Paginated_OAuthAuthorizationView

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://raw.githubusercontent.com/api-evangelist/picaos/main/json-schema/picaos-paginated-oauth-authorization-view-schema.json",
  "title": "Paginated_OAuthAuthorizationView",
  "x-generated": "2026-10-21",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/_original/picaos-api-openapi.json#/components/schemas/Paginated_OAuthAuthorizationView",
  "properties": {
    "page": {
      "format": "int64",
      "minimum": 0,
      "type": "integer"
    },
    "pages": {
      "format": "int64",
      "minimum": 0,
      "type": "integer"
    },
    "rows": {
      "items": {
        "description": "One app a user has granted access to, as their dashboard lists it.\n\nCore's response shape, not `common`'s: it names this service's consent\nvocabulary (`reach`) and nothing outside core reads it.",
        "properties": {
          "clientId": {
            "$ref": "#/$defs/OAuthClientId"
          },
          "clientName": {
            "type": "string"
          },
          "clientType": {
            "description": "Whether the app holds a secret. A public client is one that cannot, so\nthe pair says which kind of app the row is - the MCP clients that\nregister themselves and the OAuth apps a developer configured read\nidentically without it.",
            "type": "string"
          },
          "consentSurface": {
            "$ref": "#/$defs/ConsentSurface",
            "description": "Where the app's users granted this: the page core renders, or the\nconnect card framed inside the app's own site."
          },
          "createdAt": {
            "format": "date-time",
            "type": "string"
          },
          "expiresAt": {
            "description": "When the app's current access token expires. `None` while the app holds\na live grant but no live token - the window between re-consent and\nthe client redeeming the new code.",
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "homepageUrl": {
            "type": [
              "string",
              "null"
            ]
          },
          "lastUsedAt": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "logoUrl": {
            "type": [
              "string",
              "null"
            ]
          },
          "reach": {
            "description": "What a grant reaches, generic over how each entry is rendered - the one\ntrichotomy two surfaces share: a dashboard reads it as counts\n([`GrantedReachView`]), a reconnect card as pre-selectable rules\n([`PriorGrantView`]). `KnowledgeOnly`/`Full` are identical on the wire for\nboth; only the `Connectors` element type differs.\n\nA bare generic derives a single schema named `ReachView`, so both\ninstantiations would collide on that one OpenAPI component and one endpoint\nwould advertise the other's connector shape. Every schema site that carries\none of these therefore inlines it (`#[schema(inline)]` / `inline(...)`), so\nno shared `ReachView` component exists to collide.",
            "oneOf": [
              {
                "description": "Docs and search only: no connection access of any kind.",
                "properties": {
                  "type": {
                    "enum": [
                      "knowledgeOnly"
                    ],
                    "type": "string"
                  }
                },
                "required": [
                  "type"
                ],
                "type": "object"
              },
              {
                "description": "Every connection in the consented scope. No connector list because the\ngrant names none - it follows the account.",
                "properties": {
                  "type": {
                    "enum": [
                      "full"
                    ],
                    "type": "string"
                  }
                },
                "required": [
                  "type"
                ],
                "type": "object"
              },
              {
                "description": "Only what the grant names, each entry rendered as `C`. **The granularity\nis the instantiation's**: a reach report carries one entry per\nconnector, a prior grant one per granted *connection*, so two entries\nthere can share a connector.",
                "properties": {
                  "connectors": {
                    "items": {
                      "$ref": "#/$defs/GrantedConnectorView"
                    },
                    "type": "array"
                  },
                  "type": {
                    "enum": [
                      "connectors"
                    ],
                    "type": "string"
                  }
                },
                "required": [
                  "connectors",
                  "type"
                ],
                "type": "object"
              }
            ]
          },
          "scopes": {
            "items": {
              "type": "string"
            },
            "type": "array"
          },
          "tokenCount": {
            "minimum": 0,
            "type": "integer"
          }
        },
        "required": [
          "clientId",
          "clientName",
          "clientType",
          "consentSurface",
          "scopes",
          "reach",
          "createdAt",
          "tokenCount"
        ],
        "type": "object"
      },
      "type": "array"
    },
    "total": {
      "format": "int64",
      "minimum": 0,
      "type": "integer"
    }
  },
  "required": [
    "rows",
    "total",
    "pages",
    "page"
  ],
  "type": "object",
  "$defs": {
    "ConnectionDefinitionId": {
      "description": "Prefixed ID with 'conn_def' prefix (e.g., 'conn_def_1C'), also accepts raw integer",
      "type": "string"
    },
    "ConsentSurface": {
      "description": "Where an OAuth client's users are sent to grant consent.\n\nThe surface used to be read off the client id, so a client could only get a\ndifferent one by being renamed, and every existing client would have moved\nthe moment the rule changed. Naming it on the row makes it a property of the\nclient that its owner can see and set, and leaves the ones already running\nexactly where they are.",
      "enum": [
        "hosted",
        "connect"
      ],
      "type": "string"
    },
    "GrantedConnectorView": {
      "description": "One connector an issued grant reaches, as an audit surface reports it.\n\n**Not [`ResolvedConnectorView`].** This is a read-only report, never fed\nback into a request: a dashboard folds every live token together, and the\nenvelopes of several grants on one connector do not combine into one, so a\nrule-shaped answer here would be a rule nobody granted.",
      "properties": {
        "actionCount": {
          "description": "Distinct actions reached across every grant and connection touching\nthis connector - the union, so a shared action counts once and disjoint\nones each.",
          "minimum": 0,
          "type": "integer"
        },
        "connectionCount": {
          "description": "Distinct connections the grants name here. `None` when one of them\nnamed the *connector*, which reaches every connection on it including\nones added later, so no count would be true for long.",
          "minimum": 0,
          "type": [
            "integer",
            "null"
          ]
        },
        "connectionDefinitionId": {
          "$ref": "#/$defs/ConnectionDefinitionId"
        },
        "imageUrl": {
          "type": "string"
        },
        "name": {
          "type": "string"
        },
        "platform": {
          "type": "string"
        }
      },
      "required": [
        "connectionDefinitionId",
        "name",
        "platform",
        "imageUrl",
        "actionCount"
      ],
      "type": "object"
    },
    "OAuthClientId": {
      "description": "Prefixed ID with 'oac' prefix (e.g., 'oac_1C'), also accepts raw integer",
      "type": "string"
    }
  }
}