Access listing and revocation require owner/admin membership. Creation validates requested scopes against the human’s current permission ceiling and every selected project. It cannot grant access the creator lacks.
pendingClientsStatus is available or unavailable. When available, pendingClients lists up to ten recent verified OAuth client requests belonging to the signed-in human, filtered to the configured issuer and resource. Each record has a fixed 24-hour review window from its first request. An active grant in the selected workspace hides its pending record; revocation can expose the same recent record again. Unavailable does not mean there are no requests. These identity records contain no tokens and grant no access: review still requires explicit client, workspace, scope and project choices through the existing human approval flow.
API credential input
name is a nonempty string of up to 100 characters. scopes must contain supported scopes within current access. projectIds is null for unrestricted project access or an array of 1 to 100 project IDs in this workspace. Project-restricted access cannot request projects:write. expiresInDays is an integer from 1 to 90, default 30.
The response contains id, token, name, scopes, projectIds and expires_at. The full token is returned once. Access listings expose metadata such as prefix, scopes_json, project_ids_json, created_at, expires_at and revoked_at; they do not recover a token.
For normal cloud work, use the HTTP command interface. Members, invitations and access changes have shared command pages. Creating an invitation does not authorize sending an email automatically.
Check the selected environment and workspace access before calling hosted operations. See capability status.