---
title: "List organization API clients"
method: GET
path: "/api/v1/organizations/{organization_id}/clients"
tags: ["API Auth"]
---

# List organization API clients

`GET /api/v1/organizations/{organization_id}/clients`

Retrieves a paginated list of API clients for a specific organization. Returns client details including metadata, scopes, and secret information (without exposing actual secret values).

## Path parameters

- `organization_id` string, required

## Query parameters

- `page_size` integer
- `page_token` string

## Response `200`

List of organization API clients returned successfully. Each client includes its configuration details and metadata.

- ClientsListOrganizationClientsResponse — Response message containing a paginated list of API clients for the specified organization.
  - `clients` ClientsM2MClient[] — List of API client objects for the organization. Each client includes its configuration, metadata, and active secrets (without exposing actual secret values).
    - `audience` string[] — The intended recipients of access tokens issued to this client. Each audience value should be a URI that identifies an API or service.
    - `client_id` string — The unique identifier for this API client. This ID is used to identify the client in API requests and logs. It is automatically generated when the client is created and cannot be modified.
    - `create_time` string, date-time — The timestamp when this API client was created. This field is automatically set by the server and cannot be modified.
    - `custom_claims` ClientsCustomClaim[] — Additional claims included in access tokens issued to this client. These claims provide context about the client and can be used for authorization decisions.
      - `key` string — The name of the custom claim. Must be between 1 and 128 characters. Use descriptive names that clearly indicate the claim's purpose.
      - `value` string — The value of the custom claim. This value will be included in access tokens issued to the client.
    - `description` string — A detailed description of the client's purpose and usage. This helps administrators understand what the client is used for.
    - `expiry` string, int64 — Expiry time in seconds for the token generated by the client
    - `is_cimd` boolean — Indicates if the client was created via Client ID Metadata Document (CIMD). CIMD clients can update their own configuration according to the CIMD specification.
    - `is_dcr` boolean — Indicates if the client was created via Dynamic Client Registration (DCR). Clients created through DCR may have different management and lifecycle policies compared to those created manually.
    - `metadata_uri` string — The URI to the client's metadata, which is utilized to obtain the client's configuration details
    - `name` string — The display name of the API client. This name helps identify the client in the dashboard and logs.
    - `organization_id` string — The ID of the organization that owns this API client. This ID is used to associate the client with the correct organization and enforce organization-specific access controls.
    - `redirect_uris` string[] — The redirect URI for this API client. This URI is used in the OAuth 2.0 authorization flow to redirect users after authentication.
    - `resource_id` string — The ID of the resource associated with this M2M client. This field is used to link the client to a specific resource in the system.
    - `scopes` string[] — The OAuth 2.0 scopes granted to this client. These scopes determine what resources and actions the client can access.
    - `secrets` ClientsClientSecret[] — List of client secrets associated with this client. Each secret can be used for authentication, but only the most recently created secret is typically active. Secrets are stored securely and their values are never returned after creation.
      - `create_time` string, date-time — The timestamp when this secret was created. This field is automatically set by the server and cannot be modified.
      - `created_by` string — The identifier of the user or system that created this secret. This field helps track who created the secret for audit and compliance purposes.
      - `expire_time` string, date-time — The timestamp when this secret will expire. After this time, the secret cannot be used for authentication regardless of its status. If not set, the secret does not expire.
      - `id` string — The unique identifier for this client secret. This ID is used to reference the secret in API requests for management operations like updating or deleting the secret.
      - `last_used_time` string, date-time — The timestamp when this secret was last used for authentication. This field helps track secret usage for security monitoring and identifying unused secrets that may be candidates for rotation.
      - `plain_secret` string — The full plaintext secret value. This field is only populated when the secret is first created and is never stored by the server. It must be securely stored by the client application as it cannot be retrieved again.
      - `secret_suffix` string — A suffix that helps identify this secret. This is the last few characters of the full secret value but is not sufficient for authentication. Helps identify which secret is being used in logs and debugging.
      - `status` 'INACTIVE' — ClientSecretStatus indicates whether a client secret can be used for authentication. ACTIVE secrets can be used for authentication while INACTIVE secrets cannot. - INACTIVE: The secret is inactive and cannot be used for authentication
      - `update_time` string, date-time — The timestamp when this secret was last updated. This field is automatically updated by the server when the secret's status changes or other properties are modified.
    - `update_time` string, date-time — The timestamp when this API client was last updated. This field is automatically updated by the server whenever the client's configuration changes.
  - `next_page_token` string — Pagination token for the next page of results. Use this token to fetch the next page.
  - `prev_page_token` string — Pagination token for the previous page of results. Use this token to fetch the previous page.
  - `total_size` integer — Total number of API clients in the organization.

---

[API](https://skmtc.dev/scalekit/apis/scalekit-api-reference.md) · [All operations](https://skmtc.dev/scalekit/apis/scalekit-api-reference/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/scalekit/scalekit-api-reference/revisions/49af6b0b79c6/schema)