> ## Documentation Index
> Fetch the complete documentation index at: https://onecli.sh/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Apps API: Connect Apps and Configure OAuth Clients

> Browse the OneCLI app catalog, connect apps with OAuth or credentials, bring your own OAuth client, read tool catalogs, and manage app blocklists.

Apps are the services agents can reach through OneCLI, such as Gmail, GitHub, or Slack. Connecting an app creates a connection that you can then grant to agents.

Use these endpoints to explore the catalog, start OAuth or credential connects, configure your own OAuth client, read each app's tool catalog, and block specific hosts. To manage existing accounts, use [Connections](https://onecli.sh/docs/api-reference/connections). For the full flow, see [App connections](https://onecli.sh/docs/integrations/app-connections.md).

## Related guides

* [App connections: connect accounts for agents](https://onecli.sh/docs/integrations/app-connections.md)
* [Agent access: grant tools to agents](https://onecli.sh/docs/guides/agent-access.md)
* [Rules: block and limit app access](https://onecli.sh/docs/guides/rules.md)

## Endpoints

| Endpoint | Method and path | What it does |
| - | - | - |
| [List apps](https://onecli.sh/docs/api-reference/apps/list-apps.md) | `GET /apps` | List every app in the OneCLI catalog with its connection method, whether your own OAuth client is set up, and your workspace's connections. |
| [List configured apps](https://onecli.sh/docs/api-reference/apps/list-configured-apps.md) | `GET /apps/configured` | List the provider ids that have an enabled OAuth client configuration, set in your workspace or inherited from the organization. |
| [Get the app allowlist for this workspace](https://onecli.sh/docs/api-reference/apps/get-the-app-allowlist-for-this-workspace.md) | `GET /apps/available` | Check which apps your workspace may connect under the organization's app-availability rules. |
| [List apps with platform-provided OAuth clients](https://onecli.sh/docs/api-reference/apps/list-apps-with-platform-provided-oauth-clients.md) | `GET /apps/env-defaults` | List the apps whose OAuth client comes from the deployment's environment, so they connect without setting up your own client first. |
| [List every app's tool catalog](https://onecli.sh/docs/api-reference/apps/list-every-apps-tool-catalog.md) | `GET /apps/permission-definitions` | Get the static tool catalog for every app that has one, with tool ids, names, and descriptions grouped into read and write. |
| [Get an app](https://onecli.sh/docs/api-reference/apps/get-an-app.md) | `GET /apps/{provider}` | Get one app with its connections in your workspace and a readable hint that tells you what to do next to connect it. |
| [Get an app's tool catalog](https://onecli.sh/docs/api-reference/apps/get-an-apps-tool-catalog.md) | `GET /apps/{provider}/permission-definition` | Get one app's tool catalog: the tool ids that grant allow and ask lists and policy rule tools may reference. |
| [Start an OAuth connect](https://onecli.sh/docs/api-reference/apps/start-an-oauth-connect.md) | `GET /apps/{provider}/authorize` | Start an OAuth connect by sending the browser to the provider's consent screen. |
| [Connect an app with credentials](https://onecli.sh/docs/api-reference/apps/connect-an-app-with-credentials.md) | `POST /apps/{provider}/connect` | Connect an API-key or credentials-import app from the fields you send. |
| [Get an app's OAuth client configuration](https://onecli.sh/docs/api-reference/apps/get-an-apps-oauth-client-configuration.md) | `GET /apps/{provider}/config` | Check whether your workspace has its own OAuth client for an app, or inherits one from the organization. |
| [Set an app's OAuth client configuration](https://onecli.sh/docs/api-reference/apps/set-an-apps-oauth-client-configuration.md) | `POST /apps/{provider}/config` | Store your own OAuth client credentials for an app at the workspace level. |
| [Remove an app's OAuth client configuration](https://onecli.sh/docs/api-reference/apps/remove-an-apps-oauth-client-configuration.md) | `DELETE /apps/{provider}/config` | Remove your workspace's own OAuth client for an app and disconnect the connections minted from it. |
| [Enable or disable an app's OAuth client configuration](https://onecli.sh/docs/api-reference/apps/enable-or-disable-an-apps-oauth-client-configuration.md) | `PATCH /apps/{provider}/config/toggle` | Enable or disable your workspace's OAuth client configuration for an app without deleting it. |
| [Get an app's blocklist state](https://onecli.sh/docs/api-reference/apps/get-an-apps-blocklist-state.md) | `GET /apps/{provider}/blocklist` | See an app's predefined blockable hosts and whether each is blocked for your workspace or organization. |
| [Block one of an app's hosts](https://onecli.sh/docs/api-reference/apps/block-one-of-an-apps-hosts.md) | `POST /apps/{provider}/blocklist` | Block one of an app's predefined hosts, or re-enable an existing block, so agents can't reach that host through the gateway. |
| [Enable or disable a blocklist entry](https://onecli.sh/docs/api-reference/apps/enable-or-disable-a-blocklist-entry.md) | `PATCH /apps/{provider}/blocklist/{ruleId}` | Turn an existing app blocklist entry on or off without removing it, so you can pause a host block and restore it later. |
| [Remove a blocklist entry](https://onecli.sh/docs/api-reference/apps/remove-a-blocklist-entry.md) | `DELETE /apps/{provider}/blocklist/{ruleId}` | Remove an entry from an app's blocklist so the host is no longer blocked by that rule for agents in your workspace. |

## Next steps

* [API overview](https://onecli.sh/docs/api-reference.md): base URLs, authentication, and pagination
* [Errors](https://onecli.sh/docs/api-reference/errors.md): status codes and the error format
* [Editions](https://onecli.sh/docs/api-reference/editions.md): which endpoints each edition serves


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.