Charthop

Charthop oauth API

The oauth API from Charthop — 17 operation(s) for oauth.

GitHub OpenAPI

Operations 19

GET /oauth/app/{appName} Process an Oauth2 redirect request from an access request for an app installation, storing the accessToken and refreshToken as secrets for the app #
POST /oauth/credentials Return a ChartHop authorization token, given a username and password #
POST /oauth/join Return a JOIN token to be used for new user operations #
POST /oauth/loginWithToken Return a ChartHop authorization token, given a login token #
POST /oauth/mcp/approve Approve an MCP authorization grant and issue an authorization code #
GET /oauth/mcp/grant-info Describe a pending MCP authorization grant #
GET /oauth/org/{orgIdentifier}/app/{appName}/{appUserId} Retrieve the oauth uri the user should be directed to in order to start the oauth flow #
GET /oauth/org/{orgIdentifier}/app/{appUserId}/oauth/connection Whether the app installation has an active org-level OAuth connection #
GET /oauth/org/{orgIdentifier}/app/{appUserId}/oauth/user List the per-user OAuth connections for an app installation #
DELETE /oauth/org/{orgIdentifier}/app/{appUserId}/oauth/user Revoke one or more per-user OAuth connections for an app installation #
POST /oauth/revoke Delete the current Oauth2 bearer token (for signout) #
POST /oauth/sendLoginToken Send a login ("magic link") email #
GET /oauth/sso/{idp}/access-token Exchange a one-time use Auth Code for the IDP access token response #
GET /oauth/sso/{idp}/login Login via the auth endpoint #
POST /oauth/token Return an Oauth2 Authorization bearer token #
DELETE /oauth/token Delete the current Oauth2 bearer token (for signout) #
POST /oauth/token/attenuate Given an existing token, issue a new token with a reduced set of scopes #
POST /oauth/token/sso/{type} Return an Oauth2 Authorization bearer token, given a SSO id token #
POST /oauth/token/view Return a view-as token #

Documentation

📖
Documentation
https://docs.charthop.com/developer-basics

Specifications

⚙
OpenAPI
https://raw.githubusercontent.com/api-evangelist/charthop/refs/heads/main/openapi/charthop-oauth-api-openapi.yml

Other Resources

🔗
Swagger
https://api.charthop.com/swagger

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/charthop-oauth-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

charthop-oauth-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  description: REST API for ChartHop
  version: V1.0.0
  title: ChartHop access OAUTH API
  contact:
    name: ChartHop
    url: https://www.charthop.com
    email: support@charthop.com
servers:
- url: https://localhost
- url: http://localhost
tags:
- name: oauth
paths:
  /oauth/app/{appName}:
    get:
      tags:
      - oauth
      summary: Process an Oauth2 redirect request from an access request for an app installation, storing the accessToken and refreshToken as secrets for the app
      operationId: handleRedirect
      parameters:
      - name: token
        in: cookie
        required: false
        schema:
          type: string
      - name: appName
        in: path
        description: App name
        required: true
        schema:
          type: string
      - name: state
        in: query
        description: State, containing orgId and appUserId
        required: false
        schema:
          type: string
      - name: code
        in: query
        description: Temporary authorization code
        required: true
        schema:
          type: string
      responses:
        '400':
          description: bad request
        '404':
          description: not found
  /oauth/credentials:
    post:
      tags:
      - oauth
      summary: Return a ChartHop authorization token, given a username and password
      operationId: issueAccessTokenFromCredentials
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AccessTokenResponse'
        '400':
          description: invalid credentials
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              properties:
                username:
                  type: string
                  description: Username to authenticate
                password:
                  type: string
                  description: Password to authenticate
                scope:
                  type: string
                  description: Requested access scope or scopes (space separated)
                client_id:
                  type: string
                  description: client id
                code_challenge:
                  type: string
                  description: code_challenge
                code_challenge_method:
                  type: string
                  description: code_challenge_method
                redirect_uri:
                  type: string
                  description: redirect_uri
  /oauth/join:
    post:
      tags:
      - oauth
      summary: Return a JOIN token to be used for new user operations
      operationId: join
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AccessTokenResponse'
  /oauth/loginWithToken:
    post:
      tags:
      - oauth
      summary: Return a ChartHop authorization token, given a login token
      operationId: issueAccessTokenFromLoginToken
      parameters:
      - name: scope
        in: query
        description: Requested access scope or scopes (space separated)
        required: false
        schema:
          type: string
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AccessTokenResponse'
        '400':
          description: invalid credentials
  /oauth/mcp/approve:
    post:
      tags:
      - oauth
      summary: Approve an MCP authorization grant and issue an authorization code
      operationId: approveMcpGrant
      responses:
        '200':
          description: successful operation
        '400':
          description: bad request
        '403':
          description: forbidden
        '404':
          description: not found
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/McpApproveRequest'
        required: true
  /oauth/mcp/grant-info:
    get:
      tags:
      - oauth
      summary: Describe a pending MCP authorization grant
      operationId: getMcpGrantInfo
      parameters:
      - name: clientId
        in: query
        description: The client's CIMD URL
        required: true
        schema:
          type: string
      - name: resource
        in: query
        description: The MCP server URL being authorized
        required: true
        schema:
          type: string
      - name: redirectUri
        in: query
        description: The client's OAuth redirect URI
        required: true
        schema:
          type: string
      responses:
        '200':
          description: successful operation
        '400':
          description: bad request
        '403':
          description: forbidden
        '404':
          description: not found
  /oauth/org/{orgIdentifier}/app/{appName}/{appUserId}:
    get:
      tags:
      - oauth
      summary: Retrieve the oauth uri the user should be directed to in order to start the oauth flow
      operationId: getOauthConnectUri
      parameters:
      - name: orgIdentifier
        in: path
        description: Org identifier (either id or slug)
        required: true
        schema:
          type: string
      - name: appName
        in: path
        description: App name
        required: true
        schema:
          type: string
      - name: appUserId
        in: path
        description: App user id
        required: true
        schema:
          type: string
      - name: returnTo
        in: query
        description: Where to return the user
        required: true
        schema:
          type: string
          enum:
          - INSTALL
          - MANAGE
          - SELF_SERVE
          - AGENT
          - AI_CHAT
      - name: finchAppType
        in: query
        description: The type of Finch app being installed
        required: false
        schema:
          type: string
          enum:
          - ALL
          - AUTOMATED
          - SANDBOX_FINCH
          - SANDBOX_PROVIDER
      - name: tokenLevel
        in: query
        description: For OAUTH apps, whether to create a shared org or per-user connection
        required: false
        schema:
          type: string
          enum:
          - ORG
          - USER
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ConnectUriResponse'
        '400':
          description: bad request
        '403':
          description: forbidden
        '404':
          description: not found
  /oauth/org/{orgIdentifier}/app/{appUserId}/oauth/connection:
    get:
      tags:
      - oauth
      summary: Whether the app installation has an active org-level OAuth connection
      operationId: getAppOauthConnection
      parameters:
      - name: orgIdentifier
        in: path
        description: Org identifier (either id or slug)
        required: true
        schema:
          type: string
      - name: appUserId
        in: path
        description: App user id
        required: true
        schema:
          type: string
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AppOauthConnectionStatus'
        '403':
          description: forbidden
        '404':
          description: not found
  /oauth/org/{orgIdentifier}/app/{appUserId}/oauth/user:
    get:
      tags:
      - oauth
      summary: List the per-user OAuth connections for an app installation
      operationId: listAppOauthUserConnections
      parameters:
      - name: orgIdentifier
        in: path
        description: Org identifier (either id or slug)
        required: true
        schema:
          type: string
      - name: appUserId
        in: path
        description: App user id
        required: true
        schema:
          type: string
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/AppOauthUserConnection'
        '403':
          description: forbidden
        '404':
          description: not found
    delete:
      tags:
      - oauth
      summary: Revoke one or more per-user OAuth connections for an app installation
      operationId: revokeAppOauthTokens
      parameters:
      - name: orgIdentifier
        in: path
        description: Org identifier (either id or slug)
        required: true
        schema:
          type: string
      - name: appUserId
        in: path
        description: App user id
        required: true
        schema:
          type: string
      responses:
        '403':
          description: forbidden
        '404':
          description: not found
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RevokeAppOauthTokensRequest'
        required: true
  /oauth/revoke:
    post:
      tags:
      - oauth
      summary: Delete the current Oauth2 bearer token (for signout)
      operationId: revokeToken
      responses:
        '200':
          description: token revoked
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              properties:
                token:
                  type: string
                  description: Token to revoke
              required:
              - token
  /oauth/sendLoginToken:
    post:
      tags:
      - oauth
      summary: Send a login ("magic link") email
      operationId: sendLoginToken
      responses:
        '204':
          description: email sent
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/EmailRequest'
        description: User email address
        required: true
  /oauth/sso/{idp}/access-token:
    get:
      tags:
      - oauth
      summary: Exchange a one-time use Auth Code for the IDP access token response
      operationId: getIdpAccessTokenResponse
      parameters:
      - name: idp
        in: path
        description: Identity provider of SSO login (e.g. adp)
        required: true
        schema:
          type: string
      - name: authCode
        in: query
        description: A one-time use Auth Code
        required: true
        schema:
          type: string
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IdpAccessTokenResponse'
        '400':
          description: bad request
        '404':
          description: not found
  /oauth/sso/{idp}/login:
    get:
      tags:
      - oauth
      summary: Login via the auth endpoint
      operationId: ssoAuthLogin
      parameters:
      - name: idp
        in: path
        description: Identity provider of SSO login (e.g. adp)
        required: true
        schema:
          type: string
      responses:
        '400':
          description: bad request
        '404':
          description: not found
  /oauth/token:
    post:
      tags:
      - oauth
      summary: Return an Oauth2 Authorization bearer token
      operationId: issueAccessToken
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AccessTokenResponse'
        '400':
          description: invalid credentials
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              properties:
                grant_type:
                  type: string
                  description: Type of grant; 'password', 'refresh_token', 'authorization_code' supported
                code:
                  type: string
                  description: Authorization code
                redirect_uri:
                  type: string
                  format: uri
                  description: Redirect URI
                client_id:
                  type: string
                  description: Client id
                refresh_token:
                  type: string
                  description: Refresh token
                code_verifier:
                  type: string
                  description: Code verifier
                resource:
                  type: string
                  description: Target resource (RFC 8707)
    delete:
      tags:
      - oauth
      summary: Delete the current Oauth2 bearer token (for signout)
      operationId: deleteToken
      responses:
        '204':
          description: token deleted
        '401':
          description: not authorized
  /oauth/token/attenuate:
    post:
      tags:
      - oauth
      summary: Given an existing token, issue a new token with a reduced set of scopes
      operationId: attenuateToken
      parameters:
      - name: scope
        in: query
        description: Requested access scope or scopes (space separated)
        required: false
        schema:
          type: string
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AccessTokenResponse'
  /oauth/token/sso/{type}:
    post:
      tags:
      - oauth
      summary: Return an Oauth2 Authorization bearer token, given a SSO id token
      operationId: issueSsoToken
      parameters:
      - name: type
        in: path
        description: type of SSO request (google or microsoft)
        required: true
        schema:
          type: string
      - name: createOrg
        in: query
        description: automatically create org if possible to do so
        required: false
        schema:
          type: boolean
      - name: signupSource
        in: query
        description: sign up source (self-serve, connect, or sequoia)
        required: false
        schema:
          type: string
          enum:
          - ADP_MARKETPLACE
          - SELF_SERVE
          - SELF_SERVE_TEST
          - SEQUOIA_ONE
          - CONNECT
      - name: utmParams
        in: query
        description: utm params (used in salesforce for lead tracking)
        required: false
        schema:
          type: string
      - name: email
        in: query
        description: sign up email address
        required: false
        schema:
          type: string
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AccessTokenResponse'
        '400':
          description: invalid credentials
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AccessTokenRequest'
        description: access token request
        required: true
  /oauth/token/view:
    post:
      tags:
      - oauth
      summary: Return a view-as token
      operationId: issueViewToken
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AccessTokenResponse'
        '400':
          description: invalid credentials
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ViewAsRequest'
        description: request on whom to view as
        required: true
components:
  schemas:
    AppOauthConnectionStatus:
      type: object
      required:
      - connected
      properties:
        connected:
          type: boolean
          description: whether an org-level OAuth token is currently connected
        connectedAt:
          type: string
          description: when the org-level token was issued, if connected
          example: '2017-01-24T13:57:52Z'
        connectedById:
          type: string
          description: id of the user who set up the org-level connection, if connected
    ViewAsRequest:
      type: object
      required:
      - orgId
      - scope
      properties:
        orgId:
          type: string
          description: org id
          example: 588f7ee98f138b19220041a7
        personId:
          type: string
          description: person id
          example: 588f7ee98f138b19220041a7
        userId:
          type: string
          description: user id
          example: 588f7ee98f138b19220041a7
        roleId:
          type: string
          description: role id
          example: 588f7ee98f138b19220041a7
        scope:
          type: string
          description: scope being requested
    AccessTokenResponse:
      type: object
      required:
      - access_token
      - expires_in
      properties:
        access_token:
          type: string
          description: access token value
          readOnly: true
          example: 2YotnFZFEjr1zCsicMWsdv
        token_type:
          type: string
          description: access token type
          readOnly: true
          example: bearer
        expires_in:
          type: integer
          format: int32
          description: expiration time of token, in seconds
          readOnly: true
          example: '86400'
        refresh_token:
          type: string
          description: refresh token value
          readOnly: true
          example: tGzv3JOkF0XG5Qx2TlKWIA
        scope:
          type: string
          description: scope of the access token
          readOnly: true
          example: admin
        redirect_uri:
          type: string
          description: redirect uri of the access token
          readOnly: true
          example: com.charthop.mobile://oauth
    IdpAccessTokenResponse:
      type: object
      required:
      - id_token
      properties:
        id_token:
          type: string
          description: id token value (likely a JWT)
          example: header.payload.signature
    RevokeAppOauthTokensRequest:
      type: object
      required:
      - tokenIds
      properties:
        tokenIds:
          type: array
          description: ids of the oauth tokens to revoke
          items:
            type: string
    McpApproveRequest:
      type: object
      required:
      - clientId
      - redirectUri
      - codeChallenge
      - codeChallengeMethod
      - resource
      properties:
        clientId:
          type: string
        redirectUri:
          type: string
        codeChallenge:
          type: string
        codeChallengeMethod:
          type: string
        resource:
          type: string
        state:
          type: string
        orgId:
          type: string
    AppOauthUserConnection:
      type: object
      required:
      - tokenId
      - userId
      - issuedAt
      properties:
        tokenId:
          type: string
          description: the oauth token id, used to revoke the connection
        userId:
          type: string
          description: the id of the user who authorized
        issuedAt:
          type: string
          description: when the connection was authorized
          example: '2017-01-24T13:57:52Z'
        activeAt:
          type: string
          description: when the connection was last used for an API call
          example: '2017-01-24T13:57:52Z'
    EmailRequest:
      type: object
      required:
      - email
      properties:
        email:
          type: string
          description: email address
          example: example@example.com
    ConnectUriResponse:
      type: object
      required:
      - uri
      properties:
        uri:
          type: string
          description: uri to use for oath
          example: https://api.tryfinch.com/connect/sessions
    AccessTokenRequest:
      type: object
      required:
      - idToken
      - scope
      properties:
        idToken:
          type: string
          description: id token
        scope:
          type: string
          description: scope being requested
        fromToken:
          type: string
          description: an existing token
        clientId:
          type: string
          description: client id for OAuth2.0 PKCE
        codeChallenge:
          type: string
          description: code_challenge for OAuth2.0 PKCE
        codeChallengeMethod:
          type: string
          description: code_challenge_method for OAuth2.0 PKCE
        redirectUri:
          type: string
          description: redirect_uri for OAuth2.0 PKCE