openapi: 3.2.0 info: title: 'GTM API public contract: gtm.service.id OAUTH Clients API' description: 'Identity, access and money: users, teams and members, API keys, OAuth clients and authorizations, billing products, subscriptions, transactions and payment methods, notifications, TLS certificates and support requests.' version: '1.0' contact: name: GTM API url: https://gtm-api.com email: support@gtm-api.com license: name: Proprietary url: https://gtm-api.com/license servers: - url: https://app.gtm-api.com/id/v4 description: Production, through the app.gtm-api.com gateway security: - BearerJwt: [] TeamSid: [] tags: - name: oauth_clients description: Registry package `mcp.id/oauth_clients`, served on MCP mount `id.access`. paths: /api/oauth-clients: post: operationId: create_oauth_client summary: Create OAuth client description: 'Register a new OAuth application; the server generates client_id. v1 clients are public/PKCE (no secret). A confidential client (fast-follow) returns client_secret in the create envelope ONCE. Tell the user to store it; it is unrecoverable and must never be logged. permissions is the ceiling the client may request; redirect_uris is an exact-match https allow-list (closes open-redirect). Dedup (team_sid, name) → already_exists. Set platform:true (admin only) to register a platform client with no owning team. Contract: - MCP tool `create_oauth_client`, registry package `mcp.id/oauth_clients`, mount `id.access`. - Operation `create`, response envelope `create`. - Flags: dangerous: the MCP layer gates it behind a preview/commit token, and the effect cannot be undone through this API.' tags: - oauth_clients requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/CreateOauthClientRequest' responses: '200': description: '`create` success envelope.' content: application/json: schema: $ref: '#/components/schemas/CreateOauthClientResponse' 4XX: $ref: '#/components/responses/McpClientError' 5XX: $ref: '#/components/responses/McpServerError' x-gtm-mcp-tool: create_oauth_client x-gtm-mcp-mount: id.access x-gtm-entity: oauth_clients x-gtm-operation: create x-gtm-envelope: create x-gtm-availability: ga x-gtm-dangerous: true x-gtm-mass-action: false x-gtm-step-eligible: false x-gtm-schedule-required: false x-gtm-tool-class: typical /api/oauth-clients/search: post: operationId: search_oauth_clients summary: Search OAuth clients description: 'List registered OAuth applications for the caller''s team (plus platform clients when team_sid.is_null). Filter by status, client_id, registration_kind, is_confidential; include:["active_sessions"] to see the agents connected through each app (requires sessions.view). No full-text: filter by name / client_id. page_size:0 returns counts only. Contract: - MCP tool `search_oauth_clients`, registry package `mcp.id/oauth_clients`, mount `id.access`. - Operation `search`, response envelope `search`. - Flags: read only.' tags: - oauth_clients requestBody: required: false content: application/json: schema: $ref: '#/components/schemas/SearchOauthClientsRequest' responses: '200': description: '`search` success envelope.' content: application/json: schema: $ref: '#/components/schemas/SearchOauthClientsResponse' 4XX: $ref: '#/components/responses/McpClientError' 5XX: $ref: '#/components/responses/McpServerError' x-gtm-mcp-tool: search_oauth_clients x-gtm-mcp-mount: id.access x-gtm-entity: oauth_clients x-gtm-operation: search x-gtm-envelope: search x-gtm-availability: ga x-gtm-dangerous: false x-gtm-mass-action: false x-gtm-step-eligible: false x-gtm-schedule-required: false x-gtm-tool-class: typical /api/oauth-clients/{sid}: get: operationId: get_oauth_client summary: Get OAuth client description: 'Fetch one OAuth client by sid. include:["active_sessions"] lists agents connected through it (requires sessions.view). client_secret is never returned on a read. Contract: - MCP tool `get_oauth_client`, registry package `mcp.id/oauth_clients`, mount `id.access`. - Operation `get`, response envelope `get`. - Flags: read only.' tags: - oauth_clients parameters: - name: sid in: path required: true description: Path segment `{sid}`. schema: type: string minLength: 18 maxLength: 18 pattern: ^id_oc_ - name: include[] in: query required: false description: Query parameter `include`. style: form explode: true schema: type: array items: type: string enum: - active_sessions responses: '200': description: '`get` success envelope.' content: application/json: schema: $ref: '#/components/schemas/GetOauthClientResponse' 4XX: $ref: '#/components/responses/McpClientError' 5XX: $ref: '#/components/responses/McpServerError' x-gtm-mcp-tool: get_oauth_client x-gtm-mcp-mount: id.access x-gtm-entity: oauth_clients x-gtm-operation: get x-gtm-envelope: get x-gtm-availability: ga x-gtm-dangerous: false x-gtm-mass-action: false x-gtm-step-eligible: false x-gtm-schedule-required: false x-gtm-tool-class: trivial patch: operationId: update_oauth_client summary: Update OAuth client description: 'Partial update. Editable: name, redirect_uris, permissions, grant_types, status (redirect_uris / permissions full-replace). status:"disabled" cascade-revokes the client''s oauth grants and issued tokens. Tightening permissions affects only future mints: live tokens keep their frozen set; use disabled / delete for an immediate cut. client_id / is_confidential / registration_kind are not editable. At least one field required. Contract: - MCP tool `update_oauth_client`, registry package `mcp.id/oauth_clients`, mount `id.access`. - Operation `update`, response envelope `update`. - Flags: none.' tags: - oauth_clients parameters: - name: sid in: path required: true description: OAuth client sid (id_oc_…). schema: type: string minLength: 18 maxLength: 18 pattern: ^id_oc_ description: OAuth client sid (id_oc_…). requestBody: required: false content: application/json: schema: $ref: '#/components/schemas/UpdateOauthClientRequest' responses: '200': description: '`update` success envelope.' content: application/json: schema: $ref: '#/components/schemas/UpdateOauthClientResponse' 4XX: $ref: '#/components/responses/McpClientError' 5XX: $ref: '#/components/responses/McpServerError' x-gtm-mcp-tool: update_oauth_client x-gtm-mcp-mount: id.access x-gtm-entity: oauth_clients x-gtm-operation: update x-gtm-envelope: update x-gtm-availability: ga x-gtm-dangerous: false x-gtm-mass-action: false x-gtm-step-eligible: false x-gtm-schedule-required: false x-gtm-tool-class: typical delete: operationId: delete_oauth_client summary: Delete OAuth client description: 'Destructive. Soft-delete the client (sets deleted_at) and cascade-revoke every issued oauth session and grant, disconnecting all agents connected through this app immediately. The public OAuth flow rejects a soft-deleted client. Idempotent: re-deleting → already_deleted. The client''s sessions survive as revoked-not-deleted (retained). Contract: - MCP tool `delete_oauth_client`, registry package `mcp.id/oauth_clients`, mount `id.access`. - Operation `delete`, response envelope `delete_simple`. - Flags: dangerous: the MCP layer gates it behind a preview/commit token, and the effect cannot be undone through this API.' tags: - oauth_clients parameters: - name: sid in: path required: true description: Path segment `{sid}`. schema: type: string minLength: 18 maxLength: 18 pattern: ^id_oc_ responses: '200': description: '`delete_simple` success envelope.' content: application/json: schema: $ref: '#/components/schemas/DeleteOauthClientResponse' 4XX: $ref: '#/components/responses/McpClientError' 5XX: $ref: '#/components/responses/McpServerError' x-gtm-mcp-tool: delete_oauth_client x-gtm-mcp-mount: id.access x-gtm-entity: oauth_clients x-gtm-operation: delete x-gtm-envelope: delete_simple x-gtm-availability: ga x-gtm-dangerous: true x-gtm-mass-action: false x-gtm-step-eligible: false x-gtm-schedule-required: false x-gtm-tool-class: typical components: schemas: CreateOauthClientRequest: type: object description: Request body of `create_oauth_client`. properties: name: type: string minLength: 1 maxLength: 255 redirect_uris: type: array items: type: string maxLength: 2048 format: uri pattern: ^https:\/\/ minItems: 1 description: Exact-match https allow-list (at least one entry). permissions: type: array items: type: string maxLength: 128 description: Unified permission ceiling the client may request. grant_types: type: array items: type: string enum: - authorization_code - refresh_token minItems: 1 description: 'Default: [authorization_code, refresh_token].' platform: type: boolean description: 'Admin only: register a platform client (team_sid = null) instead of a team client.' actor_kind: type: string enum: - agent - integration description: 'Default for a hand-made client: integration. Pick agent when the tokens will act for an autonomous caller.' required: - name - redirect_uris - permissions McpError: type: object properties: success: type: boolean enum: - false error: type: object properties: code: type: string enum: - validation_failed - nothing_to_update - not_found - relation_not_found - invalid_transition - limit_exceeded - payment_required - duplicate_rejected - conflict - delete_blocked - unauthorized - forbidden - rate_limited - internal_error - service_unavailable - not_implemented message: type: string recoverable: type: boolean suggestion: type: string field_errors: type: object additionalProperties: type: array items: type: object properties: rule: type: string message: type: string required: - rule - message blockers: type: array items: type: object properties: type: type: string description: Machine-readable blocker type (active_flow, pending_tasks, …). severity: type: string enum: - hard - soft description: hard = external action required; soft = acknowledge is enough. description: type: string entity_sid: type: - string - 'null' count: type: integer resolution: type: string description: 'Hard: tool name to call. Soft: code for acknowledge[].' resolution_hint: type: string required: - type - severity - description - entity_sid - resolution - resolution_hint context: type: object additionalProperties: {} required: - code - message - recoverable meta: type: object properties: trace_id: type: string description: UUID v7; same 128-bit value as the X-Trace-Id header. span_id: type: string pattern: ^[0-9a-f]{16}$ description: 16 hex chars, root span of this request. timestamp: type: string description: ISO 8601 UTC (Y-m-dTH:i:sZ), response time. duration_ms: type: integer minimum: 0 description: Server-side wall clock. team_sid: type: - string - 'null' description: The team this call ran in (the token team, or the team_sid override). Null when unauthenticated; absent from pre-2026-08-20 backends. actor_type: type: - string - 'null' description: user | agent | api_key | system. Null when unauthenticated; absent from pre-2026-08-20 backends. required: - trace_id - span_id - timestamp - duration_ms required: - success - error UpdateOauthClientRequest: type: object description: Request body of `update_oauth_client`. properties: name: type: string minLength: 1 maxLength: 255 redirect_uris: type: array items: type: string maxLength: 2048 format: uri pattern: ^https:\/\/ minItems: 1 description: FULL replacement of the exact-match https allow-list. permissions: type: array items: type: string maxLength: 128 description: FULL replacement of the permission ceiling. grant_types: type: array items: type: string enum: - authorization_code - refresh_token minItems: 1 actor_kind: type: string enum: - agent - integration description: Reclassify the client; only tokens minted after the change carry the new kind. status: type: string enum: - active - disabled description: disabled cascade-revokes the client's grants + issued tokens. SearchOauthClientsResponse: type: object properties: success: type: boolean enum: - true operation: type: string enum: - search items: type: array items: type: object properties: item: type: object properties: sid: type: string team_sid: type: - string - 'null' name: type: string client_id: type: string redirect_uris: type: array items: type: string grant_types: type: array items: type: string enum: - authorization_code - refresh_token permissions: type: array items: type: string is_confidential: type: boolean registration_kind: type: string enum: - manual - dynamic status: type: string enum: - active - disabled created_by: type: object properties: actor_type: type: string enum: - user - support - api_key - system - agent actor_sid: type: - string - 'null' team_sid: type: string actor_name: type: - string - 'null' description: The OAuth client that acted ("Claude", "n8n"); null for a user, an API key or a system job. oauth_client_sid: type: - string - 'null' description: The acting OAuth client (id_oc_*); null off the OAuth path. reason: type: - string - 'null' description: Why a system actor wrote the row (snapshot_capture_job, ...); null otherwise. permissions: type: object additionalProperties: {} description: 'Internal audit context: the grant set the actor held at write time. Not a contract.' cluster_id: type: - integer - 'null' description: 'Internal audit context: the cluster that served the write.' trace_id: type: - string - 'null' description: 'Internal audit context: the trace id of the request that wrote the row.' required: - actor_type - actor_sid - team_sid - permissions created_at: type: string updated_at: type: string deleted_at: type: - string - 'null' client_secret: type: - string - 'null' required: - sid - team_sid - name - client_id - redirect_uris - grant_types - permissions - is_confidential - registration_kind - status - created_by - created_at - updated_at - deleted_at included: type: object additionalProperties: {} required: - item - included pagination: type: object properties: next_cursor: type: - string - 'null' has_more: type: boolean total_count: type: - integer - 'null' required: - next_cursor - has_more - total_count applied_filters: type: object additionalProperties: {} includes: type: array items: type: string meta: type: object properties: trace_id: type: string description: UUID v7; same 128-bit value as the X-Trace-Id header. span_id: type: string pattern: ^[0-9a-f]{16}$ description: 16 hex chars, root span of this request. timestamp: type: string description: ISO 8601 UTC (Y-m-dTH:i:sZ), response time. duration_ms: type: integer minimum: 0 description: Server-side wall clock. team_sid: type: - string - 'null' description: The team this call ran in (the token team, or the team_sid override). Null when unauthenticated; absent from pre-2026-08-20 backends. actor_type: type: - string - 'null' description: user | agent | api_key | system. Null when unauthenticated; absent from pre-2026-08-20 backends. required: - trace_id - span_id - timestamp - duration_ms counts: type: object properties: total_count: type: number groups: type: object additionalProperties: {} required: - total_count - groups required: - success - operation - items - pagination - applied_filters - includes - meta CreateOauthClientResponse: type: object properties: success: type: boolean enum: - true operation: type: string enum: - create item: type: object properties: sid: type: string team_sid: type: - string - 'null' name: type: string client_id: type: string redirect_uris: type: array items: type: string grant_types: type: array items: type: string enum: - authorization_code - refresh_token permissions: type: array items: type: string is_confidential: type: boolean registration_kind: type: string enum: - manual - dynamic status: type: string enum: - active - disabled created_by: type: object properties: actor_type: type: string enum: - user - support - api_key - system - agent actor_sid: type: - string - 'null' team_sid: type: string actor_name: type: - string - 'null' description: The OAuth client that acted ("Claude", "n8n"); null for a user, an API key or a system job. oauth_client_sid: type: - string - 'null' description: The acting OAuth client (id_oc_*); null off the OAuth path. reason: type: - string - 'null' description: Why a system actor wrote the row (snapshot_capture_job, ...); null otherwise. permissions: type: object additionalProperties: {} description: 'Internal audit context: the grant set the actor held at write time. Not a contract.' cluster_id: type: - integer - 'null' description: 'Internal audit context: the cluster that served the write.' trace_id: type: - string - 'null' description: 'Internal audit context: the trace id of the request that wrote the row.' required: - actor_type - actor_sid - team_sid - permissions created_at: type: string updated_at: type: string deleted_at: type: - string - 'null' client_secret: type: - string - 'null' required: - sid - team_sid - name - client_id - redirect_uris - grant_types - permissions - is_confidential - registration_kind - status - created_by - created_at - updated_at - deleted_at already_exists: type: boolean meta: type: object properties: trace_id: type: string description: UUID v7; same 128-bit value as the X-Trace-Id header. span_id: type: string pattern: ^[0-9a-f]{16}$ description: 16 hex chars, root span of this request. timestamp: type: string description: ISO 8601 UTC (Y-m-dTH:i:sZ), response time. duration_ms: type: integer minimum: 0 description: Server-side wall clock. team_sid: type: - string - 'null' description: The team this call ran in (the token team, or the team_sid override). Null when unauthenticated; absent from pre-2026-08-20 backends. actor_type: type: - string - 'null' description: user | agent | api_key | system. Null when unauthenticated; absent from pre-2026-08-20 backends. required: - trace_id - span_id - timestamp - duration_ms required: - success - operation - item - already_exists - meta DeleteOauthClientResponse: type: object properties: success: type: boolean enum: - true operation: type: string enum: - delete item: type: object additionalProperties: {} already_deleted: type: boolean soft_deleted: type: boolean retained: type: array items: type: string meta: type: object properties: trace_id: type: string description: UUID v7; same 128-bit value as the X-Trace-Id header. span_id: type: string pattern: ^[0-9a-f]{16}$ description: 16 hex chars, root span of this request. timestamp: type: string description: ISO 8601 UTC (Y-m-dTH:i:sZ), response time. duration_ms: type: integer minimum: 0 description: Server-side wall clock. team_sid: type: - string - 'null' description: The team this call ran in (the token team, or the team_sid override). Null when unauthenticated; absent from pre-2026-08-20 backends. actor_type: type: - string - 'null' description: user | agent | api_key | system. Null when unauthenticated; absent from pre-2026-08-20 backends. required: - trace_id - span_id - timestamp - duration_ms required: - success - operation - item - already_deleted - soft_deleted - retained - meta GetOauthClientResponse: type: object properties: success: type: boolean enum: - true operation: type: string enum: - get item: type: object properties: sid: type: string team_sid: type: - string - 'null' name: type: string client_id: type: string redirect_uris: type: array items: type: string grant_types: type: array items: type: string enum: - authorization_code - refresh_token permissions: type: array items: type: string is_confidential: type: boolean registration_kind: type: string enum: - manual - dynamic status: type: string enum: - active - disabled created_by: type: object properties: actor_type: type: string enum: - user - support - api_key - system - agent actor_sid: type: - string - 'null' team_sid: type: string actor_name: type: - string - 'null' description: The OAuth client that acted ("Claude", "n8n"); null for a user, an API key or a system job. oauth_client_sid: type: - string - 'null' description: The acting OAuth client (id_oc_*); null off the OAuth path. reason: type: - string - 'null' description: Why a system actor wrote the row (snapshot_capture_job, ...); null otherwise. permissions: type: object additionalProperties: {} description: 'Internal audit context: the grant set the actor held at write time. Not a contract.' cluster_id: type: - integer - 'null' description: 'Internal audit context: the cluster that served the write.' trace_id: type: - string - 'null' description: 'Internal audit context: the trace id of the request that wrote the row.' required: - actor_type - actor_sid - team_sid - permissions created_at: type: string updated_at: type: string deleted_at: type: - string - 'null' client_secret: type: - string - 'null' required: - sid - team_sid - name - client_id - redirect_uris - grant_types - permissions - is_confidential - registration_kind - status - created_by - created_at - updated_at - deleted_at included: type: object additionalProperties: {} includes: type: array items: type: string meta: type: object properties: trace_id: type: string description: UUID v7; same 128-bit value as the X-Trace-Id header. span_id: type: string pattern: ^[0-9a-f]{16}$ description: 16 hex chars, root span of this request. timestamp: type: string description: ISO 8601 UTC (Y-m-dTH:i:sZ), response time. duration_ms: type: integer minimum: 0 description: Server-side wall clock. team_sid: type: - string - 'null' description: The team this call ran in (the token team, or the team_sid override). Null when unauthenticated; absent from pre-2026-08-20 backends. actor_type: type: - string - 'null' description: user | agent | api_key | system. Null when unauthenticated; absent from pre-2026-08-20 backends. required: - trace_id - span_id - timestamp - duration_ms required: - success - operation - item - included - includes - meta SearchOauthClientsRequest: type: object description: Request body of `search_oauth_clients`. properties: filter: type: object properties: sid: type: object properties: eq: type: string in: type: array items: type: string additionalProperties: false team_sid: type: object properties: eq: type: string in: type: array items: type: string is_null: type: boolean additionalProperties: false description: is_null:true = platform clients (owned by no team). client_id: type: object properties: eq: type: string in: type: array items: type: string additionalProperties: false description: Exact public identifier lookup. name: type: object properties: eq: type: string additionalProperties: false description: Match on the human-readable client name. actor_kind: type: object properties: eq: type: string ne: type: string in: type: array items: type: string nin: type: array items: type: string is_null: type: boolean additionalProperties: false description: What the client is (agent, integration, ...); is_null:true = unclassified legacy clients. status: type: object properties: eq: type: string enum: - active - disabled in: type: array items: type: string enum: - active - disabled additionalProperties: false is_confidential: type: object properties: eq: type: boolean additionalProperties: false description: public/PKCE (false) vs confidential (true). registration_kind: type: object properties: eq: type: string enum: - manual - dynamic in: type: array items: type: string enum: - manual - dynamic additionalProperties: false created_at: type: object properties: gte: type: string lte: type: string gt: type: string lt: type: string additionalProperties: false deleted_at: type: object properties: gte: type: string lte: type: string is_null: type: boolean additionalProperties: false description: 'Default scope is { is_null: true } (live rows).' include: type: array items: type: string enum: - active_sessions description: Relations to eager-load (see entity Includes). sort: type: object properties: field: type: string enum: - created_at - name direction: type: string enum: - asc - desc description: Default desc. required: - field page_size: type: integer minimum: 0 maximum: 500 description: 0..500, default 50. page_size=0 = count-only, page_size=1 = getFirst. cursor: type: - string - 'null' description: Opaque forward cursor from a previous response pagination.next_cursor. UpdateOauthClientResponse: type: object properties: success: type: boolean enum: - true operation: type: string enum: - update item: type: object properties: sid: type: string team_sid: type: - string - 'null' name: type: string client_id: type: string redirect_uris: type: array items: type: string grant_types: type: array items: type: string enum: - authorization_code - refresh_token permissions: type: array items: type: string is_confidential: type: boolean registration_kind: type: string enum: - manual - dynamic status: type: string enum: - active - disabled created_by: type: object properties: actor_type: type: string enum: - user - support - api_key - system - agent actor_sid: type: - string - 'null' team_sid: type: string actor_name: type: - string - 'null' description: The OAuth client that acted ("Claude", "n8n"); null for a user, an API key or a system job. oauth_client_sid: type: - string - 'null' description: The acting OAuth client (id_oc_*); null off the OAuth path. reason: type: - string - 'null' description: Why a system actor wrote the row (snapshot_capture_job, ...); null otherwise. permissions: type: object additionalProperties: {} description: 'Internal audit context: the grant set the actor held at write time. Not a contract.' cluster_id: type: - integer - 'null' description: 'Internal audit context: the cluster that served the write.' trace_id: type: - string - 'null' description: 'Internal audit context: the trace id of the request that wrote the row.' required: - actor_type - actor_sid - team_sid - permissions created_at: type: string updated_at: type: string deleted_at: type: - string - 'null' client_secret: type: - string - 'null' required: - sid - team_sid - name - client_id - redirect_uris - grant_types - permissions - is_confidential - registration_kind - status - created_by - created_at - updated_at - deleted_at updated_fields: type: array items: type: string previous_values: type: object additionalProperties: {} meta: type: object properties: trace_id: type: string description: UUID v7; same 128-bit value as the X-Trace-Id header. span_id: type: string pattern: ^[0-9a-f]{16}$ description: 16 hex chars, root span of this request. timestamp: type: string description: ISO 8601 UTC (Y-m-dTH:i:sZ), response time. duration_ms: type: integer minimum: 0 description: Server-side wall clock. team_sid: type: - string - 'null' description: The team this call ran in (the token team, or the team_sid override). Null when unauthenticated; absent from pre-2026-08-20 backends. actor_type: type: - string - 'null' description: user | agent | api_key | system. Null when unauthenticated; absent from pre-2026-08-20 backends. required: - trace_id - span_id - timestamp - duration_ms required: - success - operation - item - updated_fields - previous_values - meta responses: McpServerError: description: MCP error envelope with `error.code` internal_error or service_unavailable. content: application/json: schema: $ref: '#/components/schemas/McpError' McpClientError: description: MCP error envelope. `error.code` is one of validation_failed, nothing_to_update, not_found, relation_not_found, invalid_transition, limit_exceeded, payment_required, duplicate_rejected, conflict, delete_blocked, unauthorized, forbidden, rate_limited, not_implemented. content: application/json: schema: $ref: '#/components/schemas/McpError' securitySchemes: BearerJwt: type: http scheme: bearer bearerFormat: JWT description: Access token issued by gtm.service.id. Its `access_identity` claim carries `team_sid`, `actor_sid` and `actor_type`, and that team scope is authoritative. TeamSid: type: apiKey in: header name: Team-SID description: Team scope for tokens that do not carry one. Ignored when the token already names a team.