Admin applications

An application is an OAuth2 client that can own one bot account. These routes inspect applications and transfer their ownership.

These records are the same ones the public Applications resource serves. Creation, deletion, renaming, bot creation, redirect URI editing, and credential rotation are available only through that resource.

Admin operations report credential metadata only

The Admin application object reports whether a client secret or bot token hash is stored, when it was created, and the non-secret bot token preview.

Admin application object

The Admin view of one application. An application and its bot account share one identifier, so an application that has a bot reports the same snowflake in id and bot_user_id.

Structure

Field	Type	Description
id	snowflake	The ID of the application
name	string	The display name (1-256 characters)
owner_user_id	snowflake	The ID of the owning account
owner_username1	?string	The username of the owner
owner_global_name1	?string	The display name of the owner, or null when unset
owner_discriminator1	?string	The discriminator of the owner, as four decimal digits with leading zeroes
bot_user_id	?snowflake	The ID of the bot account, or null when the application has no bot
bot_username2	?string	The username of the bot
bot_global_name2	?string	The display name of the bot, or null when unset
bot_discriminator2	?string	The discriminator of the bot, as four decimal digits with leading zeroes
bot_is_public	boolean	Whether an account other than the owner can add the bot
bot_require_code_grant	boolean	Whether adding the bot requires a completed authorisation code grant
oauth2_redirect_uris3	array[string]	The registered OAuth2 redirect URIs (at most 10 entries)
has_client_secret	boolean	Whether a client secret hash is stored
has_bot_token	boolean	Whether a bot token hash is stored
bot_token_preview	?string	The non-secret trailing preview of the bot token, or null when none is stored
bot_token_created_at	?ISO8601 timestamp	When the bot token was created, or null when none is stored
client_secret_created_at4	?ISO8601 timestamp	When the client secret was created
version5	integer	The optimistic locking version of the stored record (0-2147483647)

¹ Null when no account with owner_user_id exists

² Null when the application has no bot, and also null when no account with bot_user_id exists

³ The stored set arrives in no guaranteed order

⁴ Null when no client secret is stored, and null for the built-in Admin application

⁵ Incremented by every stored change, including one made through the public Applications resource

Example

{
  "id": "1501314428688998182",
  "name": "Metronome",
  "owner_user_id": "1483920011884392448",
  "owner_username": "wren",
  "owner_global_name": "Wren",
  "owner_discriminator": "0042",
  "bot_user_id": "1501314428688998182",
  "bot_username": "metronome",
  "bot_global_name": null,
  "bot_discriminator": "0001",
  "bot_is_public": true,
  "bot_require_code_grant": false,
  "oauth2_redirect_uris": ["https://example.com/oauth2/callback"],
  "has_client_secret": true,
  "has_bot_token": true,
  "bot_token_preview": "kQ9x",
  "bot_token_created_at": "2026-02-11T09:14:02.117Z",
  "client_secret_created_at": "2026-02-11T09:13:58.004Z",
  "version": 7
}

The built-in Admin application

FiveCord serves one synthetic application for its own Admin OAuth2 client. The application has no bot, so every bot_ field is null or false and has_bot_token is false. It also reports these values:

• id is the fixed constant 1234567890123456789.
• name is FiveCord Admin, and owner_user_id is the system account 0.
• oauth2_redirect_uris has one entry, the configured Admin endpoint followed by /oauth2_callback.
• has_client_secret is true in every response that returns this application, and client_secret_created_at is null.
• version is always 1.

The built-in application is read-only

Get application returns it only while an Admin client secret is configured for the deployment, and returns a null application otherwise. List applications never returns it. Transfer application ownership answers 403 FORBIDDEN.

List applications

GET/v1/admin/applicationsAudit reason

Returns the Admin application objects selected by exactly one of owner_id and guild_id. Requires application:lookup or application:list:by_owner.

The route returns the complete selection in one response. There is no cursor, no limit, and no name search.

Query parameters

Field	Type	Description
owner_id?1 2	snowflake	Select the applications owned by this account
guild_id?1 3	snowflake	Select the applications whose bot account is a member of this guild

¹ Supplying both fails with 400 INVALID_FORM_BODY reported against guild_id, and supplying neither fails against owner_id

² An owner_id naming no account fails with 404 UNKNOWN_USER

³ A guild_id naming no guild fails with 404 UNKNOWN_GUILD

owner_id returns every application the account owns, with or without a bot. guild_id returns an application only while its own bot account is a member of that guild.

Response body

Field	Type	Description
applications1	array[Admin application object]	The selected applications

¹ No order is guaranteed, and the array is empty when the account owns no application or the guild has no bot member

Response

Status	Body	Condition
200	response body	The selected applications were returned
404	error response	UNKNOWN_USER when owner_id names no account, or UNKNOWN_GUILD when guild_id names no guild

Side effects

The operation records one Admin audit entry with a metadata key application_count. An owner_id request records action list_user_applications, target type user, and the owner as target ID. A guild_id request records action list_guild_applications, target type guild, and the guild as target ID. A failed request records nothing.

Rate limit

200 requests per minute for each authenticated user, on the admin:lookup bucket.

Get application

GET/v1/admin/applications/{application_id}Audit reason

Returns one Admin application object wrapped in a single-member object. Requires application:lookup.

FiveCord answers 200 with application set to null when the ID names no application.

Path parameters

Field	Type	Description
application_id	snowflake	The ID of the application

Response body

Field	Type	Description
application1	?Admin application object	The resolved application, or null when no application has this ID

¹ Also null for the built-in Admin application on a deployment with no configured Admin client secret

Response

Status	Body	Condition
200	response body	The lookup completed, whether or not it resolved an application

Side effects

The operation records one Admin audit entry with action get_application, target type application, the path application_id as target ID, and a metadata key found. found is true when application is an object and false when it is null. A returned application adds owner_user_id, and bot_user_id when the application has a bot.

Rate limit

200 requests per minute for each authenticated user, on the admin:lookup bucket.

Transfer application ownership

PATCH/v1/admin/applications/{application_id}Audit reason

Moves the application to another account and returns the stored Admin application object. Requires application:transfer_ownership.

Ownership is the only field this operation writes. The new owner can be any existing account, and FiveCord does not notify the previous owner.

Path parameters

Field	Type	Description
application_id	snowflake	The ID of the application

JSON body

Field	Type	Description
new_owner_id1	snowflake	The account to transfer the application to

¹ An unknown application fails with 404 UNKNOWN_APPLICATION, and an unknown replacement owner fails with 404 UNKNOWN_USER. FiveCord looks up the application first, so a request where both are unknown fails with UNKNOWN_APPLICATION

Response body

Field	Type	Description
application	Admin application object	The application as stored after the transfer

Response

Status	Body	Condition
200	response body	Ownership was transferred
403	error response	FORBIDDEN because the target is the built-in Admin application
404	error response	UNKNOWN_APPLICATION for the application, or UNKNOWN_USER for the replacement owner

Side effects

The transfer changes owner_user_id, increments version, and updates the results of List applications and List user applications. It emits no Gateway Dispatch.

FiveCord records one Admin audit entry with the target type application, the target ID equal to the application ID, and the action transfer_ownership. Its metadata is old_owner_id and new_owner_id. Neither owner is resolved into related_users.

Rate limit

100 requests per minute for each authenticated user, on the admin:guild:modify bucket.