API Reference

IAM

Copy Markdown

Open in Claude

Open in ChatGPT

Open in Cursor

---

Copy Markdown

View as Markdown

OAuth Clients

List OAuth Clients

client.iam.oauthClients.list(OAuthClientListParams { account_id } params, RequestOptionsoptions?): SinglePage<OAuthClientListResponse { client_id, visibility, allowed_cors_origins, 16 more } >

GET/accounts/{account_id}/oauth_clients

OAuth Client Details

client.iam.oauthClients.get(stringoauthClientId, OAuthClientGetParams { account_id } params, RequestOptionsoptions?): OAuthClientGetResponse { client_id, visibility, allowed_cors_origins, 16 more }

GET/accounts/{account_id}/oauth_clients/{oauth_client_id}

Create OAuth Client

client.iam.oauthClients.create(OAuthClientCreateParams { account_id, client_name, grant_types, 10 more } params, RequestOptionsoptions?): OAuthClientCreateResponse { client_id, visibility, allowed_cors_origins, 17 more }

POST/accounts/{account_id}/oauth_clients

Update OAuth Client

client.iam.oauthClients.update(stringoauthClientId, OAuthClientUpdateParams { account_id, allowed_cors_origins, client_name, 11 more } params, RequestOptionsoptions?): OAuthClientUpdateResponse { client_id, visibility, allowed_cors_origins, 16 more }

PATCH/accounts/{account_id}/oauth_clients/{oauth_client_id}

Delete OAuth Client

client.iam.oauthClients.delete(stringoauthClientId, OAuthClientDeleteParams { account_id } params, RequestOptionsoptions?): OAuthClientDeleteResponse { id } | null

DELETE/accounts/{account_id}/oauth_clients/{oauth_client_id}

Rotate OAuth Client Secret

client.iam.oauthClients.rotateSecret(stringoauthClientId, OAuthClientRotateSecretParams { account_id } params, RequestOptionsoptions?): OAuthClientRotateSecretResponse { client_secret }

POST/accounts/{account_id}/oauth_clients/{oauth_client_id}/rotate_secret

Delete Rotated OAuth Client Secret

client.iam.oauthClients.deleteRotatedSecret(stringoauthClientId, OAuthClientDeleteRotatedSecretParams { account_id } params, RequestOptionsoptions?): OAuthClientDeleteRotatedSecretResponse { id } | null

DELETE/accounts/{account_id}/oauth_clients/{oauth_client_id}/rotate_secret

ModelsExpand Collapse

OAuthClientListResponse { client_id, visibility, allowed_cors_origins, 16 more }

Fields shared by OAuth client responses and create/update requests.

client_id: string

The unique identifier for an OAuth client.

visibility: "public" | "private"

Visibility of the OAuth client.

One of the following:

"public"

"private"

allowed_cors_origins?: Array<string>

Array of allowed CORS origins.

client_name?: string

Human-readable name of the OAuth client.

client_uri?: string

URL of the home page of the client.

client_uri_verification?: ClientURIVerification { status, text }

Client URI domain control verification state.

status?: "pending" | "in_progress" | "verified" | "failed"

Current verification status for the client URI host.

One of the following:

"pending"

"in_progress"

"verified"

"failed"

text?: string

Exact TXT record value that must be added to DNS to prove ownership of the client URI host.

created_at?: string

Timestamp when the OAuth client was created.

formatdate-time

grant_types?: Array<"authorization_code" | "refresh_token">

Array of OAuth grant types the client is allowed to use. authorization_code is required; refresh_token may be included optionally.

One of the following:

"authorization_code"

"refresh_token"

has_rotated_secret?: boolean

Indicates whether the client has a rotated secret that has not yet been deleted.

logo_uri?: string

URL of the client’s logo.

policy_uri?: string

URL that points to a privacy policy document.

post_logout_redirect_uris?: Array<string>

Array of allowed post-logout redirect URIs.

promoted_at?: string

Timestamp when the OAuth client was promoted to public visibility.

formatdate-time

redirect_uris?: Array<string>

Array of allowed redirect URIs for the client.

response_types?: Array<"token" | "id_token" | "code">

Array of OAuth response types the client is allowed to use.

One of the following:

"token"

"id_token"

"code"

scopes?: Array<string>

Array of OAuth scopes the client is allowed to request. Colon-delimited scopes are not accepted. Dot-delimited scopes are validated against available OAuth API scopes; simple identity scopes are allowed. Protocol scopes offline_access and openid are added or removed automatically based on grant_types and response_types.

token_endpoint_auth_method?: "none" | "client_secret_basic" | "client_secret_post"

The authentication method the client uses at the token endpoint.

One of the following:

"none"

"client_secret_basic"

"client_secret_post"

tos_uri?: string

URL that points to a terms of service document.

updated_at?: string

Timestamp when the OAuth client was last updated.

formatdate-time

OAuthClientGetResponse { client_id, visibility, allowed_cors_origins, 16 more }

Fields shared by OAuth client responses and create/update requests.

client_id: string

The unique identifier for an OAuth client.

visibility: "public" | "private"

Visibility of the OAuth client.

One of the following:

"public"

"private"

allowed_cors_origins?: Array<string>

Array of allowed CORS origins.

client_name?: string

Human-readable name of the OAuth client.

client_uri?: string

URL of the home page of the client.

client_uri_verification?: ClientURIVerification { status, text }

Client URI domain control verification state.

status?: "pending" | "in_progress" | "verified" | "failed"

Current verification status for the client URI host.

One of the following:

"pending"

"in_progress"

"verified"

"failed"

text?: string

Exact TXT record value that must be added to DNS to prove ownership of the client URI host.

created_at?: string

Timestamp when the OAuth client was created.

formatdate-time

grant_types?: Array<"authorization_code" | "refresh_token">

Array of OAuth grant types the client is allowed to use. authorization_code is required; refresh_token may be included optionally.

One of the following:

"authorization_code"

"refresh_token"

has_rotated_secret?: boolean

Indicates whether the client has a rotated secret that has not yet been deleted.

logo_uri?: string

URL of the client’s logo.

policy_uri?: string

URL that points to a privacy policy document.

post_logout_redirect_uris?: Array<string>

Array of allowed post-logout redirect URIs.

promoted_at?: string

Timestamp when the OAuth client was promoted to public visibility.

formatdate-time

redirect_uris?: Array<string>

Array of allowed redirect URIs for the client.

response_types?: Array<"token" | "id_token" | "code">

Array of OAuth response types the client is allowed to use.

One of the following:

"token"

"id_token"

"code"

scopes?: Array<string>

Array of OAuth scopes the client is allowed to request. Colon-delimited scopes are not accepted. Dot-delimited scopes are validated against available OAuth API scopes; simple identity scopes are allowed. Protocol scopes offline_access and openid are added or removed automatically based on grant_types and response_types.

token_endpoint_auth_method?: "none" | "client_secret_basic" | "client_secret_post"

The authentication method the client uses at the token endpoint.

One of the following:

"none"

"client_secret_basic"

"client_secret_post"

tos_uri?: string

URL that points to a terms of service document.

updated_at?: string

Timestamp when the OAuth client was last updated.

formatdate-time

OAuthClientCreateResponse { client_id, visibility, allowed_cors_origins, 17 more }

Fields shared by OAuth client responses and create/update requests.

client_id: string

The unique identifier for an OAuth client.

visibility: "public" | "private"

Visibility of the OAuth client.

One of the following:

"public"

"private"

allowed_cors_origins?: Array<string>

Array of allowed CORS origins.

client_name?: string

Human-readable name of the OAuth client.

client_secret?: string

The client secret. This is the only time the secret is returned in a response.

client_uri?: string

URL of the home page of the client.

client_uri_verification?: ClientURIVerification { status, text }

Client URI domain control verification state.

status?: "pending" | "in_progress" | "verified" | "failed"

Current verification status for the client URI host.

One of the following:

"pending"

"in_progress"

"verified"

"failed"

text?: string

Exact TXT record value that must be added to DNS to prove ownership of the client URI host.

created_at?: string

Timestamp when the OAuth client was created.

formatdate-time

grant_types?: Array<"authorization_code" | "refresh_token">

Array of OAuth grant types the client is allowed to use. authorization_code is required; refresh_token may be included optionally.

One of the following:

"authorization_code"

"refresh_token"

has_rotated_secret?: boolean

Indicates whether the client has a rotated secret that has not yet been deleted.

logo_uri?: string

URL of the client’s logo.

policy_uri?: string

URL that points to a privacy policy document.

post_logout_redirect_uris?: Array<string>

Array of allowed post-logout redirect URIs.

promoted_at?: string

Timestamp when the OAuth client was promoted to public visibility.

formatdate-time

redirect_uris?: Array<string>

Array of allowed redirect URIs for the client.

response_types?: Array<"token" | "id_token" | "code">

Array of OAuth response types the client is allowed to use.

One of the following:

"token"

"id_token"

"code"

scopes?: Array<string>

Array of OAuth scopes the client is allowed to request. Colon-delimited scopes are not accepted. Dot-delimited scopes are validated against available OAuth API scopes; simple identity scopes are allowed. Protocol scopes offline_access and openid are added or removed automatically based on grant_types and response_types.

token_endpoint_auth_method?: "none" | "client_secret_basic" | "client_secret_post"

The authentication method the client uses at the token endpoint.

One of the following:

"none"

"client_secret_basic"

"client_secret_post"

tos_uri?: string

URL that points to a terms of service document.

updated_at?: string

Timestamp when the OAuth client was last updated.

formatdate-time

OAuthClientUpdateResponse { client_id, visibility, allowed_cors_origins, 16 more }

Fields shared by OAuth client responses and create/update requests.

client_id: string

The unique identifier for an OAuth client.

visibility: "public" | "private"

Visibility of the OAuth client.

One of the following:

"public"

"private"

allowed_cors_origins?: Array<string>

Array of allowed CORS origins.

client_name?: string

Human-readable name of the OAuth client.

client_uri?: string

URL of the home page of the client.

client_uri_verification?: ClientURIVerification { status, text }

Client URI domain control verification state.

status?: "pending" | "in_progress" | "verified" | "failed"

Current verification status for the client URI host.

One of the following:

"pending"

"in_progress"

"verified"

"failed"

text?: string

Exact TXT record value that must be added to DNS to prove ownership of the client URI host.

created_at?: string

Timestamp when the OAuth client was created.

formatdate-time

grant_types?: Array<"authorization_code" | "refresh_token">

Array of OAuth grant types the client is allowed to use. authorization_code is required; refresh_token may be included optionally.

One of the following:

"authorization_code"

"refresh_token"

has_rotated_secret?: boolean

Indicates whether the client has a rotated secret that has not yet been deleted.

logo_uri?: string

URL of the client’s logo.

policy_uri?: string

URL that points to a privacy policy document.

post_logout_redirect_uris?: Array<string>

Array of allowed post-logout redirect URIs.

promoted_at?: string

Timestamp when the OAuth client was promoted to public visibility.

formatdate-time

redirect_uris?: Array<string>

Array of allowed redirect URIs for the client.

response_types?: Array<"token" | "id_token" | "code">

Array of OAuth response types the client is allowed to use.

One of the following:

"token"

"id_token"

"code"

scopes?: Array<string>

Array of OAuth scopes the client is allowed to request. Colon-delimited scopes are not accepted. Dot-delimited scopes are validated against available OAuth API scopes; simple identity scopes are allowed. Protocol scopes offline_access and openid are added or removed automatically based on grant_types and response_types.

token_endpoint_auth_method?: "none" | "client_secret_basic" | "client_secret_post"

The authentication method the client uses at the token endpoint.

One of the following:

"none"

"client_secret_basic"

"client_secret_post"

tos_uri?: string

URL that points to a terms of service document.

updated_at?: string

Timestamp when the OAuth client was last updated.

formatdate-time

OAuthClientDeleteResponse { id }

id: string

Identifier

maxLength32

minLength32

OAuthClientRotateSecretResponse { client_secret }

client_secret?: string

The new client secret.

OAuthClientDeleteRotatedSecretResponse { id }

id: string

Identifier

maxLength32

minLength32