GetAppCredentialsResponse

Response from GET /applications/1.0/{appId}/credentials. The credential fields are wrapped under productionCredentials so a future sandboxCredentials sibling envelope can be added without breaking this response.

clientSecret is intentionally absent: Cognito does not allow reading the secret back after creation. It is surfaced exactly once on the POST /applications/1.0/drafts response; if you did not save it then, see Getting access at https://docs.platform.timeback.com/getting-started/getting-access.

The clientId is stable across draft→active promotion: developers do NOT need to rotate credentials when their App is approved. Scopes expand on promotion; client identity does not.

applicationId
Type: stringFormat: uuid
required

Unique identifier of the App whose credentials are returned.
appUrn
Type:
required

Canonical URN identifying your registered application.

Format: urn:uuid:{applicationId} (RFC 4122). Use this value as Caliper edApp.id when emitting events from your app.
productionCredentials
Type:
required

OAuth credentials for the App on the production Cognito user pool. The same client is used in both draft and active App states — scopes expand on promotion but clientId, tokenUrl, and shape do not change. A future sandboxCredentials sibling envelope will carry sandbox-pool credentials when the sandbox Cognito pool exists.

Properties: 3
sandboxCredentials
Type: nullable
required

Sandbox-pool credentials (no secret). Null when the App is sandbox-pending.

Properties: 3
sandboxStatus
Type: "pending" or "awaiting_secret_claim" or "provisioned"enum
required

pending when the sandbox side has not been provisioned; awaiting_secret_claim when the sandbox exists but the secret has not been issued (call rotate_credentials to collect it without rotating production); provisioned when the sandbox credentials have been issued.

RegisteredCredentials

SandboxCredentials