Cowdidocs
API ReferenceOAuth clients

Update an OAuth client

PATCH
/v1/oauth/clients/{oauthClientId}

Carries the whole editable record, so every field is set on every call. Requires the org:connect:write permission. Every requested scope must be a permission the caller holds, and the redirect URIs must match the client's grant type. Returns 400 when the redirect URIs do not match the grant type, 403 when a scope is not a permission the caller holds, 404 when the caller's organization has no client with this id, and 422 when the provider refuses the request.

Authorization

oauth2
AuthorizationBearer <token>

Create a client with POST /v1/oauth/clients, then exchange its credentials for an access token. AUTHORIZATION_CODE clients act on behalf of a signed-in user and always use PKCE; CLIENT_CREDENTIALS clients act as themselves. A client may only be granted scopes its creator already holds — read the grantable list from GET /v1/oauth/clients/scopes.

In: header

Path Parameters

oauthClientId*string

Unique identifier of the OAuth client.

Request Body

application/json

Request to update an OAuth client. It replaces the name, description, scopes, and redirects. An omitted description clears the existing one. grant_type cannot change.

Response Body

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

curl -X PATCH "https://example.com/v1/oauth/clients/app_2c9f8b3e1a7d4f56" \  -H "Content-Type: application/json" \  -d '{    "name": "Point of Sale Integration",    "scopes": [      "org:accounts:read"    ]  }'
{  "id": "app_2c9f8b3e1a7d4f56",  "client_id": "client_2c9f8b3e1a7d4f56",  "name": "Point of Sale Integration",  "description": "Point of sale integration for Nairobi branches",  "grant_type": "CLIENT_CREDENTIALS",  "scopes": [    "org:accounts:read"  ],  "redirect_uris": [    {      "uri": "https://partner.example.com/callback/cowdi",      "is_default": true    }  ],  "created_at": "2026-09-01T10:15:30Z"}
{  "code": "BAD_REQUEST",  "description": "Bad Request"}
{  "code": "UNAUTHORISED",  "description": "Unauthorised"}
{  "code": "FORBIDDEN",  "description": "Forbidden"}
{  "code": "BAD_REQUEST",  "description": "Invalid input"}
{  "code": "BAD_REQUEST",  "description": "Invalid input"}
{  "code": "RATE_LIMIT_EXCEEDED",  "description": "Too Many Requests"}
{  "code": "INTERNAL_ERROR",  "description": "Internal Server Error"}

Read one OAuth client GET

Reads one OAuth client of the caller's organization, without its secrets. Requires the `org:connect:read` permission. Returns 404 when the caller's organization has no client with this id.

Delete an OAuth client DELETE

Deletes an OAuth client and revokes every one of its secrets. Requires the `org:connect:write` permission. Tokens already issued stay valid until they expire. Returns 404 when the caller's organization has no client with this id.