HCP Vault Secrets Centralized secrets lifecycle management for developers. Learn More
Terraform
Terraform Home

OAuth client API reference

An OAuth client represents the connection between an organization and a VCS provider. By default, you can globally access an OAuth client throughout the organization, or you can have scope access to one or more projects.

List OAuth Clients

GET /organizations/:organization_name/oauth-clients

ParameterDescription
:organization_nameThe name of the organization.

This endpoint allows you to list VCS connections between an organization and a VCS provider (GitHub, Bitbucket, or GitLab) for use when creating or setting up workspaces.

StatusResponseReason
200JSON API document (type: "oauth-clients")Success
404JSON API error objectOrganization not found

Query Parameters

This endpoint supports pagination with standard URL query parameters. Remember to percent-encode [ as %5B and ] as %5D if your tooling doesn't automatically encode URLs. If neither pagination query parameters are provided, the endpoint will not be paginated and will return all results.

ParameterDescription
page[number]Optional. If omitted, the endpoint will return the first page.
page[size]Optional. If omitted, the endpoint will return 20 oauth clients per page.

Sample Request

curl \
  --header "Authorization: Bearer $TOKEN" \
  --header "Content-Type: application/vnd.api+json" \
  --request GET \
  https://app.terraform.io/api/v2/organizations/my-organization/oauth-clients

Sample Response

{
  "data": [
    {
      "id": "oc-XKFwG6ggfA9n7t1K",
      "type": "oauth-clients",
      "attributes": {
        "created-at": "2018-04-16T20:42:53.771Z",
        "callback-url": "https://app.terraform.io/auth/35936d44-842c-4ddd-b4d4-7c741383dc3a/callback",
        "connect-path": "/auth/35936d44-842c-4ddd-b4d4-7c741383dc3a?organization_id=1",
        "service-provider": "github",
        "service-provider-display-name": "GitHub",
        "name": null,
        "http-url": "https://github.com",
        "api-url": "https://api.github.com",
        "key": null,
        "rsa-public-key": null,
        "organization-scoped": false
      },
      "relationships": {
        "organization": {
          "data": {
            "id": "my-organization",
            "type": "organizations"
          },
          "links": {
            "related": "/api/v2/organizations/my-organization"
          }
        },
        "projects": {
          "data": [
            { "id": "prj-AwfuCJTkdai4xj9w", "type": "projects" }
          ]
        }, 
        "oauth-tokens": {
          "data": [],
          "links": {
            "related": "/api/v2/oauth-tokens/ot-KaeqH4cy72VPXFQT"
          }
        },
        "agent-pool": {
            "data": { 
              "id": "apool-VsmjEMcYkShrckpK", 
              "type": "agent-pools" 
            },
            "links": { 
              "related": "/api/v2/agent-pools/apool-VsmjEMcYkShrckpK" 
            }
        }
      }
    }
  ]
}

Show an OAuth Client

GET /oauth-clients/:id

ParameterDescription
:idThe ID of the OAuth Client to show
StatusResponseReason
200JSON API document (type: "oauth-clients")Success
404JSON API error objectOAuth Client not found, or user unauthorized to perform action

Sample Request

curl \
  --header "Authorization: Bearer $TOKEN" \
  --header "Content-Type: application/vnd.api+json" \
  --request GET \
  https://app.terraform.io/api/v2/oauth-clients/oc-XKFwG6ggfA9n7t1K

Sample Response

{
  "data": {
    "id": "oc-XKFwG6ggfA9n7t1K",
    "type": "oauth-clients",
    "attributes": {
      "created-at": "2018-04-16T20:42:53.771Z",
      "callback-url": "https://app.terraform.io/auth/35936d44-842c-4ddd-b4d4-7c741383dc3a/callback",
      "connect-path": "/auth/35936d44-842c-4ddd-b4d4-7c741383dc3a?organization_id=1",
      "service-provider": "github",
      "service-provider-display-name": "GitHub",
      "name": null,
      "http-url": "https://github.com",
      "api-url": "https://api.github.com",
      "key": null,
      "rsa-public-key": null,
      "organization-scoped": false
    },
    "relationships": {
      "organization": {
        "data": {
          "id": "my-organization",
          "type": "organizations"
        },
        "links": {
          "related": "/api/v2/organizations/my-organization"
        }
      },
      "projects": {
        "data": [
          { "id": "prj-AwfuCJTkdai4xj9w", "type": "projects" }
        ]
      },
      "oauth-tokens": {
        "data": [],
        "links": {
          "related": "/api/v2/oauth-tokens/ot-KaeqH4cy72VPXFQT"
        }
      },
      "agent-pool": {
        "data": { 
          "id": "apool-VsmjEMcYkShrckpK",
          "type": "agent-pools"
        },
        "links": { 
          "related": "/api/v2/agent-pools/apool-VsmjEMcYkShrckpK" 
        }
      }
    }
  }
}

Create an OAuth Client

POST /organizations/:organization_name/oauth-clients

ParameterDescription
:organization_nameThe name of the organization that will be connected to the VCS provider. The organization must already exist in the system, and the user must have permission to manage VCS settings. (More about permissions.)

This endpoint allows you to create a VCS connection between an organization and a VCS provider (GitHub or GitLab) for use when creating or setting up workspaces. By using this API endpoint, you can provide a pre-generated OAuth token string instead of going through the process of creating a GitHub or GitLab OAuth Application.

To learn how to generate one of these token strings for your VCS provider, you can read the following documentation:

StatusResponseReason
201JSON API document (type: "oauth-clients")OAuth Client successfully created
404JSON API error objectOrganization not found or user unauthorized to perform action
422JSON API error objectMalformed request body (missing attributes, wrong types, etc.)

Request Body

This POST endpoint requires a JSON object with the following properties as a request payload.

Properties without a default value are required.

Key pathTypeDefaultDescription
data.typestringMust be "oauth-clients".
data.attributes.service-providerstringThe VCS provider being connected with. Valid options are "github", "github_enterprise", "gitlab_hosted", "gitlab_community_edition", "gitlab_enterprise_edition", or "ado_server".
data.attributes.namestringnullAn optional display name for the OAuth Client. If left null, the UI will default to the display name of the VCS provider.
data.attributes.keystringThe OAuth Client key. It can refer to a Consumer Key, Application Key, or another type of client key for the VCS provider.
data.attributes.http-urlstringThe homepage of your VCS provider (e.g. "https://github.com" or "https://ghe.example.com" or "https://gitlab.com").
data.attributes.api-urlstringThe base URL as per your VCS provider's API documentation (e.g. "https://api.github.com", "https://ghe.example.com/api/v3" or "https://gitlab.com/api/v4").
data.attributes.oauth-token-stringstringThe token string you were given by your VCS provider
data.attributes.private-keystringRequired for Azure DevOps Server. Not used for any other providers. The text of the SSH private key associated with your Azure DevOps Server account.
data.attributes.secretstringThe OAuth client secret. For Bitbucket Data Center, the secret is the text of the SSH private key associated with your Bitbucket Data Center application link.
data.attributes.rsa-public-keystringRequired for Bitbucket Data Center in conjunction with the secret. Not used for any other providers. The text of the SSH public key associated with your Bitbucket Data Center application link.
data.attributes.organization-scopedbooleanWhether or not the OAuth client is scoped to all projects and workspaces in the organization. Defaults to true.
data.relationships.projects.data[]array[object][]A list of resource identifier objects that defines which projects are associated with the OAuth client. If data.attributes.organization-scoped is set to false, the OAuth client is only available to this list of projects. Each object in this list must contain a project id and use the "projects" type. For example, { "id": "prj-AwfuCJTkdai4xj9w", "type": "projects" }.
data.relationships.agent-pool.dataobject{}The Agent Pool associated to the VCS connection. This pool will be responsible for forwarding VCS Provider API calls and cloning VCS repositories.

Sample Payload

{
  "data": {
    "type": "oauth-clients",
    "attributes": {
      "service-provider": "github",
      "http-url": "https://github.com",
      "api-url": "https://api.github.com",
      "oauth-token-string": "4306823352f0009d0ed81f1b654ac17a",
      "organization-scoped": false
    },
    "relationships": {
      "projects": {
        "data": [
          { "id": "prj-AwfuCJTkdai4xj9w", "type": "projects" }
        ]
      },
      "agent-pool": {
        "data": { 
            "id": "apool-VsmjEMcYkShrckzzz",
            "type": "agent-pools"
        } 
      }
    }
  }
}

Sample Request

curl \
  --header "Authorization: Bearer $TOKEN" \
  --header "Content-Type: application/vnd.api+json" \
  --request POST \
  --data @payload.json \
  https://app.terraform.io/api/v2/organizations/my-organization/oauth-clients

Sample Response

{
  "data": {
    "id": "oc-XKFwG6ggfA9n7t1K",
    "type": "oauth-clients",
    "attributes": {
      "created-at": "2018-04-16T20:42:53.771Z",
      "callback-url": "https://app.terraform.io/auth/35936d44-842c-4ddd-b4d4-7c741383dc3a/callback",
      "connect-path": "/auth/35936d44-842c-4ddd-b4d4-7c741383dc3a?organization_id=1",
      "service-provider": "github",
      "service-provider-display-name": "GitHub",
      "name": null,
      "http-url": "https://github.com",
      "api-url": "https://api.github.com",
      "key": null,
      "rsa-public-key": null,
      "organization-scoped": false
    },
    "relationships": {
      "organization": {
        "data": {
          "id": "my-organization",
          "type": "organizations"
        },
        "links": {
          "related": "/api/v2/organizations/my-organization"
        }
      },
      "projects": {
        "data": [
          { "id": "prj-AwfuCJTkdai4xj9w", "type": "projects" }
        ]
      },
      "oauth-tokens": {
        "data": [],
        "links": {
          "related": "/api/v2/oauth-tokens/ot-KaeqH4cy72VPXFQT"
        }
      },
      "agent-pool": {
        "data": { 
            "id": "apool-VsmjEMcYkShrckzzz",
            "type": "agent-pools"
        }
      }
    }
  }
}

Update an OAuth Client

PATCH /oauth-clients/:id

ParameterDescription
:idThe ID of the OAuth Client to update.

Use caution when changing attributes with this endpoint; editing an OAuth client that workspaces are currently using can have unexpected effects.

StatusResponseReason
200JSON API document (type: "oauth-clients")The request was successful
404JSON API error objectOAuth Client not found or user unauthorized to perform action
422JSON API error objectMalformed request body (missing attributes, wrong types, etc.)

Request Body

This PATCH endpoint requires a JSON object with the following properties as a request payload.

Key pathTypeDefaultDescription
data.typestringMust be "oauth-clients".
data.attributes.namestring(previous value)An optional display name for the OAuth Client. If set to null, the UI will default to the display name of the VCS provider.
data.attributes.keystring(previous value)The OAuth Client key. It can refer to a Consumer Key, Application Key, or another type of client key for the VCS provider.
data.attributes.secretstring(previous value)The OAuth client secret. For Bitbucket Data Center, this secret is the text of the SSH private key associated with your Bitbucket Data Center application link.
data.attributes.rsa-public-keystring(previous value)Required for Bitbucket Data Center in conjunction with the secret. Not used for any other providers. The text of the SSH public key associated with your Bitbucket Data Center application link.
data.attributes.organization-scopedboolean(previous value)Whether or not the OAuth client is available to all projects and workspaces in the organization.
data.relationships.projectsarray[object](previous value)A list of resource identifier objects that defines which projects are associated with the OAuth client. If data.attributes.organization-scoped is set to false, the OAuth client is only available to this list of projects. Each object in this list must contain a project id and use the "projects" type. For example, { "id": "prj-AwfuCJTkdai4xj9w", "type": "projects" }. Sending an empty array clears all project assignments.
data.relationships.agent-pool.dataobject{}The Agent Pool associated to the VCS connection. This pool will be responsible for forwarding VCS Provider API calls and cloning VCS repositories.

Sample Payload

{
  "data": {
    "id": "oc-XKFwG6ggfA9n7t1K",
    "type": "oauth-clients",
    "attributes": {
      "key": "key",
      "secret": "secret",
      "organization-scoped": false
    },
    "relationships": {
      "projects": {
        "data": [
          { "id": "prj-AwfuCJTkdai4xj9w", "type": "projects" }
        ]
      },
      "agent-pool": {
        "data": { 
            "id": "apool-VsmjEMcYkShrckzzz", 
            "type": "agent-pools" 
        } 
      }
    }
  }
}

Sample Request

curl \
  --header "Authorization: Bearer $TOKEN" \
  --header "Content-Type: application/vnd.api+json" \
  --request PATCH \
  --data @payload.json \
  https://app.terraform.io/api/v2/oauth-clients/oc-XKFwG6ggfA9n7t1K

Sample Response

{
  "data": {
    "id": "oc-XKFwG6ggfA9n7t1K",
    "type": "oauth-clients",
    "attributes": {
      "created-at": "2018-04-16T20:42:53.771Z",
      "callback-url": "https://app.terraform.io/auth/35936d44-842c-4ddd-b4d4-7c741383dc3a/callback",
      "connect-path": "/auth/35936d44-842c-4ddd-b4d4-7c741383dc3a?organization_id=1",
      "service-provider": "github",
      "service-provider-display-name": "GitHub",
      "name": null,
      "http-url": "https://github.com",
      "api-url": "https://api.github.com",
      "key": null,
      "rsa-public-key": null,
      "organization-scoped": false
    },
    "relationships": {
      "organization": {
        "data": {
          "id": "my-organization",
          "type": "organizations"
        },
        "links": {
          "related": "/api/v2/organizations/my-organization"
        }
      },
      "projects": {
        "data": [
          { "id": "prj-AwfuCJTkdai4xj9w", "type": "projects" }
        ]
      },
      "oauth-tokens": {
        "data": [],
        "links": {
          "related": "/api/v2/oauth-tokens/ot-KaeqH4cy72VPXFQT"
        }
      },
      "agent-pool": {
        "data": { 
          "id": "apool-VsmjEMcYkShrckzzz", 
          "type": "agent-pools" 
        } 
      }
    }
  }
}

Destroy an OAuth Client

DELETE /oauth-clients/:id

ParameterDescription
:idThe ID of the OAuth Client to destroy

This endpoint allows you to remove an existing connection between an organization and a VCS provider (GitHub, Bitbucket, or GitLab).

Note: Removing the OAuth Client will unlink workspaces that use this connection from their repositories, and these workspaces will need to be manually linked to another repository.

StatusResponseReason
204Empty responseThe OAuth Client was successfully destroyed
404JSON API error objectOrganization or OAuth Client not found, or user unauthorized to perform action

Sample Request

curl \
  --header "Authorization: Bearer $TOKEN" \
  --header "Content-Type: application/vnd.api+json" \
  --request DELETE \
  https://app.terraform.io/api/v2/oauth-clients/oc-XKFwG6ggfA9n7t1K

Attach to a project

POST /oauth-clients/:id/relationships/projects

ParameterDescription
:idThe ID of the OAuth client to attach to a project. Use the List OAuth Clients endpoint to reference your OAuth client IDs.
StatusResponseReason
204NothingThe request was successful
404JSON API error objectOAuth Client not found or user unauthorized to perform action
422JSON API error objectMalformed request body (one or more projects not found, wrong types, etc.)

Request Body

This POST endpoint requires a JSON object with the following properties as a request payload.

Properties without a default value are required.

Key pathTypeDefaultDescription
data[]array[object][]A list of resource identifier objects that defines which projects to attach the OAuth client to. These objects must contain id and type properties, and the type property must be projects (e.g. { "id": "prj-AwfuCJTkdai4xj9w", "type": "projects" }).

Sample Payload

{
  "data": [
    { "id": "prj-AwfuCJTkdai4xj9w", "type": "projects" },
    { "id": "prj-2HRvNs49EWPjDqT1", "type": "projects" }
  ]
}

Sample Request

curl \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/vnd.api+json" \
  --request POST \
  --data @payload.json \
  https://app.terraform.io/api/v2/oauth-clients/oc-XKFwG6ggfA9n7t1K/relationships/projects

Detach an OAuth Client from projects

DELETE /oauth-clients/:id/relationships/projects

ParameterDescription
:idThe ID of the oauth client you want to detach from the specified projects. Use the "List OAuth Clients" endpoint to find IDs.
StatusResponseReason
204NothingThe request was successful
404JSON API error objectOAuth Client not found or user unauthorized to perform action
422JSON API error objectMalformed request body (one or more projects not found, wrong types, etc.)

Request Body

This DELETE endpoint requires a JSON object with the following properties as a request payload.

Properties without a default value are required.

Key pathTypeDefaultDescription
data[]array[object][]A list of resource identifier objects that defines which projects are associated with the OAuth client. If data.attributes.organization-scoped is set to false, the OAuth client is only available to this list of projects. Each object in this list must contain a project id and use the "projects" type. For example, { "id": "prj-AwfuCJTkdai4xj9w", "type": "projects" }.

Sample Payload

{
  "data": [
    { "id": "prj-AwfuCJTkdai4xj9w", "type": "projects" },
    { "id": "prj-2HRvNs49EWPjDqT1", "type": "projects" }
  ]
}

Sample Request

curl \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/vnd.api+json" \
  --request DELETE \
  --data @payload.json \
  https://app.terraform.io/api/v2/oauth-clients/oc-XKFwG6ggfA9n7t1K/relationships/projects

Available Related Resources

The GET endpoints above can optionally return related resources, if requested with the include query parameter. The following resource types are available:

Resource NameDescription
oauth_tokensThe OAuth tokens managed by this client
projectsThe projects scoped to this client
Edit this page on GitHub