Build on the inventory
Three surfaces: a read API, signed webhooks, and a bulk export. Authentication is one bearer token from Settings.
API reference
The same inventory the interface shows, keyset-paginated so 200,000 grants do not time out. Everything is read except one endpoint, and that one revokes.
- GET/v1/grants
- GET/v1/grants/{id}
- POST/v1/grants/{id}/revoke
- GET/v1/connections
- POST/v1/exports
curl -H "Authorization: Bearer $OH_KEY" \ https://api.oauthradar.com/v1/grants \ -d band=critical -d limit=100 { "data": [{ "id": "gr_2Kq7...", "app": "otter.ai", "score": 92, "band": "CRITICAL" }], "next": "eyJhZnRlciI6..."}Webhooks
Signed with HMAC-SHA256 over the raw body. The secret is shown once at creation.
grant.discoveredA grant appears in the inventory for the first time.
grant.band_changedA score crosses a band boundary in either direction.
connection.sync_failedA provider sync failed. Carries the provider error verbatim.
Authentication
Bearer token from Settings → API keys. Optional expiry.
Rate limit
600 requests per minute per key, burst 60.
Pagination
Keyset cursors. Offsets are not supported.
Bulk export
POST an export, poll it, download CSV or JSON. No row limit.
Errors
RFC 9457 problem documents with a stable type URI.
Version policy
Two releases are supported at any time. Security fixes are backported for twelve months from a release date.
| Release | Status | Security fixes until | Notes |
|---|---|---|---|
| 2026.8.3 | Current | August 2027 | Governed removal, approvals, cohort benchmark |
| 2026.5.1 | Supported | May 2027 | Access reviews, allowlist expiry |
| 2026.2.4 | End of life | February 2027 | Security fixes only, no new features |
| 2025.11.2 | Unsupported | — | Upgrade before applying a new licence |