Sign in
OAuth Clients

Deny OAuth client

Deny an OAuth client — sets approval_status=denied and active=false.

The row is retained so a later approve can reverse the decision.

post/admin/oauth-clients/{id}:deny

Path parameters

idstring required

Request body

reasonstring nullable

Optional reason recorded in the audit trail.

Response

Successful Response

activeboolean required
active_grant_countinteger

Number of active consent→agent grants for this client. Computed on the read endpoints (list/get); write-path responses report 0.

allowed_scopesstring[] nullable required

Scopes this client may request. Null means unrestricted.

approval_statusstring required

Admin approval lifecycle: pending, approved, or denied. Only approved clients may enter OAuth flows; active remains the independent kill switch.

client_idstring required

Public client identifier used in OAuth flows.

consent_modelstring required

What a user's consent grants for this client: user or agent.

created_atstring date-time required
created_bystring nullable required
descriptionstring nullable required
idstring required

Internal ID (ksuid).

namestring required
redirect_urisstring[] required
registration_sourcestring required

How the client entered the registry: admin or dcr.

require_consentboolean required

Whether a consent screen is shown during authorization.

software_idstring nullable required

RFC 7591 software identifier claimed at registration, if any.

token_endpoint_auth_methodstring required

Client authentication method at the token endpoint: client_secret_basic (confidential) or none (public, PKCE-only).

updated_atstring date-time nullable required

Example response

{
  "active": true,
  "approval_status": "approved",
  "client_id": "oc_abc123...",
  "consent_model": "user",
  "created_at": "2026-08-18T12:00:00Z",
  "created_by": "usr_abc123",
  "description": "My application production deployment",
  "id": "oac_2NxYz...",
  "name": "my-app-production",
  "redirect_uris": [
    "https://app.example.com/auth/callback"
  ],
  "registration_source": "admin",
  "require_consent": true,
  "token_endpoint_auth_method": "client_secret_basic"
}

Changes

Changed in 2 of the 95 revisions of this API.2