Customers automating the creation or migration of client applications may encounter the following errors when using older API endpoints:
HTTP 404 Not Found
GET /exchange/api/v1/organizations/{orgId}/environments/{envId}/apis — endpoint no longer exists in v1 or v2.
HTTP 200 OK — emptyresponse
GET /apiplatform/repository/v2/organizations/{orgId}/applications returns {"applications": [], "total": 0} even when apps exist.
HTTP 403 Forbidden
POST /apiplatform/repository/v2/organizations/{orgId}/applications — missing OAuth scopes on the Connected App.
The APIs referenced in older documentation have changed endpoints. The correct APIs for managing client applications and contracts are available through the Exchange Experience API v2. Empty HTTP 200 responses and HTTP 403 errors from Connected Apps are almost always caused by missing or insufficient OAuth scopes — not invalid credentials.
1. Obtain your Org ID
Log in to Anypoint Platform. Your Org ID is visible in the browser URL: https://anypoint.mulesoft.com/home/organizations/<YOUR_ORG_ID>/...
2 . Configure Connected App with correct scopes
Set the app type to "App acts on its own behalf (client credentials)" and add all required scopes:
3. Generate an access token:
POST to /accounts/api/v2/oauth2/token with grant_type: client_credentials, client_id, and client_secret.
4. Create a client application:
POST to /exchange/api/v2/organizations/{orgId}/applications with the app name, description, redirect URI, and API endpoint flag.
5. Retrieve client application IDsGET from /apiplatform/repository/v2/organizations/{orgId}/ applications with query params includeContractsForApiVersion=0&limit=200. Note the id field from each result — required for contract creation.
6. Create an API contract
POST to /exchange/api/v2/organizations/{orgId}/applications/{applicationId}/contracts with apiId, organizationId, groupId, assetId, version, and versionGroup.
API Endpoint Reference:
005385409

We use three kinds of cookies on our websites: required, functional, and advertising. You can choose whether functional and advertising cookies apply. Click on the different cookie categories to find out more about each category and to change the default settings.
Privacy Statement
Required cookies are necessary for basic website functionality. Some examples include: session cookies needed to transmit the website, authentication cookies, and security cookies.
Functional cookies enhance functions, performance, and services on the website. Some examples include: cookies used to analyze site traffic, cookies used for market research, and cookies used to display advertising that is not directed to a particular individual.
Advertising cookies track activity across websites in order to understand a viewer’s interests, and direct them specific marketing. Some examples include: cookies used for remarketing, or interest-based advertising.