---
title: "List Connections"
method: GET
path: "/api/oauth/connections"
tags: ["oauth"]
---

# List Connections

`GET /api/oauth/connections`

## Request

- Base URL: `https://zsign.io` (the document declares no server; this is the origin it was published from)
- URL: `https://zsign.io/api/oauth/connections`
- Auth: HTTP bearer

Every third-party client the caller has a live grant for -- an
unrevoked access token OR an unrevoked refresh token. A client that has
revoked only its access token still holds a refresh token it can mint
new access tokens from at any time, so joining on OAuthAccessToken
alone would let it silently disappear from this listing while still
live: the user would believe they'd cut it off when they had not. One
row per client_id regardless of how many tokens of either kind they're
holding for it (access rows take priority when both exist, since that's
the more current grant). Scoped to `user.id` from the verified JWT --
never a client-supplied id -- so this can only ever show the caller's
own connections.

## Response `200`

Successful Response

- unknown

---

[API](https://skmtc.dev/zsign/apis/zsign-api.md) · [All operations](https://skmtc.dev/zsign/apis/zsign-api/llms.txt) · [OpenAPI document](https://skmtc.dev/zsign/apis/zsign-api/revisions/a674ac4137ba?raw)