---
title: "Get this org’s OAuth app for a connector"
method: GET
path: "/connector/{slug}/oauth-app"
tags: ["Connectors"]
---

# Get this org’s OAuth app for a connector

`GET /connector/{slug}/oauth-app`

## Request

- Base URL: `https://api.elaichi.ai`
- URL: `https://api.elaichi.ai/connector/{slug}/oauth-app`
- Auth: HTTP bearer

Whether connects on this connector use Elaichi’s platform application or one this organization supplied, and the client id if so. The client secret is never returned — `has_client_secret` reports only whether one is stored. Answers `404` for a connector this organization owns (edit its credentials with `PATCH /connector/{slug}` instead — the message says so only to a caller who can see it), for a platform remote MCP connector, and for a connector with no OAuth 2.0 credential (`auth_formats` on `GET /connector/{slug}` does not include `oauth2`) unless this organization already has an override stored for it. Every other catalog OAuth 2.0 connector answers `200`, whether or not Elaichi’s own app already works for it: `oauth_app_mode` is `platform_default` until the organization sets its own, and `byoa: true` on `GET /connector/{slug}` is what says the platform has no usable app and one is required. A client reads this endpoint directly: a `404` here means no organization OAuth application applies to this connector and the override UI should not be offered. Requires `connector:manage`.

## Path parameters

- `slug` string, required

## Headers

- `X-Organization-Id` string

## Response `200`

OK

- object
  - `oauth_app_mode` 'platform_default' | 'byoa': Which application connects on this connector use.
  - `client_id` string, nullable
  - `has_client_secret` boolean: Whether a secret is stored. The secret itself is never returned.
  - `scope` string[], nullable: Scope overrides this org stored, or null when it kept the catalog scopes.
  - `optional_scope` string[], nullable
  - `user_scope` string, nullable: Space-separated authorize-URL scopes (`params.user_scope`), or null. Null also when one is stored but held back, see `user_scope_masked`.
  - `user_scope_masked` boolean: True when a `user_scope` is stored encrypted by an older write and cannot be read or changed here. A `PUT` that sets `user_scope` then answers `409`.
  - `supports_user_scope` boolean: Whether this connector’s provider takes user token scopes (Slack does). Where false, a `user_scope` that differs from the stored one is refused with `400`.
  - `updated_at` string, nullable

## Other responses

- `400`: Bad request
- `401`: Unauthorized
- `403`: Forbidden
- `404`: Not found
- `429`: Rate limited

---

[API](https://skmtc.dev/elaichi/apis/elaichi-api.md) · [All operations](https://skmtc.dev/elaichi/apis/elaichi-api/llms.txt) · [OpenAPI document](https://skmtc.dev/elaichi/apis/elaichi-api/revisions/b22cfb7b6d15?raw)