---
title: "List OAuth Grants"
method: GET
path: "/users/me/oauth_grants"
tags: ["Users"]
---

# List OAuth Grants

`GET /users/me/oauth_grants`

Lists the authenticated user's own OAuth grants — one per app they have authorized, per account they authorized it for. The list is always the caller's own; there is no parameter for reading another user's grants. Requires a user session: an API key or an OAuth token is refused, so an app can never enumerate the other apps a user has authorized.

## Query parameters

- `app_id` string
- `first` integer
- `after` string
- `last` integer
- `before` string
- `order` 'created_at'
- `direction` 'asc' | 'desc'

## Response `200`

oauth grants listed

- object
  - `data` OauthGrant[], required
    - `account_id` string, nullable, required — The account the grant is scoped to, prefixed `biz_`. `null` when the user authorized the app for themselves rather than for one of their accounts.
    - `app_id` string, required — The app this grant authorizes, prefixed `app_`.
    - `authorized_at` string, nullable, required — When the user last authorized the app, as an ISO 8601 timestamp.
    - `created_at` string, required — When the user first authorized the app, as an ISO 8601 timestamp.
    - `id` string, required — Grant ID, prefixed `oag_`.
    - `redirect_url` string — Where to send the user to finish the flow: the `redirect_uri` you supplied with the authorization `code` appended, and `state` when you supplied one. Its scheme, host, port, and path come back exactly as sent — never re-cased or re-encoded — because the client matches them against its registered URI. Returned only once, on create: the code is single-use and expires 10 minutes after it is issued, so redirect immediately.
    - `revoked_at` string, nullable, required — When the grant was revoked, as an ISO 8601 timestamp, or `null` while it is still in force. A revoked grant authorizes nothing — treat its `scopes` as no longer granted.
    - `scopes` string[], required
  - `page_info` object, required
    - `end_cursor` string, nullable, required
    - `has_next_page` boolean, required
    - `has_previous_page` boolean, required
    - `start_cursor` string, nullable, required

## Other responses

- `400` — Invalid Parameters
- `401` — Unauthorized
- `403` — Forbidden

---

[API](https://skmtc.net/whop/apis/whop-api.md) · [All operations](https://skmtc.net/whop/apis/whop-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/whop/whop-api/versions/866821546d67/schema)