# Create

Launch stage: GA

`POST /api/2.0/accounts/{account_id}/oauth2/custom-app-integrations`

Create Custom OAuth App Integration.

 You can retrieve the custom OAuth app integration via [CustomAppIntegration/get](https://docs.databricks.com/api/account/customappintegration/get).

API scopes: authentication

## Path parameters

- `account_id` (string, optional)

## Request body

- `redirect_urls` (array of string, optional)
  List of OAuth redirect urls
- `name` (string, optional)
  Name of the custom OAuth app
- `confidential` (boolean, optional)
  This field indicates whether an OAuth client secret is required to authenticate this client.
  Default: `false`
- `token_access_policy` (object, optional)
  Token access policy
  - `access_token_ttl_in_minutes` (int32, optional)
    access token time to live in minutes
    Constraints: `[ 5 .. 1440 ]`
  - `refresh_token_ttl_in_minutes` (int32, optional)
    Refresh token time to live in minutes.
     When single-use refresh tokens are enabled, this represents the TTL of an individual refresh token.
     If the refresh token is used before it expires, a new one is issued with a renewed individual TTL.
    Constraints: `[ 5 .. 129600 ]`
  - `enable_single_use_refresh_tokens` (boolean, optional, Beta)
    Whether to enable single-use refresh tokens (refresh token rotation).
     If this feature is enabled, upon successfully getting a new access token using a refresh token, <Databricks> will
     issue a new refresh token along with the access token in the response and invalidate the old refresh token.
     The client should use the new refresh token to get access tokens in future requests.
  - `absolute_session_lifetime_in_minutes` (int32, optional, Beta)
    Absolute OAuth session TTL in minutes. Effective only when the single-use refresh token feature is enabled.
     This is the absolute TTL of all refresh tokens issued in one OAuth session. When a new refresh token is issued
     during refresh token rotation, it will inherit the same absolute TTL as the old refresh token.
     In other words, this represents the maximum amount of time a user can stay logged in without re-authenticating.
- `scopes` (array of string, optional)
  OAuth scopes granted to the application.
   Supported scopes: all-apis, sql, offline_access, openid, profile, email.
- `user_authorized_scopes` (array of string, optional)
  Scopes that will need to be consented by end user to mint the access token. If the user does
   not authorize the access token will not be minted.
   Must be a subset of scopes.

## Returns

- `integration_id` (string, optional)
  Unique integration id for the custom OAuth app
- `client_id` (string, optional)
  OAuth client-id generated by the <Databricks>
- `client_secret` (string, optional)
  OAuth client-secret generated by the <Databricks>.
   If this is a confidential OAuth app client-secret will be generated.

## Request

```json
{
  "confidential": true,
  "name": "Example Tableau Server",
  "redirect_urls": [
    "https://example.online.tableau.com/auth/add_oauth_token"
  ],
  "scopes": [
    "all-apis",
    "offline_access"
  ],
  "token_access_policy": {
    "access_token_ttl_in_minutes": 120,
    "refresh_token_ttl_in_minutes": 200
  }
}
```

## Response

```json
{
  "client_id": "0oa6ahowk1AUgLWxL1d8",
  "client_secret": "8t_0x1DExmFmqgxl2ImHIrAeaWUYH1rql3MX1zKa",
  "integration_id": "b2b136c1-ab31-2abc-bd21-885a0208f123"
}
```