uip admin external-apps

Syntax and options for `uip admin external-apps`, which manages OAuth2 client registrations and their federated credentials for external application integrations.

uip admin external-apps manages OAuth2 client registrations — external applications and services that authenticate against UiPath using their own client ID/secret (or workload identity federation) rather than a user's own login. Each app is either confidential (server-side, has a secret) or non-confidential (public, e.g. a SPA or mobile app, no secret). A nested federated-credentials group manages workload-identity-federation bindings (e.g. GitHub Actions OIDC) that let an external app authenticate without a static secret at all.

Synopsis

uip admin external-apps list
uip admin external-apps get <client-id>
uip admin external-apps create <name> [--redirect-uri <uri>] [--user-scope <scopes>] [--app-scope <scopes>] [--non-confidential] [--no-secret]
uip admin external-apps update <client-id> [--name <name>] [--redirect-uri <uri>] [--user-scope <scopes>] [--app-scope <scopes>]
uip admin external-apps delete <client-id>
uip admin external-apps generate-secret <client-id> [--description <text>] [--expiration <date>]
uip admin external-apps delete-secret <secret-id>

uip admin external-apps federated-credentials list <client-id>
uip admin external-apps federated-credentials get <client-id> <credential-id>
uip admin external-apps federated-credentials create <client-id> --name <name> --issuer <url> --audience <audience> --subject <subject>
uip admin external-apps federated-credentials update <client-id> <credential-id> --name <name> --issuer <url> --audience <audience> --subject <subject>
uip admin external-apps federated-credentials delete <client-id> <credential-id>

Verbs

Group	Verb	Purpose
external-apps	list	List external apps in the partition.
external-apps	get	Get an app's details by client ID.
external-apps	create	Register a new OAuth2 client.
external-apps	update	Update an app's name, redirect URI, or scopes.
external-apps	delete	Delete an app by client ID.
external-apps	generate-secret	Generate a new client secret.
external-apps	delete-secret	Delete a specific client secret.
federated-credentials	list	List an app's federated credentials.
federated-credentials	get	Get a federated credential by ID.
federated-credentials	create	Bind an external identity provider (e.g. GitHub Actions OIDC) to the app.
federated-credentials	update	Update a federated credential.
federated-credentials	delete	Remove a federated credential.

Concepts

• Confidential vs. non-confidential. Default is confidential (server-side, gets a client secret). --non-confidential creates a public client with no secret — it only supports --user-scope (delegated) scopes, never --app-scope; passing --app-scope on a non-confidential app fails client-side.
• Scopes are split by grant type. --user-scope (delegated, requires a signed-in user) and --app-scope (app-only, client-credentials grant) are independent lists — pass either or both. At least one is required on create. See uip admin scopes list for the full catalog of available scope names.
• --scope is a deprecated alias for --app-scope. If both are given, --app-scope wins; a blank value on either (an empty or whitespace-only string) is rejected rather than silently treated as "no scopes."
• A redirect URI is required whenever user scopes are involved — either because the app is non-confidential, or because --user-scope was passed — since both need the OAuth2 authorization-code flow. An app that's confidential and app-scope-only doesn't need one.
• update re-derives scopes from resources when you don't pass any — if you omit both --user-scope and --app-scope, the command re-sends the app's existing scopes unchanged rather than clearing them; the same non-confidential/redirect-URI validation as create still applies to whatever the final scope set and redirect URI end up being.
• Secrets are shown once. generate-secret's returned value cannot be retrieved again — store it immediately.

uip admin external-apps list

List external apps in the partition. No filtering/pagination options.

Example

uip admin external-apps list

Data shape (--output json)

{ "Code": "ExternalClientList", "Data": [{ "id": "my-app", "name": "My Application", "isConfidential": true }] }

uip admin external-apps get

Get external app details by client ID.

Arguments

Name	Required	Purpose
<client-id>	yes	External app ID. Find it with external-apps list.

Example

uip admin external-apps get my-app

Data shape (--output json)

{ "Code": "ExternalClientDetails", "Data": { "id": "my-app", "name": "My Application", "isConfidential": true, "redirectUri": "https://example.com/callback" } }

uip admin external-apps create

Create an external app (confidential by default).

Arguments

Name	Required	Purpose
<name>	yes	App display name.

Options

Long	Value	Description
--redirect-uri <uri>	comma-separated	Redirect URI(s) for the OAuth2 flow. Required when non-confidential or when --user-scope is set.
--user-scope <scopes>	comma- or space-separated	Delegated (user) scopes.
--app-scope <scopes>	comma- or space-separated	Application (app-only) scopes. Not allowed on a non-confidential app.
--scope <scopes>	comma- or space-separated	Deprecated alias for --app-scope.
--non-confidential	flag	Create a public client (no secret).
--no-secret	flag	Skip generating a client secret on creation (confidential apps only).

At least one of --user-scope/--app-scope is required.

Examples

# Confidential app with application scopes only
uip admin external-apps create "My App" --app-scope "OR.Folders,OR.Assets"

# Confidential app with both user and app scopes
uip admin external-apps create "My App" --user-scope "OR.Folders" --app-scope "OR.Jobs" --redirect-uri "https://example.com/callback"

# Public client (SPA) with user scopes
uip admin external-apps create "My SPA" --non-confidential --user-scope "OR.Folders" --redirect-uri "http://localhost:3000/callback"

Data shape (--output json)

{ "Code": "ExternalClientCreated", "Data": { "id": "my-app", "name": "My App", "isConfidential": true, "secret": "generated-secret-value" } }

secret is present only for a confidential app created without --no-secret.

uip admin external-apps update

Update an app's name, redirect URI, or scopes. At least one of --name/--redirect-uri/--user-scope/--app-scope is required.

Arguments

Name	Required	Purpose
<client-id>	yes	External app ID.

Options

Long	Short	Value	Description
--name <name>	-n	string	New display name.
--redirect-uri <uri>		comma-separated	New redirect URI(s).
--user-scope <scopes>		comma- or space-separated	New delegated scopes.
--app-scope <scopes>		comma- or space-separated	New application scopes.
--scope <scopes>		comma- or space-separated	Deprecated alias for --app-scope.

Example

uip admin external-apps update my-app-id --name "Updated App" --app-scope "OR.Folders"

Data shape (--output json)

{ "Code": "ExternalClientUpdated" }

uip admin external-apps delete

Delete an external app by client ID.

Arguments

Name	Required	Purpose
<client-id>	yes	External app ID.

Example

uip admin external-apps delete my-app-id

Data shape (--output json)

{ "Code": "ExternalClientDeleted", "Data": { "Id": "my-app-id", "Status": "Deleted successfully" } }

uip admin external-apps generate-secret

Generate a new secret for an external app. The secret value is shown only once.

Arguments

Name	Required	Purpose
<client-id>	yes	External app ID.

Options

Long	Value	Description
--description <text>	string	Description for the secret.
--expiration <date>	ISO 8601	Expiration date.

Example

uip admin external-apps generate-secret my-app

Data shape (--output json)

{ "Code": "ExternalClientSecretGenerated", "Data": { "id": 1, "secret": "generated-secret-value" } }

uip admin external-apps delete-secret

Delete a specific secret from an external app — an app can have multiple active secrets; this removes just one.

Arguments

Name	Required	Purpose
<secret-id>	yes	Secret ID (numeric). Find it via external-apps get.

Example

uip admin external-apps delete-secret 12345

Data shape (--output json)

{ "Code": "ExternalClientSecretDeleted", "Data": { "Id": "12345", "Status": "Deleted successfully" } }

uip admin external-apps federated-credentials list

List federated credentials for an external app.

Arguments

Name	Required	Purpose
<client-id>	yes	External app ID.

Example

uip admin external-apps federated-credentials list my-app-id

Data shape (--output json)

{ "Code": "FederatedCredentialList", "Data": [{ "id": "fc000000-0000-0000-0000-000000000001", "name": "GitHub Actions", "issuer": "https://token.actions.githubusercontent.com" }] }

uip admin external-apps federated-credentials get

Get a federated credential by ID.

Arguments

Name	Required	Purpose
<client-id>	yes	External app ID.
<credential-id>	yes	Federated credential ID (UUID).

Example

uip admin external-apps federated-credentials get my-app-id fc000000-0000-0000-0000-000000000001

Data shape (--output json)

{
  "Code": "FederatedCredentialDetails",
  "Data": {
    "id": "fc000000-0000-0000-0000-000000000001",
    "name": "GitHub Actions",
    "issuer": "https://token.actions.githubusercontent.com",
    "audience": "api://AzureADTokenExchange",
    "subject": "repo:org/repo:ref:refs/heads/main"
  }
}

uip admin external-apps federated-credentials create

Bind an external identity provider to the app — enables workload identity federation (e.g. a GitHub Actions workflow authenticating without a stored secret).

Arguments

Name	Required	Purpose
<client-id>	yes	External app ID.

Options

Long	Short	Value	Required	Description
--name <name>	-n	string	yes	Credential name.
--issuer <url>		url	yes	Token issuer URL, e.g. https://token.actions.githubusercontent.com.
--audience <audience>		string	yes	Expected audience claim, e.g. api://AzureADTokenExchange.
--subject <subject>		string	yes	Expected subject claim, e.g. repo:org/repo:ref:refs/heads/main.
--description <text>		string	no	Description.

Example

uip admin external-apps federated-credentials create my-app-id \
  --name "GitHub Actions" \
  --issuer "https://token.actions.githubusercontent.com" \
  --audience "api://AzureADTokenExchange" \
  --subject "repo:org/repo:ref:refs/heads/main"

Data shape (--output json)

{ "Code": "FederatedCredentialCreated" }

uip admin external-apps federated-credentials update

Update a federated credential — all four identity fields are required on every call (no partial update).

Arguments

Name	Required	Purpose
<client-id>	yes	External app ID.
<credential-id>	yes	Federated credential ID (UUID).

Options

Long	Short	Value	Required	Description
--name <name>	-n	string	yes	Credential name.
--issuer <url>		url	yes	Token issuer URL.
--audience <audience>		string	yes	Expected audience claim.
--subject <subject>		string	yes	Expected subject claim.
--description <text>		string	no	Description.

Example

uip admin external-apps federated-credentials update my-app-id fc000000-0000-0000-0000-000000000001 \
  --name "GitHub Actions (prod)" \
  --issuer "https://token.actions.githubusercontent.com" \
  --audience "api://AzureADTokenExchange" \
  --subject "repo:org/repo:environment:production"

Data shape (--output json)

{ "Code": "FederatedCredentialUpdated" }

uip admin external-apps federated-credentials delete

Delete a federated credential from an external app.

Arguments

Name	Required	Purpose
<client-id>	yes	External app ID.
<credential-id>	yes	Federated credential ID (UUID).

Example

uip admin external-apps federated-credentials delete my-app-id fc000000-0000-0000-0000-000000000001

Data shape (--output json)

{ "Code": "FederatedCredentialDeleted", "Data": { "Id": "fc000000-0000-0000-0000-000000000001", "Status": "Deleted successfully" } }

Related

• uip admin robot-accounts / pat / scopes — the shared OAuth2 scope catalog these apps draw from.
• uip admin users — directory users and groups.
• uip admin smtp — organization email configuration.

See also

• Global options
• Exit codes