v10

latestOpenAPI 3.0.0raw.githubusercontent.com2026-07-0582185581.9 KB

OAuth Apps

Update OAuth app

Update an OAuth app's configuration. All body fields are optional — supply only what should change. URL fields (homepageUrl, privacyPolicyUrl, termsOfServiceUrl) accept null to clear them.

Creator-only: even org admins cannot edit apps owned by other users.

When modifying allowedScopes, the new set must remain a subset of the caller's role-aware scope list (same rule as GET /oauth-clients/scopes). When adding authorization_code to allowedGrantTypes, redirectUris becomes required and must contain at least one URI; otherwise the request is rejected with 400 by the Zod refine on updateAppSchema.

This endpoint never rotates the client secret — use POST /oauth-clients/{appId}/regenerate-secret for that.

put/oauth-clients/{appId}

Path parameters

appIdstring required

OAuth app ID

Request body

namestring

App name

descriptionstring

App description

redirectUrisstring[]

Allowed redirect URIs (up to 10). Required when authorization_code grant type is enabled. Preserved in the database even if authorization_code is removed from grant types.

allowedGrantTypesstring[]

allowedScopesstring[]

homepageUrlstring uri nullable

privacyPolicyUrlstring uri nullable

termsOfServiceUrlstring uri nullable

accessTokenLifetimeinteger

refreshTokenLifetimeinteger

Response

OAuth app updated

messagestring required

Example response

{
  "message": "OAuth app updated successfully"
}