OAuth2 API

Snyk provides an OAuth2 API, primarily for use with Snyk Apps. It complies with RFC 6749.

Most endpoints are served from the Snyk API subdomain (for example, https://api.snyk.io), with the one exception being /oauth2/authorize which is served on the main app subdomain (for example, https://app.snyk.io).

Initiate the authorization code flow

To be called by the end user to authorize the client application to their Snyk organizations. Success returns a redirect to the provided redirect_uri, containing an authorization code which can be exchanged for an access token.

GEThttps://app.snyk.io/oauth2/authorize

Query parameters

Response

303

Redirection to authorization server. The Location header is set to the provided redirect_uri so the user's browser should follow this redirect automatically.

Headers

Request

JavaScriptCurl

const response = await fetch('https://app.snyk.io/oauth2/authorize', {
    method: 'GET',
    headers: {},
});
const data = await response.json();

Request an access token

Allows the client application to exchange the authorization code received from the authorization server for an access token.

POSThttps://api.snyk.io/oauth2/token

Body

application/x-www-form-urlencoded

one of

authorization_coderefresh_tokenclient_credentials

Response

200400401403500

Successful token request

Body

application/json

access_token*string

The access token granted to the client application.

Example: "some_opaque_access_token_string"

expires_in*integer

The number of seconds until the access token expires.

Example: 3599

refresh_tokenstring

Refresh token that can be used to obtain a new access token. Will not be granted in client_credentials grants.

Example: "some_opaque_refresh_token_string"

refresh_expires_ininteger

The number of seconds until the refresh token expires.

Example: 15552000

token_type*enum

The type of token issued.

Example: "bearer"

bearer

scope*string

The space-separated list of scopes granted to the client application.

Example: "org.read org.project.read org.project.snapshot.read"

bot_id*string (uuid)

ID of the newly created bot user.

Example: "95233fa3-33cf-4dd3-a6ac-e040985e1a4f"

Request

JavaScriptCurl

const response = await fetch('https://api.snyk.io/oauth2/token', {
    method: 'POST',
    headers: {
      "Content-Type": "application/x-www-form-urlencoded"
    },
    body: JSON.stringify({
      "grant_type": "authorization_code",
      "code": "returned_auth_code",
      "client_id": "64ae3415-5ccd-49e5-91f0-9101a6793ec2",
      "client_secret": "super_secret_client_secret",
      "code_verifier": "your_secure_code_verifier"
    }),
});
const data = await response.json();

Response

{
  "access_token": "some_opaque_access_token_string",
  "expires_in": 3599,
  "refresh_token": "some_opaque_refresh_token_string",
  "refresh_expires_in": 15552000,
  "token_type": "bearer",
  "scope": "org.read org.project.read org.project.snapshot.read",
  "bot_id": "95233fa3-33cf-4dd3-a6ac-e040985e1a4f"
}

Revoke refresh token

Revokes an otherwise valid refresh token so it can't be reused. This is used when a refresh token is accidentally, or maliciously, leaked.

POSThttps://api.snyk.io/oauth2/revoke

Body

application/x-www-form-urlencoded

client_id*string

The client ID of the client application.

Example: "64ae3415-5ccd-49e5-91f0-9101a6793ec2"

client_secret*string

The client secret of the client application.

Example: "super_secret_client_secret"

token*string

The refresh token to be revoked.

Example: "some_opaque_refresh_token_string"

Response

200400401403500

The token has been revoked, or was invalid.

Request

JavaScriptCurl

const response = await fetch('https://api.snyk.io/oauth2/revoke', {
    method: 'POST',
    headers: {
      "Content-Type": "application/x-www-form-urlencoded"
    },
    body: JSON.stringify({
      "client_id": "64ae3415-5ccd-49e5-91f0-9101a6793ec2",
      "client_secret": "super_secret_client_secret",
      "token": "some_opaque_refresh_token_string"
    }),
});
const data = await response.json();