Skip to content
KataraKatara documentation

List enrolled OAuth profiles

GET
/katara/v1/orgs/{org_id}/environments/{environment_id}/tool-credentials/oauth/profiles
curl --request GET \
  --url https://api.katara.com/katara/v1/orgs/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/environments/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/tool-credentials/oauth/profiles \
  --header 'Authorization: Bearer <token>'

Requires the current human session and exact environment authority. Begin and activate require caller idempotency keys; Complete uses the durable one-use authorization ID and no idempotency header. No automatic retries or provider exchange replay. The Start response pins organization, environment, mode, reset generation and profile before navigation. Never persist or log its URL/state, callback code, original sensitive error or token response. After unknown completion inspect Review. oauth_exchange_uncertain (409) requires inspection, not retry; oauth_authorization_rejected (403) requires a new authorization. Activation requires explicit review of the verified account digest. Tokens never leave protected service storage. All routes reject query parameters. Begin requires an explicitly reviewed authorization_expires_at, strictly future and within the enrolled profile max_authorization_seconds. Start and Review echo that immutable authority deadline. The separate expires_at is the 10-minute setup/review window. Serialized private token refresh never extends the connection authority deadline.

Authorizations

Section titled “Authorizations”

Parameters

Section titled “Parameters”

Path Parameters

Section titled “Path Parameters”
org_id
required
string format: uuid
/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/
Allowed value: 00000000-0000-0000-0000-000000000000
environment_id
required
string format: uuid
/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/
Allowed value: 00000000-0000-0000-0000-000000000000

Responses

Section titled “Responses”

200

Section titled “200”

OAuth metadata; no access or refresh tokens.

Media typeapplication/json
object
org_id
required
string format: uuid
/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/
Allowed value: 00000000-0000-0000-0000-000000000000
environment_id
required
string format: uuid
/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/
Allowed value: 00000000-0000-0000-0000-000000000000
mode
required
Allowed values: test live
reset_generation
required
integer
>= 1 <= 9007199254740991
data
required
Array<object>
<= 128 items unique items
object
profile
required
object
id
required
string format: uuid
/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/
Allowed value: 00000000-0000-0000-0000-000000000000
version
required
integer
>= 1 <= 9223372036854776000
integrity
required
string
/^sha256:[a-f0-9]{64}$/
issuer
required
string format: uri
<= 2048 characters /^https:///
audience
required
string format: uri
>= 1 characters <= 256 characters /^https:///
destination_origin
required
string format: uri
<= 2048 characters /^https:///
header
required
Allowed value: Authorization
scopes
required
Array<string>
>= 1 items <= 32 items unique items
max_authorization_seconds
required
integer
>= 60 <= 2592000
Example
{
  "mode": "test",
  "data": [
    {
      "header": "Authorization"
    }
  ]
}

Headers

Section titled “Headers”
Cache-Control
string
Allowed value: no-store
Referrer-Policy
string
Allowed value: no-referrer

409

Section titled “409”

Account_changed: reload and review with the signed-in account.

default

Section titled “default”

Request error

Media typeapplication/json
object
error
required
object
message
required
string
>= 1 characters <= 500 characters
type
required
string
>= 1 characters <= 100 characters
code
required

Stable; branch on it. Any operation can answer invalid_request, with param naming the refused field when there is one; human_session_required, when an API key, service account or workload calls an operation only a signed-in person may perform; reauthentication_required, when a person’s sign-in is too old for the operation; permission_denied; route_not_found and method_not_allowed, when no operation matches the path or method; and feature_unavailable, when the operation’s service is not enabled on this deployment.

string
>= 1 characters <= 100 characters
param
required

The request field a refusal is about, such as the agent_id or run_id query parameter; null when the refusal is not about one field.

string | null
request_id
required
string
>= 1 characters <= 100 characters
upstream_status
required
integer | null
action
Allowed values: sign_in reauthenticate request_access review fund retry reconcile refresh support
operation_id
string format: uuid
/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/
Allowed value: 00000000-0000-0000-0000-000000000000
snapshot_ref
string format: uuid
/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/
Allowed value: 00000000-0000-0000-0000-000000000000
Example
{
  "error": {
    "action": "sign_in"
  }
}