Reconnect App
Update an app in place: apply domain-specific metadata overrides (the same fields as PATCH /apps/{app_id}) and/or rotate an integration’s credentials. Providing auth/settings/version (with the matching app_class_id) reconnects the app: credentials are always overwritten and re-validated, and a sync is triggered — like connect, the app either connects in-band or awaits browser consent in the Lumos UI, and while a sync is in flight the request is throttled with 429 and a Retry-After header. Metadata-only bodies (custom apps, or integrations without credential changes) never touch credentials.
Authorizations
Bearer authentication header of the form Bearer <token>, where <token> is your auth token.
Path Parameters
Body
Body of PUT /apps/{app_id}: update metadata overrides and/or reconnect.
One flat model serves both operations (mirroring AppInputCreate): the
metadata fields apply the same domain-specific overrides as
PATCH /apps/{app_id}, and providing credentials (auth/settings/
version, which require the matching app_class_id) additionally
reconnects the integration with those credentials.
The updated domain-specific display name of the app. Set to null to reset to the app's default name.
The updated domain-specific category of the app. Set to null to reset to the app's default category. Possible values: 'Accounting & Finance', 'Marketing & Analytics', 'Content & Social Media', 'Sales & Support', 'Design & Creativity', 'IT & Security', 'Developers', 'HR & Learning', 'Office & Legal', 'Communication', 'Collaboration', 'Commerce & Marketplaces', 'Other', 'Internal'
The updated domain-specific description of the app. Set to null to reset to the app's default description.
1000The updated domain-specific URL of the logo of the app. Set to null to reset to the app's default logo.
The updated URL of the website of the app. Set to null to clear it.
The updated request instructions.
511Canonical identifier of the integration this app belongs to, e.g. okta.com. Must match the existing app (a mismatch is rejected with 400); required when rotating credentials via auth/settings/version.
New credentials for the integration, as a JSON object — all secrets go here. Providing credentials reconnects the app: they are always overwritten and re-validated, and a sync is triggered. The accepted keys depend on the integration and are validated server-side. Missing or wrong-shaped credentials are rejected with 400; credentials the third party rejects return 502. Requires app_class_id.
Non-secret configuration for the integration being reconnected, as a JSON object — e.g. host, port, region, or tenant / instance URL. The accepted keys vary by integration and some integrations need none. Requires app_class_id.
Optional integration version override for the reconnect. Pins the connection to a specific integration implementation/version instead of the current default; leave unset (null) unless directed otherwise. Requires app_class_id.
Response
Successful Response
The ID of this app.
The non-unique ID of the service associated with this requestable permission. Depending on how it is sourced in Lumos, this may be the app's name, website, or other identifier.
The non-unique ID of the instance associated with this app. This will be the Okta app id if it’s an Okta app, or will be marked as custom_app_import if manually uploaded into Lumos.
The user-friendly label of this app.
The status of this app. Possible values: 'DISCOVERED', 'IN_REVIEW', 'NEEDS_REVIEW', 'APPROVED', 'BLOCKLISTED', 'DEPRECATED'
DISCOVERED, IN_REVIEW, NEEDS_REVIEW, APPROVED, BLOCKLISTED, DEPRECATED The sources of this app.
GSUITE_QUICK_INBOX, GSUITE_DEEP_INBOX, MICROSOFT_DEEP_INBOX, MICROSOFT_OAUTH, MICROSOFT_GCC, GSUITE_OAUTH, OKTA, MANUAL, ONELOGIN, ATLASSIAN, GOOGLE_CLOUD, LUMOS_INTEGRATION, JUMPCLOUD, CUSTOM, MCP Determines whether users can request multiple permissions at once.This field will be removed in subsequent API versions.
Whether this app has been disconnected (its stored credentials removed via DELETE /apps/{app_id}). A disconnected app is excluded from GET /apps?disconnected=false; reconnect it with PUT /apps/{app_id}.
A collection of URLs related to this application
The URL of the logo of this app.
The URL of the website of this app.
The request instructions.
The user-facing description of the app
The category of the app, as shown in the AppStore
The state of this app's most recent sync: SYNCING while one is running, SUCCESS or FAILED once it finished. Poll this after POST /apps/{app_id}/sync to follow that sync. null when no sync result is recorded — the app has never synced, or was disconnected.
SYNCING, SUCCESS, FAILED