> ## Documentation Index
> Fetch the complete documentation index at: https://onecli.sh/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Organization Apps API: Shared Connects and OAuth Clients

> Connect apps at the organization level, configure your own OAuth clients, and block app hosts organization-wide with the OneCLI API.

Organization apps let an admin connect an app once for every workspace, bring your own OAuth client for an app, and block specific app hosts across the whole organization.

Use these endpoints to set up shared app access from scripts. To manage the resulting connections, use [Organization connections](https://onecli.sh/docs/api-reference/organization-connections). For self-hosted OAuth setup, see [App credentials](https://onecli.sh/docs/self-hosting/app-credentials.md).

## Related guides

* [App connections: connect agents to apps](https://onecli.sh/docs/integrations/app-connections.md)
* [Self-hosting: configure app credentials](https://onecli.sh/docs/self-hosting/app-credentials.md)

## Endpoints

| Endpoint | Method and path | What it does |
| - | - | - |
| [Start an organization-level OAuth connect](https://onecli.sh/docs/api-reference/organization-apps/start-an-organization-level-oauth-connect.md) | `GET /org/apps/{provider}/authorize` | Start an OAuth connect for an app at the organization level. |
| [Connect an app at the organization level](https://onecli.sh/docs/api-reference/organization-apps/connect-an-app-at-the-organization-level.md) | `POST /org/apps/{provider}/connect` | Connect an app at the organization level with a token or key, sharing the connection into every workspace without an OAuth redirect. |
| [Get the organization's AWS external ID](https://onecli.sh/docs/api-reference/organization-apps/get-the-organizations-aws-external-id.md) | `GET /org/apps/aws-external-id` | Get your organization's AWS external ID to place in the trust policy of the IAM role an AWS connection assumes. |
| [List organization-configured apps](https://onecli.sh/docs/api-reference/organization-apps/list-organization-configured-apps.md) | `GET /org/apps/configured` | List the apps that have an enabled organization-level OAuth client, so you know which providers use your own credentials. |
| [Get an organization app configuration](https://onecli.sh/docs/api-reference/organization-apps/get-an-organization-app-configuration.md) | `GET /org/apps/{provider}/config` | Get the organization-level OAuth client configuration for one app. |
| [Set an organization app configuration](https://onecli.sh/docs/api-reference/organization-apps/set-an-organization-app-configuration.md) | `POST /org/apps/{provider}/config` | Set your own OAuth client for an app at the organization level. |
| [Remove an organization app configuration](https://onecli.sh/docs/api-reference/organization-apps/remove-an-organization-app-configuration.md) | `DELETE /org/apps/{provider}/config` | Remove the organization-level OAuth client for an app. |
| [Enable or disable an organization app configuration](https://onecli.sh/docs/api-reference/organization-apps/enable-or-disable-an-organization-app-configuration.md) | `PATCH /org/apps/{provider}/config/toggle` | Enable or disable the organization OAuth client for an app without deleting it. |
| [Get an app's organization blocklist state](https://onecli.sh/docs/api-reference/organization-apps/get-an-apps-organization-blocklist-state.md) | `GET /org/apps/{provider}/blocklist` | Get an app's organization blocklist state, showing which of its hosts are blocked for agents in every workspace of your organization. |
| [Block one of an app's hosts organization-wide](https://onecli.sh/docs/api-reference/organization-apps/block-one-of-an-apps-hosts-organization-wide.md) | `POST /org/apps/{provider}/blocklist` | Block one of an app's hosts across the organization. |
| [Enable or disable an organization blocklist entry](https://onecli.sh/docs/api-reference/organization-apps/enable-or-disable-an-organization-blocklist-entry.md) | `PATCH /org/apps/{provider}/blocklist/{ruleId}` | Enable or disable an organization blocklist entry for an app host without removing it, so you can pause or restore a block quickly. |
| [Remove an organization blocklist entry](https://onecli.sh/docs/api-reference/organization-apps/remove-an-organization-blocklist-entry.md) | `DELETE /org/apps/{provider}/blocklist/{ruleId}` | Remove an organization blocklist entry so the app host is no longer blocked across workspaces, unless another rule still blocks it. |

## Next steps

* [API overview](https://onecli.sh/docs/api-reference.md): base URLs, authentication, and pagination
* [Errors](https://onecli.sh/docs/api-reference/errors.md): status codes and the error format
* [Editions](https://onecli.sh/docs/api-reference/editions.md): which endpoints each edition serves


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.