Retrieves all OAuth clients for the specified organization.
OAuth 2.0 scopes required: read:service-accounts-tokens:admin
Forge and OAuth2 apps cannot access this REST resource.
string
Requiredinteger
string
Returned if the request is successful.
integer
integer
string
1
2
3
curl --request GET \
--url 'https://api.atlassian.com/admin/api-access/v1/orgs/{orgId}/oauth-clients' \
--header 'Accept: application/json'1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
{
"data": [
{
"tokenEndpointAuthMethod": "private_key_jwt",
"clientId": "<string>",
"name": "<string>",
"createdAt": 1763149545609,
"updatedAt": 1763149545609,
"status": "ACTIVE"
}
],
"links": {
"self": "<string>",
"next": "<string>",
"prev": "<string>"
}
}Creates a new OAuth client for a service account in the specified organization.
Set tokenEndpointAuthMethod to private_key_jwt and supply publicKeys to
authenticate using a signed JWT. Private Key JWT must be enabled for your organization.
The response contains clientId and, when available, the supplied keyId;
clientSecret is null for private_key_jwt clients.
An active admin session with org management permissions is supported. API access requires OAuth client creation to be enabled for your organization.
OAuth 2.0 scopes required: write:service-accounts-tokens:admin
Forge and OAuth2 apps cannot access this REST resource.
string
RequiredDetails to create an OAuth client
string
Requiredstring
Requiredarray<string>
Requiredstring
array<OAuthClientPublicKey>
Returned if the OAuth client is successfully created.
integer
integer
string
Credentials returned when an OAuth client is created. Save any client secret securely; it is not returned by GET endpoints.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
curl --request POST \
--url 'https://api.atlassian.com/admin/api-access/v1/orgs/{orgId}/oauth-clients' \
--header 'Accept: application/json' \
--header 'Content-Type: application/json' \
--data '{
"name": "Automation client",
"serviceAccountId": "service-account-id",
"scopes": [
"read:jira-work"
],
"tokenEndpointAuthMethod": "private_key_jwt",
"publicKeys": [
{
"source": "external_uri",
"value": "https://auth.example.com/.well-known/jwks.json",
"kid": "client-key-2026-01"
}
]
}'1
2
3
4
5
{
"clientId": "oauth-client-id",
"clientSecret": null,
"keyId": "client-key-2026-01"
}Gets the count of OAuth clients in the specified organization.
OAuth 2.0 scopes required: read:service-accounts-tokens:admin
Forge and OAuth2 apps cannot access this REST resource.
string
RequiredReturned if the request is successful.
integer
integer
string
1
2
3
curl --request POST \
--url 'https://api.atlassian.com/admin/api-access/v1/orgs/{orgId}/oauth-clients/count' \
--header 'Accept: application/json'1
2
3
{
"total": 53
}Retrieves a specific OAuth client by ID for the specified organization.
OAuth 2.0 scopes required: read:service-accounts-tokens:admin
Forge and OAuth2 apps cannot access this REST resource.
string
Requiredstring
RequiredReturned if the request is successful.
integer
integer
string
Represents an OAuth client associated with an organization.
1
2
3
curl --request GET \
--url 'https://api.atlassian.com/admin/api-access/v1/orgs/{orgId}/oauth-clients/{clientId}' \
--header 'Accept: application/json'1
2
3
4
5
6
7
8
{
"tokenEndpointAuthMethod": "private_key_jwt",
"clientId": "<string>",
"name": "<string>",
"createdAt": 1763149545609,
"updatedAt": 1763149545609,
"status": "ACTIVE"
}Deletes an existing OAuth client from the specified organization.
OAuth 2.0 scopes required: delete:service-accounts-tokens:admin
Forge and OAuth2 apps cannot access this REST resource.
string
Requiredstring
RequiredReturned if the OAuth client is successfully deleted.
integer
integer
string
1
2
curl --request DELETE \
--url 'https://api.atlassian.com/admin/api-access/v1/orgs/{orgId}/oauth-clients/{clientId}'Updates the name, token endpoint authentication method, or public keys of an
OAuth client in the specified organization. Omitted fields remain unchanged.
Supply publicKeys to replace the configured key set, including when rotating keys.
When switching to private_key_jwt, supply the public keys to use for authentication.
Private Key JWT must be enabled for your organization.
The response includes the supplied keyId when available. When explicitly switching
from private_key_jwt to a client-secret method (basic, post, basic_pkce, or
post_pkce), the response can include clientSecret. Save it securely at this point;
GET responses do not return it. Other updates return a null clientSecret.
OAuth 2.0 scopes required: write:service-accounts-tokens:admin
Forge and OAuth2 apps cannot access this REST resource.
string
Requiredstring
Requiredstring
string
array<OAuthClientPublicKey>
Returned if the OAuth client is successfully updated.
The OAuth client details returned after an update.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
curl --request PATCH \
--url 'https://api.atlassian.com/admin/api-access/v1/orgs/{orgId}/oauth-clients/{clientId}' \
--header 'Accept: application/json' \
--header 'Content-Type: application/json' \
--data '{
"tokenEndpointAuthMethod": "private_key_jwt",
"publicKeys": [
{
"source": "external_uri",
"value": "https://auth.example.com/.well-known/jwks.json",
"kid": "client-key-2026-02"
}
]
}'1
2
3
4
5
6
7
8
{
"clientId": "oauth-client-id",
"name": "Automation client",
"tokenEndpointAuthMethod": "private_key_jwt",
"keyId": "client-key-2026-02",
"disabled": false,
"clientSecret": null
}Rate this page: