The oauth app object

⚠️

Preview — this feature is being built; the design below is the spec.

The oauth_app object as the API returns it. Every field below appears in every response that returns this object; fields with no value are null rather than missing.

Example

{
  "id": "oapp_01JD79H1K3M5P7R9T1V3",
  "type": "oauth_app",
  "client_id": "oapp_01JD79H1K3M5P7R9T1V3",
  "name": "Acme Notes",
  "client_type": "confidential",
  "redirect_uris": [
    "https://notes.example.com/oauth/callback"
  ],
  "allowed_scopes": [
    "user:profile",
    "user:inference"
  ],
  "audience": "organization",
  "logo_url": "https://notes.example.com/logo.png",
  "status": "active",
  "created_at": "2026-11-05T10:00:00Z",
  "client_secret": "scs_live_Hn2…redacted"
}

Fields

Field	Type	Description
`id`	string	Unique id of this object.
`type`	string	The object type, always `oauth_app`.
`client_id`	string	See the endpoint pages below.
`name`	string	Name shown in the Console and in reports.
`client_type`	string	`public` (no secret; PKCE required) for desktop, mobile and browser apps, or `confidential` (has a secret; PKCE still required) for server-side apps.
`redirect_uris`	array	Exact HTTPS addresses. Loopback `http://127.0.0.1` with any port is allowed for public desktop clients.
`allowed_scopes`	array	The most the app can ask for. `user:inference` lets it call `/v1` billed to the signing-in person’s organization.
`audience`	string	`organization`: only your members can sign in. `any`: any Syntic user can, after Syntic reviews the app.
`logo_url`	string	See the endpoint pages below.
`status`	string	Current state; see the values on the endpoint pages.
`created_at`	string	When it was created, RFC 3339 UTC (some older objects use Unix seconds).
`client_secret`	string	Confidential apps only; returned once.

Returned by

model organization

Was this page helpful?