---
title: "List OAuth configs for connector type"
method: GET
path: "/oauth/{connectorType}"
tags: ["OAuth Configuration"]
---

# List OAuth configs for connector type

`GET /oauth/{connectorType}`

## Request

- Base URL: `https://app.pipeshub.com/api/v1`
- URL: `https://app.pipeshub.com/api/v1/oauth/{connectorType}`
- Auth: one of:
  - HTTP bearer
  - OAuth 2
    - Authorization code: `/api/v1/oauth2/authorize`
    - Client credentials
    - Token URL: `/api/v1/oauth2/token` scopes: `connector:read`

List the organization's OAuth configurations for one connector type.<br><br>
<b>What comes back depends on the caller:</b><br>
<ul>
<li>An admin gets each stored record in full, including `config` with the client secret in clear text</li>
<li>Any other caller gets only the credential-free fields</li>
</ul>
A connector type with no configurations, or one that does not exist, yields an empty list.

## Path parameters

- `connectorType` string, required

## Query parameters

- `scope` 'team' | 'personal': Scope determines visibility and access control for connectors:<br> <ul> <li><code>team</code> - Available to all users in the organization (admin-only creation)</li> <li><code>personal</code> - Private to the creating user only</li> </ul>
- `page` integer
- `limit` integer
- `search` string
- `reveal` 'true'

## Response `200`

Saved OAuth apps

- object
  - `success` boolean, required
  - `oauthConfigs` OAuthConfigRecord[], required
    - `_id` string, uuid: OAuth app ID: the `oauthConfigId` to link a connector to
    - `oauthInstanceName` string
    - `connectorType` string
    - `iconPath` string: Icon of the connector type, copied from the OAuth registry when the configuration was created
    - `appGroup` string: Application group of the connector type (empty when the type is not in the OAuth registry)
    - `appDescription` string: Description of the connector type's OAuth application
    - `appCategories` string[]: Categories of the connector type
    - `config` object: The credentials stored for an OAuth configuration, exactly as the admin submitted them and not masked. The keys are the `name` of each entry in the connector type's `authFields` (see `GET /oauth/registry/{connectorType}`), so they differ from one connector type to the next. Create and update do not check the values, so any JSON value that was sent (a number, `null`, a nested object, an array of any items) is stored and returned here as it was sent, even for `clientId` and `clientSecret`.
      - `clientId` string: OAuth client ID; a string unless something else was sent
      - `clientSecret` string: OAuth client secret, in clear text; a string unless something else was sent
      - `tenantId` union: A stored credential value, returned exactly as it was sent on create or update. Usually a string, boolean, number or list of strings, but the value is not checked, so `null`, a nested object or an array of other items comes back as well.
        - string
        - boolean
        - number
        - unknown[]
          - unknown
        - object
    - `userId` string: ID of the admin who created the configuration (admins only)
    - `updatedBy` string: ID of the admin who last updated the configuration (admins only)
    - `createdAtTimestamp` integer: Epoch milliseconds
    - `updatedAtTimestamp` integer: Epoch milliseconds
    - `authorizeUrl` string: Provider authorization URL, from `config.authorizeUrl` when the admin supplied one and from the registry otherwise (admins only)
    - `tokenUrl` string: Provider token URL, from `config.tokenUrl` when the admin supplied one and from the registry otherwise (admins only)
    - `redirectUri` string: Redirect URI to register with the provider, built from `baseUrl` (or the frontend public endpoint) and the registry's redirect path. Empty when the registry has no redirect path. (admins only)
    - `scopes` object: OAuth scopes copied from the registry when the configuration was created, by use case
      - `personal_sync` string[]: Scopes requested for a personal connector
      - `team_sync` string[]: Scopes requested for a team connector
      - `agent` string[]: Scopes requested for agent tools
    - `orgId` string: Organization that owns the configuration (admins only)
    - `createdBy` string: ID of the admin who created the configuration (admins only)
    - `tokenAccessType` string: Token access type sent to the provider. Present only when the registry sets one. (admins only)
    - `additionalParams` OAuthAuthorizeParams: Extra query parameters added to the provider authorization URL. The keys are provider-specific.
    - `scopeParameterName` string: Name of the authorization-URL parameter that carries the scopes. Present only when it is not `scope`. (admins only)
    - `tokenResponsePath` string: Key under which the provider nests the token in its token response. Present only when the registry sets one. (admins only)
  - `pagination` OAuthRegistryPagination: Pagination block of `GET /oauth/registry` and `GET /oauth/{connectorType}`
    - `page` integer: Current page number
    - `limit` integer: Items per page
    - `search` string, nullable: The search term that was applied, or null
    - `totalCount` integer: Number of items that match
    - `totalPages` integer
    - `hasPrev` boolean
    - `hasNext` boolean
    - `prevPage` integer, nullable: Previous page number, or null on the first page
    - `nextPage` integer, nullable: Next page number, or null on the last page

## Other responses

- `400`: Invalid request: a parameter or the body failed validation Also returned, before authentication, when a query value, or any string in a JSON or form-encoded body, looks like markup to the app-wide XSS filter: an HTML tag, a script tag, `<iframe`, `<object`, `<embed` or `<svg` tag, a word starting with `on` followed by `=` (meant for inline event handlers such as `onerror=`, it also catches plain text such as `one=1`), a `javascript:` or `data:text/html` URL, an encoded script tag (`&lt;script`, `%3cscript`), or any string longer than 100,000 characters (`HTTP_BAD_REQUEST`, "HTML tags, scripts, and XSS content are not allowed in ...", naming the field or query parameter; a string over 100,000 characters is refused as too long instead). A JSON body that does not parse is refused the same way, also before authentication (`HTTP_BAD_REQUEST`, "The request body is not valid JSON.").
- `401`: Missing or invalid credentials
- `403`: The token lacks a required scope, or the caller may not use this connector
- `404`: Not found, or the caller has no access
- `500`: The configurations could not be loaded. A JSON body larger than 10 MB, or a form-encoded body larger than 100 KB or with more than 1000 fields, is answered `413` by the app-wide body parsers instead, also before authentication.

## Changes

- **2026-10-28** `dbb5e203b445`: 7 breaking, 18 warning, 2 info
  - the response property `pagination/hasNext` became optional for the status `200`
  - the response property `pagination/hasPrev` became optional for the status `200`
  - the response property `pagination/limit` became optional for the status `200`
  - the response property `pagination/page` became optional for the status `200`
  - …23 more
- **2026-10-15** `a44792e4f0e6`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/pipeshub-ai/apis/pipeshub-api/changes/oauth/:connectorType/get.md)

---

[API](https://skmtc.dev/pipeshub-ai/apis/pipeshub-api.md) - [All operations](https://skmtc.dev/pipeshub-ai/apis/pipeshub-api/llms.txt) - [OpenAPI document](https://skmtc.dev/pipeshub-ai/apis/pipeshub-api/revisions/dbb5e203b445?raw)