> ## Documentation Index > Fetch the complete documentation index at: https://developers.portao3.com.br/llms.txt > Use this file to discover all available pages before exploring further. # Create an API client > Creates an API client: the `clientId` and `clientSecret` your systems exchange for an access token at `POST /auth/sign-in`. Your API client must have access to every organization in `organizations`, and API clients must be enabled for each of them. The `clientSecret` is returned only in this response and can't be retrieved later, so store it securely right away. The new API client is `ACTIVE` immediately. ## OpenAPI ````yaml /api-reference/identity.openapi.json post /realms/{realmId}/appclients openapi: 3.0.3 info: title: Identity version: 1.0.0 description: >- Portão 3 identity API. Every endpoint requires a bearer token in the Authorization header (Authorization: Bearer ) unless its page states otherwise; see the Authentication guide. That requirement is not repeated per endpoint. Generated by tools/openapi from code (routes + security) and the hand-written spec (request/response bodies). 4 app groups run without the identity authorizer; publicPatterns enumerates every route they expose, except POST /auth/sign-in, documented with HTTP Basic for the API-client credentials flow. Confidence tiers: generated:typed=45 copied:manual=0 unknown=0. servers: - url: https://api.identity.v2.portao3.com.br/ description: production - url: https://api.identity.dev.3pers.com.br/ description: development security: [] tags: - name: Authentication - name: Current User - name: Custom Fields - name: API Clients - name: Users - name: Organizations - name: Groups - name: Realms paths: /realms/{realmId}/appclients: post: tags: - API Clients summary: Create an API client description: >- Creates an API client: the `clientId` and `clientSecret` your systems exchange for an access token at `POST /auth/sign-in`. operationId: postRealmsByRealmIdAppclients parameters: - name: realmId in: path required: true description: |- ID of your realm. Format: `UUID` schema: type: string format: uuid example: f495ff0c-ab54-4f99-8e92-ca8682e4de9b requestBody: required: true content: application/json: schema: type: object properties: description: type: string minLength: 1 maxLength: 255 description: Display name of the API client. example: ERP Integration clientId: type: string minLength: 1 maxLength: 64 pattern: ^[A-Za-z0-9+/=._-]*$ description: >- Readable identifier you choose for the API client, unique across Portão 3: letters, digits and `+` `/` `=` `.` `_` `-`. example: prod-client-v2 organizations: minItems: 1 type: array items: type: string format: uuid example: c4bd3f21-dfbd-44e8-8055-68ba15bed410 description: >- Organizations the new API client can act on. Your API client must have access to each of them, and API clients must be enabled for each. Format: `UUID` --- Example: `["c4bd3f21-dfbd-44e8-8055-68ba15bed410"]` required: - description - clientId - organizations responses: '201': description: Successful response content: application/json: schema: type: object properties: id: type: string description: ID of the API client. Use it to deactivate the client. example: 43230779-2cfb-4525-a40c-77fbf15e68f0 format: uuid clientId: type: string description: >- Public identifier of the API client. Send it, with the client secret, to `POST /auth/sign-in` to get an access token. example: prod-client-v2 description: type: string description: Display name of the API client. example: ERP Integration realm: type: string description: ID of the realm the API client belongs to. example: f495ff0c-ab54-4f99-8e92-ca8682e4de9b format: uuid organizations: type: array items: type: object properties: id: type: string description: ID of the organization. example: c4bd3f21-dfbd-44e8-8055-68ba15bed410 format: uuid level: type: string enum: - ADMIN - USER - APP_CLIENT description: >- Access level the API client holds in the organization. API clients are created as organization admins. example: ADMIN required: - id description: An organization the API client can act on. description: Organizations the API client can act on. status: type: string enum: - ACTIVE - DEACTIVATED description: >- `ACTIVE` clients can authenticate. `DEACTIVATED` clients can no longer authenticate; deactivation is permanent. example: ACTIVE createdAt: type: string description: When the API client was created. example: '2026-10-13T18:43:50.746Z' format: date-time updatedAt: type: string description: >- When the API client last changed (for example, when it was deactivated). example: '2026-10-13T18:43:50.746Z' format: date-time createdBy: type: string description: ID of the user or API client that created this API client. example: f1235202-71e0-49ef-a8ba-939b8d3ec945 format: uuid updatedBy: type: string description: >- ID of the user or API client that last changed this API client. example: f1235202-71e0-49ef-a8ba-939b8d3ec945 format: uuid clientSecret: type: string description: >- Secret of the API client. It is returned only in this response and cannot be retrieved again, so store it securely right away. example: 4+cHfGX6UIE&kmB8)vK$ils4R required: - clientId - clientSecret - createdAt - createdBy - description - id - organizations - realm - status - updatedAt - updatedBy description: A newly created API client, including its secret. '403': description: >- `FORBIDDEN_FEATURE_FLAG` — API clients are not enabled for at least one of the organizations. Contact Portão 3 support to enable them. `FORBIDDEN_APP_CLIENT` — Your API client doesn't have access to every organization in `organizations`. content: application/json: schema: type: object properties: traceId: type: string description: >- Identifier of the request that failed. Quote it when contacting support. example: 1-68ee2a1b-3c4d5e6f7a8b9c0d1e2f3a4b code: type: string enum: - FORBIDDEN_FEATURE_FLAG - FORBIDDEN_APP_CLIENT description: >- Stable, machine-readable error code. Branch on this, never on `message`. origin: type: string enum: - IDENTITY description: Service that produced the error. message: type: string description: >- Human-readable explanation. Its wording may change without notice. required: - traceId - code - origin - message example: traceId: 1-68ee2a1b-3c4d5e6f7a8b9c0d1e2f3a4b code: FORBIDDEN_FEATURE_FLAG origin: IDENTITY message: >- You do not have permission to perform this action on this resource '404': description: >- `ORGANIZATION_NOT_FOUND` — At least one ID in `organizations` is not an organization of your realm. content: application/json: schema: type: object properties: traceId: type: string description: >- Identifier of the request that failed. Quote it when contacting support. example: 1-68ee2a1b-3c4d5e6f7a8b9c0d1e2f3a4b code: type: string enum: - ORGANIZATION_NOT_FOUND description: >- Stable, machine-readable error code. Branch on this, never on `message`. origin: type: string enum: - IDENTITY description: Service that produced the error. message: type: string description: >- Human-readable explanation. Its wording may change without notice. required: - traceId - code - origin - message example: traceId: 1-68ee2a1b-3c4d5e6f7a8b9c0d1e2f3a4b code: ORGANIZATION_NOT_FOUND origin: IDENTITY message: Organization not found '409': description: >- `APP_CLIENT_CONFLICT` — The `clientId` is already in use; choose another one. content: application/json: schema: type: object properties: traceId: type: string description: >- Identifier of the request that failed. Quote it when contacting support. example: 1-68ee2a1b-3c4d5e6f7a8b9c0d1e2f3a4b code: type: string enum: - APP_CLIENT_CONFLICT description: >- Stable, machine-readable error code. Branch on this, never on `message`. origin: type: string enum: - IDENTITY description: Service that produced the error. message: type: string description: >- Human-readable explanation. Its wording may change without notice. required: - traceId - code - origin - message example: traceId: 1-68ee2a1b-3c4d5e6f7a8b9c0d1e2f3a4b code: APP_CLIENT_CONFLICT origin: IDENTITY message: App client already exists '422': description: >- `BAD_REQUEST` — The path or body failed validation; `fields` lists each invalid field. content: application/json: schema: type: object properties: traceId: type: string description: >- Identifier of the request that failed. Quote it when contacting support. example: 1-68ee2a1b-3c4d5e6f7a8b9c0d1e2f3a4b code: type: string enum: - BAD_REQUEST description: >- Stable, machine-readable error code. Branch on this, never on `message`. origin: type: string enum: - IDENTITY description: Service that produced the error. message: type: string description: >- Human-readable explanation. Its wording may change without notice. fields: type: array description: >- One entry per invalid request field (validation errors only). items: type: object properties: field: type: string description: >- Path of the invalid field, e.g. `label` or `values[0].value`. example: label message: type: string description: Why the field was rejected. example: label is required code: type: string description: >- `_` — e.g. `LABEL_REQUIRED`, `TYPE_ONE_OF`, `VALUES_VALUE_TYPE_ERROR`. example: LABEL_REQUIRED values: type: array items: type: string description: >- The accepted values, when the field is an enumeration. required: - field - message - code required: - traceId - code - origin - message example: traceId: 1-68ee2a1b-3c4d5e6f7a8b9c0d1e2f3a4b code: BAD_REQUEST origin: IDENTITY message: >- Bad Request: Your request is invalid or incomplete. Please make sure you are requesting with the right fields. fields: - field: description message: 'Invalid input: expected string, received undefined' code: DESCRIPTION_REQUIRED ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.