applications

GET /application/orgs

List the organizations this application created

WP-A9 provisioning (applications only). Lists only orgs the calling application created, ordered by org_id (ULIDs, so creation order, oldest first) and cursor-paginated; external_ref and status filter. Sessions and API keys get 403.

Operation ID: listApplicationOrgs · Service: gateway-api

Authentication

• applicationToken (http (bearer)) — A registered partner application's Google-signed OIDC ID token (WP-A9): minted by the application's own workload identity with the environment's exact audience, and pinned on the service account's email and unique id. Only registered applications are accepted.

Parameters

Name	In	Required	Type	Description
cursor	query	no	string	Opaque pagination cursor from a previous response's next_cursor.
external_ref	query	no	string	Only the org with this external reference.
limit	query	no	integer	Page size (cursor pagination, 003 §1). Maximum 200.
status	query	no	string	Only orgs in this status.

Pagination

Cursor pagination (003 §1): pass limit (max 200) and cursor; the response is the pagination envelope — data plus next_cursor (null on the last page).

Responses

Status	Schema	Description
200	ApplicationOrgPage	A page of owned organizations.
default	ErrorEnvelope	Error response (003 §1). Every non-2xx response uses this envelope; the HTTP status matches error.code. Rate-limited requests get 429 resource_exhausted with retry_after_seconds and a Retry-After header; the X-RateLimit-* headers ride on EVERY response, success or error (003 §1; plan-driven per API key + endpoint class — WP-B2). A 503 unavailable carries retry_after_seconds too for a lock-wait timeout (SQLSTATE 55P03), a rule preview at capacity (preview_capacity_exhausted), or a label preview during which the erasure of every entity holding its censor clock began (label_preview_clock_entity_erased): how long to wait before retrying.

POST /application/orgs

Create an organization owned by this application

WP-A9 req 5 (applications only). Creates an org with ZERO members, pinned to the application's configured plan (assigned and audited in the same transaction; never a Stripe object), bound to the application. Idempotent by external_ref, which IS the idempotency key: an Idempotency-Key header is ignored here (never replayed), and a different ref is a new create (201). A repeat with the same name returns 200 and the existing org; a different name is 409 already_exists with resource_id; a ref of a deleting or deleted org is 409 (reason: external_ref_retired) — refs are never reused. Quotas (orgs_total, orgs_per_day) are 429 resource_exhausted (reason: application_quota).

Operation ID: createApplicationOrg · Service: gateway-api

Authentication

• applicationToken (http (bearer)) — A registered partner application's Google-signed OIDC ID token (WP-A9): minted by the application's own workload identity with the environment's exact audience, and pinned on the service account's email and unique id. Only registered applications are accepted.

Request body

ApplicationOrgCreate

Responses

Status	Schema	Description
200	ApplicationOrg	The existing organization (idempotent repeat).
201	ApplicationOrg	The new organization.
default	ErrorEnvelope	Error response (003 §1). Every non-2xx response uses this envelope; the HTTP status matches error.code. Rate-limited requests get 429 resource_exhausted with retry_after_seconds and a Retry-After header; the X-RateLimit-* headers ride on EVERY response, success or error (003 §1; plan-driven per API key + endpoint class — WP-B2). A 503 unavailable carries retry_after_seconds too for a lock-wait timeout (SQLSTATE 55P03), a rule preview at capacity (preview_capacity_exhausted), or a label preview during which the erasure of every entity holding its censor clock began (label_preview_clock_entity_erased): how long to wait before retrying.

GET /application/orgs/{org_id}

Read an organization this application created

WP-A9 (applications only). Any org the application did not create is 404 with the body used for a nonexistent org.

Operation ID: getApplicationOrg · Service: gateway-api

Authentication

• applicationToken (http (bearer)) — A registered partner application's Google-signed OIDC ID token (WP-A9): minted by the application's own workload identity with the environment's exact audience, and pinned on the service account's email and unique id. Only registered applications are accepted.

Parameters

Name	In	Required	Type	Description
org_id	path	yes	string

Responses

Status	Schema	Description
200	ApplicationOrg	The owned organization.
default	ErrorEnvelope	Error response (003 §1). Every non-2xx response uses this envelope; the HTTP status matches error.code. Rate-limited requests get 429 resource_exhausted with retry_after_seconds and a Retry-After header; the X-RateLimit-* headers ride on EVERY response, success or error (003 §1; plan-driven per API key + endpoint class — WP-B2). A 503 unavailable carries retry_after_seconds too for a lock-wait timeout (SQLSTATE 55P03), a rule preview at capacity (preview_capacity_exhausted), or a label preview during which the erasure of every entity holding its censor clock began (label_preview_clock_entity_erased): how long to wait before retrying.

DELETE /application/orgs/{org_id}

Delete an organization this application created

WP-A9 req 7 (applications only). Refused with 400 failed_precondition (reason: org_has_unowned_projects, no ids) while the org holds a project the application did not create. Otherwise every owned project enters the WP-O3 delete (status deleting, API keys revoked at once, the 7-day purge grace, then the purge), the org reads deleting (purge_after: its last project purge) and its members' sessions are refused at once. Once every project is deleted the org is deactivated (deleted): its memberships and provisioned members are removed, SSO is disabled, its domains are released, and SCIM tokens and invites are revoked. There is no application restore, and the external_ref stays retired. A repeat answers 200 with the org as it is.

Operation ID: deleteApplicationOrg · Service: gateway-api

Authentication

• applicationToken (http (bearer)) — A registered partner application's Google-signed OIDC ID token (WP-A9): minted by the application's own workload identity with the environment's exact audience, and pinned on the service account's email and unique id. Only registered applications are accepted.

Parameters

Name	In	Required	Type	Description
org_id	path	yes	string

Responses

Status	Schema	Description
200	ApplicationOrg	The organization, now deleting (or as it already was).
default	ErrorEnvelope	Error response (003 §1). Every non-2xx response uses this envelope; the HTTP status matches error.code. Rate-limited requests get 429 resource_exhausted with retry_after_seconds and a Retry-After header; the X-RateLimit-* headers ride on EVERY response, success or error (003 §1; plan-driven per API key + endpoint class — WP-B2). A 503 unavailable carries retry_after_seconds too for a lock-wait timeout (SQLSTATE 55P03), a rule preview at capacity (preview_capacity_exhausted), or a label preview during which the erasure of every entity holding its censor clock began (label_preview_clock_entity_erased): how long to wait before retrying.

PATCH /application/orgs/{org_id}

Rename an organization this application created

WP-A9 (applications only). Renames an owned org that is active or suspended; a deleting or deleted org is 400 failed_precondition (reason: org_not_active). A rename is not a status change (status_changed_at is kept). Any org the application did not create is 404 with the body used for a nonexistent org.

Operation ID: updateApplicationOrg · Service: gateway-api

Authentication

• applicationToken (http (bearer)) — A registered partner application's Google-signed OIDC ID token (WP-A9): minted by the application's own workload identity with the environment's exact audience, and pinned on the service account's email and unique id. Only registered applications are accepted.

Parameters

Name	In	Required	Type	Description
org_id	path	yes	string

Request body

ApplicationOrgUpdate

Responses

Status	Schema	Description
200	ApplicationOrg	The renamed organization.
default	ErrorEnvelope	Error response (003 §1). Every non-2xx response uses this envelope; the HTTP status matches error.code. Rate-limited requests get 429 resource_exhausted with retry_after_seconds and a Retry-After header; the X-RateLimit-* headers ride on EVERY response, success or error (003 §1; plan-driven per API key + endpoint class — WP-B2). A 503 unavailable carries retry_after_seconds too for a lock-wait timeout (SQLSTATE 55P03), a rule preview at capacity (preview_capacity_exhausted), or a label preview during which the erasure of every entity holding its censor clock began (label_preview_clock_entity_erased): how long to wait before retrying.

GET /application/orgs/{org_id}/audit-events

List the audit events of an organization this application created

WP-A9 (applications only; MCC contract P4.7): the org-level audit feed of an org the application created — the same page, order, cursor and filters as listOrgAuditEvents. A foreign org is 404. Managed orgs hold only the application's own actions and its provisioned people's. The application acts only in its registered environments (003 §2), so the feed holds only their events, plus the events recorded with no environment (org- and project-level actions).

Operation ID: listApplicationOrgAuditEvents · Service: gateway-api

Authentication

• applicationToken (http (bearer)) — A registered partner application's Google-signed OIDC ID token (WP-A9): minted by the application's own workload identity with the environment's exact audience, and pinned on the service account's email and unique id. Only registered applications are accepted.

Parameters

Name	In	Required	Type	Description
org_id	path	yes	string
action	query	no	string	Action prefix match (WP-A3): api_key matches api_key.create and api_key.revoke; auth.login matches auth.login and auth.login_denied.
actor_id	query	no	string	Exact actor id (user_ / key_ ULID, or a service identity).
cursor	query	no	string	Opaque pagination cursor from a previous response's next_cursor.
limit	query	no	integer	Page size (cursor pagination, 003 §1). Maximum 200.
occurred_after	query	no	string	Only events with occurred_at strictly after this instant.
occurred_before	query	no	string	Only events with occurred_at strictly before this instant.
outcome	query	no	string	Exact outcome.
resource_id	query	no	string	Exact resource id.
resource_type	query	no	string	Exact resource type (e.g. api_key, slot, schema_contract).

Pagination

Cursor pagination (003 §1): pass limit (max 200) and cursor; the response is the pagination envelope — data plus next_cursor (null on the last page).

Responses

Status	Schema	Description
200	AuditEventPage	Page of audit events, newest first.
default	ErrorEnvelope	Error response (003 §1). Every non-2xx response uses this envelope; the HTTP status matches error.code. Rate-limited requests get 429 resource_exhausted with retry_after_seconds and a Retry-After header; the X-RateLimit-* headers ride on EVERY response, success or error (003 §1; plan-driven per API key + endpoint class — WP-B2). A 503 unavailable carries retry_after_seconds too for a lock-wait timeout (SQLSTATE 55P03), a rule preview at capacity (preview_capacity_exhausted), or a label preview during which the erasure of every entity holding its censor clock began (label_preview_clock_entity_erased): how long to wait before retrying.

GET /application/orgs/{org_id}/members

List the members this application provisioned in one of its orgs

WP-A9 req 8 (applications only). Only people the calling application provisioned in an org it created, pending or active, ordered by member_id and cursor-paginated. A pending member drops out once it expires (72 hours after the add, unredeemed). Members a human added are never listed (their count is ApplicationOrg.unmanaged.members). A foreign org is 404.

Operation ID: listApplicationMembers · Service: gateway-api

Authentication

• applicationToken (http (bearer)) — A registered partner application's Google-signed OIDC ID token (WP-A9): minted by the application's own workload identity with the environment's exact audience, and pinned on the service account's email and unique id. Only registered applications are accepted.

Parameters

Name	In	Required	Type	Description
org_id	path	yes	string
cursor	query	no	string	Opaque pagination cursor from a previous response's next_cursor.
limit	query	no	integer	Page size (cursor pagination, 003 §1). Maximum 200.

Pagination

Cursor pagination (003 §1): pass limit (max 200) and cursor; the response is the pagination envelope — data plus next_cursor (null on the last page).

Responses

Status	Schema	Description
200	ApplicationMemberPage	A page of provisioned members.
default	ErrorEnvelope	Error response (003 §1). Every non-2xx response uses this envelope; the HTTP status matches error.code. Rate-limited requests get 429 resource_exhausted with retry_after_seconds and a Retry-After header; the X-RateLimit-* headers ride on EVERY response, success or error (003 §1; plan-driven per API key + endpoint class — WP-B2). A 503 unavailable carries retry_after_seconds too for a lock-wait timeout (SQLSTATE 55P03), a rule preview at capacity (preview_capacity_exhausted), or a label preview during which the erasure of every entity holding its censor clock began (label_preview_clock_entity_erased): how long to wait before retrying.

POST /application/orgs/{org_id}/members

Provision a person in an organization this application created

WP-A9 req 8 (applications only). Provisions exactly this person, by email, as admin, member or viewer (never owner) of an owned, active org. Tessera sends no email or invitation. A new member is always pending, and the answer never says whether the email has a Tessera account: the person activates only by redeeming a claim code (createApplicationMemberClaim) on the console's claim page. Idempotent by the normalized email (trimmed, ASCII-lowercased; an Idempotency-Key header is ignored): the same role → 200 and the existing member; another role → 409 already_exists with resource_id. members_per_org and members_churn_per_day (adds plus removals in a rolling 24 hours) are 429 resource_exhausted (reason: application_quota).

Operation ID: addApplicationMember · Service: gateway-api

Authentication

• applicationToken (http (bearer)) — A registered partner application's Google-signed OIDC ID token (WP-A9): minted by the application's own workload identity with the environment's exact audience, and pinned on the service account's email and unique id. Only registered applications are accepted.

Parameters

Name	In	Required	Type	Description
org_id	path	yes	string

Request body

ApplicationMemberCreate

Responses

Status	Schema	Description
200	ApplicationMember	The existing member (idempotent repeat).
201	ApplicationMember	The new pending member.
default	ErrorEnvelope	Error response (003 §1). Every non-2xx response uses this envelope; the HTTP status matches error.code. Rate-limited requests get 429 resource_exhausted with retry_after_seconds and a Retry-After header; the X-RateLimit-* headers ride on EVERY response, success or error (003 §1; plan-driven per API key + endpoint class — WP-B2). A 503 unavailable carries retry_after_seconds too for a lock-wait timeout (SQLSTATE 55P03), a rule preview at capacity (preview_capacity_exhausted), or a label preview during which the erasure of every entity holding its censor clock began (label_preview_clock_entity_erased): how long to wait before retrying.

DELETE /application/orgs/{org_id}/members/{member_id}

Remove a member this application provisioned

WP-A9 req 8 (applications only). Pending or active; takes effect on the member's next request and revokes every API key the member created in the org's projects (audited). Counts toward members_churn_per_day. Any member the application did not provision is 404.

Operation ID: removeApplicationMember · Service: gateway-api

Authentication

• applicationToken (http (bearer)) — A registered partner application's Google-signed OIDC ID token (WP-A9): minted by the application's own workload identity with the environment's exact audience, and pinned on the service account's email and unique id. Only registered applications are accepted.

Parameters

Name	In	Required	Type	Description
member_id	path	yes	string	A provisioned member id (amem_ ULID, WP-A9).
org_id	path	yes	string

Responses

Status	Schema	Description
204	—	Removed.
default	ErrorEnvelope	Error response (003 §1). Every non-2xx response uses this envelope; the HTTP status matches error.code. Rate-limited requests get 429 resource_exhausted with retry_after_seconds and a Retry-After header; the X-RateLimit-* headers ride on EVERY response, success or error (003 §1; plan-driven per API key + endpoint class — WP-B2). A 503 unavailable carries retry_after_seconds too for a lock-wait timeout (SQLSTATE 55P03), a rule preview at capacity (preview_capacity_exhausted), or a label preview during which the erasure of every entity holding its censor clock began (label_preview_clock_entity_erased): how long to wait before retrying.

PATCH /application/orgs/{org_id}/members/{member_id}

Change the role of a member this application provisioned

WP-A9 req 8 (applications only). admin, member or viewer; pending or active. Takes effect on the member's next request. A role below admin revokes every API key the member created in the org's projects (audited). Any member the application did not provision is 404.

Operation ID: updateApplicationMember · Service: gateway-api

Authentication

• applicationToken (http (bearer)) — A registered partner application's Google-signed OIDC ID token (WP-A9): minted by the application's own workload identity with the environment's exact audience, and pinned on the service account's email and unique id. Only registered applications are accepted.

Parameters

Name	In	Required	Type	Description
member_id	path	yes	string	A provisioned member id (amem_ ULID, WP-A9).
org_id	path	yes	string

Request body

ApplicationMemberUpdate

Responses

Status	Schema	Description
200	ApplicationMember	The member.
default	ErrorEnvelope	Error response (003 §1). Every non-2xx response uses this envelope; the HTTP status matches error.code. Rate-limited requests get 429 resource_exhausted with retry_after_seconds and a Retry-After header; the X-RateLimit-* headers ride on EVERY response, success or error (003 §1; plan-driven per API key + endpoint class — WP-B2). A 503 unavailable carries retry_after_seconds too for a lock-wait timeout (SQLSTATE 55P03), a rule preview at capacity (preview_capacity_exhausted), or a label preview during which the erasure of every entity holding its censor clock began (label_preview_clock_entity_erased): how long to wait before retrying.

POST /application/orgs/{org_id}/members/{member_id}:claim-code

Mint a single-use claim code for a pending member

WP-A9 req 8 (applications only; closes HD-109). Returns a single-use claim code, bound to this pending member, valid for at most 15 minutes (never past the member's own 72-hour expiry). It is returned ONCE and stored only as a hash; a new code replaces the previous one. The partner shows it to the person out of band, who redeems it in a Tessera session (redeemMemberClaim). An active member is 400 failed_precondition (reason: member_already_active), and an org that is not active 400 failed_precondition (reason: org_not_active).

Operation ID: createApplicationMemberClaim · Service: gateway-api

Authentication

• applicationToken (http (bearer)) — A registered partner application's Google-signed OIDC ID token (WP-A9): minted by the application's own workload identity with the environment's exact audience, and pinned on the service account's email and unique id. Only registered applications are accepted.

Parameters

Name	In	Required	Type	Description
member_id	path	yes	string	A provisioned member id (amem_ ULID, WP-A9).
org_id	path	yes	string

Responses

Status	Schema	Description
201	ApplicationMemberClaim	The claim code (shown once).
default	ErrorEnvelope	Error response (003 §1). Every non-2xx response uses this envelope; the HTTP status matches error.code. Rate-limited requests get 429 resource_exhausted with retry_after_seconds and a Retry-After header; the X-RateLimit-* headers ride on EVERY response, success or error (003 §1; plan-driven per API key + endpoint class — WP-B2). A 503 unavailable carries retry_after_seconds too for a lock-wait timeout (SQLSTATE 55P03), a rule preview at capacity (preview_capacity_exhausted), or a label preview during which the erasure of every entity holding its censor clock began (label_preview_clock_entity_erased): how long to wait before retrying.

GET /application/orgs/{org_id}/projects

List the projects this application created in one of its orgs

WP-A9 (applications only). Only projects the application created in an org it created; external_ref and status filter. A foreign org is 404.

Operation ID: listApplicationProjects · Service: gateway-api

Authentication

• applicationToken (http (bearer)) — A registered partner application's Google-signed OIDC ID token (WP-A9): minted by the application's own workload identity with the environment's exact audience, and pinned on the service account's email and unique id. Only registered applications are accepted.

Parameters

Name	In	Required	Type	Description
org_id	path	yes	string
cursor	query	no	string	Opaque pagination cursor from a previous response's next_cursor.
external_ref	query	no	string	Only the project with this external reference.
limit	query	no	integer	Page size (cursor pagination, 003 §1). Maximum 200.
status	query	no	string	Only projects in this status.

Pagination

Cursor pagination (003 §1): pass limit (max 200) and cursor; the response is the pagination envelope — data plus next_cursor (null on the last page).

Responses

Status	Schema	Description
200	ApplicationProjectPage	A page of owned projects.
default	ErrorEnvelope	Error response (003 §1). Every non-2xx response uses this envelope; the HTTP status matches error.code. Rate-limited requests get 429 resource_exhausted with retry_after_seconds and a Retry-After header; the X-RateLimit-* headers ride on EVERY response, success or error (003 §1; plan-driven per API key + endpoint class — WP-B2). A 503 unavailable carries retry_after_seconds too for a lock-wait timeout (SQLSTATE 55P03), a rule preview at capacity (preview_capacity_exhausted), or a label preview during which the erasure of every entity holding its censor clock began (label_preview_clock_entity_erased): how long to wait before retrying.

POST /application/orgs/{org_id}/projects

Create a project in an organization this application created

WP-A9 req 6 (applications only). Creates a project bound to the application in an owned, active org. Idempotent by (org_id, external_ref), which IS the idempotency key (an Idempotency-Key header is ignored here): the same name AND onboarding_mode → 200 and the existing project; a different name or mode → 409 already_exists with resource_id; a retired ref → 409 (reason: external_ref_retired). The application's projects_per_org quota (which counts every project it created in the org, deleted ones included, because refs are retired) and the plan's project cap apply.

Operation ID: createApplicationProject · Service: gateway-api

Authentication

• applicationToken (http (bearer)) — A registered partner application's Google-signed OIDC ID token (WP-A9): minted by the application's own workload identity with the environment's exact audience, and pinned on the service account's email and unique id. Only registered applications are accepted.

Parameters

Name	In	Required	Type	Description
org_id	path	yes	string

Request body

ApplicationProjectCreate

Responses

Status	Schema	Description
200	ApplicationProject	The existing project (idempotent repeat).
201	ApplicationProject	The new project.
default	ErrorEnvelope	Error response (003 §1). Every non-2xx response uses this envelope; the HTTP status matches error.code. Rate-limited requests get 429 resource_exhausted with retry_after_seconds and a Retry-After header; the X-RateLimit-* headers ride on EVERY response, success or error (003 §1; plan-driven per API key + endpoint class — WP-B2). A 503 unavailable carries retry_after_seconds too for a lock-wait timeout (SQLSTATE 55P03), a rule preview at capacity (preview_capacity_exhausted), or a label preview during which the erasure of every entity holding its censor clock began (label_preview_clock_entity_erased): how long to wait before retrying.

POST /application/orgs/{org_id}:resume

Resume an organization this application created

WP-A9 req 6 (applications only). Lifts the org's suspension (a project suspended on its own stays suspended). A deleting or deleted org is 400 failed_precondition (reason: org_not_active); a repeat answers 200; an Idempotency-Key header is ignored (the handler is idempotent by state).

Operation ID: resumeApplicationOrg · Service: gateway-api

Authentication

• applicationToken (http (bearer)) — A registered partner application's Google-signed OIDC ID token (WP-A9): minted by the application's own workload identity with the environment's exact audience, and pinned on the service account's email and unique id. Only registered applications are accepted.

Parameters

Name	In	Required	Type	Description
org_id	path	yes	string

Responses

Status	Schema	Description
200	ApplicationOrg	The organization, as it now is.
default	ErrorEnvelope	Error response (003 §1). Every non-2xx response uses this envelope; the HTTP status matches error.code. Rate-limited requests get 429 resource_exhausted with retry_after_seconds and a Retry-After header; the X-RateLimit-* headers ride on EVERY response, success or error (003 §1; plan-driven per API key + endpoint class — WP-B2). A 503 unavailable carries retry_after_seconds too for a lock-wait timeout (SQLSTATE 55P03), a rule preview at capacity (preview_capacity_exhausted), or a label preview during which the erasure of every entity holding its censor clock began (label_preview_clock_entity_erased): how long to wait before retrying.

POST /application/orgs/{org_id}:suspend

Suspend an organization this application created

WP-A9 req 6 (applications only). Freezes the data plane of every project of the org: keys, sessions and the application are refused with 403 permission_denied (reason: org_suspended), and work started through the API with them. The data is kept; running jobs finish. Org-level session reads continue, nobody is removed and no key is revoked, and claim codes stop redeeming. Scheduled background work is skipped only from WP-A9 slice 6b. The application keeps its provisioning operations and its event-feed reads. A deleting or deleted org is 400 failed_precondition (reason: org_not_active); a repeat answers 200; an Idempotency-Key header is ignored (the handler is idempotent by state).

Operation ID: suspendApplicationOrg · Service: gateway-api

Authentication

• applicationToken (http (bearer)) — A registered partner application's Google-signed OIDC ID token (WP-A9): minted by the application's own workload identity with the environment's exact audience, and pinned on the service account's email and unique id. Only registered applications are accepted.

Parameters

Name	In	Required	Type	Description
org_id	path	yes	string

Responses

Status	Schema	Description
200	ApplicationOrg	The organization, as it now is.
default	ErrorEnvelope	Error response (003 §1). Every non-2xx response uses this envelope; the HTTP status matches error.code. Rate-limited requests get 429 resource_exhausted with retry_after_seconds and a Retry-After header; the X-RateLimit-* headers ride on EVERY response, success or error (003 §1; plan-driven per API key + endpoint class — WP-B2). A 503 unavailable carries retry_after_seconds too for a lock-wait timeout (SQLSTATE 55P03), a rule preview at capacity (preview_capacity_exhausted), or a label preview during which the erasure of every entity holding its censor clock began (label_preview_clock_entity_erased): how long to wait before retrying.

GET /application/projects/{project_id}

Read a project this application created

WP-A9 (applications only). Any project the application did not create (including one a human created inside an owned org) is 404 with the body used for a nonexistent project.

Operation ID: getApplicationProject · Service: gateway-api

Authentication

• applicationToken (http (bearer)) — A registered partner application's Google-signed OIDC ID token (WP-A9): minted by the application's own workload identity with the environment's exact audience, and pinned on the service account's email and unique id. Only registered applications are accepted.

Parameters

Name	In	Required	Type	Description
project_id	path	yes	string

Responses

Status	Schema	Description
200	ApplicationProject	The owned project.
default	ErrorEnvelope	Error response (003 §1). Every non-2xx response uses this envelope; the HTTP status matches error.code. Rate-limited requests get 429 resource_exhausted with retry_after_seconds and a Retry-After header; the X-RateLimit-* headers ride on EVERY response, success or error (003 §1; plan-driven per API key + endpoint class — WP-B2). A 503 unavailable carries retry_after_seconds too for a lock-wait timeout (SQLSTATE 55P03), a rule preview at capacity (preview_capacity_exhausted), or a label preview during which the erasure of every entity holding its censor clock began (label_preview_clock_entity_erased): how long to wait before retrying.

DELETE /application/projects/{project_id}

Delete a project this application created

WP-A9 req 6 (applications only): the WP-O3 delete. The project reads deleting with its purge_after (the 7-day grace), every API key is revoked at once, and the purge then leaves a deleted tombstone. There is no application restore, and the external_ref stays retired (a create naming it is 409 external_ref_retired). While the purge is pending the creating application keeps reading the project's event feed (WP-D6 R1). A repeat answers 200 with the project as it is.

Operation ID: deleteApplicationProject · Service: gateway-api

Authentication

• applicationToken (http (bearer)) — A registered partner application's Google-signed OIDC ID token (WP-A9): minted by the application's own workload identity with the environment's exact audience, and pinned on the service account's email and unique id. Only registered applications are accepted.

Parameters

Name	In	Required	Type	Description
project_id	path	yes	string

Responses

Status	Schema	Description
200	ApplicationProject	The project, now deleting (or as it already was).
default	ErrorEnvelope	Error response (003 §1). Every non-2xx response uses this envelope; the HTTP status matches error.code. Rate-limited requests get 429 resource_exhausted with retry_after_seconds and a Retry-After header; the X-RateLimit-* headers ride on EVERY response, success or error (003 §1; plan-driven per API key + endpoint class — WP-B2). A 503 unavailable carries retry_after_seconds too for a lock-wait timeout (SQLSTATE 55P03), a rule preview at capacity (preview_capacity_exhausted), or a label preview during which the erasure of every entity holding its censor clock began (label_preview_clock_entity_erased): how long to wait before retrying.

PATCH /application/projects/{project_id}

Rename a project this application created

WP-A9 (applications only). Renames an owned project that is active or suspended (the onboarding mode is chosen at creation); a deleting or deleted project is 400 failed_precondition (reason: project_not_active), and a name another project of the org holds is 409 already_exists. Any project the application did not create is the uniform 404.

Operation ID: updateApplicationProject · Service: gateway-api

Authentication

• applicationToken (http (bearer)) — A registered partner application's Google-signed OIDC ID token (WP-A9): minted by the application's own workload identity with the environment's exact audience, and pinned on the service account's email and unique id. Only registered applications are accepted.

Parameters

Name	In	Required	Type	Description
project_id	path	yes	string

Request body

ApplicationProjectUpdate

Responses

Status	Schema	Description
200	ApplicationProject	The renamed project.
default	ErrorEnvelope	Error response (003 §1). Every non-2xx response uses this envelope; the HTTP status matches error.code. Rate-limited requests get 429 resource_exhausted with retry_after_seconds and a Retry-After header; the X-RateLimit-* headers ride on EVERY response, success or error (003 §1; plan-driven per API key + endpoint class — WP-B2). A 503 unavailable carries retry_after_seconds too for a lock-wait timeout (SQLSTATE 55P03), a rule preview at capacity (preview_capacity_exhausted), or a label preview during which the erasure of every entity holding its censor clock began (label_preview_clock_entity_erased): how long to wait before retrying.

POST /application/projects/{project_id}:resume

Resume a project this application created

WP-A9 req 6 (applications only). Lifts the project's suspension; a project of a suspended org stays refused (org_suspended) until the org is resumed. A deleting or deleted project is 400 failed_precondition (reason: project_not_active); a repeat answers 200; an Idempotency-Key header is ignored (the handler is idempotent by state).

Operation ID: resumeApplicationProject · Service: gateway-api

Authentication

• applicationToken (http (bearer)) — A registered partner application's Google-signed OIDC ID token (WP-A9): minted by the application's own workload identity with the environment's exact audience, and pinned on the service account's email and unique id. Only registered applications are accepted.

Parameters

Name	In	Required	Type	Description
project_id	path	yes	string

Responses

Status	Schema	Description
200	ApplicationProject	The project, as it now is.
default	ErrorEnvelope	Error response (003 §1). Every non-2xx response uses this envelope; the HTTP status matches error.code. Rate-limited requests get 429 resource_exhausted with retry_after_seconds and a Retry-After header; the X-RateLimit-* headers ride on EVERY response, success or error (003 §1; plan-driven per API key + endpoint class — WP-B2). A 503 unavailable carries retry_after_seconds too for a lock-wait timeout (SQLSTATE 55P03), a rule preview at capacity (preview_capacity_exhausted), or a label preview during which the erasure of every entity holding its censor clock began (label_preview_clock_entity_erased): how long to wait before retrying.

POST /application/projects/{project_id}:suspend

Suspend a project this application created

WP-A9 req 6 (applications only). Freezes the project's data plane: keys, sessions and the application are refused with 403 permission_denied (reason: project_suspended), and work started through the API with them. The data is kept; running jobs finish. Scheduled background work is skipped only from WP-A9 slice 6b. The application keeps its provisioning operations and its event-feed reads. A deleting or deleted project is 400 failed_precondition (reason: project_not_active); a repeat answers 200; an Idempotency-Key header is ignored (the handler is idempotent by state).

Operation ID: suspendApplicationProject · Service: gateway-api

Authentication

• applicationToken (http (bearer)) — A registered partner application's Google-signed OIDC ID token (WP-A9): minted by the application's own workload identity with the environment's exact audience, and pinned on the service account's email and unique id. Only registered applications are accepted.

Parameters

Name	In	Required	Type	Description
project_id	path	yes	string

Responses

Status	Schema	Description
200	ApplicationProject	The project, as it now is.
default	ErrorEnvelope	Error response (003 §1). Every non-2xx response uses this envelope; the HTTP status matches error.code. Rate-limited requests get 429 resource_exhausted with retry_after_seconds and a Retry-After header; the X-RateLimit-* headers ride on EVERY response, success or error (003 §1; plan-driven per API key + endpoint class — WP-B2). A 503 unavailable carries retry_after_seconds too for a lock-wait timeout (SQLSTATE 55P03), a rule preview at capacity (preview_capacity_exhausted), or a label preview during which the erasure of every entity holding its censor clock began (label_preview_clock_entity_erased): how long to wait before retrying.

POST /member-claims:redeem

Redeem a member claim code

WP-A9 req 8 (console sessions only). The person redeems the claim code a partner application showed them. The membership is created only when the CURRENT session token passes every check: not an SSO tenant session, the email_verified claim is the boolean true, the provider is password or google.com, the user the token resolves to is neither an SSO-scoped identity nor a SCIM placeholder, and its email equals the provisioned email. A refused session is 403 permission_denied (reason: member_claim_identity, with check naming the failed property of the session). An unknown, used, expired or foreign code, or one minted before the application's token revocation instant, is 404. Attempts are limited per user (429 resource_exhausted, reason: member_claim_attempts, with Retry-After). An existing membership is never replaced (409 already_exists). A deactivated org is 400 failed_precondition (reason: org_deactivated), and one suspended or being deleted 400 failed_precondition (reason: org_not_active). While the provisioning application is disabled, 403 permission_denied (reason: application_disabled), or 503 unavailable with Retry-After when its state cannot be read. No refusal consumes the code. The created membership's invited_email is null.

Operation ID: redeemMemberClaim · Service: gateway-api

Authentication

• consoleSession (http (bearer)) — Console session (003 §2): Identity Platform JWT. Data-plane calls add X-Tessera-Project + X-Tessera-Environment headers, validated against org membership.

Request body

MemberClaimRedeem

Responses

Status	Schema	Description
200	Membership	The membership created by redeeming the code.
default	ErrorEnvelope	Error response (003 §1). Every non-2xx response uses this envelope; the HTTP status matches error.code. Rate-limited requests get 429 resource_exhausted with retry_after_seconds and a Retry-After header; the X-RateLimit-* headers ride on EVERY response, success or error (003 §1; plan-driven per API key + endpoint class — WP-B2). A 503 unavailable carries retry_after_seconds too for a lock-wait timeout (SQLSTATE 55P03), a rule preview at capacity (preview_capacity_exhausted), or a label preview during which the erasure of every entity holding its censor clock began (label_preview_clock_entity_erased): how long to wait before retrying.

Errors

Every non-2xx response uses the 003 §1 error envelope; error.request_id matches the X-Request-Id response header, and the HTTP status always matches error.code:

{
  "error": {
    "code": "invalid_argument",
    "details": [
      {
        "type": "field_violation"
      }
    ],
    "message": "human-readable",
    "request_id": "req_01hxample"
  }
}

Closed error-code set (003 §1): invalid_argument, unauthenticated, permission_denied, not_found, already_exists, failed_precondition, resource_exhausted, internal, unavailable.

resource_exhausted responses (HTTP 429) additionally carry retry_after_seconds. See ErrorEnvelope.