v1
latestOpenAPI 3.0.02026-08-064311,0881.3 MBoauthManagement
Create a new OAuth client.
Creates a new OAuth clientId and clientSecret.
post/v1/oauth/clients
Request body
typestring required
Type of the object model.
scopesstring[] required
Scopes assigned to the client.
MCP Server Required Scopes: For full access to all MCP Server tools, the following scopes are required. Each tool lists the scopes it needs.
- alerts___alertsReadById — viewAlerts
- alerts___alertsSearch — viewAlerts
- dashboards___getDashboard — viewLibrary
- dashboards___listDashboards — viewLibrary
- dashboards___createDashboard — manageLibrary
- dashboards___updateDashboard — manageLibrary
- discovery___listPartitions — viewPartitions
- discovery___listExtractionRules — viewFieldExtractionRules
- discovery___listCustomFields — viewFields
- log-search___runLogSearch — runLogSearch
- insights___getAllInsights — viewCse
- insights___getInsight — viewCse
- insights___getInsights — viewCse
- insights___updateInsightAssignee — viewCse, cseManageInsightAssignee
- insights___updateInsightStatus — viewCse, cseManageInsightStatus
- rules___getRule — viewCse, cseViewRules
- rules___getRules — viewCse, cseViewRules
- rules___createTemplatedMatchRule — viewCse, cseManageRules
- rules___createThresholdRule — viewCse, cseManageRules
Alerting
- viewAlerts (MCP Server)
- adminMonitorsV2
- viewMonitorsV2
- manageMonitorsV2
- viewMutingSchedules
- manageMutingSchedules
Audit Event Management
- searchAuditIndex
- dataVolumeIndex
- auditEventIndex
Cloud SIEM
- viewCse (MCP Server)
- cseViewRules (MCP Server)
- cseManageRules (MCP Server)
- cseManageInsightAssignee (MCP Server)
- cseManageInsightStatus (MCP Server)
- cseCommentOnInsights
- cseCreateInsights
- cseDeleteInsights
- cseInvokeInsights
- cseManageInsightPolicy
- cseManageInsightSignals
- cseManageInsightTags
- cseViewThreatIntelligence
- cseManageThreatIntelligence
- cseViewMatchLists
- cseManageMatchLists
- cseViewFileAnalysis
- cseManageFileAnalysis
- cseViewCustomInsights
- cseManageCustomInsights
- cseViewNetworkBlocks
- cseManageNetworkBlocks
- cseViewSuppressedEntities
- cseManageSuppressedEntities
- cseViewMappings
- cseManageMappings
- cseManageArtifacts
- cseViewCustomInsightStatuses
- cseManageCustomInsightStatuses
- cseViewContextActions
- cseManageContextActions
- cseViewActions
- cseManageActions
- cseViewEnrichments
- cseManageEnrichments
- cseViewCustomEntityType
- cseManageCustomEntityType
- cseViewEntity
- cseManageEntity
- cseViewEntityConfiguration
- cseManageEntityConfiguration
- cseViewEntityCriticality
- cseManageEntityCriticality
- cseViewTagSchemas
- cseManageTagSchemas
- cseManageFavoriteFields
- cseViewEntityGroups
- cseManageEntityGroups
- cseViewAutomations
- cseManageAutomations
- cseExecuteAutomations
Cloud SOAR
- viewCloudSoar
- cloudSoarAPIAdmin
- cloudSoarAPIEmailEdit
- cloudSoarAPIEmailRead
- cloudSoarAPIUse
- cloudSoarAppCentralAccess
- cloudSoarAppCentralExport
- cloudSoarAuditAndInformationAuditTrail
- cloudSoarAuditAndInformationConfigureAuditTrail
- cloudSoarAuditAndInformationLicenseInformation
- cloudSoarAutomationRulesAccess
- cloudSoarAutomationRulesConfigure
- cloudSoarBridgeMonitoringAccess
- cloudSoarCustomizationFields
- cloudSoarCustomizationIncidentLabels
- cloudSoarCustomizationLogo
- cloudSoarDashboardAccess
- cloudSoarDashboardAll
- cloudSoarEntitiesAccess
- cloudSoarEntitiesBulkPhysicalDelete
- cloudSoarEntitiesManage
- cloudSoarGeneralConfigure
- cloudSoarIncidentAccess
- cloudSoarIncidentAccessAll
- cloudSoarIncidentAttachmentsAccess
- cloudSoarIncidentAttachmentsEdit
- cloudSoarIncidentBulkOperations
- cloudSoarIncidentChangeOwnership
- cloudSoarIncidentEdit
- cloudSoarIncidentFoldersEdit
- cloudSoarIncidentManageInvestigators
- cloudSoarIncidentNotesAccess
- cloudSoarIncidentNotesEdit
- cloudSoarIncidentPlaybooksAccess
- cloudSoarIncidentPlaybooksEdit
- cloudSoarIncidentPlaybooksManage
- cloudSoarIncidentTaskAccess
- cloudSoarIncidentTaskAccessAll
- cloudSoarIncidentTaskEdit
- cloudSoarIncidentTaskReassign
- cloudSoarIncidentTaskView
- cloudSoarIncidentTemplatesAccess
- cloudSoarIncidentTemplatesConfigure
- cloudSoarIncidentTriageAccess
- cloudSoarIncidentTriageAccessAll
- cloudSoarIncidentTriageChangeOwnership
- cloudSoarIncidentTriageEdit
- cloudSoarIncidentTriageView
- cloudSoarIncidentView
- cloudSoarIncidentWarRoomUse
- cloudSoarIntegrationsAccess
- cloudSoarIntegrationsConfigure
- cloudSoarNotificationConfigure
- cloudSoarNotificationTriage
- cloudSoarObservabilityAccess
- cloudSoarObservabilityManagement
- cloudSoarPlaybooksAccess
- cloudSoarPlaybooksConfigure
- cloudSoarReportAccess
- cloudSoarReportAll
- cloudSoarUserManagementGroups
- cloudSoarWidgetsAll
Dashboards
- worldDashboards
- whitelistDashboards
- shareDashboardAllowlist
- manageDashboardExecutionControls
Data Management
- manageApps
- viewCollectors
- manageCollectors
- viewConnections
- manageConnections
- contentAdmin
- viewFieldExtractionRules (MCP Server)
- manageFieldExtractionRules
- viewFields (MCP Server)
- manageFields
- manageBudgets
- viewLibrary (MCP Server)
- manageLibrary (MCP Server)
- viewPartitions (MCP Server)
- managePartitions
- manageS3DataForwarding
- viewScheduledViews
- manageScheduledViews
- manageTokens
- viewPipelines
- managePipelines
- viewAccountOverview
- dataVolume
- downloadSearchResults
- viewDeletionRules
- manageDeletionRules
- reviewDeletionRequest
- viewEventExtractionRules
- manageEventExtractionRules
- viewParsers
Data Masking
- viewUnmaskedData
- manageDataMasking
Entity Management
- manageEntityTypeConfig
Logs
- runLogSearch (MCP Server)
Macros
- manageMacros
Metrics
- runMetricsQuery
- metricsTransformation
- metricsExtraction
- metricsRules
Open Analytics
- manageOpenAnalyticsEndpoint
Organizations
- viewOrganizations
- createTrialOrganizations
- createOrganizations
- upgradeTrialOrganizations
- changeCreditsAllocation
- deactivateOrganizations
- manageOrganizations
Reliability Management
- viewSlos
- manageSlos
Security
- manageAccessKeys
- viewPersonalAccessKeys
- managePersonalAccessKeys
- manageOAuthClients
- changeDataAccessLevel
- passwordPolicy
- ipWhitelisting
- ipAllowlisting
- supportAccount
- audit
- saml
- worldDashboardMaster
- orgSettings
Threat Intelligence
- viewThreatIntelDataStore
- manageThreatIntelDataStore
Usage Management
- viewUsageManagement
- manageUsageManagement
User Management
- viewUsersAndRoles
- manageUsersAndRoles
Example request
{
"scopes": [
"manageUsersAndRoles",
"viewCollectors"
]
}Response
The OAuth client has been created.
typestring required
Type of the object model.
idstring required
Unique identifier of the OAuth client.
clientIdstring required
Identifier of the OAuth client. Unique within each organization. Will be a URL for dynamically generated clients.
createdAtstring date-time required
Creation timestamp in UTC in RFC3339 format.
createdBystring required
Identifier of the user who created the OAuth client.
modifiedAtstring date-time required
Last modification timestamp in UTC.
modifiedBystring required
Identifier of the user who modified the OAuth client.
namestring required
Name of the OAuth client.
descriptionstring required
Description of the OAuth client.
disabledboolean required
Whether the OAuth client is disabled. Disabled OAuth clients cannot be used to authenticate users.
scopesstring[] required
Scopes assigned to the client.
MCP Server Required Scopes: For full access to all MCP Server tools, the following scopes are required. Each tool lists the scopes it needs.
- alerts___alertsReadById — viewAlerts
- alerts___alertsSearch — viewAlerts
- dashboards___getDashboard — viewLibrary
- dashboards___listDashboards — viewLibrary
- dashboards___createDashboard — manageLibrary
- dashboards___updateDashboard — manageLibrary
- discovery___listPartitions — viewPartitions
- discovery___listExtractionRules — viewFieldExtractionRules
- discovery___listCustomFields — viewFields
- log-search___runLogSearch — runLogSearch
- insights___getAllInsights — viewCse
- insights___getInsight — viewCse
- insights___getInsights — viewCse
- insights___updateInsightAssignee — viewCse, cseManageInsightAssignee
- insights___updateInsightStatus — viewCse, cseManageInsightStatus
- rules___getRule — viewCse, cseViewRules
- rules___getRules — viewCse, cseViewRules
- rules___createTemplatedMatchRule — viewCse, cseManageRules
- rules___createThresholdRule — viewCse, cseManageRules
Alerting
- viewAlerts (MCP Server)
- adminMonitorsV2
- viewMonitorsV2
- manageMonitorsV2
- viewMutingSchedules
- manageMutingSchedules
Audit Event Management
- searchAuditIndex
- dataVolumeIndex
- auditEventIndex
Cloud SIEM
- viewCse (MCP Server)
- cseViewRules (MCP Server)
- cseManageRules (MCP Server)
- cseManageInsightAssignee (MCP Server)
- cseManageInsightStatus (MCP Server)
- cseCommentOnInsights
- cseCreateInsights
- cseDeleteInsights
- cseInvokeInsights
- cseManageInsightPolicy
- cseManageInsightSignals
- cseManageInsightTags
- cseViewThreatIntelligence
- cseManageThreatIntelligence
- cseViewMatchLists
- cseManageMatchLists
- cseViewFileAnalysis
- cseManageFileAnalysis
- cseViewCustomInsights
- cseManageCustomInsights
- cseViewNetworkBlocks
- cseManageNetworkBlocks
- cseViewSuppressedEntities
- cseManageSuppressedEntities
- cseViewMappings
- cseManageMappings
- cseManageArtifacts
- cseViewCustomInsightStatuses
- cseManageCustomInsightStatuses
- cseViewContextActions
- cseManageContextActions
- cseViewActions
- cseManageActions
- cseViewEnrichments
- cseManageEnrichments
- cseViewCustomEntityType
- cseManageCustomEntityType
- cseViewEntity
- cseManageEntity
- cseViewEntityConfiguration
- cseManageEntityConfiguration
- cseViewEntityCriticality
- cseManageEntityCriticality
- cseViewTagSchemas
- cseManageTagSchemas
- cseManageFavoriteFields
- cseViewEntityGroups
- cseManageEntityGroups
- cseViewAutomations
- cseManageAutomations
- cseExecuteAutomations
Cloud SOAR
- viewCloudSoar
- cloudSoarAPIAdmin
- cloudSoarAPIEmailEdit
- cloudSoarAPIEmailRead
- cloudSoarAPIUse
- cloudSoarAppCentralAccess
- cloudSoarAppCentralExport
- cloudSoarAuditAndInformationAuditTrail
- cloudSoarAuditAndInformationConfigureAuditTrail
- cloudSoarAuditAndInformationLicenseInformation
- cloudSoarAutomationRulesAccess
- cloudSoarAutomationRulesConfigure
- cloudSoarBridgeMonitoringAccess
- cloudSoarCustomizationFields
- cloudSoarCustomizationIncidentLabels
- cloudSoarCustomizationLogo
- cloudSoarDashboardAccess
- cloudSoarDashboardAll
- cloudSoarEntitiesAccess
- cloudSoarEntitiesBulkPhysicalDelete
- cloudSoarEntitiesManage
- cloudSoarGeneralConfigure
- cloudSoarIncidentAccess
- cloudSoarIncidentAccessAll
- cloudSoarIncidentAttachmentsAccess
- cloudSoarIncidentAttachmentsEdit
- cloudSoarIncidentBulkOperations
- cloudSoarIncidentChangeOwnership
- cloudSoarIncidentEdit
- cloudSoarIncidentFoldersEdit
- cloudSoarIncidentManageInvestigators
- cloudSoarIncidentNotesAccess
- cloudSoarIncidentNotesEdit
- cloudSoarIncidentPlaybooksAccess
- cloudSoarIncidentPlaybooksEdit
- cloudSoarIncidentPlaybooksManage
- cloudSoarIncidentTaskAccess
- cloudSoarIncidentTaskAccessAll
- cloudSoarIncidentTaskEdit
- cloudSoarIncidentTaskReassign
- cloudSoarIncidentTaskView
- cloudSoarIncidentTemplatesAccess
- cloudSoarIncidentTemplatesConfigure
- cloudSoarIncidentTriageAccess
- cloudSoarIncidentTriageAccessAll
- cloudSoarIncidentTriageChangeOwnership
- cloudSoarIncidentTriageEdit
- cloudSoarIncidentTriageView
- cloudSoarIncidentView
- cloudSoarIncidentWarRoomUse
- cloudSoarIntegrationsAccess
- cloudSoarIntegrationsConfigure
- cloudSoarNotificationConfigure
- cloudSoarNotificationTriage
- cloudSoarObservabilityAccess
- cloudSoarObservabilityManagement
- cloudSoarPlaybooksAccess
- cloudSoarPlaybooksConfigure
- cloudSoarReportAccess
- cloudSoarReportAll
- cloudSoarUserManagementGroups
- cloudSoarWidgetsAll
Dashboards
- worldDashboards
- whitelistDashboards
- shareDashboardAllowlist
- manageDashboardExecutionControls
Data Management
- manageApps
- viewCollectors
- manageCollectors
- viewConnections
- manageConnections
- contentAdmin
- viewFieldExtractionRules (MCP Server)
- manageFieldExtractionRules
- viewFields (MCP Server)
- manageFields
- manageBudgets
- viewLibrary (MCP Server)
- manageLibrary (MCP Server)
- viewPartitions (MCP Server)
- managePartitions
- manageS3DataForwarding
- viewScheduledViews
- manageScheduledViews
- manageTokens
- viewPipelines
- managePipelines
- viewAccountOverview
- dataVolume
- downloadSearchResults
- viewDeletionRules
- manageDeletionRules
- reviewDeletionRequest
- viewEventExtractionRules
- manageEventExtractionRules
- viewParsers
Data Masking
- viewUnmaskedData
- manageDataMasking
Entity Management
- manageEntityTypeConfig
Logs
- runLogSearch (MCP Server)
Macros
- manageMacros
Metrics
- runMetricsQuery
- metricsTransformation
- metricsExtraction
- metricsRules
Open Analytics
- manageOpenAnalyticsEndpoint
Organizations
- viewOrganizations
- createTrialOrganizations
- createOrganizations
- upgradeTrialOrganizations
- changeCreditsAllocation
- deactivateOrganizations
- manageOrganizations
Reliability Management
- viewSlos
- manageSlos
Security
- manageAccessKeys
- viewPersonalAccessKeys
- managePersonalAccessKeys
- manageOAuthClients
- changeDataAccessLevel
- passwordPolicy
- ipWhitelisting
- ipAllowlisting
- supportAccount
- audit
- saml
- worldDashboardMaster
- orgSettings
Threat Intelligence
- viewThreatIntelDataStore
- manageThreatIntelDataStore
Usage Management
- viewUsageManagement
- manageUsageManagement
User Management
- viewUsersAndRoles
- manageUsersAndRoles
Example response
{
"id": "0000000006743FDE",
"clientId": "zVplCFHcpTDwtktBIQmFI2K6s9HEo4HAtcQD1f1M5eQ",
"createdAt": "2018-10-16T09:10:00Z",
"createdBy": "0000000006743FDD",
"modifiedAt": "2018-10-16T09:10:00Z",
"modifiedBy": "0000000006743FDD",
"name": "My OAuth Client",
"description": "OAuth client for data ingestion",
"scopes": [
"manageUsersAndRoles",
"viewCollectors"
]
}