# API: OAuth apps

| Method | Path | What it does | Scope |
|---|---|---|---|
| GET | `/v1/oauth-apps` | List partner OAuth apps registered for this organization (owner) | `keys:write` |
| POST | `/v1/oauth-apps` | Register a partner OAuth app. A confidential app's secret is shown once. (web app only) | `keys:write` |
| DELETE | `/v1/oauth-apps/:id` | Revoke a partner app and every token it holds | `keys:write` |
| GET | `/v1/oauth/authorize-info` | Describe a pending authorization request (for the consent screen) (web app only) | — |
| GET | `/v1/oauth/connected-apps` | Apps people in this organization have connected (owners), with who and when | `keys:write` |
| DELETE | `/v1/oauth/connected-apps/:client_id` | Disconnect an app for everyone in this organization (revokes its tokens here) (web app only) | `keys:write` |
| POST | `/v1/oauth/decision` | Approve or deny an authorization request; returns where to send the browser (web app only) | — |
| GET | `/v1/oauth/device` | The CLI sign-in waiting for this code: the app, where and when it was asked for, and the scopes you'd grant in the active organization (web app only) | — |
| POST | `/v1/oauth/device/decision` | Approve or deny a CLI sign-in for the active organization (signed in, in the web app). Sending and owner scopes need allow_elevated and a recent sign-in. Audited. (web app only) | — |
| GET | `/v1/oauth/grants` | Apps you've connected to this organization (web app only) | — |
| DELETE | `/v1/oauth/grants/:client_id` | Disconnect an app you authorized (revokes your tokens for it) (web app only) | — |
| PUT | `/v1/settings/oauth` | Whether people may authorize self-registered (dynamic) apps such as MCP clients (owners; on by default) (web app only) | `security:write` |

## Examples

### GET /v1/oauth-apps

List partner OAuth apps registered for this organization (owner)

```bash
curl -s "https://api.closefinch.com/v1/oauth-apps" \
  -H "Authorization: Bearer $RA_API_KEY"
```

```js
const res = await fetch(`https://api.closefinch.com/v1/oauth-apps`, {
  method: "GET",
  headers: { authorization: `Bearer ${process.env.RA_API_KEY}` },
});
const data = await res.json();
```

### DELETE /v1/oauth-apps/$ID

Revoke a partner app and every token it holds

```bash
curl -s -X DELETE "https://api.closefinch.com/v1/oauth-apps/$ID" \
  -H "Authorization: Bearer $RA_API_KEY"
```

```js
const res = await fetch(`https://api.closefinch.com/v1/oauth-apps/${id}`, {
  method: "DELETE",
  headers: { authorization: `Bearer ${process.env.RA_API_KEY}` },
});
const data = await res.json();
```

### GET /v1/oauth/connected-apps

Apps people in this organization have connected (owners), with who and when

```bash
curl -s "https://api.closefinch.com/v1/oauth/connected-apps" \
  -H "Authorization: Bearer $RA_API_KEY"
```

```js
const res = await fetch(`https://api.closefinch.com/v1/oauth/connected-apps`, {
  method: "GET",
  headers: { authorization: `Bearer ${process.env.RA_API_KEY}` },
});
const data = await res.json();
```

Request and response schemas: [https://www.closefinch.com/openapi.json](https://www.closefinch.com/openapi.json). All resources: [API reference](https://www.closefinch.com/docs/api).