---
title: "Upsert an OAuth2 client scopes restriction"
method: POST
path: "/api/v2/oauth2/clients/{client_uuid}/scopes_restriction"
tags: ["OAuth2 Client Public"]
---

# Upsert an OAuth2 client scopes restriction

`POST /api/v2/oauth2/clients/{client_uuid}/scopes_restriction`

Create or update the scopes restriction configured for the OAuth2 client.

## Path parameters

- `client_uuid` string, uuid, required

## Request body

- UpsertOAuthScopesRestrictionRequest — Request payload for creating or updating the scopes restriction of an OAuth2 client.
  - `data` UpsertOAuthScopesRestrictionData, required — Data object of an upsert OAuth2 scopes restriction request.
    - `attributes` UpsertOAuthScopesRestrictionDataAttributes — Attributes of an upsert OAuth2 scopes restriction request.
      - `oidc_scopes` OAuthOidcScope[] — OIDC scopes the client is allowed to request.
      - `permission_scopes` string[] — Datadog permission scopes the client is allowed to request. Each value must be a valid permission name.
    - `type` 'upsert_scopes_restriction', required — JSON:API resource type for an upsert OAuth2 client scopes restriction request.

## Response `200`

OK

- OAuthScopesRestrictionResponse — Response payload describing the scopes restriction of an OAuth2 client.
  - `data` OAuthScopesRestrictionResponseData, required — Data object of an OAuth2 client scopes restriction response.
    - `attributes` OAuthScopesRestrictionResponseAttributes, required — Attributes of an OAuth2 client scopes restriction.
      - `required_permission_scopes` string[], nullable, required — Permission scopes automatically required for this client (for example, mobile-app permission scopes). Returns `null` when no scopes are required.
      - `scopes_restriction` OAuthScopesRestriction, nullable, required — Allowlist of OIDC and permission scopes enforced for the OAuth2 client.
        - `oidc_scopes` OAuthOidcScope[], required — OIDC scopes the client is restricted to.
        - `permission_scopes` string[], required — Datadog permission scopes the client is restricted to.
    - `id` string, uuid, required — UUID of the OAuth2 client this restriction applies to.
    - `type` 'scopes_restriction', required — JSON:API resource type for an OAuth2 client scopes restriction.

## Other responses

- `400` — Bad Request
- `404` — Not Found
- `429` — Too many requests

---

[API](https://skmtc.dev/datadog/apis/api-v2.md) · [All operations](https://skmtc.dev/datadog/apis/api-v2/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/datadog/api-v2/revisions/da68bf029e4c/schema)