POST /v1/oauth/clients

Creates a new OAuth clientId and clientSecret.

Servers

Request headers

Name Type Required Description
Content-Type String Yes The media type of the request body.

Default value: "application/json"

Request body fields

Name Type Required Description
scopes[] Array Yes

Scopes assigned to the client.

MCP Server Required Scopes: For full access to all MCP Server tools, the following scopes are required. Each tool lists the scopes it needs.

  • alerts___alertsReadById — viewAlerts
  • alerts___alertsSearch — viewAlerts
  • dashboards___getDashboard — viewLibrary
  • dashboards___listDashboards — viewLibrary
  • dashboards___createDashboard — manageLibrary
  • dashboards___updateDashboard — manageLibrary
  • discovery___listPartitions — viewPartitions
  • discovery___listExtractionRules — viewFieldExtractionRules
  • discovery___listCustomFields — viewFields
  • log-search___runLogSearch — runLogSearch
  • insights___getAllInsights — viewCse
  • insights___getInsight — viewCse
  • insights___getInsights — viewCse
  • insights___updateInsightAssignee — viewCse, cseManageInsightAssignee
  • insights___updateInsightStatus — viewCse, cseManageInsightStatus
  • rules___getRule — viewCse, cseViewRules
  • rules___getRules — viewCse, cseViewRules
  • rules___createTemplatedMatchRule — viewCse, cseManageRules
  • rules___createThresholdRule — viewCse, cseManageRules

Alerting

  • viewAlerts (MCP Server)
  • adminMonitorsV2
  • viewMonitorsV2
  • manageMonitorsV2
  • viewMutingSchedules
  • manageMutingSchedules

Audit Event Management

  • searchAuditIndex
  • dataVolumeIndex
  • auditEventIndex

Cloud SIEM

  • viewCse (MCP Server)
  • cseViewRules (MCP Server)
  • cseManageRules (MCP Server)
  • cseManageInsightAssignee (MCP Server)
  • cseManageInsightStatus (MCP Server)
  • cseCommentOnInsights
  • cseCreateInsights
  • cseDeleteInsights
  • cseInvokeInsights
  • cseManageInsightPolicy
  • cseManageInsightSignals
  • cseManageInsightTags
  • cseViewThreatIntelligence
  • cseManageThreatIntelligence
  • cseViewMatchLists
  • cseManageMatchLists
  • cseViewFileAnalysis
  • cseManageFileAnalysis
  • cseViewCustomInsights
  • cseManageCustomInsights
  • cseViewNetworkBlocks
  • cseManageNetworkBlocks
  • cseViewSuppressedEntities
  • cseManageSuppressedEntities
  • cseViewMappings
  • cseManageMappings
  • cseManageArtifacts
  • cseViewCustomInsightStatuses
  • cseManageCustomInsightStatuses
  • cseViewContextActions
  • cseManageContextActions
  • cseViewActions
  • cseManageActions
  • cseViewEnrichments
  • cseManageEnrichments
  • cseViewCustomEntityType
  • cseManageCustomEntityType
  • cseViewEntity
  • cseManageEntity
  • cseViewEntityConfiguration
  • cseManageEntityConfiguration
  • cseViewEntityCriticality
  • cseManageEntityCriticality
  • cseViewTagSchemas
  • cseManageTagSchemas
  • cseManageFavoriteFields
  • cseViewEntityGroups
  • cseManageEntityGroups
  • cseViewAutomations
  • cseManageAutomations
  • cseExecuteAutomations

Cloud SOAR

  • viewCloudSoar
  • cloudSoarAPIAdmin
  • cloudSoarAPIEmailEdit
  • cloudSoarAPIEmailRead
  • cloudSoarAPIUse
  • cloudSoarAppCentralAccess
  • cloudSoarAppCentralExport
  • cloudSoarAuditAndInformationAuditTrail
  • cloudSoarAuditAndInformationConfigureAuditTrail
  • cloudSoarAuditAndInformationLicenseInformation
  • cloudSoarAutomationRulesAccess
  • cloudSoarAutomationRulesConfigure
  • cloudSoarBridgeMonitoringAccess
  • cloudSoarCustomizationFields
  • cloudSoarCustomizationIncidentLabels
  • cloudSoarCustomizationLogo
  • cloudSoarDashboardAccess
  • cloudSoarDashboardAll
  • cloudSoarEntitiesAccess
  • cloudSoarEntitiesBulkPhysicalDelete
  • cloudSoarEntitiesManage
  • cloudSoarGeneralConfigure
  • cloudSoarIncidentAccess
  • cloudSoarIncidentAccessAll
  • cloudSoarIncidentAttachmentsAccess
  • cloudSoarIncidentAttachmentsEdit
  • cloudSoarIncidentBulkOperations
  • cloudSoarIncidentChangeOwnership
  • cloudSoarIncidentEdit
  • cloudSoarIncidentFoldersEdit
  • cloudSoarIncidentManageInvestigators
  • cloudSoarIncidentNotesAccess
  • cloudSoarIncidentNotesEdit
  • cloudSoarIncidentPlaybooksAccess
  • cloudSoarIncidentPlaybooksEdit
  • cloudSoarIncidentPlaybooksManage
  • cloudSoarIncidentTaskAccess
  • cloudSoarIncidentTaskAccessAll
  • cloudSoarIncidentTaskEdit
  • cloudSoarIncidentTaskReassign
  • cloudSoarIncidentTaskView
  • cloudSoarIncidentTemplatesAccess
  • cloudSoarIncidentTemplatesConfigure
  • cloudSoarIncidentTriageAccess
  • cloudSoarIncidentTriageAccessAll
  • cloudSoarIncidentTriageChangeOwnership
  • cloudSoarIncidentTriageEdit
  • cloudSoarIncidentTriageView
  • cloudSoarIncidentView
  • cloudSoarIncidentWarRoomUse
  • cloudSoarIntegrationsAccess
  • cloudSoarIntegrationsConfigure
  • cloudSoarNotificationConfigure
  • cloudSoarNotificationTriage
  • cloudSoarObservabilityAccess
  • cloudSoarObservabilityManagement
  • cloudSoarPlaybooksAccess
  • cloudSoarPlaybooksConfigure
  • cloudSoarReportAccess
  • cloudSoarReportAll
  • cloudSoarUserManagementGroups
  • cloudSoarWidgetsAll

Dashboards

  • worldDashboards
  • whitelistDashboards
  • shareDashboardAllowlist
  • manageDashboardExecutionControls

Data Management

  • manageApps
  • viewCollectors
  • manageCollectors
  • viewConnections
  • manageConnections
  • contentAdmin
  • viewFieldExtractionRules (MCP Server)
  • manageFieldExtractionRules
  • viewFields (MCP Server)
  • manageFields
  • manageBudgets
  • viewLibrary (MCP Server)
  • manageLibrary (MCP Server)
  • viewPartitions (MCP Server)
  • managePartitions
  • manageS3DataForwarding
  • viewScheduledViews
  • manageScheduledViews
  • manageTokens
  • viewPipelines
  • managePipelines
  • viewAccountOverview
  • dataVolume
  • downloadSearchResults
  • viewDeletionRules
  • manageDeletionRules
  • reviewDeletionRequest
  • viewEventExtractionRules
  • manageEventExtractionRules
  • viewParsers

Data Masking

  • viewUnmaskedData
  • manageDataMasking

Entity Management

  • manageEntityTypeConfig

Logs

  • runLogSearch (MCP Server)

Macros

  • manageMacros

Metrics

  • runMetricsQuery
  • metricsTransformation
  • metricsExtraction
  • metricsRules

Open Analytics

  • manageOpenAnalyticsEndpoint

Organizations

  • viewOrganizations
  • createTrialOrganizations
  • createOrganizations
  • upgradeTrialOrganizations
  • changeCreditsAllocation
  • deactivateOrganizations
  • manageOrganizations

Reliability Management

  • viewSlos
  • manageSlos

Security

  • manageAccessKeys
  • viewPersonalAccessKeys
  • managePersonalAccessKeys
  • manageOAuthClients
  • changeDataAccessLevel
  • passwordPolicy
  • ipWhitelisting
  • ipAllowlisting
  • supportAccount
  • audit
  • saml
  • worldDashboardMaster
  • orgSettings

Threat Intelligence

  • viewThreatIntelDataStore
  • manageThreatIntelDataStore

Usage Management

  • viewUsageManagement
  • manageUsageManagement

User Management

  • viewUsersAndRoles
  • manageUsersAndRoles
type String Yes

Type of the object model.

How to start integrating

  1. Add HTTP Task to your workflow definition.
  2. Search for the API you want to integrate with and click on the name.
    • This loads the API reference documentation and prepares the Http request settings.
  3. Click Test request to test run your request to the API and see the API's response.