Set an application API grant

PUT /v1/applications/{application_id}/api-grants/{api_id} · permission applications:write

Replaces, as a whole, the scopes an application may request for one API. An application can hold grants for at most 50 APIs.

Request

Parameter	In	Description
`application_id`	path	Application id (`app_…`).
`api_id`	path	API id (`api_…`).

Body

Field	Type	Required	Description
`scopes`	string[]	yes	Allowed scopes (`resource:action`); each must be defined on the API. At most 1000.
`default_scopes`	string[]	no	Scopes granted by default; a subset of `scopes`.

Response

200 OK with the grant.

{
  "application_id": "app_6f8d0cjgbmf0gtn2rg6pscp3cg",
  "api_id": "api_0000000000000000000000001z",
  "scopes": ["orders:read", "orders:write"],
  "default_scopes": ["orders:read"],
  "created_at": "2026-10-05T10:00:01Z",
  "updated_at": "2026-10-05T10:00:01Z"
}

Errors

HTTP	`code`	When
401	`unauthenticated`	The key is missing, invalid or revoked.
403	`insufficient_permissions`	The key lacks the required permission.
404	`not_found`	The application or the grant does not exist in this environment.
422	`validation_failed`	A scope is malformed or not defined on the API, or `default_scopes` is not a subset of `scopes`.
403	`quota_exceeded`	The application already holds grants for 50 APIs.
400	`unknown_field`	The body has a field that is not part of the schema.

Example

curl -X PUT https://api.eu.keenauth.com/v1/applications/app_6f8d0cjgbmf0gtn2rg6pscp3cg/api-grants/api_0000000000000000000000001z \
  -H "Authorization: Bearer $KEENAUTH_SECRET_KEY" \
  -H "Content-Type: application/json" \
  -d '{"scopes":["orders:read","orders:write"],"default_scopes":["orders:read"]}'