# uip admin external-apps

> Syntax and options for `uip admin external-apps`, which manages OAuth2 client registrations and their federated credentials for external application integrations.

`uip admin external-apps` manages OAuth2 client registrations — external applications and services that authenticate against UiPath using their own client ID/secret (or workload identity federation) rather than a user's own login. Each app is either **confidential** (server-side, has a secret) or **non-confidential** (public, e.g. a SPA or mobile app, no secret). A nested `federated-credentials` group manages workload-identity-federation bindings (e.g. GitHub Actions OIDC) that let an external app authenticate without a static secret at all.

## Synopsis

```text
uip admin external-apps list
uip admin external-apps get <client-id>
uip admin external-apps create <name> [--redirect-uri <uri>] [--user-scope <scopes>] [--app-scope <scopes>] [--non-confidential] [--no-secret]
uip admin external-apps update <client-id> [--name <name>] [--redirect-uri <uri>] [--user-scope <scopes>] [--app-scope <scopes>]
uip admin external-apps delete <client-id>
uip admin external-apps generate-secret <client-id> [--description <text>] [--expiration <date>]
uip admin external-apps delete-secret <secret-id>

uip admin external-apps federated-credentials list <client-id>
uip admin external-apps federated-credentials get <client-id> <credential-id>
uip admin external-apps federated-credentials create <client-id> --name <name> --issuer <url> --audience <audience> --subject <subject>
uip admin external-apps federated-credentials update <client-id> <credential-id> --name <name> --issuer <url> --audience <audience> --subject <subject>
uip admin external-apps federated-credentials delete <client-id> <credential-id>
```

## Verbs

| Group | Verb | Purpose |
|---|---|---|
| `external-apps` | `list` | List external apps in the partition. |
| `external-apps` | `get` | Get an app's details by client ID. |
| `external-apps` | `create` | Register a new OAuth2 client. |
| `external-apps` | `update` | Update an app's name, redirect URI, or scopes. |
| `external-apps` | `delete` | Delete an app by client ID. |
| `external-apps` | `generate-secret` | Generate a new client secret. |
| `external-apps` | `delete-secret` | Delete a specific client secret. |
| `federated-credentials` | `list` | List an app's federated credentials. |
| `federated-credentials` | `get` | Get a federated credential by ID. |
| `federated-credentials` | `create` | Bind an external identity provider (e.g. GitHub Actions OIDC) to the app. |
| `federated-credentials` | `update` | Update a federated credential. |
| `federated-credentials` | `delete` | Remove a federated credential. |

## Concepts

- **Confidential vs. non-confidential.** Default is confidential (server-side, gets a client secret). `--non-confidential` creates a public client with no secret — it only supports `--user-scope` (delegated) scopes, never `--app-scope`; passing `--app-scope` on a non-confidential app fails client-side.
- **Scopes are split by grant type.** `--user-scope` (delegated, requires a signed-in user) and `--app-scope` (app-only, client-credentials grant) are independent lists — pass either or both. At least one is required on `create`. See [`uip admin scopes list`](./uip-admin-robot-accounts.md#uip-admin-scopes-list) for the full catalog of available scope names.
- **`--scope` is a deprecated alias for `--app-scope`.** If both are given, `--app-scope` wins; a blank value on either (an empty or whitespace-only string) is rejected rather than silently treated as "no scopes."
- **A redirect URI is required whenever user scopes are involved** — either because the app is non-confidential, or because `--user-scope` was passed — since both need the OAuth2 authorization-code flow. An app that's confidential and app-scope-only doesn't need one.
- **`update` re-derives scopes from resources when you don't pass any** — if you omit both `--user-scope` and `--app-scope`, the command re-sends the app's existing scopes unchanged rather than clearing them; the same non-confidential/redirect-URI validation as `create` still applies to whatever the final scope set and redirect URI end up being.
- **Secrets are shown once.** `generate-secret`'s returned value cannot be retrieved again — store it immediately.

## uip admin external-apps list

List external apps in the partition. No filtering/pagination options.

### Example

```bash
uip admin external-apps list
```

### Data shape (--output json)

```json
{ "Code": "ExternalClientList", "Data": [{ "id": "my-app", "name": "My Application", "isConfidential": true }] }
```

## uip admin external-apps get

Get external app details by client ID.

### Arguments

| Name | Required | Purpose |
|---|---|---|
| `<client-id>` | yes | External app ID. Find it with `external-apps list`. |

### Example

```bash
uip admin external-apps get my-app
```

### Data shape (--output json)

```json
{ "Code": "ExternalClientDetails", "Data": { "id": "my-app", "name": "My Application", "isConfidential": true, "redirectUri": "https://example.com/callback" } }
```

## uip admin external-apps create

Create an external app (confidential by default).

### Arguments

| Name | Required | Purpose |
|---|---|---|
| `<name>` | yes | App display name. |

### Options

| Long | Value | Description |
|---|---|---|
| `--redirect-uri <uri>` | comma-separated | Redirect URI(s) for the OAuth2 flow. Required when non-confidential or when `--user-scope` is set. |
| `--user-scope <scopes>` | comma- or space-separated | Delegated (user) scopes. |
| `--app-scope <scopes>` | comma- or space-separated | Application (app-only) scopes. Not allowed on a non-confidential app. |
| `--scope <scopes>` | comma- or space-separated | Deprecated alias for `--app-scope`. |
| `--non-confidential` | flag | Create a public client (no secret). |
| `--no-secret` | flag | Skip generating a client secret on creation (confidential apps only). |

At least one of `--user-scope`/`--app-scope` is required.

### Examples

```bash
# Confidential app with application scopes only
uip admin external-apps create "My App" --app-scope "OR.Folders,OR.Assets"
```

```bash
# Confidential app with both user and app scopes
uip admin external-apps create "My App" --user-scope "OR.Folders" --app-scope "OR.Jobs" --redirect-uri "https://example.com/callback"
```

```bash
# Public client (SPA) with user scopes
uip admin external-apps create "My SPA" --non-confidential --user-scope "OR.Folders" --redirect-uri "http://localhost:3000/callback"
```

### Data shape (--output json)

```json
{ "Code": "ExternalClientCreated", "Data": { "id": "my-app", "name": "My App", "isConfidential": true, "secret": "generated-secret-value" } }
```

`secret` is present only for a confidential app created without `--no-secret`.

## uip admin external-apps update

Update an app's name, redirect URI, or scopes. At least one of `--name`/`--redirect-uri`/`--user-scope`/`--app-scope` is required.

### Arguments

| Name | Required | Purpose |
|---|---|---|
| `<client-id>` | yes | External app ID. |

### Options

| Long | Short | Value | Description |
|---|---|---|---|
| `--name <name>` | `-n` | string | New display name. |
| `--redirect-uri <uri>` | | comma-separated | New redirect URI(s). |
| `--user-scope <scopes>` | | comma- or space-separated | New delegated scopes. |
| `--app-scope <scopes>` | | comma- or space-separated | New application scopes. |
| `--scope <scopes>` | | comma- or space-separated | Deprecated alias for `--app-scope`. |

### Example

```bash
uip admin external-apps update my-app-id --name "Updated App" --app-scope "OR.Folders"
```

### Data shape (--output json)

```json
{ "Code": "ExternalClientUpdated" }
```

## uip admin external-apps delete

Delete an external app by client ID.

### Arguments

| Name | Required | Purpose |
|---|---|---|
| `<client-id>` | yes | External app ID. |

### Example

```bash
uip admin external-apps delete my-app-id
```

### Data shape (--output json)

```json
{ "Code": "ExternalClientDeleted", "Data": { "Id": "my-app-id", "Status": "Deleted successfully" } }
```

## uip admin external-apps generate-secret

Generate a new secret for an external app. The secret value is shown only once.

### Arguments

| Name | Required | Purpose |
|---|---|---|
| `<client-id>` | yes | External app ID. |

### Options

| Long | Value | Description |
|---|---|---|
| `--description <text>` | string | Description for the secret. |
| `--expiration <date>` | ISO 8601 | Expiration date. |

### Example

```bash
uip admin external-apps generate-secret my-app
```

### Data shape (--output json)

```json
{ "Code": "ExternalClientSecretGenerated", "Data": { "id": 1, "secret": "generated-secret-value" } }
```

## uip admin external-apps delete-secret

Delete a specific secret from an external app — an app can have multiple active secrets; this removes just one.

### Arguments

| Name | Required | Purpose |
|---|---|---|
| `<secret-id>` | yes | Secret ID (numeric). Find it via `external-apps get`. |

### Example

```bash
uip admin external-apps delete-secret 12345
```

### Data shape (--output json)

```json
{ "Code": "ExternalClientSecretDeleted", "Data": { "Id": "12345", "Status": "Deleted successfully" } }
```

## uip admin external-apps federated-credentials list

List federated credentials for an external app.

### Arguments

| Name | Required | Purpose |
|---|---|---|
| `<client-id>` | yes | External app ID. |

### Example

```bash
uip admin external-apps federated-credentials list my-app-id
```

### Data shape (--output json)

```json
{ "Code": "FederatedCredentialList", "Data": [{ "id": "fc000000-0000-0000-0000-000000000001", "name": "GitHub Actions", "issuer": "https://token.actions.githubusercontent.com" }] }
```

## uip admin external-apps federated-credentials get

Get a federated credential by ID.

### Arguments

| Name | Required | Purpose |
|---|---|---|
| `<client-id>` | yes | External app ID. |
| `<credential-id>` | yes | Federated credential ID (UUID). |

### Example

```bash
uip admin external-apps federated-credentials get my-app-id fc000000-0000-0000-0000-000000000001
```

### Data shape (--output json)

```json
{
  "Code": "FederatedCredentialDetails",
  "Data": {
    "id": "fc000000-0000-0000-0000-000000000001",
    "name": "GitHub Actions",
    "issuer": "https://token.actions.githubusercontent.com",
    "audience": "api://AzureADTokenExchange",
    "subject": "repo:org/repo:ref:refs/heads/main"
  }
}
```

## uip admin external-apps federated-credentials create

Bind an external identity provider to the app — enables workload identity federation (e.g. a GitHub Actions workflow authenticating without a stored secret).

### Arguments

| Name | Required | Purpose |
|---|---|---|
| `<client-id>` | yes | External app ID. |

### Options

| Long | Short | Value | Required | Description |
|---|---|---|---|---|
| `--name <name>` | `-n` | string | **yes** | Credential name. |
| `--issuer <url>` | | url | **yes** | Token issuer URL, e.g. `https://token.actions.githubusercontent.com`. |
| `--audience <audience>` | | string | **yes** | Expected audience claim, e.g. `api://AzureADTokenExchange`. |
| `--subject <subject>` | | string | **yes** | Expected subject claim, e.g. `repo:org/repo:ref:refs/heads/main`. |
| `--description <text>` | | string | no | Description. |

### Example

```bash
uip admin external-apps federated-credentials create my-app-id \
  --name "GitHub Actions" \
  --issuer "https://token.actions.githubusercontent.com" \
  --audience "api://AzureADTokenExchange" \
  --subject "repo:org/repo:ref:refs/heads/main"
```

### Data shape (--output json)

```json
{ "Code": "FederatedCredentialCreated" }
```

## uip admin external-apps federated-credentials update

Update a federated credential — all four identity fields are required on every call (no partial update).

### Arguments

| Name | Required | Purpose |
|---|---|---|
| `<client-id>` | yes | External app ID. |
| `<credential-id>` | yes | Federated credential ID (UUID). |

### Options

| Long | Short | Value | Required | Description |
|---|---|---|---|---|
| `--name <name>` | `-n` | string | **yes** | Credential name. |
| `--issuer <url>` | | url | **yes** | Token issuer URL. |
| `--audience <audience>` | | string | **yes** | Expected audience claim. |
| `--subject <subject>` | | string | **yes** | Expected subject claim. |
| `--description <text>` | | string | no | Description. |

### Example

```bash
uip admin external-apps federated-credentials update my-app-id fc000000-0000-0000-0000-000000000001 \
  --name "GitHub Actions (prod)" \
  --issuer "https://token.actions.githubusercontent.com" \
  --audience "api://AzureADTokenExchange" \
  --subject "repo:org/repo:environment:production"
```

### Data shape (--output json)

```json
{ "Code": "FederatedCredentialUpdated" }
```

## uip admin external-apps federated-credentials delete

Delete a federated credential from an external app.

### Arguments

| Name | Required | Purpose |
|---|---|---|
| `<client-id>` | yes | External app ID. |
| `<credential-id>` | yes | Federated credential ID (UUID). |

### Example

```bash
uip admin external-apps federated-credentials delete my-app-id fc000000-0000-0000-0000-000000000001
```

### Data shape (--output json)

```json
{ "Code": "FederatedCredentialDeleted", "Data": { "Id": "fc000000-0000-0000-0000-000000000001", "Status": "Deleted successfully" } }
```

## Related

- [`uip admin robot-accounts` / `pat` / `scopes`](./uip-admin-robot-accounts.md) — the shared OAuth2 scope catalog these apps draw from.
- [`uip admin users`](./uip-admin-users.md) — directory users and groups.
- [`uip admin smtp`](./uip-admin-smtp.md) — organization email configuration.

## See also

- [Global options](./global-options.md)
- [Exit codes](./exit-codes.md)