> ## Documentation Index > Fetch the complete documentation index at: https://docs.timeback.com/llms.txt > Use this file to discover all available pages before exploring further. # Retrieve application OAuth credentials > Returns the Cognito `clientId`, `tokenUrl`, and currently-authorized `scopes` for the App, wrapped under a `productionCredentials` envelope (and a `sandboxCredentials` envelope when provisioned), plus `sandboxStatus`. No secret is ever returned by this endpoint, by Cognito design. `sandboxStatus` is `pending` when the sandbox side has not been provisioned, `awaiting_secret_claim` when the sandbox exists but the developer has not yet collected its secret (call `POST /applications/1.0/{sourcedApplicationId}/credentials/rotate` to receive a claim URL without rotating production), and `provisioned` when the sandbox credentials have been issued. If you lost a client secret, call `POST /applications/1.0/{sourcedApplicationId}/credentials/rotate`, which mints a new client + secret and returns a fresh SSO-gated claim URL. The `clientId` is stable across draft→active promotion: developers do NOT need to rotate credentials when their App is approved. Scopes expand on promotion; client identity does not. (Rotation is a separate, developer-initiated event where the `clientId` does change.) The caller must hold the `app:read_credentials` grant on `urn:app:`. The grant is issued to the App's creator at registration time. ## OpenAPI ````yaml /openapi/learn-with-ai/platform-api.yaml get /applications/1.0/{sourcedApplicationId}/credentials openapi: 3.1.1 info: title: TimeBack Platform API description: >- RESTful API for the TimeBack Platform. Covers authentication, rostering, curriculum, insights, assessments, content grading, and more. version: 2026.09.10.1 servers: - url: https://platform.dev.timeback.com description: integration security: [] tags: - name: Auth description: Authentication and authorization endpoints - name: Organizations description: Organizations module contains all endpoints around organization management - name: Applications description: Applications module contains all endpoints for managing LTI applications - name: Users description: >- Users module contains all endpoints around user creation, update and consultation - name: Students description: Students module contains all endpoints around student management - name: Demographics description: >- Demographics module contains all endpoints around demographics consultation - name: Consent description: >- Initiate and query TimeBack parental consent for a student, backed by an immutable audit trail. - name: Classes description: Classes module contains all endpoints around class management - name: Courses description: Courses module contains all endpoints around course management - name: Enrollments description: Enrollments module contains all endpoints around enrollment consultation - name: CASE description: Competency and Academic Standards Exchange (CASE) 1.1 API - name: Curriculum description: Curriculum module contains endpoints for managing curriculum data - name: Competency Track description: Competency track endpoints - name: Content Grading description: >- Registration and management of graders for free-response content items — bring-your-own external graders (Tier 2) and, once shipped, platform-managed grading prompts (Tier 1). - name: Caliper description: The Caliper module contains all endpoints around Caliper Analytics - name: Insights description: Coaching insights and session analytics endpoints paths: /applications/1.0/{sourcedApplicationId}/credentials: get: tags: - Applications summary: Retrieve application OAuth credentials description: >- Returns the Cognito `clientId`, `tokenUrl`, and currently-authorized `scopes` for the App, wrapped under a `productionCredentials` envelope (and a `sandboxCredentials` envelope when provisioned), plus `sandboxStatus`. No secret is ever returned by this endpoint, by Cognito design. `sandboxStatus` is `pending` when the sandbox side has not been provisioned, `awaiting_secret_claim` when the sandbox exists but the developer has not yet collected its secret (call `POST /applications/1.0/{sourcedApplicationId}/credentials/rotate` to receive a claim URL without rotating production), and `provisioned` when the sandbox credentials have been issued. If you lost a client secret, call `POST /applications/1.0/{sourcedApplicationId}/credentials/rotate`, which mints a new client + secret and returns a fresh SSO-gated claim URL. The `clientId` is stable across draft→active promotion: developers do NOT need to rotate credentials when their App is approved. Scopes expand on promotion; client identity does not. (Rotation is a separate, developer-initiated event where the `clientId` does change.) The caller must hold the `app:read_credentials` grant on `urn:app:`. The grant is issued to the App's creator at registration time. operationId: getAppCredentials parameters: - name: sourcedApplicationId in: path description: UUID of the App whose credentials are being retrieved required: true schema: type: string format: uuid responses: '200': description: App credentials content: application/json: schema: $ref: '#/components/schemas/GetAppCredentialsResponse' '400': $ref: '#/components/responses/BadRequest2' '403': description: Caller does not hold `app:read_credentials` on this App content: application/json: schema: $ref: '#/components/schemas/ApiError1' '404': description: No App matches the supplied ID content: application/json: schema: $ref: '#/components/schemas/ApiError1' security: - CognitoUserPoolAuthorizer: [] components: schemas: GetAppCredentialsResponse: type: object description: >- Response from `GET /applications/1.0/{appId}/credentials`. The credential fields are wrapped under `productionCredentials` so a future `sandboxCredentials` sibling envelope can be added without breaking this response. `clientSecret` is intentionally absent: Cognito does not allow reading the secret back after creation. It is surfaced exactly once on the `POST /applications/1.0/drafts` response; if you did not save it then, contact TimeBack support. The `clientId` is stable across draft→active promotion: developers do NOT need to rotate credentials when their App is approved. Scopes expand on promotion; client identity does not. required: - appUrn - applicationId - productionCredentials - sandboxCredentials - sandboxStatus properties: appUrn: $ref: '#/components/schemas/AppUrn' applicationId: type: string format: uuid description: Unique identifier of the App whose credentials are returned. productionCredentials: $ref: '#/components/schemas/ProductionCredentials' sandboxCredentials: oneOf: - $ref: '#/components/schemas/SandboxCredentials' - type: 'null' description: >- Sandbox-pool credentials (no secret). Null when the App is sandbox-pending. sandboxStatus: type: string enum: - pending - awaiting_secret_claim - provisioned description: >- `pending` when the sandbox side has not been provisioned; `awaiting_secret_claim` when the sandbox exists but the secret has not been issued (call rotate_credentials to collect it without rotating production); `provisioned` when the sandbox credentials have been issued. ApiError1: type: object description: >- Structured API error envelope. May include `docsUrl` and `nextAction` to guide recovery. required: - error - message properties: error: type: string description: Stable error code (matches `ApiError.name` on the server). message: type: string description: Human-readable error message. docsUrl: type: string format: uri description: Documentation URL for the failing surface. nextAction: type: string description: One-sentence instruction describing how to recover from this error. offendingField: type: string description: >- When the error is field-scoped, the request field that caused the failure. fields: type: array items: type: object properties: field: type: string message: type: string required: - field - message AppUrn: type: string description: | Canonical URN identifying your registered application. Format: `urn:uuid:{applicationId}` (RFC 4122). Use this value as Caliper `edApp.id` when emitting events from your app. pattern: >- ^urn:uuid:[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$ examples: - urn:uuid:53f0d94d-786d-409a-b5eb-7a6c1db8957b ProductionCredentials: type: object description: |- OAuth credentials for the App on the production Cognito user pool. The same client is used in both draft and active App states — scopes expand on promotion but `clientId`, `tokenUrl`, and shape do not change. A future `sandboxCredentials` sibling envelope will carry sandbox-pool credentials when the sandbox Cognito pool exists. required: - clientId - tokenUrl - scopes properties: clientId: type: string description: >- OAuth client ID for authenticating your application (client credentials flow). Stable across draft→active promotion. tokenUrl: type: string format: uri description: >- Cognito token endpoint. POST `client_id` + `client_secret` here with `grant_type=client_credentials` to mint an access token. scopes: type: array items: type: string description: >- OAuth scopes currently authorized on this client. Expands on promotion; today's list reflects the draft scope only. SandboxCredentials: type: object description: |- Sandbox OAuth credentials for the App on the sandbox Cognito user pool (`sandbox.platform.timeback.com`). No secret is returned; the sandbox secret is surfaced exactly once on the `POST /applications/1.0/drafts` response. required: - clientId - tokenUrl - scopes properties: clientId: type: string description: Sandbox-pool OAuth client ID (client credentials flow). tokenUrl: type: string format: uri description: Sandbox Cognito token endpoint. scopes: type: array items: type: string description: Sandbox-tier OAuth scopes authorized on this client. imsxStatusInfoDType: description: > This is the container for the status code and associated information returned within the HTTP messages received from the Service Provider. type: object required: - imsx_codeMajor - imsx_severity properties: imsx_codeMajor: description: | The code major value (from the corresponding enumerated vocabulary). type: string enum: - success - processing - failure - unsupported imsx_severity: description: | The severity value (from the corresponding enumerated vocabulary). type: string enum: - status - warning - error imsx_description: description: >- A human readable description supplied by the entity creating the status code information. type: string imsx_CodeMinor: $ref: '#/components/schemas/imsxCodeMinorDType' additionalProperties: false imsxCodeMinorDType: description: > This is the container for the set of code minor status codes reported in the responses from the Service Provider. type: object required: - imsx_codeMinorField properties: imsx_codeMinorField: description: | Each reported code minor status code. type: array minItems: 1 items: $ref: '#/components/schemas/imsxCodeMinorFieldDType' additionalProperties: false imsxCodeMinorFieldDType: description: | This is the container for a single code minor status code. type: object required: - imsx_codeMinorFieldName - imsx_codeMinorFieldValue properties: imsx_codeMinorFieldName: description: >- This should contain the identity of the system that has produced the code minor status code report. In most cases this will be the target service provider denoted as 'TargetEndSystem'. type: string default: TargetEndSystem imsx_codeMinorFieldValue: description: > The code minor status code (this is a value from the corresponding enumerated vocabulary). type: string enum: - fullsuccess - invalid_filter_field - invalid_selection_field - invaliddata - unauthorisedrequest - forbidden - server_busy - unknownobject - internal_server_error additionalProperties: false responses: BadRequest2: description: Bad request content: application/json: schema: $ref: '#/components/schemas/imsxStatusInfoDType' examples: invalidData: value: imsx_codeMajor: failure imsx_severity: error imsx_description: Invalid data provided imsx_CodeMinor: imsx_codeMinorField: - imsx_codeMinorFieldName: TargetEndSystem imsx_codeMinorFieldValue: invaliddata invalidFilter: value: imsx_codeMajor: failure imsx_severity: error imsx_description: Invalid filter field imsx_CodeMinor: imsx_codeMinorField: - imsx_codeMinorFieldName: TargetEndSystem imsx_codeMinorFieldValue: invalid_filter_field securitySchemes: CognitoUserPoolAuthorizer: type: oauth2 description: >- OAuth 2.0 client credentials flow. Contact timeback@trilogy.com to request credentials for your application. flows: clientCredentials: tokenUrl: https://platform.dev.timeback.com/auth/1.0/token scopes: https://purl.imsglobal.org/spec/or/v1p2/scope/roster.readonly: roster readonly https://purl.imsglobal.org/spec/or/v1p2/scope/roster-core.readonly: roster-core readonly https://purl.imsglobal.org/spec/or/v1p2/scope/roster.createput: roster createput https://purl.imsglobal.org/spec/lti/v1p3/scope/lti.readonly: lti readonly https://purl.imsglobal.org/spec/or/v1p2/scope/roster-demographics.readonly: roster-demographics readonly https://timeback-platform.trilogy.com/consent/scope/consent.write: consent write https://timeback-platform.trilogy.com/consent/scope/consent.read: consent read https://purl.imsglobal.org/spec/or/v1p2/scope/roster-core.createput: roster-core createput https://purl.imsglobal.org/spec/or/v1p2/scope/roster.delete: roster delete https://purl.imsglobal.org/spec/or/v1p2/scope/roster-core.delete: roster-core delete https://purl.imsglobal.org/spec/case/v1p0/scope/case.readonly: case readonly https://purl.imsglobal.org/spec/case/v1p0/scope/case.createput: case createput https://purl.imsglobal.org/spec/case/v1p0/scope/case.delete: case delete https://timeback-platform.trilogy.com/competency-track/scope/competency-track.readonly: competency-track readonly https://timeback-platform.trilogy.com/competency-track/scope/competency-track.write: competency-track write https://timeback-platform.trilogy.com/competency-track/scope/competency-track.delete: competency-track delete https://timeback-platform.trilogy.com/content/scope/content.write: content write https://timeback-platform.trilogy.com/content/scope/content.read: content read https://purl.imsglobal.org/spec/caliper/v1p2/scope/events.write: events write https://purl.imsglobal.org/spec/caliper/v1p2/scope/events.readonly: events readonly https://timeback-platform.trilogy.com/webhooks/scope/webhooks.write: webhooks write https://timeback-platform.trilogy.com/webhooks/scope/webhooks.read: webhooks read https://timeback-platform.trilogy.com/webhooks/scope/webhooks.delete: webhooks delete ````