OAuthGrant

Authorization granted by an account to an OAuth application. Deleting it signs the application out.

This object can be configured from the WebUI under Account › Credentials › Connected Applications

Fields

`accountId`

Type: Id<Account> · read-only

Identifier for the account that granted the authorization

`clientId`

Type: String · server-set

Identifier of the OAuth client that received the authorization

`clientName`

Type: String? · server-set

Name of the application, as provided by the client or its administrator

`clientKind`

Type: OAuthClientKind · server-set

How the application was registered. Dynamically registered applications and Client ID Metadata Documents are not verified by an administrator.

`scopes`

Type: Set<OAuthScope> · server-set

Services the application was given access to. First-party applications have full access to the account.

`remoteIp`

Type: IpAddr? · server-set

IP address from which the authorization was granted

`createdAt`

Type: UTCDateTime · server-set

Date the authorization was granted

`lastUsedAt`

Type: UTCDateTime · server-set

Date the application last renewed its access

JMAP API

The OAuthGrant object is available via the urn:stalwart:jmap capability.

`x:OAuthGrant/get`

This is a standard Foo/get method as defined in RFC 8620, Section 5.1.

This method requires the sysOAuthGrantGet permission.

curl -X POST https://mail.example.com/jmap/ \
  -H 'Authorization: Bearer $TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{
      "methodCalls": [
        [
          "x:OAuthGrant/get",
          {
            "ids": [
              "id1"
            ]
          },
          "c1"
        ]
      ],
      "using": [
        "urn:ietf:params:jmap:core",
        "urn:stalwart:jmap"
      ]
    }'

`x:OAuthGrant/set`

This is a standard Foo/set method as defined in RFC 8620, Section 5.3.

Supports the destroy operation only.

This method requires the sysOAuthGrantDestroy permission.

curl -X POST https://mail.example.com/jmap/ \
  -H 'Authorization: Bearer $TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{
      "methodCalls": [
        [
          "x:OAuthGrant/set",
          {
            "destroy": [
              "id1"
            ]
          },
          "c1"
        ]
      ],
      "using": [
        "urn:ietf:params:jmap:core",
        "urn:stalwart:jmap"
      ]
    }'

`x:OAuthGrant/query`

This is a standard Foo/query method as defined in RFC 8620, Section 5.5.

This method requires the sysOAuthGrantQuery permission.

curl -X POST https://mail.example.com/jmap/ \
  -H 'Authorization: Bearer $TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{
      "methodCalls": [
        [
          "x:OAuthGrant/query",
          {
            "filter": {
              "accountId": "id1"
            }
          },
          "c1"
        ]
      ],
      "using": [
        "urn:ietf:params:jmap:core",
        "urn:stalwart:jmap"
      ]
    }'

The x:OAuthGrant/query filter argument accepts the following conditions (combinable with AnyOf / AllOf / Not per RFC 8620):

Condition	Kind
`accountId`	id of Account

CLI

stalwart-cli wraps the same JMAP calls. See the CLI reference for installation, authentication, and general usage.

Fetch

stalwart-cli get OAuthGrant id1

Query

stalwart-cli query OAuthGrant
stalwart-cli query OAuthGrant --where accountId=id1

Delete

stalwart-cli delete OAuthGrant --ids id1

Enums

OAuthClientKind

Value	Label
`registered`	Registered by an administrator
`dynamic`	Registered dynamically (unverified)
`metadataDocument`	Client ID Metadata Document (unverified)
`firstParty`	Web application of this server

OAuthScope

Value	Label
`mail`	Mail (IMAP, POP3, SMTP submission, ManageSieve, JMAP Mail)
`contacts`	Contacts (CardDAV, JMAP Contacts)
`calendars`	Calendars (CalDAV, JMAP Calendars)
`files`	Files (WebDAV, JMAP File Storage)