Script to audit OAuth client scopes and detect drift in Terraform state

How do we programmatically list every OAuth client in a Genesys Cloud org and verify their assigned scopes against our Terraform state file? We’ve got a drift detection script running in our CI pipeline, but it’s currently blind to OAuth clients because we haven’t figured out the right API calls to pull that data efficiently. The goal is to catch if someone manually adds a scope in the UI that isn’t reflected in the genesyscloud_oauth_client resources. I’ve been looking at the documentation for /api/v2/oauth/clients, but it’s not immediately clear if there’s a simple GET endpoint that returns a list of all clients with their full scope definitions. I tried hitting GET /api/v2/oauth/clients directly, but it seems to expect a specific client ID in the path or returns a 404 if I don’t provide one. Is there a way to paginate through all clients or a different endpoint I should be using? Here’s the basic structure of what I’m trying to achieve in Python using the SDK:

from genesyscloud import oauth_client_api

api_instance = oauth_client_api.OauthClientApi(api_client)
# How do I get all clients here? The get_oauth_client method requires a client_id.
# clients = api_instance.list_oauth_clients() # This method doesn't exist apparently

If I have to loop through IDs, where do I get the list of IDs from? I’ve seen some references to the Admin API, but I don’t want to use the internal undocumented endpoints if there’s a proper public way to do this. We need this to be stable for our Terraform import and plan commands. Any pointers on the correct endpoint or SDK method?

You can pull the list with a simple GET request. It’s not the most efficient for large orgs since you have to paginate, but it works for a quick audit. Here’s the basic curl command to get you started.

curl -X GET "https://{{subdomain}}.mypurecloud.com/api/v2/integrations/oauth/clients" \
 -H "Authorization: Bearer {{access_token}}"