{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://artifacts.apis.io/microsoft-entra/json-schema/microsoft-entra-application-collection-response-schema.json",
  "title": "ApplicationCollectionResponse",
  "description": "Paged collection of application objects",
  "x-generated": "2026-11-05",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/microsoft-entra-applications-api-openapi.yml#/components/schemas/ApplicationCollectionResponse",
  "type": "object",
  "properties": {
    "@odata.context": {
      "type": "string"
    },
    "@odata.count": {
      "type": "integer"
    },
    "@odata.nextLink": {
      "type": "string",
      "format": "uri"
    },
    "value": {
      "type": "array",
      "items": {
        "$ref": "#/$defs/Application"
      }
    }
  },
  "$defs": {
    "ApiApplication": {
      "type": "object",
      "description": "Settings for an application that implements a web API",
      "properties": {
        "acceptMappedClaims": {
          "type": [
            "boolean",
            "null"
          ],
          "description": "Allows an application to use claims mapping without specifying a custom signing key"
        },
        "knownClientApplications": {
          "type": "array",
          "description": "Used for bundling consent. Lists client app IDs that are considered known clients of this API",
          "items": {
            "type": "string",
            "format": "uuid"
          }
        },
        "oauth2PermissionScopes": {
          "type": "array",
          "description": "OAuth 2.0 permission scopes exposed by the web API to client applications",
          "items": {
            "$ref": "#/$defs/PermissionScope"
          }
        },
        "preAuthorizedApplications": {
          "type": "array",
          "description": "Lists client applications pre-authorized with specified delegated permissions that do not require user consent",
          "items": {
            "type": "object",
            "properties": {
              "appId": {
                "type": "string"
              },
              "delegatedPermissionIds": {
                "type": "array",
                "items": {
                  "type": "string",
                  "format": "uuid"
                }
              }
            }
          }
        },
        "requestedAccessTokenVersion": {
          "type": [
            "integer",
            "null"
          ],
          "description": "Specifies the access token version expected by the resource. Possible values are 1 or 2.",
          "enum": [
            1,
            2,
            null
          ]
        }
      }
    },
    "AppRole": {
      "type": "object",
      "description": "Represents a role defined by an application that can be assigned to users, groups, or service principals",
      "properties": {
        "id": {
          "type": "string",
          "format": "uuid",
          "description": "Unique identifier for the app role"
        },
        "allowedMemberTypes": {
          "type": "array",
          "description": "Specifies whether the role can be assigned to users/groups, applications, or both",
          "items": {
            "type": "string",
            "enum": [
              "User",
              "Application"
            ]
          }
        },
        "displayName": {
          "type": "string",
          "description": "Display name for the app role"
        },
        "description": {
          "type": [
            "string",
            "null"
          ],
          "description": "Description of the app role"
        },
        "value": {
          "type": [
            "string",
            "null"
          ],
          "description": "Value that is included in the roles claim in authentication tokens"
        },
        "isEnabled": {
          "type": "boolean",
          "description": "Whether the app role is enabled"
        }
      }
    },
    "Application": {
      "type": "object",
      "description": "Represents an application registration in Microsoft Entra ID. Defines the app's identity configuration, credentials, permissions requested, and reply URLs.",
      "properties": {
        "id": {
          "type": "string",
          "readOnly": true,
          "description": "Unique identifier for the application object (GUID). This is the object ID, not the appId."
        },
        "appId": {
          "type": "string",
          "readOnly": true,
          "description": "The unique application identifier assigned by Microsoft Entra ID (also known as the client ID)"
        },
        "displayName": {
          "type": "string",
          "description": "The display name for the application"
        },
        "description": {
          "type": [
            "string",
            "null"
          ],
          "description": "An optional description of the application"
        },
        "signInAudience": {
          "type": "string",
          "description": "Specifies which Microsoft accounts are supported for the application",
          "enum": [
            "AzureADMyOrg",
            "AzureADMultipleOrgs",
            "AzureADandPersonalMicrosoftAccount",
            "PersonalMicrosoftAccount"
          ]
        },
        "identifierUris": {
          "type": "array",
          "description": "URIs that uniquely identify the application within its Azure AD tenant or verified custom domain",
          "items": {
            "type": "string"
          }
        },
        "web": {
          "$ref": "#/$defs/WebApplication"
        },
        "spa": {
          "$ref": "#/$defs/SpaApplication"
        },
        "api": {
          "$ref": "#/$defs/ApiApplication"
        },
        "requiredResourceAccess": {
          "type": "array",
          "description": "Specifies the resources that the application needs access to and the set of OAuth permission scopes and app roles needed under each resource",
          "items": {
            "$ref": "#/$defs/RequiredResourceAccess"
          }
        },
        "appRoles": {
          "type": "array",
          "description": "Collection of roles defined for the application that can be assigned to users, groups, or service principals",
          "items": {
            "$ref": "#/$defs/AppRole"
          }
        },
        "keyCredentials": {
          "type": "array",
          "description": "Collection of certificate credentials associated with the app",
          "items": {
            "$ref": "#/$defs/KeyCredential"
          }
        },
        "passwordCredentials": {
          "type": "array",
          "description": "Collection of password credentials (client secrets)",
          "items": {
            "$ref": "#/$defs/PasswordCredential"
          }
        },
        "publicClient": {
          "type": "object",
          "description": "Public client settings for mobile and desktop apps",
          "properties": {
            "redirectUris": {
              "type": "array",
              "items": {
                "type": "string"
              }
            }
          }
        },
        "tags": {
          "type": "array",
          "description": "Custom strings used to categorize and identify the application",
          "items": {
            "type": "string"
          }
        },
        "createdDateTime": {
          "type": "string",
          "format": "date-time",
          "readOnly": true,
          "description": "The date and time the application was registered"
        }
      }
    },
    "KeyCredential": {
      "type": "object",
      "description": "Contains a key credential (certificate) associated with an application or service principal",
      "properties": {
        "keyId": {
          "type": "string",
          "format": "uuid",
          "description": "Unique identifier for the key"
        },
        "displayName": {
          "type": [
            "string",
            "null"
          ],
          "description": "Friendly name for the key"
        },
        "type": {
          "type": "string",
          "description": "Type of key credential",
          "enum": [
            "AsymmetricX509Cert",
            "X509CertAndPassword"
          ]
        },
        "usage": {
          "type": "string",
          "description": "Describes the purpose of the key",
          "enum": [
            "Sign",
            "Verify"
          ]
        },
        "key": {
          "type": "string",
          "format": "byte",
          "description": "The certificate's raw data in byte array converted to Base64 string"
        },
        "startDateTime": {
          "type": "string",
          "format": "date-time",
          "description": "The date and time at which the credential becomes valid"
        },
        "endDateTime": {
          "type": "string",
          "format": "date-time",
          "description": "The date and time at which the credential expires"
        }
      }
    },
    "PasswordCredential": {
      "type": "object",
      "description": "Represents a password credential (client secret) associated with an application or service principal",
      "properties": {
        "keyId": {
          "type": "string",
          "format": "uuid",
          "readOnly": true,
          "description": "Unique identifier for the password"
        },
        "displayName": {
          "type": [
            "string",
            "null"
          ],
          "description": "Friendly name for the password credential"
        },
        "hint": {
          "type": "string",
          "readOnly": true,
          "description": "Contains the first three characters of the password (returned on read operations)"
        },
        "secretText": {
          "type": "string",
          "readOnly": true,
          "description": "The generated password value. Only returned at creation time and cannot be retrieved later."
        },
        "startDateTime": {
          "type": "string",
          "format": "date-time",
          "description": "The date and time at which the password becomes valid"
        },
        "endDateTime": {
          "type": "string",
          "format": "date-time",
          "description": "The date and time at which the password expires. Maximum lifetime varies by policy."
        }
      }
    },
    "PermissionScope": {
      "type": "object",
      "description": "Defines an OAuth 2.0 delegated permission scope exposed by a web API application",
      "properties": {
        "id": {
          "type": "string",
          "format": "uuid",
          "description": "Unique identifier for the scope"
        },
        "value": {
          "type": "string",
          "description": "The value that identifies the scope in OAuth 2.0 authorization requests"
        },
        "type": {
          "type": "string",
          "description": "Whether the scope can be consented to by a user or requires admin consent",
          "enum": [
            "User",
            "Admin"
          ]
        },
        "adminConsentDisplayName": {
          "type": "string",
          "description": "Display name shown on the admin consent experience"
        },
        "adminConsentDescription": {
          "type": "string",
          "description": "Description shown on the admin consent experience"
        },
        "userConsentDisplayName": {
          "type": [
            "string",
            "null"
          ],
          "description": "Display name shown on the user consent experience"
        },
        "userConsentDescription": {
          "type": [
            "string",
            "null"
          ],
          "description": "Description shown on the user consent experience"
        },
        "isEnabled": {
          "type": "boolean",
          "description": "Whether the scope is enabled and can be requested"
        }
      }
    },
    "RequiredResourceAccess": {
      "type": "object",
      "description": "Specifies the set of OAuth 2.0 permission scopes and app roles under a specified resource that an application requires access to",
      "properties": {
        "resourceAppId": {
          "type": "string",
          "description": "The unique identifier for the resource that the application requires access to (the appId of the target application)"
        },
        "resourceAccess": {
          "type": "array",
          "description": "The list of OAuth 2.0 permission scopes and app roles required from the specified resource",
          "items": {
            "type": "object",
            "properties": {
              "id": {
                "type": "string",
                "format": "uuid",
                "description": "Unique identifier for the app role or OAuth 2.0 permission scope"
              },
              "type": {
                "type": "string",
                "description": "Specifies whether the id property references a Scope (delegated permission) or a Role (application permission)",
                "enum": [
                  "Scope",
                  "Role"
                ]
              }
            }
          }
        }
      }
    },
    "SpaApplication": {
      "type": "object",
      "description": "Single-page application configuration",
      "properties": {
        "redirectUris": {
          "type": "array",
          "description": "Redirect URIs for single-page application authentication",
          "items": {
            "type": "string",
            "format": "uri"
          }
        }
      }
    },
    "WebApplication": {
      "type": "object",
      "description": "Web application configuration including redirect URIs",
      "properties": {
        "redirectUris": {
          "type": "array",
          "description": "URIs to which Microsoft Entra ID will redirect after authentication",
          "items": {
            "type": "string",
            "format": "uri"
          }
        },
        "homePageUrl": {
          "type": [
            "string",
            "null"
          ],
          "description": "Home page URL of the application",
          "format": "uri"
        },
        "logoutUrl": {
          "type": [
            "string",
            "null"
          ],
          "description": "URL used by the authorization service to sign out the user",
          "format": "uri"
        },
        "implicitGrantSettings": {
          "type": "object",
          "description": "Settings for implicit grant flow tokens",
          "properties": {
            "enableIdTokenIssuance": {
              "type": "boolean",
              "description": "Whether ID tokens can be issued using the implicit flow",
              "default": false
            },
            "enableAccessTokenIssuance": {
              "type": "boolean",
              "description": "Whether access tokens can be issued using the implicit flow",
              "default": false
            }
          }
        }
      }
    }
  }
}