---
title: "Upsert an OAuth2 client scopes restriction"
method: POST
path: "/api/v2/oauth2/clients/{client_uuid}/scopes_restriction"
tags: ["OAuth2 Client Public"]
---

# Upsert an OAuth2 client scopes restriction

`POST /api/v2/oauth2/clients/{client_uuid}/scopes_restriction`

## Request

- Base URL: `https://api.datadoghq.com`
- URL: `https://api.datadoghq.com/api/v2/oauth2/clients/{client_uuid}/scopes_restriction`
- Auth: API key in header `DD-API-KEY` and API key in header `DD-APPLICATION-KEY`

Create or update the scopes restriction configured for the OAuth2 client.

## Path parameters

- `client_uuid` string, uuid, required

## Request body

- UpsertOAuthScopesRestrictionRequest: Request payload for creating or updating the scopes restriction of an OAuth2 client.
  - `data` UpsertOAuthScopesRestrictionData, required: Data object of an upsert OAuth2 scopes restriction request.
    - `attributes` UpsertOAuthScopesRestrictionDataAttributes: Attributes of an upsert OAuth2 scopes restriction request.
      - `oidc_scopes` OAuthOidcScope[]: OIDC scopes the client is allowed to request.
      - `permission_scopes` string[]: Datadog permission scopes the client is allowed to request. Each value must be a valid permission name.
    - `type` 'upsert_scopes_restriction', required: JSON:API resource type for an upsert OAuth2 client scopes restriction request.

## Response `200`

OK

- OAuthScopesRestrictionResponse: Response payload describing the scopes restriction of an OAuth2 client.
  - `data` OAuthScopesRestrictionResponseData, required: Data object of an OAuth2 client scopes restriction response.
    - `attributes` OAuthScopesRestrictionResponseAttributes, required: Attributes of an OAuth2 client scopes restriction.
      - `required_permission_scopes` string[], nullable, required: Permission scopes automatically required for this client (for example, mobile-app permission scopes). Returns `null` when no scopes are required.
      - `scopes_restriction` OAuthScopesRestriction, nullable, required: Allowlist of OIDC and permission scopes enforced for the OAuth2 client.
        - `oidc_scopes` OAuthOidcScope[], required: OIDC scopes the client is restricted to.
        - `permission_scopes` string[], required: Datadog permission scopes the client is restricted to.
    - `id` string, uuid, required: UUID of the OAuth2 client this restriction applies to.
    - `type` 'scopes_restriction', required: JSON:API resource type for an OAuth2 client scopes restriction.

## Other responses

- `400`: Bad Request
- `404`: Not Found
- `429`: Too many requests

---

[API](https://skmtc.dev/datadog/apis/datadog-api-v2-collection.md) - [All operations](https://skmtc.dev/datadog/apis/datadog-api-v2-collection/llms.txt) - [OpenAPI document](https://skmtc.dev/datadog/apis/datadog-api-v2-collection/revisions/da68bf029e4c?raw)