Cowdidocs
API ReferenceOAuth clients

Revoke a client secret

DELETE
/v1/oauth/clients/{oauthClientId}/secrets/{secretId}

Revokes one secret of an OAuth client. Read last_used_at on the rotate the client secret response first, to confirm the holder has moved to the new secret. Requires the org:connect:write permission. Returns 404 when the caller's organization has no client with this id, or the client has no such secret.

Authorization

oauth2
AuthorizationBearer <token>

Create a client with POST /v1/oauth/clients, then exchange its credentials for an access token. AUTHORIZATION_CODE clients act on behalf of a signed-in user and always use PKCE; CLIENT_CREDENTIALS clients act as themselves. A client may only be granted scopes its creator already holds — read the grantable list from GET /v1/oauth/clients/scopes.

In: header

Path Parameters

oauthClientId*string

Unique identifier of the OAuth client.

secretId*string

Unique identifier of the client secret.

Response Body

application/json

application/json

application/json

application/json

application/json

application/json

curl -X DELETE "https://example.com/v1/oauth/clients/app_2c9f8b3e1a7d4f56/secrets/sec_8f14e45fceea167a"
Empty
{  "code": "BAD_REQUEST",  "description": "Bad Request"}
{  "code": "UNAUTHORISED",  "description": "Unauthorised"}
{  "code": "FORBIDDEN",  "description": "Forbidden"}
{  "code": "BAD_REQUEST",  "description": "Invalid input"}
{  "code": "RATE_LIMIT_EXCEEDED",  "description": "Too Many Requests"}
{  "code": "INTERNAL_ERROR",  "description": "Internal Server Error"}

Rotate the client secret POST

Mints a second secret so the holder can roll over. Deploy it, wait for `last_used_at` on the old secret to stop moving, then revoke the old one with the revoke a client secret operation. Requires the `org:connect:write` permission. Returns 404 when the caller's organization has no client with this id, and 409 when the client already holds the maximum number of secrets.

List the scopes the caller can grant GET

Lists the permissions the caller holds and can delegate. A client can be granted any of them and nothing else. Requires the `org:connect:read` permission.