Edit

Share via

oAuth2PermissionGrant resource type

  • Article

Namespace: microsoft.graph

Important

APIs under the /beta version in Microsoft Graph are subject to change. Use of these APIs in production applications is not supported. To determine whether an API is available in v1.0, use the Version selector.

Represents the delegated permissions that have been granted to an application's service principal.

Delegated permissions grants can be created as a result of a user consenting to an application's request to access an API, or created directly.

Delegated permissions are sometimes referred to as "OAuth 2.0 scopes" or "scopes".

Methods

Method Return Type Description
List oAuth2PermissionGrant collection Retrieve a list of delegated permission grants.
Create oAuth2PermissionGrant Create a delegated permission grant.
Get oAuth2PermissionGrant Read a single delegated permission grant.
Update None Update oAuth2PermissionGrant object.
Delete None Delete a delegated permission grant.
Get delta oAuth2PermissionGrant collection Get newly created, updated, or deleted oauth2permissiongrant objects without performing a full read of the entire resource collection.

Properties

Property Type Description
clientId String The object id (not appId) of the client service principal for the application that is authorized to act on behalf of a signed-in user when accessing an API. Required. Supports $filter (eq only).
consentType String Indicates whether authorization is granted for the client application to impersonate all users or only a specific user. AllPrincipals indicates authorization to impersonate all users. Principal indicates authorization to impersonate a specific user. Consent on behalf of all users can be granted by an administrator. Nonadmin users may be authorized to consent on behalf of themselves in some cases, for some delegated permissions. Required. Supports $filter (eq only).
expiryTime DateTimeOffset Currently, the end time value is ignored, but a value is required when creating an oAuth2PermissionGrant. Required.
id String Unique identifier for the oAuth2PermissionGrant. Read-only.
principalId String The id of the user on behalf of whom the client is authorized to access the resource, when consentType is Principal. If consentType is AllPrincipals this value is null. Required when consentType is Principal. Supports $filter (eq only).
resourceId String The id of the resource service principal to which access is authorized. This identifies the API that the client is authorized to attempt to call on behalf of a signed-in user. Supports $filter (eq only).
scope String A space-separated list of the claim values for delegated permissions that should be included in access tokens for the resource application (the API). For example, openid User.Read GroupMember.Read.All. Each claim value should match the value field of one of the delegated permissions defined by the API, listed in the publishedPermissionScopes property of the resource service principal. Must not exceed 3850 characters in length.
startTime DateTimeOffset Currently, the start time value is ignored, but a value is required when creating an oAuth2PermissionGrant. Required.

Relationships

None.

JSON representation

The following JSON representation shows the resource type.

{
  "clientId": "String",
  "consentType": "String",
  "expiryTime": "String (timestamp)",
  "id": "String (identifier)",
  "principalId": "String",
  "resourceId": "String",
  "scope": "String",
  "startTime": "String (timestamp)"
}

Related content