Upwork Authentication API

openapi: 3.2.0
info:
  title: Upwork GraphQL Authentication API
  description: The primary Upwork API surface, providing GraphQL queries and mutations for job search, profile access, contract management, and messaging. The API is accessed at a single GraphQL endpoint using POST requests with JSON bodies containing queries and variables. Authentication uses OAuth 2.0 authorization code flow with Bearer tokens. GraphQL subscriptions are supported for real-time webhook event notifications.
  version: 1.0.0
  contact:
    name: Upwork Developer Support
    url: https://support.upwork.com/hc/en-us/sections/17976982721555-Upwork-API
  termsOfService: https://www.upwork.com/legal
  x-generated-from: documentation
servers:
- url: https://api.upwork.com
  description: Upwork Production API
security:
- oauth2AuthCode: []
tags:
- name: Authentication
  description: OAuth 2.0 token management for API access.
paths:
  /api/auth/v1/oauth/token:
    post:
      operationId: getOAuthToken
      summary: Upwork Get OAuth2 Access Token
      description: Exchange an authorization code for an OAuth2 access token and refresh token. Supports both authorization_code and refresh_token grant types.
      tags:
      - Authentication
      security: []
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
              - grant_type
              - client_id
              - client_secret
              properties:
                grant_type:
                  type: string
                  enum:
                  - authorization_code
                  - refresh_token
                  description: OAuth2 grant type
                  example: authorization_code
                client_id:
                  type: string
                  description: Application client identifier
                  example: client-abc123
                client_secret:
                  type: string
                  description: Application client secret
                  example: secret-xyz789
                code:
                  type: string
                  description: Authorization code (required for authorization_code grant)
                  example: auth-code-123
                refresh_token:
                  type: string
                  description: Refresh token (required for refresh_token grant)
                  example: refresh-token-abc
                redirect_uri:
                  type: string
                  description: Redirect URI matching the one used in authorization
                  example: https://myapp.example.com/callback
      responses:
        '200':
          description: OAuth2 token response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthToken'
              examples:
                getOAuthToken200Example:
                  summary: Default getOAuthToken 200 response
                  x-microcks-default: true
                  value:
                    access_token: eyJhbGciOiJSUzI1NiJ9.example.token
                    token_type: bearer
                    refresh_token: refresh-token-xyz789
                    expires_in: 86400
        '401':
          description: Invalid client credentials
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIError'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  schemas:
    APIError:
      type: object
      description: API error response
      properties:
        error:
          type: string
          description: Error code
          example: unauthorized
        message:
          type: string
          description: Human-readable error message
          example: Authentication failed. Please check your credentials.
        code:
          type: integer
          description: HTTP status code
          example: 401
    OAuthToken:
      type: object
      description: OAuth2 access token response
      properties:
        access_token:
          type: string
          description: The access token for API requests
          example: eyJhbGciOiJSUzI1NiJ9.example.token
        token_type:
          type: string
          description: Token type (always bearer)
          example: bearer
        refresh_token:
          type: string
          description: Token for obtaining new access tokens
          example: refresh-token-xyz789
        expires_in:
          type: integer
          description: Token lifetime in seconds
          example: 86400
  securitySchemes:
    oauth2AuthCode:
      type: oauth2
      description: OAuth 2.0 authorization code flow for Upwork API access. Obtain an authorization code by redirecting users to the Upwork OAuth consent page, then exchange for access and refresh tokens.
      flows:
        authorizationCode:
          authorizationUrl: https://www.upwork.com/ab/account-security/oauth2/authorize
          tokenUrl: https://www.upwork.com/api/v3/oauth2/token
          scopes:
            openid: Access to user identity information
            email: Access to user email
            profile: Access to user profile data
            jobs:read: Read job postings
            contracts:read: Read contract data
            messages:read: Read messages
            messages:write: Send messages
            profiles:read: Read freelancer profiles
            reports:read: Read financial reports
externalDocs:
  description: Upwork GraphQL API Documentation
  url: https://www.upwork.com/developer/documentation/graphql/api/docs/index.html