Applications

What this capability is for

An Application in the Partner API is one of the integrations LuxID has registered for your partnership. Each application has at least one instance - usually a single "default" instance, but applications that exist in multiple flavours (beta, per-tenant, separate UAT environment) carry several instances under the same application name.

This capability is read-only. You discover what LuxID has on file for your partnership; you do not create or edit applications through the Partner API. New applications and instances are provisioned via the LuxID Console or by your LuxID Account manager.

The endpoints you have here are:

What you want to do	Endpoint
List every application your partnership manages	GET /applications
Get full details for one application (incl. its instances)	GET /applications/{applicationExtId}
List the groups attached to one application	GET /applications/{applicationExtId}/groups

The data model

Partnership
  └── Application                 (e.g. "MyApp")
        ├── ApplicationInstance   (default, e.g. "Production")
        ├── ApplicationInstance   (e.g. "Beta")
        └── ApplicationInstance   (e.g. "Tenant-Acme")

An Application carries:

• externalId - LuxID's stable path identifier for this application. This is what other endpoints expect when they ask for {applicationExtId}.
• apiIdentifier - the OIDC client_id. You will see this in your ID tokens' aud claim. Do not confuse it with externalId.
• name - a human-readable display name, useful in admin UIs.

An ApplicationInstance carries:

• externalId - stable id for this specific instance.
• name - display name.
• isDefault - true for exactly one instance per application, false for the others.
• url - the application's URL (optional).
• description - free text (optional).

Most partners with a single application and a single environment will only ever see one instance, marked isDefault: true. The instance model is there for partners with several flavours of the same product, or several deployments under one umbrella name.

List all your Applications

curl -sS \
  -H "X-Client-Id: $LUXID_CLIENT_ID" \
  -H "X-Client-Secret: $LUXID_CLIENT_SECRET" \
  https://api-uat.luxid.lu/services/luxid-partner-api/applications

Response:

{
  "applications": [
    {
      "externalId": "app-abc-123",
      "apiIdentifier": "myapp-prod-client",
      "name": "MyApp"
    },
    {
      "externalId": "app-xyz-789",
      "apiIdentifier": "myapp-mobile-client",
      "name": "MyApp Mobile"
    }
  ]
}

remarque

This listing returns the lightweight ApplicationRef - it does not include the instance list. To see instances, fetch the full application by id.

Get one Application with its instances

curl -sS \
  -H "X-Client-Id: $LUXID_CLIENT_ID" \
  -H "X-Client-Secret: $LUXID_CLIENT_SECRET" \
  https://api-uat.luxid.lu/services/luxid-partner-api/applications/app-abc-123

Response:

{
  "externalId": "app-abc-123",
  "apiIdentifier": "myapp-prod-client",
  "name": "MyApp",
  "defaultInstance": {
    "externalId": "inst-default-001",
    "name": "Production",
    "isDefault": true,
    "url": "https://app.example.com",
    "description": "Main production deployment"
  },
  "instances": [
    {
      "externalId": "inst-default-001",
      "name": "Production",
      "isDefault": true,
      "url": "https://app.example.com",
      "description": "Main production deployment"
    },
    {
      "externalId": "inst-beta-002",
      "name": "Beta",
      "isDefault": false,
      "url": "https://beta.example.com",
      "description": "Public beta channel"
    }
  ]
}

The default instance is returned both as a standalone defaultInstance field and inside the instances array. Use whichever shape is easier in your code; they describe the same object.

List the Groups attached to an Application

Groups can be scoped to an application (managed in the context of that application) or be global to your partnership. To list those attached to one specific application:

curl -sS \
  -H "X-Client-Id: $LUXID_CLIENT_ID" \
  -H "X-Client-Secret: $LUXID_CLIENT_SECRET" \
  https://api-uat.luxid.lu/services/luxid-partner-api/applications/app-abc-123/groups

Response:

{
  "groups": [
    { "name": "myapp-admins",   "description": "Application administrators" },
    { "name": "myapp-managers", "description": "Team managers with elevated access" },
    { "name": "myapp-readonly", "description": "Read-only auditors" }
  ]
}

What you do with these groups - listing members, adding people, removing people - is covered in Groups.

Errors you may see

Status	When	What to do
400	The request was malformed or violated a business rule.	Read message; fix and retry.
404	The applicationExtId does not exist or does not belong to your partnership.	Double-check you used the externalId (not the apiIdentifier).

Typical use cases

• Building an internal admin dashboard that needs to know which applications exist under your partnership and where each one lives. Fetch the list once at boot, refresh on demand.
• Cross-referencing a group action against a specific application. Before bulk-adding users to myapp-admins, you may want to confirm the group is actually attached to the application you think it is.
• Sanity-checking your OIDC configuration. The apiIdentifier returned here is the client_id your application must present to LuxID's OIDC endpoints - useful when several environments are involved and credentials get rotated.