openapi: 3.2.0
info:
  title: 'GTM API public contract: gtm.service.id OAUTH…'
  description: 'Identity, access and money: users, teams and members, API keys, OAuth clients and authorizations, billing products, subscriptions, transactions and payment methods, notifications, TLS certificates and support requests.'
  version: '1.0'
  contact:
    name: GTM API
    url: https://gtm-api.com
    email: support@gtm-api.com
  license:
    name: Proprietary
    url: https://gtm-api.com/license
servers:
- url: https://app.gtm-api.com/id/v4
  description: Production, through the app.gtm-api.com gateway
security:
- BearerJwt: []
  TeamSid: []
tags:
- name: oauth_authorizations
  description: Registry package `mcp.id/oauth_authorizations`, served on MCP mount `id.access`.
paths:
  /api/oauth-authorizations/search:
    post:
      operationId: search_oauth_authorizations
      summary: Search connected apps
      description: 'List the caller''s connected apps (standing OAuth consent grants). Always scoped to the caller''s own grants, never cross-user. Filter by status (active vs revoked history), oauth_client_sid, or team_scope_mode; include client (name + ceiling), teams (in-scope team names), and active_sessions (live installation tokens). This is the user''s view of who has access to their workspaces. page_size:0 returns counts only.


        Contract:

        - MCP tool `search_oauth_authorizations`, registry package `mcp.id/oauth_authorizations`, mount `id.access`.

        - Operation `search`, response envelope `search`.

        - Flags: read only.'
      tags:
      - oauth_authorizations
      requestBody:
        required: false
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SearchOauthAuthorizationsRequest'
      responses:
        '200':
          description: '`search` success envelope.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SearchOauthAuthorizationsResponse'
        4XX:
          $ref: '#/components/responses/McpClientError'
        5XX:
          $ref: '#/components/responses/McpServerError'
      x-gtm-mcp-tool: search_oauth_authorizations
      x-gtm-mcp-mount: id.access
      x-gtm-entity: oauth_authorizations
      x-gtm-operation: search
      x-gtm-envelope: search
      x-gtm-availability: ga
      x-gtm-dangerous: false
      x-gtm-mass-action: false
      x-gtm-step-eligible: false
      x-gtm-schedule-required: false
      x-gtm-tool-class: typical
  /api/oauth-authorizations/{sid}:
    patch:
      operationId: update_oauth_authorization
      summary: Edit connected app
      description: 'Partial self-service edit of the grant''s mutable fields WITHOUT re-running the browser consent: team_scope_mode, consented_team_sids (full-replace, non-empty when mode=selected), and permissions (full-replace, must stay ⊆ the client ceiling). Each submitted team is re-checked against live membership (403 if not a member). Narrowing is security-positive; you can never exceed the ceiling via update. Changes are frozen-at-mint, so live tokens keep their claims until their short TTL; use revoke for an immediate cut. At least one field required. 404 if not the caller''s own grant.


        Contract:

        - MCP tool `update_oauth_authorization`, registry package `mcp.id/oauth_authorizations`, mount `id.access`.

        - Operation `update`, response envelope `update`.

        - Flags: none.'
      tags:
      - oauth_authorizations
      parameters:
      - name: sid
        in: path
        required: true
        description: OAuth authorization (grant) sid (id_oa_…).
        schema:
          type: string
          minLength: 18
          maxLength: 18
          pattern: ^id_oa_
          description: OAuth authorization (grant) sid (id_oa_…).
      requestBody:
        required: false
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateOauthAuthorizationRequest'
      responses:
        '200':
          description: '`update` success envelope.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UpdateOauthAuthorizationResponse'
        4XX:
          $ref: '#/components/responses/McpClientError'
        5XX:
          $ref: '#/components/responses/McpServerError'
      x-gtm-mcp-tool: update_oauth_authorization
      x-gtm-mcp-mount: id.access
      x-gtm-entity: oauth_authorizations
      x-gtm-operation: update
      x-gtm-envelope: update
      x-gtm-availability: ga
      x-gtm-dangerous: false
      x-gtm-mass-action: false
      x-gtm-step-eligible: false
      x-gtm-schedule-required: false
      x-gtm-tool-class: typical
  /api/oauth-authorizations/{sid}/revoke:
    post:
      operationId: revoke_oauth_authorization
      summary: Disconnect app (revoke grant)
      description: 'Disconnect an app: flip the grant to status=revoked, clear its refresh credential, and cascade-revoke every installation token (all teams) in one transaction, so the agent is cut off immediately. The envelope item is the post-action grant (it persists, revoked); result.revoked_sessions is the count cut. Idempotent (already-revoked → 0). 404 if the sid is not the caller''s own grant.


        Contract:

        - MCP tool `revoke_oauth_authorization`, registry package `mcp.id/oauth_authorizations`, mount `id.access`.

        - Operation `action`, response envelope `action`.

        - Flags: dangerous: the MCP layer gates it behind a preview/commit token, and the effect cannot be undone through this API.'
      tags:
      - oauth_authorizations
      parameters:
      - name: sid
        in: path
        required: true
        description: OAuth authorization (grant) sid (id_oa_…).
        schema:
          type: string
          minLength: 18
          maxLength: 18
          pattern: ^id_oa_
          description: OAuth authorization (grant) sid (id_oa_…).
      responses:
        '200':
          description: '`action` success envelope.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RevokeOauthAuthorizationResponse'
        4XX:
          $ref: '#/components/responses/McpClientError'
        5XX:
          $ref: '#/components/responses/McpServerError'
      x-gtm-mcp-tool: revoke_oauth_authorization
      x-gtm-mcp-mount: id.access
      x-gtm-entity: oauth_authorizations
      x-gtm-operation: action
      x-gtm-envelope: action
      x-gtm-availability: ga
      x-gtm-dangerous: true
      x-gtm-mass-action: false
      x-gtm-step-eligible: false
      x-gtm-schedule-required: false
      x-gtm-tool-class: typical
components:
  schemas:
    SearchOauthAuthorizationsRequest:
      type: object
      description: Request body of `search_oauth_authorizations`.
      properties:
        filter:
          type: object
          properties:
            oauth_client_sid:
              type: object
              properties:
                eq:
                  type: string
                in:
                  type: array
                  items:
                    type: string
              additionalProperties: false
              description: Filter to one connected client.
            status:
              type: object
              properties:
                eq:
                  type: string
                  enum:
                  - active
                  - revoked
                in:
                  type: array
                  items:
                    type: string
                    enum:
                    - active
                    - revoked
              additionalProperties: false
              description: active vs revoked (history).
            team_scope_mode:
              type: object
              properties:
                eq:
                  type: string
                  enum:
                  - selected
                  - all_my_teams
              additionalProperties: false
              description: Which grants are all_my_teams vs selected.
            created_at:
              type: object
              properties:
                gte:
                  type: string
                lte:
                  type: string
              additionalProperties: false
              description: Connected-since window.
            last_used_at:
              type: object
              properties:
                gte:
                  type: string
                lte:
                  type: string
                is_null:
                  type: boolean
              additionalProperties: false
              description: is_null:true = never used; range = recently active.
        include:
          type: array
          items:
            type: string
            enum:
            - client
            - teams
            - active_sessions
          description: Relations to eager-load (see entity Includes).
        sort:
          type: object
          properties:
            field:
              type: string
              enum:
              - created_at
              - last_used_at
            direction:
              type: string
              enum:
              - asc
              - desc
              description: Default desc.
          required:
          - field
        page_size:
          type: integer
          minimum: 0
          maximum: 500
          description: 0..500, default 50. page_size=0 = count-only, page_size=1 = getFirst.
        cursor:
          type:
          - string
          - 'null'
          description: Opaque forward cursor from a previous response pagination.next_cursor.
    RevokeOauthAuthorizationResponse:
      type: object
      properties:
        success:
          type: boolean
          enum:
          - true
        operation:
          type: string
          enum:
          - action
        action:
          type: string
          description: kebab-case verb; matches the route segment.
        item:
          type:
          - object
          - 'null'
          properties:
            sid:
              type: string
            user_sid:
              type: string
            oauth_client_sid:
              type: string
            team_scope_mode:
              type: string
              enum:
              - selected
              - all_my_teams
            consented_team_sids:
              type: array
              items:
                type: string
            permissions:
              type: array
              items:
                type: string
            status:
              type: string
              enum:
              - active
              - revoked
            last_used_at:
              type:
              - string
              - 'null'
            created_at:
              type: string
            updated_at:
              type: string
          required:
          - sid
          - user_sid
          - oauth_client_sid
          - team_scope_mode
          - consented_team_sids
          - permissions
          - status
          - last_used_at
          - created_at
          - updated_at
        result:
          type: object
          additionalProperties: {}
        meta:
          type: object
          properties:
            trace_id:
              type: string
              description: UUID v7; same 128-bit value as the X-Trace-Id header.
            span_id:
              type: string
              pattern: ^[0-9a-f]{16}$
              description: 16 hex chars, root span of this request.
            timestamp:
              type: string
              description: ISO 8601 UTC (Y-m-dTH:i:sZ), response time.
            duration_ms:
              type: integer
              minimum: 0
              description: Server-side wall clock.
            team_sid:
              type:
              - string
              - 'null'
              description: The team this call ran in (the token team, or the team_sid override). Null when unauthenticated; absent from pre-2026-08-20 backends.
            actor_type:
              type:
              - string
              - 'null'
              description: user | agent | api_key | system. Null when unauthenticated; absent from pre-2026-08-20 backends.
          required:
          - trace_id
          - span_id
          - timestamp
          - duration_ms
      required:
      - success
      - operation
      - action
      - item
      - result
      - meta
    McpError:
      type: object
      properties:
        success:
          type: boolean
          enum:
          - false
        error:
          type: object
          properties:
            code:
              type: string
              enum:
              - validation_failed
              - nothing_to_update
              - not_found
              - relation_not_found
              - invalid_transition
              - limit_exceeded
              - payment_required
              - duplicate_rejected
              - conflict
              - delete_blocked
              - unauthorized
              - forbidden
              - rate_limited
              - internal_error
              - service_unavailable
              - not_implemented
            message:
              type: string
            recoverable:
              type: boolean
            suggestion:
              type: string
            field_errors:
              type: object
              additionalProperties:
                type: array
                items:
                  type: object
                  properties:
                    rule:
                      type: string
                    message:
                      type: string
                  required:
                  - rule
                  - message
            blockers:
              type: array
              items:
                type: object
                properties:
                  type:
                    type: string
                    description: Machine-readable blocker type (active_flow, pending_tasks, …).
                  severity:
                    type: string
                    enum:
                    - hard
                    - soft
                    description: hard = external action required; soft = acknowledge is enough.
                  description:
                    type: string
                  entity_sid:
                    type:
                    - string
                    - 'null'
                  count:
                    type: integer
                  resolution:
                    type: string
                    description: 'Hard: tool name to call. Soft: code for acknowledge[].'
                  resolution_hint:
                    type: string
                required:
                - type
                - severity
                - description
                - entity_sid
                - resolution
                - resolution_hint
            context:
              type: object
              additionalProperties: {}
          required:
          - code
          - message
          - recoverable
        meta:
          type: object
          properties:
            trace_id:
              type: string
              description: UUID v7; same 128-bit value as the X-Trace-Id header.
            span_id:
              type: string
              pattern: ^[0-9a-f]{16}$
              description: 16 hex chars, root span of this request.
            timestamp:
              type: string
              description: ISO 8601 UTC (Y-m-dTH:i:sZ), response time.
            duration_ms:
              type: integer
              minimum: 0
              description: Server-side wall clock.
            team_sid:
              type:
              - string
              - 'null'
              description: The team this call ran in (the token team, or the team_sid override). Null when unauthenticated; absent from pre-2026-08-20 backends.
            actor_type:
              type:
              - string
              - 'null'
              description: user | agent | api_key | system. Null when unauthenticated; absent from pre-2026-08-20 backends.
          required:
          - trace_id
          - span_id
          - timestamp
          - duration_ms
      required:
      - success
      - error
    SearchOauthAuthorizationsResponse:
      type: object
      properties:
        success:
          type: boolean
          enum:
          - true
        operation:
          type: string
          enum:
          - search
        items:
          type: array
          items:
            type: object
            properties:
              item:
                type: object
                properties:
                  sid:
                    type: string
                  user_sid:
                    type: string
                  oauth_client_sid:
                    type: string
                  team_scope_mode:
                    type: string
                    enum:
                    - selected
                    - all_my_teams
                  consented_team_sids:
                    type: array
                    items:
                      type: string
                  permissions:
                    type: array
                    items:
                      type: string
                  status:
                    type: string
                    enum:
                    - active
                    - revoked
                  last_used_at:
                    type:
                    - string
                    - 'null'
                  created_at:
                    type: string
                  updated_at:
                    type: string
                required:
                - sid
                - user_sid
                - oauth_client_sid
                - team_scope_mode
                - consented_team_sids
                - permissions
                - status
                - last_used_at
                - created_at
                - updated_at
              included:
                type: object
                additionalProperties: {}
            required:
            - item
            - included
        pagination:
          type: object
          properties:
            next_cursor:
              type:
              - string
              - 'null'
            has_more:
              type: boolean
            total_count:
              type:
              - integer
              - 'null'
          required:
          - next_cursor
          - has_more
          - total_count
        applied_filters:
          type: object
          additionalProperties: {}
        includes:
          type: array
          items:
            type: string
        meta:
          type: object
          properties:
            trace_id:
              type: string
              description: UUID v7; same 128-bit value as the X-Trace-Id header.
            span_id:
              type: string
              pattern: ^[0-9a-f]{16}$
              description: 16 hex chars, root span of this request.
            timestamp:
              type: string
              description: ISO 8601 UTC (Y-m-dTH:i:sZ), response time.
            duration_ms:
              type: integer
              minimum: 0
              description: Server-side wall clock.
            team_sid:
              type:
              - string
              - 'null'
              description: The team this call ran in (the token team, or the team_sid override). Null when unauthenticated; absent from pre-2026-08-20 backends.
            actor_type:
              type:
              - string
              - 'null'
              description: user | agent | api_key | system. Null when unauthenticated; absent from pre-2026-08-20 backends.
          required:
          - trace_id
          - span_id
          - timestamp
          - duration_ms
        counts:
          type: object
          properties:
            total_count:
              type: number
            groups:
              type: object
              additionalProperties: {}
          required:
          - total_count
          - groups
      required:
      - success
      - operation
      - items
      - pagination
      - applied_filters
      - includes
      - meta
    UpdateOauthAuthorizationResponse:
      type: object
      properties:
        success:
          type: boolean
          enum:
          - true
        operation:
          type: string
          enum:
          - update
        item:
          type: object
          properties:
            sid:
              type: string
            user_sid:
              type: string
            oauth_client_sid:
              type: string
            team_scope_mode:
              type: string
              enum:
              - selected
              - all_my_teams
            consented_team_sids:
              type: array
              items:
                type: string
            permissions:
              type: array
              items:
                type: string
            status:
              type: string
              enum:
              - active
              - revoked
            last_used_at:
              type:
              - string
              - 'null'
            created_at:
              type: string
            updated_at:
              type: string
          required:
          - sid
          - user_sid
          - oauth_client_sid
          - team_scope_mode
          - consented_team_sids
          - permissions
          - status
          - last_used_at
          - created_at
          - updated_at
        updated_fields:
          type: array
          items:
            type: string
        previous_values:
          type: object
          additionalProperties: {}
        meta:
          type: object
          properties:
            trace_id:
              type: string
              description: UUID v7; same 128-bit value as the X-Trace-Id header.
            span_id:
              type: string
              pattern: ^[0-9a-f]{16}$
              description: 16 hex chars, root span of this request.
            timestamp:
              type: string
              description: ISO 8601 UTC (Y-m-dTH:i:sZ), response time.
            duration_ms:
              type: integer
              minimum: 0
              description: Server-side wall clock.
            team_sid:
              type:
              - string
              - 'null'
              description: The team this call ran in (the token team, or the team_sid override). Null when unauthenticated; absent from pre-2026-08-20 backends.
            actor_type:
              type:
              - string
              - 'null'
              description: user | agent | api_key | system. Null when unauthenticated; absent from pre-2026-08-20 backends.
          required:
          - trace_id
          - span_id
          - timestamp
          - duration_ms
      required:
      - success
      - operation
      - item
      - updated_fields
      - previous_values
      - meta
    UpdateOauthAuthorizationRequest:
      type: object
      description: Request body of `update_oauth_authorization`.
      properties:
        team_scope_mode:
          type: string
          enum:
          - selected
          - all_my_teams
        consented_team_sids:
          type: array
          items:
            type: string
            minLength: 18
            maxLength: 18
            pattern: ^ts_tm_
          description: FULL replacement; required + non-empty when the effective mode is selected; ignored for all_my_teams.
        permissions:
          type: array
          items:
            type: string
            maxLength: 128
          description: FULL replacement; MUST be ⊆ the client's permission ceiling.
  responses:
    McpServerError:
      description: MCP error envelope with `error.code` internal_error or service_unavailable.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/McpError'
    McpClientError:
      description: MCP error envelope. `error.code` is one of validation_failed, nothing_to_update, not_found, relation_not_found, invalid_transition, limit_exceeded, payment_required, duplicate_rejected, conflict, delete_blocked, unauthorized, forbidden, rate_limited, not_implemented.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/McpError'
  securitySchemes:
    BearerJwt:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: Access token issued by gtm.service.id. Its `access_identity` claim carries `team_sid`, `actor_sid` and `actor_type`, and that team scope is authoritative.
    TeamSid:
      type: apiKey
      in: header
      name: Team-SID
      description: Team scope for tokens that do not carry one. Ignored when the token already names a team.