---
title: "List the OAuth-connected apps that reach this toolbox"
method: GET
path: "/toolbox/{id}/connected-app"
tags: ["Toolboxes"]
---

# List the OAuth-connected apps that reach this toolbox

`GET /toolbox/{id}/connected-app`

## Request

- Base URL: `https://api.elaichi.ai`
- URL: `https://api.elaichi.ai/toolbox/{id}/connected-app`
- Auth: HTTP bearer

Lists the OAuth-connected apps (MCP clients) that reach this toolbox, cursor-paginated. Visible to the same people as `GET /toolbox/{id}/share`, because an app reaching a toolbox is as sensitive as who the toolbox is shared with. `via` says how the app reaches it: `toolbox` when this toolbox is named explicitly on the grant, `all_tools` when the grant authorized "All my tools" for a user who can currently use this toolbox (checked live against the grantee's own access, so it cannot go stale). `is_own` flags the caller's own authorization. Requires owner or `edit` access (a grant of the caller's own); `toolbox:manage` alone is not enough.

## Path parameters

- `id` string, required

## Query parameters

- `limit` integer
- `cursor` string

## Headers

- `X-Organization-Id` string

## Response `200`

OK

- object
  - `result` object[], required
    - `grant_id` string: OAuth grant id (`ogrt_…`) — what `DELETE /oauth/grant/{id}` takes, scoped to the grant's own user.
    - `client_id` string
    - `client_name` string, nullable: Null when the OAuth client row is gone.
    - `user` object
      - `id` string: User id (`usr_…`).
      - `name` string: Omitted along with `email` when the id no longer resolves to an org member.
      - `email` string, email
      - `avatar_url` string, nullable: The person's picture: their stored profile picture, else a Gravatar URL (`d=404`, 96px) derived from their email (the address itself is not sent), else null. Draw initials when it is null or the image fails to load.
    - `via` 'toolbox' | 'all_tools': `toolbox`: this toolbox is named explicitly on the grant. `all_tools`: an "All my tools" authorization by a user who can currently use this toolbox — computed live, not a stored fact.
    - `scopes` string[]: The grant's MCP OAuth scopes (`mcp:read`, `mcp:write`, …).
    - `last_used_at` string, date-time, nullable
    - `created_at` string, date-time
    - `is_own` boolean: True when this is the caller's own authorization.
  - `next_cursor` string, nullable, required
  - `prev_cursor` string, nullable, required

## Other responses

- `400`: Bad request
- `401`: Unauthorized
- `403`: Forbidden
- `404`: Not found
- `429`: Rate limited

---

[API](https://skmtc.dev/elaichi/apis/elaichi-api.md) · [All operations](https://skmtc.dev/elaichi/apis/elaichi-api/llms.txt) · [OpenAPI document](https://skmtc.dev/elaichi/apis/elaichi-api/revisions/b22cfb7b6d15?raw)