> ## Documentation Index > Fetch the complete documentation index at: https://docs.2501.ai/llms.txt > Use this file to discover all available pages before exploring further. # Read the OAuth account status of a plugin for an organization > Reads an OAuth plugin's account for one organization, never any token. An organization plugin answers for its own organization; a tenant-wide plugin needs org_id. Nothing renews an expired access token in the background: see renewable. ## OpenAPI ````yaml /0.18/openapi.json get /api/v1/plugins/{id}/oauth openapi: 3.0.3 info: title: 2501 Public API version: v1 description: >- The stable, versioned HTTP API for driving 2501 as code. See the API Overview for authentication, the org_id rule, cursor pagination, and the error envelope. servers: - url: https://{command_center_host} variables: command_center_host: default: your-command-center-host description: Your Command Center host security: - bearerAuth: [] paths: /api/v1/plugins/{id}/oauth: get: tags: - Plugins summary: Read the OAuth account status of a plugin for an organization description: >- Reads an OAuth plugin's account for one organization, never any token. An organization plugin answers for its own organization; a tenant-wide plugin needs org_id. Nothing renews an expired access token in the background: see renewable. parameters: - schema: type: string required: true name: id in: path - schema: type: string description: >- Required for a tenant-wide plugin; an organization plugin answers for its own organization. required: false name: org_id in: query description: >- Required for a tenant-wide plugin; an organization plugin answers for its own organization. responses: '200': description: >- Connected account expiry and scopes, or null, and the trusted authorization server content: application/json: schema: type: object properties: authorization: type: object nullable: true properties: account_name: type: string nullable: true description: >- Who the account signs in as: the provider's user name, email or subject, or a service account's client id. Null when the provider did not say. expires_at: type: string nullable: true format: date-time description: >- Null when the provider did not say: the token serves until a server refuses it. scopes: type: array items: type: string description: The scopes the account was granted. missing_scopes: type: array items: type: string description: >- Scopes the server refused a request for, which reconnecting asks for. renewal_failed_at: type: string nullable: true format: date-time description: When the last renewal failed; null when it did not. renewal_failure_reason: type: string nullable: true enum: - provider_refused - provider_unreachable - invalid_token_response - issuer_changed - refresh_token_missing - client_secret_unavailable - internal_error - client_rejected - issuer_untrusted - provider_private - configuration_invalid - provider_unsupported - client_key_unusable - null description: >- Why the last renewal failed; null when it did not. The account is kept, and only reconnecting brings it back. missing_scopes_outside_plugin: type: array items: type: string description: >- Missing scopes the plugin's own scope list leaves out: reconnecting does not ask for them until they are added to it. renewable: type: boolean description: >- Whether an expired access token is renewed at the next use: the provider gave a refresh token, or the plugin signs in as a service account. Otherwise only reconnecting brings the account back. required: - account_name - expires_at - scopes - missing_scopes - renewal_failed_at - renewal_failure_reason - missing_scopes_outside_plugin - renewable description: >- The account connected for the organization; null when none is. problem: type: string nullable: true description: >- What stops the plugin from using an account, such as a client secret the organization cannot read, and what to do about it. problem_reason: type: string nullable: true enum: - client_secret_unavailable - null description: The reason behind problem, for a client that acts on it. trusted_issuer: type: string nullable: true description: >- The authorization server the plugin sends secrets and tokens to; null until one is trusted. required: - authorization - problem - problem_reason - trusted_issuer '400': description: >- Bad request - a field is missing, malformed, or not allowed (VALIDATION_FAILED, BAD_REQUEST, INVALID_CURSOR) content: application/json: schema: $ref: '#/components/schemas/Error' '401': description: >- No credentials, or a key that is invalid, revoked, or expired (UNAUTHORIZED) content: application/json: schema: $ref: '#/components/schemas/Error' '403': description: >- Authenticated but not allowed (FORBIDDEN, ORG_ACCESS_DENIED, STEP_UP_REFUSED, TWO_FACTOR_ENROLLMENT_REQUIRED, LICENSE_CAP_REACHED, LICENSE_EXPIRED) content: application/json: schema: $ref: '#/components/schemas/Error' '404': description: No such row that this caller can see (NOT_FOUND) content: application/json: schema: $ref: '#/components/schemas/Error' components: schemas: Error: type: object properties: code: type: string example: VALIDATION_FAILED message: type: string example: Validation failed request_id: type: string example: req_3702b7e7-... field: type: string description: Set when one input is at fault errors: type: array items: type: object properties: field: type: string message: type: string required: - field - message description: Set when several inputs are at fault details: type: object additionalProperties: nullable: true required: - code - message - request_id securitySchemes: bearerAuth: type: http scheme: bearer description: >- An API key minted in Command Center (Settings -> API Keys), sent as `Authorization: Bearer 2501_ak_...`. A Command Center session cookie is also accepted. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.