Listing OAuth clients and checking scopes via API returns empty array

I’m trying to audit our OAuth clients programmatically to ensure none of them have excessive scope assignments. I’ve been using the Embeddable Client App SDK to handle authentication and API calls in a custom admin tool. The idea is simple: fetch the list of all OAuth clients, then iterate through them to check their associated scopes.

Here’s the code snippet I’ve been using:

val oauthClient = client.auth.oauthClient
val clients = oauthClient.getOauthClients()

for (client in clients) {
 println("Client: ${client.name}, Scopes: ${client.scopes}")
}

The issue is that client.scopes is always an empty list. I’ve verified that these clients do have scopes assigned in the Genesys Cloud admin UI. I’ve also tried using the REST API directly with the following endpoint:

GET /api/v2/oauth/clients

The response looks like this:

{
 "entities": [
 {
 "id": "abc123",
 "name": "MyApp",
 "scopes": []
 }
 ]
}

I’ve checked the documentation, and it seems like the scopes should be included in the response. I’ve also tried using the GET /api/v2/oauth/clients/{clientId} endpoint to get details for a specific client, but the scopes are still missing.

I’ve verified that the access token I’m using has the admin:oauthclient:read scope, so that shouldn’t be the issue. I’ve also tried using different access tokens, but the result is the same.

I’m wondering if there’s a specific way to fetch the scopes for an OAuth client, or if this is a known limitation of the API. Any help would be appreciated.

The SDK wrapper isn’t the issue here. It’s likely a permissions gap on the service account or the user token you’re using to make the call. You need oauth:client:read scope at minimum. If that’s set and you’re still getting an empty list, try hitting the raw endpoint directly to rule out SDK caching or pagination defaults.

curl -X GET "https://api.mypurecloud.com/api/v2/oauth/clients" \
 -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
 -H "Accept: application/json"

Check the response headers for x-pagination-count. If it’s zero, your token simply doesn’t have visibility into those clients.