I’m trying to build a quick audit script to list every OAuth client in our org and see what scopes each one has.
I know I can get the list of clients with GET /api/v2/oauth/clients. That returns the client IDs and names just fine. The problem is the scopes field in that response is always empty or null.
I figured I’d have to hit GET /api/v2/oauth/clients/{clientId} for each one to get the details. But that endpoint doesn’t seem to return the scope assignments either. It gives me the grant types and redirect URIs, but no scopes.
Is there another endpoint I’m missing? Or is the only way to get the scopes by doing a separate call to the authorization settings?
Here’s the curl for the single client call I’m stuck on:
curl -X GET "https://api.mypurecloud.com/api/v2/oauth/clients/abc-123" \
-H "Authorization: Bearer <token>"
Response body:
{
"clientId": "abc-123",
"name": "Test App",
"grantTypes": ["client_credentials"],
"redirectUris": ["https://example.com/callback"]
}
No scopes field. I’ve checked the Swagger docs but I’m not seeing an obvious way to pull this data in bulk or even for a single client. Am I looking in the wrong place?