| Start an organization-level OAuth connect | GET /org/apps/{provider}/authorize | Start an OAuth connect for an app at the organization level. |
| Connect an app at the organization level | POST /org/apps/{provider}/connect | Connect an app at the organization level with a token or key, sharing the connection into every workspace without an OAuth redirect. |
| Get the organization’s AWS external ID | GET /org/apps/aws-external-id | Get your organization’s AWS external ID to place in the trust policy of the IAM role an AWS connection assumes. |
| List organization-configured apps | GET /org/apps/configured | List the apps that have an enabled organization-level OAuth client, so you know which providers use your own credentials. |
| Get an organization app configuration | GET /org/apps/{provider}/config | Get the organization-level OAuth client configuration for one app. |
| Set an organization app configuration | POST /org/apps/{provider}/config | Set your own OAuth client for an app at the organization level. |
| Remove an organization app configuration | DELETE /org/apps/{provider}/config | Remove the organization-level OAuth client for an app. |
| Enable or disable an organization app configuration | PATCH /org/apps/{provider}/config/toggle | Enable or disable the organization OAuth client for an app without deleting it. |
| Get an app’s organization blocklist state | GET /org/apps/{provider}/blocklist | Get an app’s organization blocklist state, showing which of its hosts are blocked for agents in every workspace of your organization. |
| Block one of an app’s hosts organization-wide | POST /org/apps/{provider}/blocklist | Block one of an app’s hosts across the organization. |
| Enable or disable an organization blocklist entry | PATCH /org/apps/{provider}/blocklist/{ruleId} | Enable or disable an organization blocklist entry for an app host without removing it, so you can pause or restore a block quickly. |
| Remove an organization blocklist entry | DELETE /org/apps/{provider}/blocklist/{ruleId} | Remove an organization blocklist entry so the app host is no longer blocked across workspaces, unless another rule still blocks it. |
