Authorization Server Clients

These endpoints allow you to manage tokens issued by an authorization server for a particular client. For example, you can revoke every active refresh token for a specific client. You can also revoke specific tokens or manage tokens at the User level.

Read Validate access tokens and Validate ID tokens to understand more about how OAuth 2.0 tokens work.

List all client resources for an authorization server
API Access Management
OAuth 2.0: `okta.authorizationServers.read`

Lists all Client resources for which the specified authorization server has tokens

Request

path Parameters

authServerId

required

string

id of the Authorization Server

Example: GeGRTEr7f3yu2n7grw22

Responses

200

Success

403

Forbidden

404

Not Found

429

Too Many Requests

get/api/v1/authorizationServers/{authServerId}/clients

Request samples

Response samples

application/json

[{"client_id": "{clientId}",
"client_name": "My Web App",
"client_uri": "null,",
"logo_uri": "null,",
"_links": {"client": {"href": "https://{yourOktaDomain}/oauth2/v1/clients/{clientId}",
"title": "My Web App"
},
"tokens": {"href": "https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/clients/{clientId}/tokens",
"hints": {"allow": ["GET",
"DELETE"
]
}
}
}
}
]

List all refresh tokens for a client
API Access Management
OAuth 2.0: `okta.authorizationServers.read`

Lists all refresh tokens issued by an authorization server for a specific Client

Request

path Parameters

authServerId required	string `id` of the Authorization Server Example: GeGRTEr7f3yu2n7grw22
clientId required	string Client app ID Example: 52Uy4BUWVBOjFItcg2jWsmnd83Ad8dD

query Parameters

expand	string Valid value: `scope`. If specified, scope details are included in the `_embedded` attribute.
after	string Specifies the pagination cursor for the next page of tokens
limit	integer <int32> Default: -1 The maximum number of tokens to return (maximum 200)

Responses

200

Success

403

Forbidden

404

Not Found

429

Too Many Requests

get/api/v1/authorizationServers/{authServerId}/clients/{clientId}/tokens

Request samples

Response samples

application/json

[{"id": "{refreshTokenId}",
"status": "ACTIVE",
"created": "2023-09-21T19:59:56.000Z",
"lastUpdated": "2023-09-21T20:00:38.000Z",
"expiresAt": "2023-09-28T20:00:38.000Z",
"issuer": "https://{yourOktaDomain}/oauth2/{authorizationServerId}",
"client_id": "{clientId}",
"userId": "{userId}",
"scopes": ["offline_access",
"openid"
],
"_embedded": {"scopes": [{"id": "{scopeId}",
"name": "openid",
"displayName": "openid",
"description": "Signals that a request is an OpenID request",
"_links": {"scope": {"href": "https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/scopes/{scopeId}",
"title": "openid"
}
}
},
{"id": "{scopeID}",
"name": "offline_access",
"displayName": "Keep you signed in to the app",
"description": "This keeps you signed in to the app, even when you aren't using it.",
"_links": {"scope": {"href": "https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/scopes/{scopeId}",
"itle": "Keep you signed in to the app"
}
}
}
]
},
"_links": {"app": {"href": "https://{yourOktaDomain}/api/v1/apps/{appId}",
"title": "My Web App"
},
"authorizationServer": {"href": "https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}",
"title": "Authorization Server name"
},
"self": {"href": "https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/clients/{clientId}/tokens/{tokenId}"
},
"revoke": {"href": "https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/clients/{clientId}/tokens/{tokenId}",
"hints": {"allow": ["DELETE"
]
}
},
"client": {"href": "https://{yourOktaDomain}/oauth2/v1/clients/{clientId}",
"title": "My Web App"
},
"user": {"href": "https://{yourOktaDomain}/api/v1/users/{userId}",
"title": "Joe User"
}
}
}
]

Revoke all refresh tokens for a client
API Access Management
OAuth 2.0: `okta.authorizationServers.manage`

Revokes all refresh tokens for a Client

Request

path Parameters

authServerId required	string `id` of the Authorization Server Example: GeGRTEr7f3yu2n7grw22
clientId required	string Client app ID Example: 52Uy4BUWVBOjFItcg2jWsmnd83Ad8dD

Responses

204

No Content

403

Forbidden

404

Not Found

429

Too Many Requests

delete/api/v1/authorizationServers/{authServerId}/clients/{clientId}/tokens

Request samples

Response samples

application/json

{"errorCode": "E0000006",
"errorSummary": "You do not have permission to perform the requested action",
"errorLink": "E0000006",
"errorId": "sampleNUSD_8fdkFd8fs8SDBK",
"errorCauses": [ ]
}

Retrieve a refresh token for a client
API Access Management
OAuth 2.0: `okta.authorizationServers.read`

Retrieves a refresh token for a Client

Request

path Parameters

authServerId required	string `id` of the Authorization Server Example: GeGRTEr7f3yu2n7grw22
clientId required	string Client app ID Example: 52Uy4BUWVBOjFItcg2jWsmnd83Ad8dD
tokenId required	string `id` of Token Example: sHHSth53yJAyNSTQKDJZ

query Parameters

expand

string

Valid value: scope. If specified, scope details are included in the _embedded attribute.

Responses

200

Success

403

Forbidden

404

Not Found

429

Too Many Requests

get/api/v1/authorizationServers/{authServerId}/clients/{clientId}/tokens/{tokenId}

Request samples

Response samples

application/json

[{"id": "{refreshTokenId}",
"status": "ACTIVE",
"created": "2023-09-21T19:59:56.000Z",
"lastUpdated": "2023-09-21T20:00:38.000Z",
"expiresAt": "2023-09-28T20:00:38.000Z",
"issuer": "https://{yourOktaDomain}/oauth2/{authorizationServerId}",
"client_id": "{clientId}",
"userId": "{userId}",
"scopes": ["offline_access",
"openid"
],
"_embedded": {"scopes": [{"id": "{scopeID}",
"name": "offline_access",
"displayName": "Keep you signed in to the app",
"description": "This keeps you signed in to the app, even when you aren't using it.",
"_links": {"scope": {"href": "https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/scopes/{scopeId}",
"title": "Keep you signed in to the app"
}
}
},
{"id": "{scopeId}",
"name": "openid",
"displayName": "openid",
"description": "Signals that a request is an OpenID request",
"_links": {"scope": {"href": "https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/scopes/{scopeId}",
"title": "openid"
}
}
}
]
},
"_links": {"app": {"href": "https://{yourOktaDomain}/api/v1/apps/{appId}",
"title": "My Web App"
},
"authorizationServer": {"href": "https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}",
"title": "Authorization Server name"
},
"self": {"href": "https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/clients/{clientId}/tokens/{tokenId}"
},
"revoke": {"href": "https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/clients/{clientId}/tokens/{tokenId}",
"hints": {"allow": ["DELETE"
]
}
},
"client": {"href": "https://{yourOktaDomain}/oauth2/v1/clients/{clientId}",
"title": "My Web App"
},
"user": {"href": "https://{yourOktaDomain}/api/v1/users/{userId}",
"title": "Joe User"
}
}
}
]

Revoke a refresh token for a client
API Access Management
OAuth 2.0: `okta.authorizationServers.manage`

Revokes a refresh token for a Client

Request

path Parameters

authServerId required	string `id` of the Authorization Server Example: GeGRTEr7f3yu2n7grw22
clientId required	string Client app ID Example: 52Uy4BUWVBOjFItcg2jWsmnd83Ad8dD
tokenId required	string `id` of Token Example: sHHSth53yJAyNSTQKDJZ

Responses

204

No Content

403

Forbidden

404

Not Found

429

Too Many Requests

delete/api/v1/authorizationServers/{authServerId}/clients/{clientId}/tokens/{tokenId}

Request samples

Response samples

application/json

{"errorCode": "E0000006",
"errorSummary": "You do not have permission to perform the requested action",
"errorLink": "E0000006",
"errorId": "sampleNUSD_8fdkFd8fs8SDBK",
"errorCauses": [ ]
}

Social
CONTACT & LEGAL
MORE INFORMATION
okta.com
Products, case studies, resources
Help Center
Knowledgebase, roadmaps, and more
Trust
System status, security, compliance

Authorization Server Clients

List all client resources for an authorization serverAPI Access ManagementOAuth 2.0: okta.authorizationServers.read

path Parameters

List all refresh tokens for a clientAPI Access ManagementOAuth 2.0: okta.authorizationServers.read

path Parameters

query Parameters

Revoke all refresh tokens for a clientAPI Access ManagementOAuth 2.0: okta.authorizationServers.manage

path Parameters

Retrieve a refresh token for a clientAPI Access ManagementOAuth 2.0: okta.authorizationServers.read

path Parameters

query Parameters

Revoke a refresh token for a clientAPI Access ManagementOAuth 2.0: okta.authorizationServers.manage

path Parameters

List all client resources for an authorization server
API Access Management
OAuth 2.0: `okta.authorizationServers.read`

List all refresh tokens for a client
API Access Management
OAuth 2.0: `okta.authorizationServers.read`

Revoke all refresh tokens for a client
API Access Management
OAuth 2.0: `okta.authorizationServers.manage`

Retrieve a refresh token for a client
API Access Management
OAuth 2.0: `okta.authorizationServers.read`

Revoke a refresh token for a client
API Access Management
OAuth 2.0: `okta.authorizationServers.manage`