Skip to content
GitmoapAPIBeta
Identity & platformoauth
GET/user/oauth-grants

The apps the authenticated user has connected through sign-in

list_oauth_grants
  • token:read
    A token needs the token:read scope: View access tokensGranted by read_api, write_api.Every operation this scope unlocks
  • Audited · sensitive read

    x-gitmoap-audit: {"kind":"audited","arg":"sensitive_read"}

  • Single-resource

    x-gitmoap-isolation: {"kind":"single_or_self_scoped"}

  • Paginated
    Pass the next_token a page returns to get the next one.

Newest first, each with the app's name and links, where it returns, the scopes granted, any group or repository the access is limited to, when it was last used, and when it lapses unless the app refreshes it. Only your own connections are listed.

Parameters

Query
  • limitinteger · int32optionalPage size (1-100)
  • next_tokenstringoptionalPagination cursor

Responses

200Connected appsapplication/json
  • itemsarray of OAuthGrantView
    • The OAuthGrantView schema
    • client_idstring
    • client_namestring
    • created_atstring
    • expires_atstringWhen the connection lapses unless the app uses it.
    • grant_idOAuthGrantId (string · uuid)
    • redirect_hoststringThe host the app's sign-in returns to.
    • scopesarray of string
    • client_uristring or nulloptional
    • last_used_atstring or nulloptional
    • logo_uristring or nulloptional
    • resource_scope_idstring or nulloptionalThe group or repository the access is limited to, when it is.
  • next_tokenstring or nulloptional
200 exampleSynthesized example
{
"items": [
{
"client_id": "365e5fae-23a7-4e48-83de-cdc8b59cacdd",
"client_name": "payments-api",
"created_at": "2026-10-13T21:20:42Z",
"expires_at": "2026-10-10T06:20:10Z",
"grant_id": "5f6a7046-a911-4d6c-9cbd-c84a37d9975e",
"redirect_host": "redirect-host-d02b",
"scopes": []
}
],
"next_token": "next-token-0d26"
}
401Unauthorizedapplication/json
Error codes
  • UNAUTHORIZEDNo credential was sent, or the one sent is invalid, expired or revoked
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
401 exampleSynthesized example
{
"error": {
"code": "code-6788",
"message": "Pin a page's payload to the build that rendered it"
}
}
403Forbidden — the caller's access level or token scope is insufficientapplication/json
Error codes
  • FORBIDDENYou are signed in but may not do this here; reason names the permission or the rule that refused it
  • INSUFFICIENT_SCOPEThe access token lacks the scope this operation needs; required_scope names it
  • PERMISSION_REQUIREDYou need a permission you do not hold here; the message names it
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
403 exampleSynthesized example
{
"error": {
"code": "code-9a29",
"message": "Draw the region map from operation density"
}
}

CLI

gitmoap oauth list-oauth-grants

  • --limitnumberoptionalPage size (1-100)
  • --next-tokenstringoptionalPagination cursor