Source:
<code>public Response applications() { checkAccountApiEnabled(); <START> auth.requireOneOf(AccountRoles.VIEW_APPLICATIONS, AccountRoles.MANAGE_APPLICATIONS); <END> List<String> activeClients = new LinkedList<String>(); List<UserSessionModel> sessions = session.sessions().getUserSessions(realm, user); for (UserSessionModel s : sessions) { activeClients.addAll(s.getAuthenticatedClientSessions().keySet()); } List<ClientRepresentation> apps = new LinkedList<>(); for (ClientModel client : realm.getClients()) { if (client.isBearerOnly()) { continue; } ClientRepresentation clientRep = new ClientRepresentation(); clientRep.setClientId(client.getClientId()); clientRep.setClientName(client.getName()); clientRep.setInternal(true); clientRep.setInUse(activeClients.contains(client.getClientId())); clientRep.setUrl(client.getBaseUrl()); apps.add(clientRep); } for (UserConsentModel consent : session.users().getConsents(realm, user.getId())) { ClientModel client = consent.getClient(); if (!new StorageId(client.getId()).isLocal()) { ClientRepresentation clientRep = new ClientRepresentation(); clientRep.setClientId(client.getClientId()); clientRep.setClientName(client.getName()); clientRep.setInternal(false); clientRep.setInUse(activeClients.contains(client.getClientId())); clientRep.setUrl(client.getBaseUrl()); apps.add(clientRep); } } return Cors.add(request, Response.ok(apps)).auth().allowedOrigins(auth.getToken()).build(); }</code><technical_language>@douglaspalmer I MANAGE_APPLICATIONS in removal endpoint, for listing VIEW_APPLICATIONS enough. sense? worth ask dev mailing list engage others think</technical_language>

Target:
public Response applications() { checkAccountApiEnabled(); auth.requireOneOf(AccountRoles.MANAGE_ACCOUNT, AccountRoles.VIEW_APPLICATIONS); Set<ClientModel> clients = new HashSet<ClientModel>(); List<String> inUseClients = new LinkedList<String>(); List<UserSessionModel> sessions = session.sessions().getUserSessions(realm, user); for(UserSessionModel s : sessions) { for (AuthenticatedClientSessionModel a : s.getAuthenticatedClientSessions().values()) { ClientModel client = a.getClient(); clients.add(client); inUseClients.add(client.getClientId()); } } List<String> offlineClients = new LinkedList<String>(); List<UserSessionModel> offlineSessions = session.sessions().getOfflineUserSessions(realm, user); for(UserSessionModel s : offlineSessions) { for(AuthenticatedClientSessionModel a : s.getAuthenticatedClientSessions().values()) { ClientModel client = a.getClient(); clients.add(client); offlineClients.add(client.getClientId()); } } Map<String, UserConsentModel> consentModels = new HashMap<String, UserConsentModel>(); List<UserConsentModel> consents = session.users().getConsents(realm, user.getId()); for (UserConsentModel consent : consents) { ClientModel client = consent.getClient(); clients.add(client); consentModels.put(client.getClientId(), consent); } List<ClientRepresentation> apps = new LinkedList<ClientRepresentation>(); for (ClientModel client : clients) { if (client.isBearerOnly() || client.getBaseUrl() == null) { continue; } apps.add(modelToRepresentation(client, inUseClients, offlineClients, consentModels)); } return Cors.add(request, Response.ok(apps)).auth().allowedOrigins(auth.getToken()).build(); }