List applications the user has authorized

GET

/v1/oauth/clients/authorized

const url = 'https://api.adversarial.com/api/v1/oauth/clients/authorized?page=1&page_size=25';
const options = {method: 'GET', headers: {cookie: 'arm-session=<arm-session>'}};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request GET \
  --url 'https://api.adversarial.com/api/v1/oauth/clients/authorized?page=1&page_size=25' \
  --cookie arm-session=<arm-session>

Returns the third-party applications granted access to the account through the authorization code flow, with the scopes each was granted and when it was last used.

Authorizations

session
bearer

Parameters

Query Parameters

user_id

Array<string>

Restrict to authorizations for the given user ids. Only meaningful for callers holding ORGANIZATION_MANAGE; non-admins may pass only their own id (or omit entirely). Cross-org ids return 403.

search

string

Case-insensitive substring search. Matches the client name for any caller; for admins also matches the authorizing user’s email, first name, or last name.

scope

Array<string>

Restrict to authorizations whose live refresh-token rows include at least one of the requested atomic scopes. Repeat the param to OR them: ?scope=risks:read&scope=incidents:read. Compound aliases (mcp, mcp:full) are rejected — pass the expanded atomic scopes instead.

page

integer format: int64

default: 1 >= 1 <= 1000000

1-indexed page number. Defaults to 1; zero is rejected.

page_size

integer format: int64

default: 25 >= 1 <= 100

Rows per page. Defaults to 25, max 100; zero is rejected.

order_by

string

Sort column + direction in the shape “column, asc” or “column, desc”. Valid columns: client_name, last_used, authorized_on, authorized_by (admin-only). Defaults to last_used, desc.

Responses

200

Paged list of authorized applications

application/json

Paginated list envelope: { "results": [...], "pagination": {...} }.

object

pagination

required

Pagination metadata describing the slice.

object

page

required

1-indexed page number of this result slice.

integer format: int64

page_size

required

Number of items requested per page.

integer format: int64

total_items

required

Total number of matching items across all pages.

integer format: int64

total_pages

required

Total number of pages at this page size.

integer format: int64

results

required

The items on this page.

Array<object>

One entry in the list of applications the user has authorized.

authorized_by is populated only when the list is returned in org scope (admin view) — in self-scope responses it’s always None and omitted from the wire format.

object

authorized_by

One of:

null
object

null

authorized_on

required

string format: date-time

client_id

required

string

client_name

required

string

last_used

string | null format: date-time

scope

required

Space-separated atomic scopes granted by the user’s most recent live consent for this client. Compound aliases are already expanded.

string

software_id

string | null

software_version

string | null

status

required

Current usability state for this authorization. expired means no usable refresh token remains; explicitly revoked authorizations are not returned by the list endpoint.

string

Allowed values: active expired

Example

{
  "results": [
    {
      "status": "active"
    }
  ]
}

400

Bad request

401

Unauthorized

403

Forbidden