials

Retrieve application OAuth credentials

curl --request GET \
  --url https://platform.dev.timeback.com/applications/1.0/{sourcedApplicationId}/credentials \
  --header 'Authorization: Bearer <token>'

import requests

url = "https://platform.dev.timeback.com/applications/1.0/{sourcedApplicationId}/credentials"

headers = {"Authorization": "Bearer <token>"}

response = requests.get(url, headers=headers)

print(response.text)

const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

fetch('https://platform.dev.timeback.com/applications/1.0/{sourcedApplicationId}/credentials', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://platform.dev.timeback.com/applications/1.0/{sourcedApplicationId}/credentials",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://platform.dev.timeback.com/applications/1.0/{sourcedApplicationId}/credentials"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://platform.dev.timeback.com/applications/1.0/{sourcedApplicationId}/credentials")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'

response = http.request(request)
puts response.read_body

{
  "appUrn": "urn:uuid:53f0d94d-786d-409a-b5eb-7a6c1db8957b",
  "applicationId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
  "productionCredentials": {
    "clientId": "<string>",
    "tokenUrl": "<string>",
    "scopes": [
      "<string>"
    ]
  },
  "sandboxCredentials": {
    "clientId": "<string>",
    "tokenUrl": "<string>",
    "scopes": [
      "<string>"
    ]
  },
  "sandboxStatus": "pending"
}

Authorizations

Authorization

string

header

required

OAuth 2.0 client credentials flow. Contact timeback@trilogy.com to request credentials for your application.

Path Parameters

sourcedApplicationId

string<uuid>

required

UUID of the App whose credentials are being retrieved

Response

App credentials

Response from GET /applications/1.0/{appId}/credentials. The credential fields are wrapped under productionCredentials so a future sandboxCredentials sibling envelope can be added without breaking this response.

clientSecret is intentionally absent: Cognito does not allow reading the secret back after creation. It is surfaced exactly once on the POST /applications/1.0/drafts response; if you did not save it then, contact TimeBack support.

The clientId is stable across draft→active promotion: developers do NOT need to rotate credentials when their App is approved. Scopes expand on promotion; client identity does not.

appUrn

string

required

Canonical URN identifying your registered application.

Format: urn:uuid:{applicationId} (RFC 4122). Use this value as Caliper edApp.id when emitting events from your app.

Pattern: ^urn:uuid:[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$

Example:

"urn:uuid:53f0d94d-786d-409a-b5eb-7a6c1db8957b"

applicationId

string<uuid>

required

Unique identifier of the App whose credentials are returned.

productionCredentials

object

required

OAuth credentials for the App on the production Cognito user pool. The same client is used in both draft and active App states — scopes expand on promotion but clientId, tokenUrl, and shape do not change. A future sandboxCredentials sibling envelope will carry sandbox-pool credentials when the sandbox Cognito pool exists.

Show child attributes

sandboxCredentials

object | null

required

Sandbox-pool credentials (no secret). Null when the App is sandbox-pending.

Show child attributes

sandboxStatus

enum<string>

required

pending when the sandbox side has not been provisioned; awaiting_secret_claim when the sandbox exists but the secret has not been issued (call rotate_credentials to collect it without rotating production); provisioned when the sandbox credentials have been issued.

Available options:

pending,

awaiting_secret_claim,

provisioned

⌘I