Merge pull request #504 from mulesoft/W-12069284-connected-apps-client-apps-gr

Connected apps for client applciations

Author: glenn-rodgers-sf

modules/ROOT/assets/image-source-files/connected-app-client-apps.graffle

@@ -31,6 +31,7 @@
  ** xref:hash-client-credentials.adoc[Configure Credential Hashing for Mule 4]
  ** xref:migrate-client-apps.adoc[Migrate Client Applications]
  ** xref:datagraph-viewing-application-contracts.adoc[View Client Applications with Anypoint Datagraph Contracts]
+ ** xref:manage-client-apps-connected-apps-concept.adoc[Create Client Applications with Connected Apps]
 * xref:environments-concept.adoc[Manage Environments]
  ** xref:switch-environment-task.adoc[Switch Environments]
  ** xref:environment-permission-task.adoc[Grant Permission to Access an Environment]

modules/ROOT/assets/images/connected-app-client-apps.png

@@ -0,0 +1,105 @@
+
+= Creating Client Applications with Connected Apps
+ifndef::env-site,env-github[]
+include::_attributes.adoc[]
+endif::[]
+:keywords: grant access, api, contracts
+
+
+For automation use cases, you can use Connected Apps to create and manage client applications.
+
+Connected Apps help users delegate their access without sharing sensitive credentials or giving full control of their applications to third parties. Actions taken by connected apps are audited, and users can revoke access at any time.
+
+
+== Creating a Connected App
+
+To create a Connected App, see xref:access-management::connected-apps-developers.adoc[].
+
+When you create the Connected App to manage client applications, ensure that you:
+
+. Select *App acts on its own behalf (client credentials)* for *Type*.
+. Add the *Application Creator* scope.
+
+image::connected-app-client-apps.png[Screenshot calling out the location of App acts on its own behalf (client credentials) and Application Creator]
+
+[calloutlist]
+. *App acts on its own behalf (client credentials)* type
+. *Add Scopes* button to add *Application Creator* scope
+
+The new Connected App can now create client applications and manage the client applications that it creates.
+
+
+== Client Application Management
+
+When a Connected App creates a client application, the owner of the Connected App is the owner of the new client application. The owner can add additional users as owners by using API Manager.   
+
+The Connected App can manage the client application it created, and can perform the following actions:
+
+* Add users as client application owners
+* Request access to an API instance
+* Request a tier change
+* Reset a client applications secret
+
+You cannot add a Connected App as an owner of a client application. Connected Apps can only manage the client applications they create. 
+
+== Creating a Client Application with the API Manager API 
+
+After creating your Connected App, you can make requests to the API Manager API to create and manage client applications. 
+
+This section only demonstrates how to create a client application. For more information about the API Manager API requests to manage client applications, see https://anypoint.mulesoft.com/exchange/portals/anypoint-platform/f1e97bc6-315a-4490-82a7-23abe036327a.anypoint-platform/api-manager-api/[API Manager API Documentation^].
+
+To create a client application with the API Manager API:
+
+. Collect the following information to obtain your Authorization Token:
+
+* `<connected-app-client-id>`: *Id* of your connected app
+* `<connected-app-client-secret>`: *Secret* of your connected app
+
+. Execute the following request to obtain your Authorization Token after replacing the placeholders with the following: 
++
+[source,ssh]
+----
+curl --location --request POST 'https://anypoint.mulesoft.com/accounts/api/v2/oauth2/token' \
+--header 'Content-Type: application/json' \
+--data-raw '{
+ "grant_type": "client_credentials",
+ "client_id": "<connected-app-client-id>",
+ "client_secret": "<connected-app-client-secret>"
+}'
+----
+
+. Collect the following information to create your client application: 
+
+* `<your-org-id>`: *Organization ID* for the organization where you want to create the connected app
+* `<instance-id>`: API instance ID of the API instance you are creating a client application for
+* Client Application parameters:
+** `name`: Name of the application
+** `description`: Description of the application
+** `url`: URL of the application
+** `redirectURI`: An array of redirect Uris
+** `grantTypes`: An array of Grant Types, for example: `"password"`, `"implicit"`, `"client_credentials"`, `"authorization_code"`, and `"refresh_token"`
+** `apiEndpoints`: “true” or “false” value indicating whether to automatically register the redirect URIs.
+
+. Execute the following request to create your client application after replacing the placeholders with the following:
++
+[source,ssh]
+----
+curl --X POST 'https://anypoint.mulesoft.com/apiplatform/repository/v2/organizations/<your-org-id>/applications?apiVersionId=<instance-id>' \
+--header 'Authorization: bearer <anypoint_token>' \
+--header 'Content-Type: application/json' \
+--data '{ 
+     "redirectUri": ["http://example.com/"], 
+     "apiEndpoints": false, 
+     "name": "Sample Client Apps Name", 
+     "description": "Create this App for Sample Client Apps via API 1", 
+     "url": "https://www.example.com/app-test1"
+} '
+----
+
+
+
+== See Also
+
+* xref:exchange::to-request-access.adoc[Request Access to API Instances from Exchange]
+* xref:remove-client-app-latest-task.adoc[Remove API Instance Contracts]
+* xref:access-client-app-id-task.adoc[Obtain Client ID and Client Secret Credentials of a Client Application]