Cowdidocs
API ReferenceOAuth clients

Delete an OAuth client

DELETE
/v1/oauth/clients/{oauthClientId}

Deletes an OAuth client and revokes every one of its secrets. Requires the org:connect:write permission. Tokens already issued stay valid until they expire. Returns 404 when the caller's organization has no client with this id.

Authorization

oauth2
AuthorizationBearer <token>

Create a client with POST /v1/oauth/clients, then exchange its credentials for an access token. AUTHORIZATION_CODE clients act on behalf of a signed-in user and always use PKCE; CLIENT_CREDENTIALS clients act as themselves. A client may only be granted scopes its creator already holds — read the grantable list from GET /v1/oauth/clients/scopes.

In: header

Path Parameters

oauthClientId*string

Unique identifier of the OAuth client.

Response Body

application/json

application/json

application/json

application/json

application/json

application/json

curl -X DELETE "https://example.com/v1/oauth/clients/app_2c9f8b3e1a7d4f56"
Empty
{  "code": "BAD_REQUEST",  "description": "Bad Request"}
{  "code": "UNAUTHORISED",  "description": "Unauthorised"}
{  "code": "FORBIDDEN",  "description": "Forbidden"}
{  "code": "BAD_REQUEST",  "description": "Invalid input"}
{  "code": "RATE_LIMIT_EXCEEDED",  "description": "Too Many Requests"}
{  "code": "INTERNAL_ERROR",  "description": "Internal Server Error"}

Update an OAuth client PATCH

Carries the whole editable record, so every field is set on every call. Requires the `org:connect:write` permission. Every requested scope must be a permission the caller holds, and the redirect URIs must match the client's grant type. Returns 400 when the redirect URIs do not match the grant type, 403 when a scope is not a permission the caller holds, 404 when the caller's organization has no client with this id, and 422 when the provider refuses the request.

List the secrets of an OAuth client GET

Lists a client's secrets, with their hints and last-used times. The plain text is not readable here; it is shown once, when the secret is minted. Requires the `org:connect:read` permission. Returns 404 when the caller's organization has no client with this id.