openapi: 3.1.1
info:
  title: WorkOS admin-portal user-management.users.authorized-applications API
  description: WorkOS REST API
  version: '1.0'
  contact:
    name: WorkOS
    url: https://workos.com
    email: support@workos.com
  license:
    name: MIT
    url: https://opensource.org/license/MIT
servers:
- url: https://api.workos.com
  description: Production
- url: https://api.workos-test.com
  description: Staging
security:
- bearer: []
tags:
- name: user-management.users.authorized-applications
  description: Manage authorized applications for users.
  x-displayName: Authorized Applications
paths:
  /user_management/users/{user_id}/authorized_applications:
    get:
      description: Get a list of all Connect applications that the user has authorized.
      operationId: AuthorizedApplicationsController_list
      parameters:
      - name: user_id
        required: true
        in: path
        description: The ID of the user.
        schema:
          example: user_01E4ZCR3C56J083X43JQXF3JK5
          type: string
      - name: before
        required: false
        in: query
        description: An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `before="obj_123"` to fetch a new batch of objects before `"obj_123"`.
        schema:
          example: xxx_01HXYZ123456789ABCDEFGHIJ
          type: string
      - name: after
        required: false
        in: query
        description: An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `after="obj_123"` to fetch a new batch of objects after `"obj_123"`.
        schema:
          example: xxx_01HXYZ987654321KJIHGFEDCBA
          type: string
      - name: limit
        required: false
        in: query
        description: Upper limit on the number of objects to return, between `1` and `100`.
        schema:
          minimum: 1
          maximum: 100
          default: 10
          example: 10
          type: integer
      - name: order
        required: false
        in: query
        description: Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). Defaults to descending.
        schema:
          $ref: '#/components/schemas/PaginationOrder'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuthorizedConnectApplicationList'
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                type: object
                properties:
                  message:
                    type: string
                    description: A human-readable description of the error.
                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
                required:
                - message
        '422':
          description: Unprocessable Entity
          content:
            application/json:
              schema:
                type: object
                properties:
                  message:
                    type: string
                    description: A human-readable description of the error.
                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
                required:
                - message
      summary: List Authorized Applications
      tags:
      - user-management.users.authorized-applications
  /user_management/users/{user_id}/authorized_applications/{application_id}:
    delete:
      description: Delete an existing Authorized Connect Application.
      operationId: AuthorizedApplicationsController_delete
      parameters:
      - name: application_id
        required: true
        in: path
        description: The ID or client ID of the application.
        schema:
          example: conn_app_01HXYZ123456789ABCDEFGHIJ
          type: string
      - name: user_id
        required: true
        in: path
        description: The ID of the user.
        schema:
          example: user_01E4ZCR3C56J083X43JQXF3JK5
          type: string
      responses:
        '204':
          description: No Content
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                type: object
                properties:
                  message:
                    type: string
                    description: A human-readable description of the error.
                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
                required:
                - message
      summary: Delete an Authorized Application
      tags:
      - user-management.users.authorized-applications
components:
  schemas:
    ConnectApplication:
      allOf:
      - type: object
        properties:
          object:
            type: string
            description: Distinguishes the connect application object.
            example: connect_application
            const: connect_application
          id:
            type: string
            description: The unique ID of the connect application.
            example: conn_app_01HXYZ123456789ABCDEFGHIJ
          client_id:
            type: string
            description: The client ID of the connect application.
            example: client_01HXYZ123456789ABCDEFGHIJ
          description:
            type:
            - string
            - 'null'
            description: A description of the connect application.
            example: An application for managing user access
          name:
            type: string
            description: The name of the connect application.
            example: My Application
          scopes:
            type: array
            items:
              type: string
            description: The scopes available for this application.
            example:
            - openid
            - profile
            - email
          created_at:
            format: date-time
            type: string
            description: An ISO 8601 timestamp.
            example: '2026-01-15T12:00:00.000Z'
          updated_at:
            format: date-time
            type: string
            description: An ISO 8601 timestamp.
            example: '2026-01-15T12:00:00.000Z'
        required:
        - object
        - id
        - client_id
        - description
        - name
        - scopes
        - created_at
        - updated_at
      - oneOf:
        - allOf:
          - type: object
            properties:
              application_type:
                type: string
                description: The type of the application.
                const: oauth
              redirect_uris:
                type: array
                items:
                  type: object
                  properties:
                    uri:
                      type: string
                      format: uri
                      description: The redirect URI for the application.
                      example: https://example.com/callback
                    default:
                      type: boolean
                      description: Whether this is the default redirect URI.
                      example: true
                  required:
                  - uri
                  - default
                description: The redirect URIs configured for this application.
              uses_pkce:
                type: boolean
                description: Whether the application uses PKCE for authorization.
                example: true
            required:
            - application_type
            - redirect_uris
            - uses_pkce
          - oneOf:
            - type: object
              properties:
                is_first_party:
                  type: boolean
                  description: Whether the application is a first-party application.
                  example: true
                  const: true
              required:
              - is_first_party
            - type: object
              properties:
                is_first_party:
                  type: boolean
                  description: Whether the application is a first-party application.
                  example: false
                  const: false
                was_dynamically_registered:
                  type: boolean
                  description: Whether the application was dynamically registered.
                  example: false
                  const: false
                organization_id:
                  type: string
                  description: The ID of the organization the application belongs to.
                  example: org_01EHZNVPK3SFK441A1RGBFSHRT
              required:
              - is_first_party
              - was_dynamically_registered
              - organization_id
            - type: object
              properties:
                is_first_party:
                  type: boolean
                  description: Whether the application is a first-party application.
                  example: false
                  const: false
                was_dynamically_registered:
                  type: boolean
                  description: Whether the application was dynamically registered.
                  example: true
                  const: true
              required:
              - is_first_party
              - was_dynamically_registered
        - type: object
          properties:
            application_type:
              type: string
              description: The type of the application.
              example: m2m
              const: m2m
            organization_id:
              type: string
              description: The ID of the organization the application belongs to.
              example: org_01EHZNVPK3SFK441A1RGBFSHRT
          required:
          - application_type
          - organization_id
    PaginationOrder:
      type: string
      enum:
      - normal
      - desc
      - asc
      example: desc
      default: desc
    AuthorizedConnectApplicationList:
      type: object
      properties:
        object:
          type: string
          description: Indicates this is a list response.
          const: list
        data:
          type: array
          items:
            type: object
            properties:
              object:
                type: string
                description: Distinguishes the authorized connect application object.
                const: authorized_connect_application
              id:
                type: string
                description: The unique ID of the authorized connect application.
                example: authorized_connect_app_01HXYZ123456789ABCDEFGHIJ
              granted_scopes:
                type: array
                items:
                  type: string
                description: The scopes granted by the user to the application.
                example:
                - openid
                - profile
                - email
              oauth_resource:
                type: string
                description: The OAuth resource associated with the authorized connect application, if one was requested.
                example: https://api.example.com/resource
              application:
                $ref: '#/components/schemas/ConnectApplication'
            required:
            - object
            - id
            - granted_scopes
            - application
          description: The list of records for the current page.
        list_metadata:
          type: object
          properties:
            before:
              type:
              - string
              - 'null'
              description: An object ID that defines your place in the list. When the ID is not present, you are at the start of the list.
              example: authorized_connect_app_01HXYZ123456789ABCDEFGHIJ
            after:
              type:
              - string
              - 'null'
              description: An object ID that defines your place in the list. When the ID is not present, you are at the end of the list.
              example: authorized_connect_app_01HXYZ987654321KJIHGFEDCBA
          required:
          - before
          - after
          description: Pagination cursors for navigating between pages of results.
      required:
      - object
      - data
      - list_metadata
  securitySchemes:
    bearer:
      scheme: bearer
      bearerFormat: JWT
      type: http
      description: 'Your WorkOS API key prefixed with `sk_`. Pass it as a Bearer token: `Authorization: Bearer sk_example_123456789`.'
    access_token:
      scheme: bearer
      bearerFormat: JWT
      type: http
      description: An SSO access token returned from the Get a Profile and Token endpoint.