In November 2020, the Apigee Edge API reference documentation will move to a new experience based on the Apigee integrated portal and visitors to this site will be redirected.

You are viewing the Apigee Edge API reference documentation. For the main product docs, and to search all docs, go to

Update the Scope of an App

Resource Summary


Content Type

application/json or text/xml


Developer App,



Update the Scope of an App

Updates the allowed OAuth scope(s) associated with an app. This API does not change the list of scopes in the API product(s) included in the app; rather, it sets allowed list of scopes in the scopes element under the apiProducts element in the attributes of the app.

Important: The specified scopes must already exist on the API product(s) associated with the app. You can't arbitrarily add a scope that does not already exist in an API product.  For example, if the app has one API product with these scopes: READ, WRITE. You can't use this API to add a new scope, such as DELETE (unless the app has another product with that scope). If you do this, you'll get a 400 Bad Request error. For example:



  "code": "keymanagement.service.InvalidScopes",

  "message": "Invalid scopes. Scopes must be contained in [READ, WRITE]",

  "contexts": []


It would be allowed, however, to remove one or both of the existing scopes, and later add one or both back. 

To use this API properly, specify the complete list of scopes to apply. The specified list replaces the existing scopes on the app. Therefore, to add a scope, you must specify all of the existing scopes along with the added scope. 


Apigee recommends that you use the developer's email address when calling this API. Developer IDs are generated internally by Apigee and are not guaranteed to stay the same over time. 

See also Working with OAuth2 scopes.

Resource URL /organizations/{org_name}/developers/{developer_email_or_id}/apps/{app_name}/keys/{consumer_key}

Header Parameters

Name Values Description

Specify the content type as application/json or text/xml.

Request Body

The specified scope names must already exist on the API product that you have associated with the app.

org_name Mention the organization name true

developer_email_or_id Mention the developer email or ID true

app_name Mention the app name true

consumer_key Mention the consumer key true

HTTP Basic

OAuth 2.0



Make a request and see the response.

Make a request and see the response.

Make a request and see the response.


Help or comments?

  • If something's not working: Ask the Apigee Community or see Apigee Support.
  • If something's wrong with the docs: Click the "Send Feedback" button.
    (Incorrect? Unclear? Broken link? Typo?)