Set the authenticating application's auth-email test allowlist
PATCH/auth/application
Set test_recipients — the per-application auth-email allowlist — on the
application whose credentials authenticated this request. When non-empty,
this allowlist gates ALL auth emails (only listed addresses receive them);
an EMPTY array clears it and disables the gate. Lets an integrator manage
the allowlist from their own infrastructure config instead of the
dashboard.
Application-SECRET scoped (server-side write): requires X-Application-Key AND X-Application-Secret. Mutates ONLY the authenticating application — it never takes an application id from the request, so there is no cross-tenant write path. The response mirrors GET /auth/application exactly (never returns secrets).
Request
Responses
- 200
- 400
- 401
- 500
Application updated
Validation error (not an array, non-string entry, or malformed email)
Missing or invalid application credentials
Internal server error