Managing external OAuth applications

As an admin, using the OAuth framework, you can delegate authorization to external applications. Once registered, these applications can make API calls to UiPath applications or resources scoped to the APIs you designate.

Adding an External Application

To register an external application so that it can use OAuth to access the UiPath resources within your organization:

1. Log in to Automation Suite as an organization administrator.
2. Go to Admin, make sure that the organization is selected at the top of the left pane, and then click External Applications.
3. In the top right, click Add Application.
   The Add Application page opens where you can register an external application.
4. Fill in the Application Name field.
5. Select an option for Application Type.

   If you select Confidential application, you will receive an app secret at the end of app creation, so make sure your application can store it securely. If it cannot, select Non-confidential application.

6. Under Resources, click Add Scopes.

   The Edit Resource panel opens on the right, where you can select the resources to which the application should have access.

7. From the Resource drop-down list, select the UiPath API that the application can use.
   Note: You can only add scope for one resource at a time. If you want to allow access to multiple resources, repeat this process to add scope for each resource.
8. On the User Scope(s) tab, select the check boxes for the logical API permissions that you want to grant, as needed.

   Granting permissions under user scope means that the external application can access those resources within a user context and a user with the appropriate permissions must be logged in.

9. If this is a confidential application, you can switch to the Application Scope(s) tab to also grant application-level permissions for the selected resource, as needed.

   With permissions under application scope, the external application has access to application-wide data for the selected scopes without the need for user interaction.

   Non-confidential applications cannot access application scope.

10. Click Save.

    The panel closes and the selected resource and scopes are added to the Resources table in the form.

11. If the external application can accept it, you can add a URL in the Redirect URL field and the authorization response is sent there. The application can then use it to access UiPath resources.
12. Click Add to create the registration.

    A confirmation message opens. For confidential applications, the confirmation message includes the app secret that the registered external application can use to request authorization. Make sure you save it in a secure location because you cannot see it again.

Changing the Scope for an Existing Application

Scopes are the permissions of the external application in relation to your UiPath resources.

1. Go to Admin > organization > External Applications.
2. Click at the right of the application row.
3. Change the scope to which the application has access:
   • Use the icons at the right of a resource row to edit existing scope or to delete the resource.
   • Click Add Scopes to add an additional resource and then select scopes for it.
4. Click Save.

Generating a New App Secret

If you don't know the application secret that was generated for an external application, you cannot recover it. But you can generate a new one.

Note: If you generate a new app secret, make sure to share it with the developer who is maintaining the integration with the external application. They must update the authentication mechanism, otherwise the existing integration no longer works.

To generate a new app secret:

1. Go to Admin > Organization > External Applications.
2. Click at the right of the application row.
3. Under App Secret, click Generate New.

   A new app secret is generated and displayed above the button. It remains visible until you click Cancel to close the page.

4. Copy it and make sure you store it in a safe place.

Providing details to developers

After you register an external application, a developer must also set up the external application so that it properly authenticates, requests authorization from UiPath Identity Server, and then access the allowed UiPath resources.

To be able to perform those tasks, you must share the following information with them:

• the Application Type and Application ID, both of which are visible on the Admin > External Applications page
• the scopes added for each scope type. For some resources, the same name is used under both user and application scopes, so the type is also important.

• if this is a confidential application, the application secret generated when you registered the external application.

  Note: If you don't have the secret anymore, generate a new one as described above.

For more details on how to authenticate and authorize external apps as a developer, see External Apps in the API guide.