Cowdidocs
API ReferenceOAuth clients

List the scopes the caller can grant

GET
/v1/oauth/clients/scopes

Lists the permissions the caller holds and can delegate. A client can be granted any of them and nothing else. Requires the org:connect:read permission.

Authorization

oauth2
AuthorizationBearer <token>

Create a client with POST /v1/oauth/clients, then exchange its credentials for an access token. AUTHORIZATION_CODE clients act on behalf of a signed-in user and always use PKCE; CLIENT_CREDENTIALS clients act as themselves. A client may only be granted scopes its creator already holds — read the grantable list from GET /v1/oauth/clients/scopes.

In: header

Response Body

application/json

application/json

application/json

application/json

application/json

application/json

curl -X GET "https://example.com/v1/oauth/clients/scopes"
{  "data": [    "org:accounts:read"  ],  "links": {    "next": "/v1/payees?after=eyJpZCI6MX0",    "prev": "/v1/payees?before=eyJpZCI6MX0"  }}
{  "code": "BAD_REQUEST",  "description": "Bad Request"}
{  "code": "UNAUTHORISED",  "description": "Unauthorised"}
{  "code": "FORBIDDEN",  "description": "Forbidden"}
{  "code": "RATE_LIMIT_EXCEEDED",  "description": "Too Many Requests"}
{  "code": "INTERNAL_ERROR",  "description": "Internal Server Error"}

Revoke a client secret DELETE

Revokes one secret of an OAuth client. Read `last_used_at` on the rotate the client secret response first, to confirm the holder has moved to the new secret. Requires the `org:connect:write` permission. Returns 404 when the caller's organization has no client with this id, or the client has no such secret.

Get the organization's API version GET

Returns the version the organization's requests run on when they send no `Cowdi-Version` header, the latest version, the rollback that is still possible, and every released version. Requires the `org:connect:read` permission on the organization. A request can run on another version for one call with the `Cowdi-Version` header.