Batch upload user OAuth tokens for outbound app | API Reference

POST

/v1/mgmt/outbound/app/user/oauthtoken/batch/upload

Authorization

Descope Project ID and Management Key

AuthorizationBearer <token>

Project ID:Management Key as bearer token.

In: header

Request Body

application/json

tokens?array<SaveOAuthAppUserTokenItem>

Batch upload (migrate) existing OAuth tokens for users on OAuth-type outbound applications. All-or-nothing: if any item fails per-item validation, the failures are returned and no tokens are committed; the caller should fix the failures and retry the entire batch.

curl -X POST "https://api.descope.com/v1/mgmt/outbound/app/user/oauthtoken/batch/upload" \
  -H "Content-Type: application/json" \
  -d '{}'

curl -X POST "https://api.descope.com/v1/mgmt/outbound/app/user/oauthtoken/batch/upload" \  -H "Content-Type: application/json" \  -d '{}'

ResponseOK

{
  "failures": [
    {
      "appId": "string",
      "userId": "string",
      "tenantId": "string",
      "errorCode": "string",
      "reason": "string"
    }
  ]
}

{  "failures": [    {      "appId": "string",      "userId": "string",      "tenantId": "string",      "errorCode": "string",      "reason": "string"    }  ]}

TypeScript

/**
 * Shared response for both user and tenant batch endpoints.
 */
export interface Response {
failures?: SaveOAuthAppTokenFailure[]
}
/**
 * Shared failure descriptor for batch endpoints (response-only, never validated as input).
 *  The SAME message is returned by both the user and tenant batch endpoints, so userId and tenantId
 *  are `optional`: only the one relevant to the variant is populated, and the other is absent (not an
 *  empty string) on the wire — callers of the user endpoint never see a stray tenantId and vice versa.
 */
export interface SaveOAuthAppTokenFailure {
appId?: string
userId?: string
tenantId?: string
errorCode?: string
reason?: string
}

/** * Shared response for both user and tenant batch endpoints. */export interface Response {failures?: SaveOAuthAppTokenFailure[]}/** * Shared failure descriptor for batch endpoints (response-only, never validated as input). *  The SAME message is returned by both the user and tenant batch endpoints, so userId and tenantId *  are `optional`: only the one relevant to the variant is populated, and the other is absent (not an *  empty string) on the wire — callers of the user endpoint never see a stray tenantId and vice versa. */export interface SaveOAuthAppTokenFailure {appId?: stringuserId?: stringtenantId?: stringerrorCode?: stringreason?: string}

Was this helpful?