Skip to main content
PUT
Reconnect App

Authorizations

Authorization
string
header
required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Path Parameters

app_id
string
required

Body

application/json

Body of PUT /apps/{app_id}: update metadata overrides and/or reconnect.

One flat model serves both operations (mirroring AppInputCreate): the metadata fields apply the same domain-specific overrides as PATCH /apps/{app_id}, and providing credentials (auth/settings/ version, which require the matching app_class_id) additionally reconnects the integration with those credentials.

name
string | null

The updated domain-specific display name of the app. Set to null to reset to the app's default name.

category
string | null

The updated domain-specific category of the app. Set to null to reset to the app's default category. Possible values: 'Accounting & Finance', 'Marketing & Analytics', 'Content & Social Media', 'Sales & Support', 'Design & Creativity', 'IT & Security', 'Developers', 'HR & Learning', 'Office & Legal', 'Communication', 'Collaboration', 'Commerce & Marketplaces', 'Other', 'Internal'

description
string

The updated domain-specific description of the app. Set to null to reset to the app's default description.

Maximum string length: 1000
logo_url
string | null

The updated domain-specific URL of the logo of the app. Set to null to reset to the app's default logo.

website_url
string | null

The updated URL of the website of the app. Set to null to clear it.

request_instructions
string

The updated request instructions.

Maximum string length: 511
app_class_id
string | null

Canonical identifier of the integration this app belongs to, e.g. okta.com. Must match the existing app (a mismatch is rejected with 400); required when rotating credentials via auth/settings/version.

auth
Auth · object | null

New credentials for the integration, as a JSON object — all secrets go here. Providing credentials reconnects the app: they are always overwritten and re-validated, and a sync is triggered. The accepted keys depend on the integration and are validated server-side. Missing or wrong-shaped credentials are rejected with 400; credentials the third party rejects return 502. Requires app_class_id.

settings
Settings · object | null

Non-secret configuration for the integration being reconnected, as a JSON object — e.g. host, port, region, or tenant / instance URL. The accepted keys vary by integration and some integrations need none. Requires app_class_id.

version
string | null

Optional integration version override for the reconnect. Pins the connection to a specific integration implementation/version instead of the current default; leave unset (null) unless directed otherwise. Requires app_class_id.

Response

Successful Response

id
string
required

The ID of this app.

app_class_id
string
required

The non-unique ID of the service associated with this requestable permission. Depending on how it is sourced in Lumos, this may be the app's name, website, or other identifier.

instance_id
string
required

The non-unique ID of the instance associated with this app. This will be the Okta app id if it’s an Okta app, or will be marked as custom_app_import if manually uploaded into Lumos.

user_friendly_label
string
required

The user-friendly label of this app.

status
enum<string>
required

The status of this app. Possible values: 'DISCOVERED', 'IN_REVIEW', 'NEEDS_REVIEW', 'APPROVED', 'BLOCKLISTED', 'DEPRECATED'

Available options:
DISCOVERED,
IN_REVIEW,
NEEDS_REVIEW,
APPROVED,
BLOCKLISTED,
DEPRECATED
sources
enum<string>[]
required

The sources of this app.

Available options:
GSUITE_QUICK_INBOX,
GSUITE_DEEP_INBOX,
MICROSOFT_DEEP_INBOX,
MICROSOFT_OAUTH,
MICROSOFT_GCC,
GSUITE_OAUTH,
OKTA,
MANUAL,
ONELOGIN,
ATLASSIAN,
GOOGLE_CLOUD,
LUMOS_INTEGRATION,
JUMPCLOUD,
CUSTOM,
MCP
allow_multiple_permission_selection
boolean
required

Determines whether users can request multiple permissions at once.This field will be removed in subsequent API versions.

disconnected
boolean
required

Whether this app has been disconnected (its stored credentials removed via DELETE /apps/{app_id}). A disconnected app is excluded from GET /apps?disconnected=false; reconnect it with PUT /apps/{app_id}.

A collection of URLs related to this application

logo_url
string | null

The URL of the logo of this app.

website_url
string | null

The URL of the website of this app.

request_instructions
string | null

The request instructions.

description
string | null

The user-facing description of the app

category
string | null

The category of the app, as shown in the AppStore

sync_status
enum<string> | null

The state of this app's most recent sync: SYNCING while one is running, SUCCESS or FAILED once it finished. Poll this after POST /apps/{app_id}/sync to follow that sync. null when no sync result is recorded — the app has never synced, or was disconnected.

Available options:
SYNCING,
SUCCESS,
FAILED