Stripe: Apps schemas
4 Stripe schemas with complete fields and constraints.
← Apps operations · All schemas
Create an app install — response body
| Field | Type | Presence | Description and constraints |
|---|---|---|---|
$ | object | Root | An app install represents a Stripe App that is installed on an account. It reports the permissions, content security policy entries, and endpoints that the installing account has authorized, along with any that the app's latest version requests but the account has not authorized yet. Use the Install API to install, reauthorize, and uninstall apps, and to check the state of existing installs. |
account | string | Required within parent | The ID of the account that the app install belongs to. Maximum length: 5000 |
app | string | Required within parent | The ID of the app installed. Maximum length: 5000 |
approval_required | boolean | Required within parent | Whether the installer must authorize pending permissions, content security policy entries, or endpoints. For private apps, `approval_required` stays `false`; creating or reauthorizing the install through the API installs the newest completed upload and grants its permissions. |
auth_code | JSON | Optional | |
auth_code (anyOf 1) | string | Alternative | The authorization code for an oauth app install. Maximum length: 5000 |
auth_code (anyOf 2) | null | Alternative | |
channel | string | Required within parent | The distribution channel associated with the app install. Known values: private_live, private_test, public, review, testing |
content_security_policy_granted | Model | Required within parent | Expand Create an app install — response body — content security policy granted |
content_security_policy_pending | Model | Required within parent | Expand Create an app install — response body — content security policy granted |
created | JSON | Required within parent | |
created (anyOf 1) | integer | Alternative | Time at which the object was created. Measured in seconds since the Unix epoch. Format: unix-time |
created (anyOf 2) | string | Alternative | Pattern: ^-?[0-9]+(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?$ |
created_by | JSON | Optional | |
created_by (anyOf 1) | string | Alternative | The ID of the embedding platform that created the install, if applicable. Maximum length: 5000 |
created_by (anyOf 2) | null | Alternative | |
endpoints_granted | array | Required within parent | The endpoint URLs authorized by the installer. |
endpoints_granted[] | string | Each item | Maximum length: 5000 |
endpoints_pending | array | Required within parent | The endpoint URLs requested by the latest app version that the installer has not authorized. |
endpoints_pending[] | string | Each item | Maximum length: 5000 |
id | string | Required within parent | Unique identifier for the object. Maximum length: 5000 |
livemode | boolean | Required within parent | If the object exists in live mode, the value is `true`. If the object exists in test mode, the value is `false`. |
object | string | Required within parent | String representing the object's type. Objects of the same type share the same value. Known values: apps.install |
permissions_granted | array | Required within parent | The permissions authorized by the installer. |
permissions_granted[] | string | Each item | Maximum length: 5000 |
permissions_pending | array | Required within parent | The permissions requested by the latest app version that the installer has not authorized. |
permissions_pending[] | string | Each item | Maximum length: 5000 |
status | string | Required within parent | The status of the app install. Known values: install_failed, installed, installing, uninstall_failed, uninstalling |
Referenced models: Create an app install — response body — content security policy granted
Create an app install — response body — content security policy granted
| Field | Type | Presence | Description and constraints |
|---|---|---|---|
$ | object | Root | |
connect_src | array | Required within parent | The URLs that the app can make network requests to. |
connect_src[] | string | Each item | Maximum length: 5000 |
image_src | array | Required within parent | The URLs that the app can load images from. |
image_src[] | string | Each item | Maximum length: 5000 |
Set a Secret — response body
| Field | Type | Presence | Description and constraints |
|---|---|---|---|
$ | object | Root | Secret Store is an API that allows Stripe Apps developers to securely persist secrets for use by UI Extensions and app backends. The primary resource in Secret Store is a `secret`. Other apps can't view secrets created by an app. Additionally, secrets are scoped to provide further permission control. All Dashboard users and the app backend share `account` scoped secrets. Use the `account` scope for secrets that don't change per-user, like a third-party API key. A `user` scoped secret is accessible by the app backend and one specific Dashboard user. Use the `user` scope for per-user secrets like per-user OAuth tokens, where different users might have different permissions. Related guide: [Store data between page reloads](https://docs.stripe.com/stripe-apps/store-auth-data-custom-objects) |
created | JSON | Required within parent | |
created (anyOf 1) | integer | Alternative | Time at which the object was created. Measured in seconds since the Unix epoch. Format: unix-time |
created (anyOf 2) | string | Alternative | Pattern: ^-?[0-9]+(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?$ |
deleted | boolean | Optional | If true, indicates that this secret has been deleted |
expires_at | JSON | Optional | |
expires_at (anyOf 1) | JSON | Alternative | |
expires_at (anyOf 1) (anyOf 1) | integer | Alternative | The Unix timestamp for the expiry time of the secret, after which the secret deletes. Format: unix-time |
expires_at (anyOf 1) (anyOf 2) | string | Alternative | Pattern: ^-?[0-9]+(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?$ |
expires_at (anyOf 2) | null | Alternative | |
id | string | Required within parent | Unique identifier for the object. Maximum length: 5000 |
livemode | boolean | Required within parent | If the object exists in live mode, the value is `true`. If the object exists in test mode, the value is `false`. |
name | string | Required within parent | A name for the secret that's unique within the scope. Maximum length: 5000 |
object | string | Required within parent | String representing the object's type. Objects of the same type share the same value. Known values: apps.secret |
payload | JSON | Optional | |
payload (anyOf 1) | string | Alternative | The plaintext secret value to be stored. Maximum length: 5000 |
payload (anyOf 2) | null | Alternative | |
scope | Model | Required within parent | Expand Set a Secret — response body — scope |
Referenced models: Set a Secret — response body — scope
Set a Secret — response body — scope
| Field | Type | Presence | Description and constraints |
|---|---|---|---|
$ | object | Root | |
type | string | Required within parent | The secret scope type. Known values: account, user |
user | string | Optional | The user ID, if type is set to "user" Maximum length: 5000 |