> For the complete documentation index, see [llms.txt](https://navixy.com/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://navixy.com/docs/navixy-api/user-api/resources/commons/user/applications.md).

# User applications

Third-party applications embedded into the Navixy platform interface, and how to manage them through the API.

A user application embeds a third-party application into the platform interface, either inline or opened in a new tab. It is configured entirely from the account, with no developer or support involvement, using URL parameters, user authentication, and session management to pass context through to the embedded application.

Applications are usually configured from the interface. For those instructions, see [User applications in the user documentation](/docs/user/guide/account/user-applications.md). The operations below do the same configuration from code: they list, create, replace, delete, and hide applications.

## Application object

## The UserApplication object

```json
{"openapi":"3.1.0","info":{"title":"Navixy Platform API","version":"1.0.0"},"components":{"schemas":{"UserApplication":{"type":"object","description":"A custom application embedded into the platform interface and reachable from the side menu.\n\n**One `authorization` object, three shapes, selected by `type`.** `none` opens the URL with no credential, `user_session` passes the current platform session, and `api_key` passes a fixed key and is the only shape that carries `hash`.","properties":{"id":{"type":"integer","description":"Application identifier. Absent when creating, required when updating."},"label":{"type":"string","description":"Name shown in the side menu. Not blank, 1 to 50 characters, trimmed before it is stored.","minLength":1,"maxLength":50},"url_template":{"type":"string","description":"URL the application opens at. May carry placeholders that the interface substitutes when a user opens it: `{locale_code}`, `{user_identifier}`, and `{timezone}`. 4 to 1000 characters, trimmed before it is stored.","minLength":4,"maxLength":1000},"enabled":{"type":"boolean","description":"Whether the application appears in the side menu. Ignored on create, where a new application is always enabled. Defaults to `true` on update."},"authorization":{"type":"object","description":"How the application is authorised when its URL is opened. Defaults to `user_session`.","properties":{"type":{"type":"string","description":"Which of the three shapes this is, and therefore whether `hash` applies.","enum":["none","user_session","api_key"]},"hash":{"type":"string","description":"The API key to pass. **`api_key` only, and required for it.**"}}},"display_method":{"type":"string","description":"How the application opens: `new_tab` in a new browser tab, `embedded` inside the platform interface. Defaults to `new_tab`.","enum":["new_tab","embedded"]},"icon":{"type":"string","description":"Icon name shown beside the label in the side menu, for example `dashboard` or `camera`. Defaults to `extension`. Not checked against a list of names, and **not length-checked either, while the column holds 50 characters**."},"description":{"type":"string","description":"Longer plain-text description shown to users. Up to 1000 characters, trimmed before it is stored. Defaults to empty.","maxLength":1000}},"required":["label","url_template"]}}}}
```

## API actions

API base path: `/user/application`.

Operations that list no errors of their own return only the [general error codes](/docs/navixy-api/general/errors.md#error-codes).

***

*Required sub-user rights:* none.

## List user applications

> List the custom applications registered for the account, enabled or not.\
> \
> \*\*This operation needs no right of its own, only a valid session, and it returns the stored key of every application whose \`authorization.type\` is \`api\_key\`.\*\*\
> \
> Callable with an empty body. Also accepts GET.

```json
{"openapi":"3.1.0","info":{"title":"Navixy Platform API","version":"1.0.0"},"tags":[{"name":"Users","description":"Operations for authenticating a user, managing their sessions, reading and updating their settings and personal information, reading audit records, and registering custom applications. All resources under the /user/ path."}],"servers":[{"url":"https://api.eu.navixy.com/v2","description":"Navixy production server on European platform"},{"url":"https://api.us.navixy.com/v2","description":"Navixy production server on American platform"},{"url":"https://api.me.navixy.com/v2","description":"Navixy production server on Middle East platform"}],"security":[{"api_key":[]}],"components":{"securitySchemes":{"api_key":{"type":"apiKey","description":"Either a user session hash or an API key, with the \"NVX \" prefix, for example \"NVX 22eac1c27af4be7b9d04da2ce1af111b\". Obtain a session hash from the userAuth operation, or create an API key from the API keys operations. A small number of operations accept a session hash only and reject an API key with error code 4; each says so in its description.","name":"Authorization","in":"header"}},"schemas":{"UserApplication":{"type":"object","description":"A custom application embedded into the platform interface and reachable from the side menu.\n\n**One `authorization` object, three shapes, selected by `type`.** `none` opens the URL with no credential, `user_session` passes the current platform session, and `api_key` passes a fixed key and is the only shape that carries `hash`.","properties":{"id":{"type":"integer","description":"Application identifier. Absent when creating, required when updating."},"label":{"type":"string","description":"Name shown in the side menu. Not blank, 1 to 50 characters, trimmed before it is stored.","minLength":1,"maxLength":50},"url_template":{"type":"string","description":"URL the application opens at. May carry placeholders that the interface substitutes when a user opens it: `{locale_code}`, `{user_identifier}`, and `{timezone}`. 4 to 1000 characters, trimmed before it is stored.","minLength":4,"maxLength":1000},"enabled":{"type":"boolean","description":"Whether the application appears in the side menu. Ignored on create, where a new application is always enabled. Defaults to `true` on update."},"authorization":{"type":"object","description":"How the application is authorised when its URL is opened. Defaults to `user_session`.","properties":{"type":{"type":"string","description":"Which of the three shapes this is, and therefore whether `hash` applies.","enum":["none","user_session","api_key"]},"hash":{"type":"string","description":"The API key to pass. **`api_key` only, and required for it.**"}}},"display_method":{"type":"string","description":"How the application opens: `new_tab` in a new browser tab, `embedded` inside the platform interface. Defaults to `new_tab`.","enum":["new_tab","embedded"]},"icon":{"type":"string","description":"Icon name shown beside the label in the side menu, for example `dashboard` or `camera`. Defaults to `extension`. Not checked against a list of names, and **not length-checked either, while the column holds 50 characters**."},"description":{"type":"string","description":"Longer plain-text description shown to users. Up to 1000 characters, trimmed before it is stored. Defaults to empty.","maxLength":1000}},"required":["label","url_template"]}},"responses":{"ResponseError":{"description":"Error response object","content":{"application/json":{"schema":{"type":"object","properties":{"success":{"type":"boolean","description":"Always false."},"status":{"type":"object","description":"Error status. Present only when an error occurred.","properties":{"code":{"type":"integer","description":"An error code in this API, not an HTTP code."},"description":{"type":"string","description":"An error description."}}},"errors":{"type":"array","description":"Per-parameter detail, returned with validation failures such as error code 7. A parameter name here may be an internal field name rather than the documented parameter name.","items":{"type":"object","properties":{"parameter":{"type":"string","description":"Name of the parameter that failed validation."},"error":{"type":"string","description":"What was wrong with it."}}}}}}}}}}},"paths":{"/user/application/list":{"post":{"tags":["Users"],"summary":"List user applications","description":"List the custom applications registered for the account, enabled or not.\n\n**This operation needs no right of its own, only a valid session, and it returns the stored key of every application whose `authorization.type` is `api_key`.**\n\nCallable with an empty body. Also accepts GET.","operationId":"userApplicationList","responses":{"200":{"description":"The applications","content":{"application/json":{"schema":{"type":"object","properties":{"success":{"type":"boolean","description":"`true` if request finished successfully.","readOnly":true},"list":{"type":"array","items":{"$ref":"#/components/schemas/UserApplication"}}}}}}},"400":{"description":"Bad request. The response body carries the API-level error code in `status.code`. Validation failures also include an `errors` array naming each offending parameter.","$ref":"#/components/responses/ResponseError"},"default":{"$ref":"#/components/responses/ResponseError"}}}}}}
```

***

*Required sub-user rights:* `admin` (available only to master users).

## Create user application

> Register a custom application for the account.\
> \
> \`id\` and \`enabled\` are accepted and ignored: a new application is always created enabled, and \`user/application/enabled/set\` hides it afterwards.\
> \
> \*\*\`icon\` is not length-checked and is stored in a 50-character column\*\*, so a longer value fails with error code 1, a database error, rather than a validation error.\
> \
> Also accepts GET with the same parameters as query-string values.\
> \
> Requires the \`admin\` right.

```json
{"openapi":"3.1.0","info":{"title":"Navixy Platform API","version":"1.0.0"},"tags":[{"name":"Users","description":"Operations for authenticating a user, managing their sessions, reading and updating their settings and personal information, reading audit records, and registering custom applications. All resources under the /user/ path."}],"servers":[{"url":"https://api.eu.navixy.com/v2","description":"Navixy production server on European platform"},{"url":"https://api.us.navixy.com/v2","description":"Navixy production server on American platform"},{"url":"https://api.me.navixy.com/v2","description":"Navixy production server on Middle East platform"}],"security":[{"api_key":[]}],"components":{"securitySchemes":{"api_key":{"type":"apiKey","description":"Either a user session hash or an API key, with the \"NVX \" prefix, for example \"NVX 22eac1c27af4be7b9d04da2ce1af111b\". Obtain a session hash from the userAuth operation, or create an API key from the API keys operations. A small number of operations accept a session hash only and reject an API key with error code 4; each says so in its description.","name":"Authorization","in":"header"}},"schemas":{"UserApplication":{"type":"object","description":"A custom application embedded into the platform interface and reachable from the side menu.\n\n**One `authorization` object, three shapes, selected by `type`.** `none` opens the URL with no credential, `user_session` passes the current platform session, and `api_key` passes a fixed key and is the only shape that carries `hash`.","properties":{"id":{"type":"integer","description":"Application identifier. Absent when creating, required when updating."},"label":{"type":"string","description":"Name shown in the side menu. Not blank, 1 to 50 characters, trimmed before it is stored.","minLength":1,"maxLength":50},"url_template":{"type":"string","description":"URL the application opens at. May carry placeholders that the interface substitutes when a user opens it: `{locale_code}`, `{user_identifier}`, and `{timezone}`. 4 to 1000 characters, trimmed before it is stored.","minLength":4,"maxLength":1000},"enabled":{"type":"boolean","description":"Whether the application appears in the side menu. Ignored on create, where a new application is always enabled. Defaults to `true` on update."},"authorization":{"type":"object","description":"How the application is authorised when its URL is opened. Defaults to `user_session`.","properties":{"type":{"type":"string","description":"Which of the three shapes this is, and therefore whether `hash` applies.","enum":["none","user_session","api_key"]},"hash":{"type":"string","description":"The API key to pass. **`api_key` only, and required for it.**"}}},"display_method":{"type":"string","description":"How the application opens: `new_tab` in a new browser tab, `embedded` inside the platform interface. Defaults to `new_tab`.","enum":["new_tab","embedded"]},"icon":{"type":"string","description":"Icon name shown beside the label in the side menu, for example `dashboard` or `camera`. Defaults to `extension`. Not checked against a list of names, and **not length-checked either, while the column holds 50 characters**."},"description":{"type":"string","description":"Longer plain-text description shown to users. Up to 1000 characters, trimmed before it is stored. Defaults to empty.","maxLength":1000}},"required":["label","url_template"]}},"responses":{"ResponseError":{"description":"Error response object","content":{"application/json":{"schema":{"type":"object","properties":{"success":{"type":"boolean","description":"Always false."},"status":{"type":"object","description":"Error status. Present only when an error occurred.","properties":{"code":{"type":"integer","description":"An error code in this API, not an HTTP code."},"description":{"type":"string","description":"An error description."}}},"errors":{"type":"array","description":"Per-parameter detail, returned with validation failures such as error code 7. A parameter name here may be an internal field name rather than the documented parameter name.","items":{"type":"object","properties":{"parameter":{"type":"string","description":"Name of the parameter that failed validation."},"error":{"type":"string","description":"What was wrong with it."}}}}}}}}}}},"paths":{"/user/application/create":{"post":{"tags":["Users"],"summary":"Create user application","description":"Register a custom application for the account.\n\n`id` and `enabled` are accepted and ignored: a new application is always created enabled, and `user/application/enabled/set` hides it afterwards.\n\n**`icon` is not length-checked and is stored in a 50-character column**, so a longer value fails with error code 1, a database error, rather than a validation error.\n\nAlso accepts GET with the same parameters as query-string values.\n\nRequires the `admin` right.","operationId":"userApplicationCreate","requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"application":{"allOf":[{"$ref":"#/components/schemas/UserApplication"}],"description":"The application to create. Omit `id`."}},"required":["application"]}}}},"responses":{"200":{"description":"The created application","content":{"application/json":{"schema":{"type":"object","properties":{"success":{"type":"boolean","description":"`true` if request finished successfully.","readOnly":true},"id":{"type":"integer","description":"Identifier of the new application."}}}}}},"400":{"description":"Bad request. The response body carries the API-level error code in `status.code`. Validation failures also include an `errors` array naming each offending parameter.","$ref":"#/components/responses/ResponseError"},"402":{"description":"Error code 268, over quota: the account already holds as many applications as the platform allows.","$ref":"#/components/responses/ResponseError"},"403":{"description":"Operation not permitted, error code 13: the caller lacks the `admin` right.","$ref":"#/components/responses/ResponseError"},"default":{"$ref":"#/components/responses/ResponseError"}}}}}}
```

#### Errors

These errors come in addition to the [general error codes](/docs/navixy-api/general/errors.md#error-codes):

* 268 - Over quota, when the account already holds as many applications as the platform allows.

***

*Required sub-user rights:* `admin` (available only to master users).

## Update user application

> Replace an existing application.\
> \
> \*\*This is a full replacement, not a merge.\*\* Every optional field left out is reset to its default: \`enabled\` to \`true\`, \`authorization\` to \`user\_session\`, \`display\_method\` to \`new\_tab\`, \`icon\` to \`extension\`, and \`description\` to empty. Send the whole object, not only the fields being changed.\
> \
> \*\*The length limits are not enforced here, unlike on create.\*\* An over-long \`label\`, \`url\_template\`, \`description\`, or \`icon\` fails with error code 1, a database error, instead of error code 7. Types and enum values are still checked and still give error code 7.\
> \
> \`id\` has to name an existing application of this account. Naming one that does not exist, or leaving \`id\` out, returns error code 201, not found in database.\
> \
> Also accepts GET with the same parameters as query-string values.\
> \
> Requires the \`admin\` right.

```json
{"openapi":"3.1.0","info":{"title":"Navixy Platform API","version":"1.0.0"},"tags":[{"name":"Users","description":"Operations for authenticating a user, managing their sessions, reading and updating their settings and personal information, reading audit records, and registering custom applications. All resources under the /user/ path."}],"servers":[{"url":"https://api.eu.navixy.com/v2","description":"Navixy production server on European platform"},{"url":"https://api.us.navixy.com/v2","description":"Navixy production server on American platform"},{"url":"https://api.me.navixy.com/v2","description":"Navixy production server on Middle East platform"}],"security":[{"api_key":[]}],"components":{"securitySchemes":{"api_key":{"type":"apiKey","description":"Either a user session hash or an API key, with the \"NVX \" prefix, for example \"NVX 22eac1c27af4be7b9d04da2ce1af111b\". Obtain a session hash from the userAuth operation, or create an API key from the API keys operations. A small number of operations accept a session hash only and reject an API key with error code 4; each says so in its description.","name":"Authorization","in":"header"}},"schemas":{"UserApplication":{"type":"object","description":"A custom application embedded into the platform interface and reachable from the side menu.\n\n**One `authorization` object, three shapes, selected by `type`.** `none` opens the URL with no credential, `user_session` passes the current platform session, and `api_key` passes a fixed key and is the only shape that carries `hash`.","properties":{"id":{"type":"integer","description":"Application identifier. Absent when creating, required when updating."},"label":{"type":"string","description":"Name shown in the side menu. Not blank, 1 to 50 characters, trimmed before it is stored.","minLength":1,"maxLength":50},"url_template":{"type":"string","description":"URL the application opens at. May carry placeholders that the interface substitutes when a user opens it: `{locale_code}`, `{user_identifier}`, and `{timezone}`. 4 to 1000 characters, trimmed before it is stored.","minLength":4,"maxLength":1000},"enabled":{"type":"boolean","description":"Whether the application appears in the side menu. Ignored on create, where a new application is always enabled. Defaults to `true` on update."},"authorization":{"type":"object","description":"How the application is authorised when its URL is opened. Defaults to `user_session`.","properties":{"type":{"type":"string","description":"Which of the three shapes this is, and therefore whether `hash` applies.","enum":["none","user_session","api_key"]},"hash":{"type":"string","description":"The API key to pass. **`api_key` only, and required for it.**"}}},"display_method":{"type":"string","description":"How the application opens: `new_tab` in a new browser tab, `embedded` inside the platform interface. Defaults to `new_tab`.","enum":["new_tab","embedded"]},"icon":{"type":"string","description":"Icon name shown beside the label in the side menu, for example `dashboard` or `camera`. Defaults to `extension`. Not checked against a list of names, and **not length-checked either, while the column holds 50 characters**."},"description":{"type":"string","description":"Longer plain-text description shown to users. Up to 1000 characters, trimmed before it is stored. Defaults to empty.","maxLength":1000}},"required":["label","url_template"]}},"responses":{"OK":{"description":"Successful response","content":{"application/json":{"schema":{"type":"object","properties":{"success":{"type":"boolean","description":"`true` if request finished successfully.","readOnly":true}}}}}},"ResponseError":{"description":"Error response object","content":{"application/json":{"schema":{"type":"object","properties":{"success":{"type":"boolean","description":"Always false."},"status":{"type":"object","description":"Error status. Present only when an error occurred.","properties":{"code":{"type":"integer","description":"An error code in this API, not an HTTP code."},"description":{"type":"string","description":"An error description."}}},"errors":{"type":"array","description":"Per-parameter detail, returned with validation failures such as error code 7. A parameter name here may be an internal field name rather than the documented parameter name.","items":{"type":"object","properties":{"parameter":{"type":"string","description":"Name of the parameter that failed validation."},"error":{"type":"string","description":"What was wrong with it."}}}}}}}}}}},"paths":{"/user/application/update":{"post":{"tags":["Users"],"summary":"Update user application","description":"Replace an existing application.\n\n**This is a full replacement, not a merge.** Every optional field left out is reset to its default: `enabled` to `true`, `authorization` to `user_session`, `display_method` to `new_tab`, `icon` to `extension`, and `description` to empty. Send the whole object, not only the fields being changed.\n\n**The length limits are not enforced here, unlike on create.** An over-long `label`, `url_template`, `description`, or `icon` fails with error code 1, a database error, instead of error code 7. Types and enum values are still checked and still give error code 7.\n\n`id` has to name an existing application of this account. Naming one that does not exist, or leaving `id` out, returns error code 201, not found in database.\n\nAlso accepts GET with the same parameters as query-string values.\n\nRequires the `admin` right.","operationId":"userApplicationUpdate","requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"application":{"allOf":[{"$ref":"#/components/schemas/UserApplication"}],"description":"The replacement application, identified by its `id`."}},"required":["application"]}}}},"responses":{"200":{"description":"Application replaced","$ref":"#/components/responses/OK"},"400":{"description":"Bad request. The response body carries the API-level error code in `status.code`. Validation failures also include an `errors` array naming each offending parameter.","$ref":"#/components/responses/ResponseError"},"403":{"description":"Operation not permitted, error code 13: the caller lacks the `admin` right.","$ref":"#/components/responses/ResponseError"},"default":{"$ref":"#/components/responses/ResponseError"}}}}}}
```

#### Errors

These errors come in addition to the [general error codes](/docs/navixy-api/general/errors.md#error-codes):

* 201 - Not found in the database, when `id` names no application of this account, or is left out.

***

*Required sub-user rights:* `admin` (available only to master users).

## Delete user application

> Delete an application. It leaves the side menu immediately.\
> \
> Returns error code 201, not found in database, when no application of this account carries that identifier. \*\*Leaving \`application\_id\` out returns 201 as well, rather than a validation error.\*\*\
> \
> Also accepts GET with the same parameters as query-string values.\
> \
> Requires the \`admin\` right.

```json
{"openapi":"3.1.0","info":{"title":"Navixy Platform API","version":"1.0.0"},"tags":[{"name":"Users","description":"Operations for authenticating a user, managing their sessions, reading and updating their settings and personal information, reading audit records, and registering custom applications. All resources under the /user/ path."}],"servers":[{"url":"https://api.eu.navixy.com/v2","description":"Navixy production server on European platform"},{"url":"https://api.us.navixy.com/v2","description":"Navixy production server on American platform"},{"url":"https://api.me.navixy.com/v2","description":"Navixy production server on Middle East platform"}],"security":[{"api_key":[]}],"components":{"securitySchemes":{"api_key":{"type":"apiKey","description":"Either a user session hash or an API key, with the \"NVX \" prefix, for example \"NVX 22eac1c27af4be7b9d04da2ce1af111b\". Obtain a session hash from the userAuth operation, or create an API key from the API keys operations. A small number of operations accept a session hash only and reject an API key with error code 4; each says so in its description.","name":"Authorization","in":"header"}},"responses":{"OK":{"description":"Successful response","content":{"application/json":{"schema":{"type":"object","properties":{"success":{"type":"boolean","description":"`true` if request finished successfully.","readOnly":true}}}}}},"ResponseError":{"description":"Error response object","content":{"application/json":{"schema":{"type":"object","properties":{"success":{"type":"boolean","description":"Always false."},"status":{"type":"object","description":"Error status. Present only when an error occurred.","properties":{"code":{"type":"integer","description":"An error code in this API, not an HTTP code."},"description":{"type":"string","description":"An error description."}}},"errors":{"type":"array","description":"Per-parameter detail, returned with validation failures such as error code 7. A parameter name here may be an internal field name rather than the documented parameter name.","items":{"type":"object","properties":{"parameter":{"type":"string","description":"Name of the parameter that failed validation."},"error":{"type":"string","description":"What was wrong with it."}}}}}}}}}}},"paths":{"/user/application/delete":{"post":{"tags":["Users"],"summary":"Delete user application","description":"Delete an application. It leaves the side menu immediately.\n\nReturns error code 201, not found in database, when no application of this account carries that identifier. **Leaving `application_id` out returns 201 as well, rather than a validation error.**\n\nAlso accepts GET with the same parameters as query-string values.\n\nRequires the `admin` right.","operationId":"userApplicationDelete","requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"application_id":{"type":"integer","description":"Identifier of the application to delete."}},"required":["application_id"]}}}},"responses":{"200":{"description":"Application deleted","$ref":"#/components/responses/OK"},"400":{"description":"Bad request. The response body carries the API-level error code in `status.code`. Validation failures also include an `errors` array naming each offending parameter.","$ref":"#/components/responses/ResponseError"},"403":{"description":"Operation not permitted, error code 13: the caller lacks the `admin` right.","$ref":"#/components/responses/ResponseError"},"default":{"$ref":"#/components/responses/ResponseError"}}}}}}
```

#### Errors

These errors come in addition to the [general error codes](/docs/navixy-api/general/errors.md#error-codes):

* 201 - Not found in the database, when `application_id` names no application of this account, or is left out.

***

*Required sub-user rights:* `admin` (available only to master users).

## Show or hide a user application

> Show or hide an application in the side menu, leaving everything else about it unchanged.\
> \
> \*\*\`enabled\` is not treated as missing when it is left out: it falls back to \`false\` and the application is hidden.\*\* Always send it.\
> \
> Returns error code 201, not found in database, when no application of this account carries that identifier. Leaving \`application\_id\` out returns 201 as well.\
> \
> Also accepts GET with the same parameters as query-string values.\
> \
> Requires the \`admin\` right.

```json
{"openapi":"3.1.0","info":{"title":"Navixy Platform API","version":"1.0.0"},"tags":[{"name":"Users","description":"Operations for authenticating a user, managing their sessions, reading and updating their settings and personal information, reading audit records, and registering custom applications. All resources under the /user/ path."}],"servers":[{"url":"https://api.eu.navixy.com/v2","description":"Navixy production server on European platform"},{"url":"https://api.us.navixy.com/v2","description":"Navixy production server on American platform"},{"url":"https://api.me.navixy.com/v2","description":"Navixy production server on Middle East platform"}],"security":[{"api_key":[]}],"components":{"securitySchemes":{"api_key":{"type":"apiKey","description":"Either a user session hash or an API key, with the \"NVX \" prefix, for example \"NVX 22eac1c27af4be7b9d04da2ce1af111b\". Obtain a session hash from the userAuth operation, or create an API key from the API keys operations. A small number of operations accept a session hash only and reject an API key with error code 4; each says so in its description.","name":"Authorization","in":"header"}},"responses":{"OK":{"description":"Successful response","content":{"application/json":{"schema":{"type":"object","properties":{"success":{"type":"boolean","description":"`true` if request finished successfully.","readOnly":true}}}}}},"ResponseError":{"description":"Error response object","content":{"application/json":{"schema":{"type":"object","properties":{"success":{"type":"boolean","description":"Always false."},"status":{"type":"object","description":"Error status. Present only when an error occurred.","properties":{"code":{"type":"integer","description":"An error code in this API, not an HTTP code."},"description":{"type":"string","description":"An error description."}}},"errors":{"type":"array","description":"Per-parameter detail, returned with validation failures such as error code 7. A parameter name here may be an internal field name rather than the documented parameter name.","items":{"type":"object","properties":{"parameter":{"type":"string","description":"Name of the parameter that failed validation."},"error":{"type":"string","description":"What was wrong with it."}}}}}}}}}}},"paths":{"/user/application/enabled/set":{"post":{"tags":["Users"],"summary":"Show or hide a user application","description":"Show or hide an application in the side menu, leaving everything else about it unchanged.\n\n**`enabled` is not treated as missing when it is left out: it falls back to `false` and the application is hidden.** Always send it.\n\nReturns error code 201, not found in database, when no application of this account carries that identifier. Leaving `application_id` out returns 201 as well.\n\nAlso accepts GET with the same parameters as query-string values.\n\nRequires the `admin` right.","operationId":"userApplicationEnabledSet","requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"application_id":{"type":"integer","description":"Identifier of the application to show or hide."},"enabled":{"type":"boolean","description":"Whether the application appears in the side menu. Falls back to `false` when left out, which hides it."}},"required":["application_id","enabled"]}}}},"responses":{"200":{"description":"Visibility set","$ref":"#/components/responses/OK"},"400":{"description":"Bad request. The response body carries the API-level error code in `status.code`. Validation failures also include an `errors` array naming each offending parameter.","$ref":"#/components/responses/ResponseError"},"403":{"description":"Operation not permitted, error code 13: the caller lacks the `admin` right.","$ref":"#/components/responses/ResponseError"},"default":{"$ref":"#/components/responses/ResponseError"}}}}}}
```

#### Errors

These errors come in addition to the [general error codes](/docs/navixy-api/general/errors.md#error-codes):

* 201 - Not found in the database, when `application_id` names no application of this account, or is left out.

## How to authenticate custom applications

An embedded application can use Navixy's own authentication rather than asking users to sign in again, through the **Authentication Gateway**. The gateway sits between the two, so a user already signed in to Navixy reaches the embedded application already authenticated, handled on the backend.

The gateway gives an application:

* Automatic user authentication through Navixy sessions.
* Database access credentials for IoT and user data.
* Session management and token-based API authorization.

Custom dashboards, analytics tools, and business system integrations are the usual cases. For the implementation details, see [Authentication Gateway](/docs/navixy-api/user-api/resources/commons/user/applications/app-connect.md).


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://navixy.com/docs/navixy-api/user-api/resources/commons/user/applications.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.