OAuth client API reference

An OAuth client represents the connection between an organization and a VCS provider. By default, you can globally access an OAuth client throughout the organization, or you can have scope access to one or more projects.

List OAuth Clients

GET /organizations/:organization_name/oauth-clients

Parameter	Description
`:organization_name`	The name of the organization.

This endpoint allows you to list VCS connections between an organization and a VCS provider (GitHub, Bitbucket, or GitLab) for use when creating or setting up workspaces.

Status	Response	Reason
200	JSON API document (`type: "oauth-clients"`)	Success
404	JSON API error object	Organization not found

Query Parameters

This endpoint supports pagination with standard URL query parameters. Remember to percent-encode [ as %5B and ] as %5D if your tooling doesn't automatically encode URLs. If neither pagination query parameters are provided, the endpoint will not be paginated and will return all results.

Parameter	Description
`page[number]`	Optional. If omitted, the endpoint will return the first page.
`page[size]`	Optional. If omitted, the endpoint will return 20 oauth clients per page.

Sample Request

curl \
  --header "Authorization: Bearer $TOKEN" \
  --header "Content-Type: application/vnd.api+json" \
  --request GET \
  https://app.terraform.io/api/v2/organizations/my-organization/oauth-clients

Sample Response

{
  "data": [
    {
      "id": "oc-XKFwG6ggfA9n7t1K",
      "type": "oauth-clients",
      "attributes": {
        "created-at": "2018-04-16T20:42:53.771Z",
        "callback-url": "https://app.terraform.io/auth/35936d44-842c-4ddd-b4d4-7c741383dc3a/callback",
        "connect-path": "/auth/35936d44-842c-4ddd-b4d4-7c741383dc3a?organization_id=1",
        "service-provider": "github",
        "service-provider-display-name": "GitHub",
        "name": null,
        "http-url": "https://github.com",
        "api-url": "https://api.github.com",
        "key": null,
        "rsa-public-key": null,
        "organization-scoped": false
      },
      "relationships": {
        "organization": {
          "data": {
            "id": "my-organization",
            "type": "organizations"
          },
          "links": {
            "related": "/api/v2/organizations/my-organization"
          }
        },
        "projects": {
          "data": [
            { "id": "prj-AwfuCJTkdai4xj9w", "type": "projects" }
          ]
        }, 
        "oauth-tokens": {
          "data": [],
          "links": {
            "related": "/api/v2/oauth-tokens/ot-KaeqH4cy72VPXFQT"
          }
        },
        "agent-pool": {
            "data": { 
              "id": "apool-VsmjEMcYkShrckpK", 
              "type": "agent-pools" 
            },
            "links": { 
              "related": "/api/v2/agent-pools/apool-VsmjEMcYkShrckpK" 
            }
        }
      }
    }
  ]
}

Show an OAuth Client

GET /oauth-clients/:id

Parameter	Description
`:id`	The ID of the OAuth Client to show

Status	Response	Reason
200	JSON API document (`type: "oauth-clients"`)	Success
404	JSON API error object	OAuth Client not found, or user unauthorized to perform action

Sample Request

curl \
  --header "Authorization: Bearer $TOKEN" \
  --header "Content-Type: application/vnd.api+json" \
  --request GET \
  https://app.terraform.io/api/v2/oauth-clients/oc-XKFwG6ggfA9n7t1K

Sample Response

{
  "data": {
    "id": "oc-XKFwG6ggfA9n7t1K",
    "type": "oauth-clients",
    "attributes": {
      "created-at": "2018-04-16T20:42:53.771Z",
      "callback-url": "https://app.terraform.io/auth/35936d44-842c-4ddd-b4d4-7c741383dc3a/callback",
      "connect-path": "/auth/35936d44-842c-4ddd-b4d4-7c741383dc3a?organization_id=1",
      "service-provider": "github",
      "service-provider-display-name": "GitHub",
      "name": null,
      "http-url": "https://github.com",
      "api-url": "https://api.github.com",
      "key": null,
      "rsa-public-key": null,
      "organization-scoped": false
    },
    "relationships": {
      "organization": {
        "data": {
          "id": "my-organization",
          "type": "organizations"
        },
        "links": {
          "related": "/api/v2/organizations/my-organization"
        }
      },
      "projects": {
        "data": [
          { "id": "prj-AwfuCJTkdai4xj9w", "type": "projects" }
        ]
      },
      "oauth-tokens": {
        "data": [],
        "links": {
          "related": "/api/v2/oauth-tokens/ot-KaeqH4cy72VPXFQT"
        }
      },
      "agent-pool": {
        "data": { 
          "id": "apool-VsmjEMcYkShrckpK",
          "type": "agent-pools"
        },
        "links": { 
          "related": "/api/v2/agent-pools/apool-VsmjEMcYkShrckpK" 
        }
      }
    }
  }
}

Create an OAuth Client

POST /organizations/:organization_name/oauth-clients

Parameter	Description
`:organization_name`	The name of the organization that will be connected to the VCS provider. The organization must already exist in the system, and the user must have permission to manage VCS settings. (More about permissions.)

This endpoint allows you to create a VCS connection between an organization and a VCS provider (GitHub or GitLab) for use when creating or setting up workspaces. By using this API endpoint, you can provide a pre-generated OAuth token string instead of going through the process of creating a GitHub or GitLab OAuth Application.

To learn how to generate one of these token strings for your VCS provider, you can read the following documentation:

Status	Response	Reason
201	JSON API document (`type: "oauth-clients"`)	OAuth Client successfully created
404	JSON API error object	Organization not found or user unauthorized to perform action
422	JSON API error object	Malformed request body (missing attributes, wrong types, etc.)

Request Body

This POST endpoint requires a JSON object with the following properties as a request payload.

Properties without a default value are required.

Key path	Type	Default	Description
`data.type`	string		Must be `"oauth-clients"`.
`data.attributes.service-provider`	string		The VCS provider being connected with. Valid options are `"github"`, `"github_enterprise"`, `"gitlab_hosted"`, `"gitlab_community_edition"`, `"gitlab_enterprise_edition"`, or `"ado_server"`.
`data.attributes.name`	string	`null`	An optional display name for the OAuth Client. If left `null`, the UI will default to the display name of the VCS provider.
`data.attributes.key`	string		The OAuth Client key. It can refer to a Consumer Key, Application Key, or another type of client key for the VCS provider.
`data.attributes.http-url`	string		The homepage of your VCS provider (e.g. `"https://github.com"` or `"https://ghe.example.com"` or `"https://gitlab.com"`).
`data.attributes.api-url`	string		The base URL as per your VCS provider's API documentation (e.g. `"https://api.github.com"`, `"https://ghe.example.com/api/v3"` or `"https://gitlab.com/api/v4"`).
`data.attributes.oauth-token-string`	string		The token string you were given by your VCS provider
`data.attributes.private-key`	string		Required for Azure DevOps Server. Not used for any other providers. The text of the SSH private key associated with your Azure DevOps Server account.
`data.attributes.secret`	string		The OAuth client secret. For Bitbucket Data Center, the secret is the text of the SSH private key associated with your Bitbucket Data Center application link.
`data.attributes.rsa-public-key`	string		Required for Bitbucket Data Center in conjunction with the `secret`. Not used for any other providers. The text of the SSH public key associated with your Bitbucket Data Center application link.
`data.attributes.organization-scoped`	boolean		Whether or not the OAuth client is scoped to all projects and workspaces in the organization. Defaults to `true`.
`data.relationships.projects.data[]`	array[object]	`[]`	A list of resource identifier objects that defines which projects are associated with the OAuth client. If `data.attributes.organization-scoped` is set to `false`, the OAuth client is only available to this list of projects. Each object in this list must contain a project `id` and use the `"projects"` type. For example, `{ "id": "prj-AwfuCJTkdai4xj9w", "type": "projects" }`.
`data.relationships.agent-pool.data`	object	`{}`	The Agent Pool associated to the VCS connection. This pool will be responsible for forwarding VCS Provider API calls and cloning VCS repositories.

Sample Payload

{
  "data": {
    "type": "oauth-clients",
    "attributes": {
      "service-provider": "github",
      "http-url": "https://github.com",
      "api-url": "https://api.github.com",
      "oauth-token-string": "4306823352f0009d0ed81f1b654ac17a",
      "organization-scoped": false
    },
    "relationships": {
      "projects": {
        "data": [
          { "id": "prj-AwfuCJTkdai4xj9w", "type": "projects" }
        ]
      },
      "agent-pool": {
        "data": { 
            "id": "apool-VsmjEMcYkShrckzzz",
            "type": "agent-pools"
        } 
      }
    }
  }
}

Sample Request

curl \
  --header "Authorization: Bearer $TOKEN" \
  --header "Content-Type: application/vnd.api+json" \
  --request POST \
  --data @payload.json \
  https://app.terraform.io/api/v2/organizations/my-organization/oauth-clients

Sample Response

{
  "data": {
    "id": "oc-XKFwG6ggfA9n7t1K",
    "type": "oauth-clients",
    "attributes": {
      "created-at": "2018-04-16T20:42:53.771Z",
      "callback-url": "https://app.terraform.io/auth/35936d44-842c-4ddd-b4d4-7c741383dc3a/callback",
      "connect-path": "/auth/35936d44-842c-4ddd-b4d4-7c741383dc3a?organization_id=1",
      "service-provider": "github",
      "service-provider-display-name": "GitHub",
      "name": null,
      "http-url": "https://github.com",
      "api-url": "https://api.github.com",
      "key": null,
      "rsa-public-key": null,
      "organization-scoped": false
    },
    "relationships": {
      "organization": {
        "data": {
          "id": "my-organization",
          "type": "organizations"
        },
        "links": {
          "related": "/api/v2/organizations/my-organization"
        }
      },
      "projects": {
        "data": [
          { "id": "prj-AwfuCJTkdai4xj9w", "type": "projects" }
        ]
      },
      "oauth-tokens": {
        "data": [],
        "links": {
          "related": "/api/v2/oauth-tokens/ot-KaeqH4cy72VPXFQT"
        }
      },
      "agent-pool": {
        "data": { 
            "id": "apool-VsmjEMcYkShrckzzz",
            "type": "agent-pools"
        }
      }
    }
  }
}

Update an OAuth Client

PATCH /oauth-clients/:id

Parameter	Description
`:id`	The ID of the OAuth Client to update.

Use caution when changing attributes with this endpoint; editing an OAuth client that workspaces are currently using can have unexpected effects.

Status	Response	Reason
200	JSON API document (`type: "oauth-clients"`)	The request was successful
404	JSON API error object	OAuth Client not found or user unauthorized to perform action
422	JSON API error object	Malformed request body (missing attributes, wrong types, etc.)

Request Body

This PATCH endpoint requires a JSON object with the following properties as a request payload.

Key path	Type	Default	Description
`data.type`	string		Must be `"oauth-clients"`.
`data.attributes.name`	string	(previous value)	An optional display name for the OAuth Client. If set to `null`, the UI will default to the display name of the VCS provider.
`data.attributes.key`	string	(previous value)	The OAuth Client key. It can refer to a Consumer Key, Application Key, or another type of client key for the VCS provider.
`data.attributes.secret`	string	(previous value)	The OAuth client secret. For Bitbucket Data Center, this secret is the text of the SSH private key associated with your Bitbucket Data Center application link.
`data.attributes.rsa-public-key`	string	(previous value)	Required for Bitbucket Data Center in conjunction with the `secret`. Not used for any other providers. The text of the SSH public key associated with your Bitbucket Data Center application link.
`data.attributes.organization-scoped`	boolean	(previous value)	Whether or not the OAuth client is available to all projects and workspaces in the organization.
`data.relationships.projects`	array[object]	(previous value)	A list of resource identifier objects that defines which projects are associated with the OAuth client. If `data.attributes.organization-scoped` is set to `false`, the OAuth client is only available to this list of projects. Each object in this list must contain a project `id` and use the `"projects"` type. For example, `{ "id": "prj-AwfuCJTkdai4xj9w", "type": "projects" }`. Sending an empty array clears all project assignments.
`data.relationships.agent-pool.data`	object	`{}`	The Agent Pool associated to the VCS connection. This pool will be responsible for forwarding VCS Provider API calls and cloning VCS repositories.

Sample Payload

{
  "data": {
    "id": "oc-XKFwG6ggfA9n7t1K",
    "type": "oauth-clients",
    "attributes": {
      "key": "key",
      "secret": "secret",
      "organization-scoped": false
    },
    "relationships": {
      "projects": {
        "data": [
          { "id": "prj-AwfuCJTkdai4xj9w", "type": "projects" }
        ]
      },
      "agent-pool": {
        "data": { 
            "id": "apool-VsmjEMcYkShrckzzz", 
            "type": "agent-pools" 
        } 
      }
    }
  }
}

Sample Request

curl \
  --header "Authorization: Bearer $TOKEN" \
  --header "Content-Type: application/vnd.api+json" \
  --request PATCH \
  --data @payload.json \
  https://app.terraform.io/api/v2/oauth-clients/oc-XKFwG6ggfA9n7t1K

Sample Response

{
  "data": {
    "id": "oc-XKFwG6ggfA9n7t1K",
    "type": "oauth-clients",
    "attributes": {
      "created-at": "2018-04-16T20:42:53.771Z",
      "callback-url": "https://app.terraform.io/auth/35936d44-842c-4ddd-b4d4-7c741383dc3a/callback",
      "connect-path": "/auth/35936d44-842c-4ddd-b4d4-7c741383dc3a?organization_id=1",
      "service-provider": "github",
      "service-provider-display-name": "GitHub",
      "name": null,
      "http-url": "https://github.com",
      "api-url": "https://api.github.com",
      "key": null,
      "rsa-public-key": null,
      "organization-scoped": false
    },
    "relationships": {
      "organization": {
        "data": {
          "id": "my-organization",
          "type": "organizations"
        },
        "links": {
          "related": "/api/v2/organizations/my-organization"
        }
      },
      "projects": {
        "data": [
          { "id": "prj-AwfuCJTkdai4xj9w", "type": "projects" }
        ]
      },
      "oauth-tokens": {
        "data": [],
        "links": {
          "related": "/api/v2/oauth-tokens/ot-KaeqH4cy72VPXFQT"
        }
      },
      "agent-pool": {
        "data": { 
          "id": "apool-VsmjEMcYkShrckzzz", 
          "type": "agent-pools" 
        } 
      }
    }
  }
}

Destroy an OAuth Client

DELETE /oauth-clients/:id

Parameter	Description
`:id`	The ID of the OAuth Client to destroy

This endpoint allows you to remove an existing connection between an organization and a VCS provider (GitHub, Bitbucket, or GitLab).

Note: Removing the OAuth Client will unlink workspaces that use this connection from their repositories, and these workspaces will need to be manually linked to another repository.

Status	Response	Reason
204	Empty response	The OAuth Client was successfully destroyed
404	JSON API error object	Organization or OAuth Client not found, or user unauthorized to perform action

Sample Request

curl \
  --header "Authorization: Bearer $TOKEN" \
  --header "Content-Type: application/vnd.api+json" \
  --request DELETE \
  https://app.terraform.io/api/v2/oauth-clients/oc-XKFwG6ggfA9n7t1K

Attach to a project

POST /oauth-clients/:id/relationships/projects

Parameter	Description
`:id`	The ID of the OAuth client to attach to a project. Use the List OAuth Clients endpoint to reference your OAuth client IDs.

Status	Response	Reason
204	Nothing	The request was successful
404	JSON API error object	OAuth Client not found or user unauthorized to perform action
422	JSON API error object	Malformed request body (one or more projects not found, wrong types, etc.)

Request Body

This POST endpoint requires a JSON object with the following properties as a request payload.

Properties without a default value are required.

Key path	Type	Default	Description
`data[]`	array[object]	`[]`	A list of resource identifier objects that defines which projects to attach the OAuth client to. These objects must contain `id` and `type` properties, and the `type` property must be `projects` (e.g. `{ "id": "prj-AwfuCJTkdai4xj9w", "type": "projects" }`).

Sample Payload

{
  "data": [
    { "id": "prj-AwfuCJTkdai4xj9w", "type": "projects" },
    { "id": "prj-2HRvNs49EWPjDqT1", "type": "projects" }
  ]
}

Sample Request

curl \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/vnd.api+json" \
  --request POST \
  --data @payload.json \
  https://app.terraform.io/api/v2/oauth-clients/oc-XKFwG6ggfA9n7t1K/relationships/projects

Detach an OAuth Client from projects

DELETE /oauth-clients/:id/relationships/projects

Parameter	Description
`:id`	The ID of the oauth client you want to detach from the specified projects. Use the "List OAuth Clients" endpoint to find IDs.

Status	Response	Reason
204	Nothing	The request was successful
404	JSON API error object	OAuth Client not found or user unauthorized to perform action
422	JSON API error object	Malformed request body (one or more projects not found, wrong types, etc.)

Request Body

This DELETE endpoint requires a JSON object with the following properties as a request payload.

Properties without a default value are required.

Key path	Type	Default	Description
`data[]`	array[object]	`[]`	A list of resource identifier objects that defines which projects are associated with the OAuth client. If `data.attributes.organization-scoped` is set to `false`, the OAuth client is only available to this list of projects. Each object in this list must contain a project `id` and use the `"projects"` type. For example, `{ "id": "prj-AwfuCJTkdai4xj9w", "type": "projects" }`.

Sample Payload

{
  "data": [
    { "id": "prj-AwfuCJTkdai4xj9w", "type": "projects" },
    { "id": "prj-2HRvNs49EWPjDqT1", "type": "projects" }
  ]
}

Sample Request

curl \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/vnd.api+json" \
  --request DELETE \
  --data @payload.json \
  https://app.terraform.io/api/v2/oauth-clients/oc-XKFwG6ggfA9n7t1K/relationships/projects

The GET endpoints above can optionally return related resources, if requested with the include query parameter. The following resource types are available:

Resource Name	Description
`oauth_tokens`	The OAuth tokens managed by this client
`projects`	The projects scoped to this client

OAuth client API reference

List OAuth Clients

Query Parameters

Sample Request

Sample Response

Show an OAuth Client

Sample Request

Sample Response

Create an OAuth Client

Request Body

Sample Payload

Sample Request

Sample Response

Update an OAuth Client

Request Body

Sample Payload

Sample Request

Sample Response

Destroy an OAuth Client

Sample Request

Attach to a project

Request Body

Sample Payload

Sample Request

Detach an OAuth Client from projects

Request Body

Sample Payload

Sample Request

Available Related Resources