Matomo

Matomo O Auth2 API

Exposes super-user OAuth2 client management endpoints for Matomo. This API lists configured scopes and lets administrators create, inspect, update, rotate, activate, and delete OAuth2 clients.

GitHub OpenAPI

Operations 8

Each operation below carries the questions people ask an LLM about it and the instructions they give an agent to run it. Generated by API Evangelist overlay

GET /index.php?module=API&method=OAuth2.getClients List OAuth2 clients · OAuth2 get clients #
Ask an LLM
“Which OAuth2 client applications are configured in my Matomo?”
“Can a super user see every OAuth client that has API access?”
Tell an agent
List all configured OAuth2 clients.
Show every OAuth client app registered on this instance.
GET /index.php?module=API&method=OAuth2.getClient Get one OAuth2 client · OAuth2 get client #
Ask an LLM
“What grant types and redirect URIs does a specific OAuth client have?”
“Is a particular OAuth2 client still active?”
Tell an agent
Get OAuth2 client {clientId}.
Show the scopes, grant types and redirect URIs of OAuth client {clientId}.
GET /index.php?module=API&method=OAuth2.getScopes List the OAuth2 scopes available to clients · OAuth2 get scopes #
Ask an LLM
“What scopes can I grant to an OAuth2 client?”
“Which OAuth permission scopes are enabled for client configuration?”
Tell an agent
List the OAuth2 scopes enabled for clients.
Show which permission scopes I can assign to an OAuth app.
GET /index.php?module=API&method=OAuth2.createClient Create an OAuth2 client · OAuth2 create client #
Ask an LLM
“How do I register a new OAuth2 app so it can call the Matomo API?”
“Can I create a client with the client credentials grant and get its secret back?”
Tell an agent
Create an OAuth2 client named {name} with grant types {grantTypes} and scope {scope}.
Register OAuth app {name} using {grantTypes}, scope {scope}, redirecting to {redirectUris}.
GET /index.php?module=API&method=OAuth2.updateClient Update an OAuth2 client · OAuth2 update client #
Ask an LLM
“How do I change the redirect URIs or scope on an existing OAuth client?”
“Can I edit an OAuth app's name and grant types after creating it?”
Tell an agent
Update OAuth2 client {clientId}: name {name}, grant types {grantTypes}, scope {scope}.
Change the redirect URIs of existing client {clientId} to {redirectUris}, keeping name {name}, grants {grantTypes} and scope {scope}.
GET /index.php?module=API&method=OAuth2.rotateSecret Rotate an OAuth2 client's secret · OAuth2 rotate secret #
Ask an LLM
“How do I generate a new secret for an OAuth client whose secret leaked?”
“Will rotating a client secret replace the old one?”
Tell an agent destructive · confirm first
Rotate the secret for OAuth2 client {clientId}.
Generate a fresh client secret for {clientId}, confirming with password {passwordConfirmation}.
GET /index.php?module=API&method=OAuth2.setClientActive Activate or deactivate an OAuth2 client · OAuth2 set client active #
Ask an LLM
“Can I temporarily disable an OAuth client without deleting it?”
“How do I re-enable an OAuth app I switched off?”
Tell an agent
Set OAuth2 client {clientId} active to {active}.
Deactivate OAuth client {clientId} by setting active={active}.
GET /index.php?module=API&method=OAuth2.deleteClient Delete an OAuth2 client and its tokens · OAuth2 delete client #
Ask an LLM
“What happens to access and refresh tokens when I delete an OAuth client?”
“How do I permanently remove an OAuth app from Matomo?”
Tell an agent destructive · confirm first
Delete OAuth2 client {clientId}.
Remove OAuth client {clientId} and all its tokens, confirming with password {passwordConfirmation}.

Documentation

📖
Documentation
https://developer.matomo.org/api-reference/reporting-api
📖
Documentation
https://developer.matomo.org/api-reference/reporting-api#Live
📖
Documentation
https://developer.matomo.org/api-reference/reporting-api#Goals
📖
Documentation
https://developer.matomo.org/api-reference/reporting-api-segmentation

Specifications

⚙
OpenAPI
https://raw.githubusercontent.com/api-evangelist/matomo/refs/heads/main/openapi/matomo-oauth2-api-openapi.yml

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/matomo:matomo-oauth2-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

matomo-oauth2-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  title: Matomo Reporting API for plugin O Auth2 API
  version: 1.0.0
  description: Exposes super-user OAuth2 client management endpoints for Matomo. This API lists configured scopes and lets administrators create, inspect, update, rotate, activate, and delete OAuth2 clients.
servers:
- url: https://demo-proxy.innocraft.cloud/
  description: Current Matomo instance
security:
- MatomoToken: []
tags:
- name: OAuth2
  description: Exposes super-user OAuth2 client management endpoints for Matomo. This API lists configured scopes and lets administrators create, inspect, update, rotate, activate, and delete OAuth2 clients.
paths:
  /index.php?module=API&method=OAuth2.getClients:
    get:
      tags:
      - OAuth2
      description: Lists all OAuth2 clients configured in Matomo (super users only).
      operationId: OAuth2.getClients
      parameters:
      - $ref: '#/components/parameters/formatOptional'
      responses:
        '200':
          description: 'OAuth2 clients ordered by most recently updated first.


            Example responses require Super User access. Use Try it out to see a live response.'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/ServerError'
        default:
          $ref: '#/components/responses/DefaultError'
      summary: OAuth2 get clients
      x-summary-source: derived
  /index.php?module=API&method=OAuth2.getClient:
    get:
      tags:
      - OAuth2
      description: Returns one OAuth2 client configured in Matomo (super users only).
      operationId: OAuth2.getClient
      parameters:
      - $ref: '#/components/parameters/formatOptional'
      - name: clientId
        in: query
        description: 32-character hexadecimal client identifier.
        required: true
        schema:
          type: string
          example: 0123456789abcdef0123456789abcdef
      responses:
        '200':
          description: 'Sanitized OAuth2 client details for the requested client.


            Example responses require Super User access. Use Try it out to see a live response.'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/ServerError'
        default:
          $ref: '#/components/responses/DefaultError'
      summary: OAuth2 get client
      x-summary-source: derived
  /index.php?module=API&method=OAuth2.getScopes:
    get:
      tags:
      - OAuth2
      description: Returns the OAuth2 scopes enabled for client configuration (super users only).
      operationId: OAuth2.getScopes
      parameters:
      - $ref: '#/components/parameters/formatOptional'
      responses:
        '200':
          description: 'Enabled scope identifiers mapped to their translated descriptions.


            Example responses require Super User access. Use Try it out to see a live response.'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/ServerError'
        default:
          $ref: '#/components/responses/DefaultError'
      summary: OAuth2 get scopes
      x-summary-source: derived
  /index.php?module=API&method=OAuth2.createClient:
    get:
      tags:
      - OAuth2
      description: Creates a new OAuth2 client and optionally returns the generated secret.
      operationId: OAuth2.createClient
      parameters:
      - $ref: '#/components/parameters/formatOptional'
      - name: name
        in: query
        description: Display name shown in the Matomo UI.
        required: true
        schema:
          type: string
          example: Pricing
      - name: grantTypes
        in: query
        description: Grant types to enable (`authorization_code`, `client_credentials`, `refresh_token`).
        required: true
        schema:
          type: array
          items:
            type: string
          example:
          - authorization_code
      - name: scope
        in: query
        description: Single scope identifier to allow for the client. Must match one of the enabled OAuth2 scopes.
        required: true
        schema:
          type: string
          example: matomo:read
      - name: redirectUris
        in: query
        description: Allowed redirect URIs (array or newline-separated string).
        required: false
        schema:
          oneOf:
          - type: string
            default: '[]'
          - type: array
            items:
              type: string
            default: []
      - name: description
        in: query
        description: Optional description for administrators.
        required: false
        schema:
          type: string
          default: ''
      - name: type
        in: query
        description: '`confidential` (default, requires secret) or `public` (no client secret).'
        required: false
        schema:
          type: string
          default: confidential
      - name: active
        in: query
        description: '`''1''` to enable the client or `''0''` to disable it.'
        required: false
        schema:
          type: string
          default: '1'
      - name: passwordConfirmation
        in: query
        description: Current user's password confirmation.
        required: false
        schema:
          type: string
          default: ''
      responses:
        '200':
          description: 'The sanitized client record and the generated plaintext secret when the created client is confidential.


            Example responses require Super User access. Use Try it out to see a live response.'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/ServerError'
        default:
          $ref: '#/components/responses/DefaultError'
      summary: OAuth2 create client
      x-summary-source: derived
  /index.php?module=API&method=OAuth2.updateClient:
    get:
      tags:
      - OAuth2
      description: Updates an OAuth2 client and optionally returns a newly generated secret.
      operationId: OAuth2.updateClient
      parameters:
      - $ref: '#/components/parameters/formatOptional'
      - name: clientId
        in: query
        description: 32-character hexadecimal client identifier.
        required: true
        schema:
          type: string
          example: 0123456789abcdef0123456789abcdef
      - name: name
        in: query
        description: Display name shown in the Matomo UI.
        required: true
        schema:
          type: string
          example: Pricing
      - name: grantTypes
        in: query
        description: Grant types to enable (`authorization_code`, `client_credentials`, `refresh_token`).
        required: true
        schema:
          type: array
          items:
            type: string
          example:
          - authorization_code
      - name: scope
        in: query
        description: Single scope identifier to allow for the client. Must match one of the enabled OAuth2 scopes.
        required: true
        schema:
          type: string
          example: matomo:read
      - name: redirectUris
        in: query
        description: Allowed redirect URIs (array or newline-separated string).
        required: false
        schema:
          oneOf:
          - type: string
            default: '[]'
          - type: array
            items:
              type: string
            default: []
      - name: description
        in: query
        description: Optional description for administrators.
        required: false
        schema:
          type: string
          default: ''
      - name: type
        in: query
        description: '`confidential` (default, requires secret) or `public` (no client secret).'
        required: false
        schema:
          type: string
          default: confidential
      - name: active
        in: query
        description: '`''1''` to enable the client or `''0''` to disable it.'
        required: false
        schema:
          type: string
          default: '1'
      - name: passwordConfirmation
        in: query
        description: Current user's password confirmation.
        required: false
        schema:
          type: string
          default: ''
      responses:
        '200':
          description: 'The sanitized updated client record and a newly generated plaintext secret when the client becomes confidential.


            Example responses require Super User access. Use Try it out to see a live response.'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/ServerError'
        default:
          $ref: '#/components/responses/DefaultError'
      summary: OAuth2 update client
      x-summary-source: derived
  /index.php?module=API&method=OAuth2.rotateSecret:
    get:
      tags:
      - OAuth2
      description: Generates and persists a new secret for the given OAuth2 client (super users only).
      operationId: OAuth2.rotateSecret
      parameters:
      - $ref: '#/components/parameters/formatOptional'
      - name: clientId
        in: query
        description: 32-character hexadecimal client identifier.
        required: true
        schema:
          type: string
          example: 0123456789abcdef0123456789abcdef
      - name: passwordConfirmation
        in: query
        description: Current user's password confirmation.
        required: false
        schema:
          type: string
          default: ''
      responses:
        '200':
          description: 'The client ID and the newly generated plaintext secret.


            Example responses require Super User access. Use Try it out to see a live response.'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/ServerError'
        default:
          $ref: '#/components/responses/DefaultError'
      summary: OAuth2 rotate secret
      x-summary-source: derived
  /index.php?module=API&method=OAuth2.setClientActive:
    get:
      tags:
      - OAuth2
      description: Updates whether an OAuth2 client is active (super users only).
      operationId: OAuth2.setClientActive
      parameters:
      - $ref: '#/components/parameters/formatOptional'
      - name: clientId
        in: query
        description: 32-character hexadecimal client identifier.
        required: true
        schema:
          type: string
          example: 0123456789abcdef0123456789abcdef
      - name: active
        in: query
        description: '`''1''` to enable the client or `''0''` to disable it.'
        required: true
        schema:
          type: string
          example: '1'
      responses:
        '200':
          description: 'The sanitized client record after the active flag is updated.


            Example responses require Super User access. Use Try it out to see a live response.'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/ServerError'
        default:
          $ref: '#/components/responses/DefaultError'
      summary: OAuth2 set client active
      x-summary-source: derived
  /index.php?module=API&method=OAuth2.deleteClient:
    get:
      tags:
      - OAuth2
      description: Deletes an OAuth2 client and its related access tokens, refresh tokens, and auth codes (super users only).
      operationId: OAuth2.deleteClient
      parameters:
      - $ref: '#/components/parameters/formatOptional'
      - name: clientId
        in: query
        description: 32-character hexadecimal client identifier.
        required: true
        schema:
          type: string
          example: 0123456789abcdef0123456789abcdef
      - name: passwordConfirmation
        in: query
        description: Current user's password confirmation.
        required: false
        schema:
          type: string
          default: ''
      responses:
        '200':
          description: 'Confirmation that the client and its related OAuth2 records were deleted.


            Example responses require Super User access. Use Try it out to see a live response.'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/ServerError'
        default:
          $ref: '#/components/responses/DefaultError'
      summary: OAuth2 delete client
      x-summary-source: derived
components:
  responses:
    Forbidden:
      description: Authenticated but not allowed to access the resource.
      content:
        text/plain:
          schema:
            type: string
          example: 'Error: Not authorised.'
        text/html:
          schema:
            type: string
          example: Not authorised.
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
        application/xml:
          schema:
            $ref: '#/components/schemas/ErrorXml'
    BadRequest:
      description: Bad request (validation or missing parameters).
      content:
        text/plain:
          schema:
            type: string
          example: 'Error: There was an error.'
        text/html:
          schema:
            type: string
          example: There was an error.
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
        application/xml:
          schema:
            $ref: '#/components/schemas/ErrorXml'
    NotFound:
      description: Resource not found.
      content:
        text/plain:
          schema:
            type: string
          example: 'Error: The method is not available.'
        text/html:
          schema:
            type: string
          example: The method is not available.
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
        application/xml:
          schema:
            $ref: '#/components/schemas/ErrorXml'
    Unauthorized:
      description: Authentication failed or missing token.
      content:
        text/plain:
          schema:
            type: string
          example: 'Error: You must be logged in to access this functionality.'
        text/html:
          schema:
            type: string
          example: You must be logged in to access this functionality.
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
        application/xml:
          schema:
            $ref: '#/components/schemas/ErrorXml'
    ServerError:
      description: Unexpected server error.
      content:
        text/plain:
          schema:
            type: string
          example: 'Error: There was an error.'
        text/html:
          schema:
            type: string
          example: There was an error.
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
        application/xml:
          schema:
            $ref: '#/components/schemas/ErrorXml'
    DefaultError:
      description: Default error response (any non-2xx).
      content:
        text/plain:
          schema:
            type: string
          example: 'Error: There was an error.'
        text/html:
          schema:
            type: string
          example: There was an error.
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
        application/xml:
          schema:
            $ref: '#/components/schemas/ErrorXml'
  schemas:
    ErrorXml:
      description: Generic Matomo error payload in XML.
      properties:
        error:
          properties:
            message:
              type: string
              xml:
                attribute: true
              example: There was an error
          type: object
          xml:
            name: error
      type: object
      xml:
        name: result
    Error:
      description: Generic Matomo error payload.
      required:
      - result
      - message
      properties:
        result:
          type: string
          example: error
        message:
          type: string
          example: There was an error
        code:
          type: integer
      type: object
      additionalProperties: true
  parameters:
    formatOptional:
      name: format
      in: query
      description: Response format. Defaults to `xml`. Use `original` to get the original PHP data structure.
      required: false
      schema:
        type: string
        default: xml
        enum:
        - xml
        - json
        - csv
        - tsv
        - html
        - rss
        - original
  securitySchemes:
    MatomoToken:
      type: http
      description: Paste your token generated from Personal > Security. Swagger will send it as a Bearer token.
      scheme: bearer
externalDocs:
  description: Matomo Reporting API developer page
  url: https://developer.matomo.org/api-reference/reporting-api/