Register a personal access client

Request

Registers a new personal access client against the authenticated user and returns it. The id on the response is the client_id the token endpoint expects.

The client belongs to the caller. It is not shared with the rest of the account, and it carries the caller's own access - a token issued through it can reach whatever that user can reach, so register the client as the user whose access the integration should have.

The response does not include the client secret, and no endpoint returns it afterwards. Ask Rosterfy for the secret that goes with the client_id this call returns; until you have it, the client cannot complete a token exchange.

Security

default

Rosterfy-Platformstring

Bodyapplication/jsonrequired

namestringrequired

A label for the client, shown wherever the client is listed. Use something that identifies the system that will hold the credentials, so a client can be recognised and withdrawn later without guesswork.

redirectstringrequired

The absolute URL an authorisation response is returned to. Required in practice: a request that omits it fails, so send a URL you control even when the integration never redirects a browser anywhere.

curl -i -X POST \
  https://developer.rosterfy.com/_mock/api-docs/openapi/api/v2/oauth/clients \
  -H 'Authorization: Bearer <YOUR_TOKEN_HERE>' \
  -H 'Content-Type: application/json' \
  -H 'Rosterfy-Platform: admin' \
  -d '{
    "name": null,
    "redirect": null
  }'

Responses

Bodyapplication/json

user_idinteger

namestring

providerstring or null

redirectstring

personal_access_clientboolean

password_clientboolean

revokedboolean

updated_atstring

created_atstring

idinteger

Response

{
  "user_id": 1234,
  "name": "Nightly roster export",
  "provider": null,
  "redirect": "https://example.com/oauth/callback",
  "personal_access_client": true,
  "password_client": false,
  "revoked": false,
  "updated_at": "2026-01-14T02:08:00.000000Z",
  "created_at": "2026-01-14T02:08:00.000000Z",
  "id": 1234
}