> ## Documentation Index > Fetch the complete documentation index at: https://docs.orbit.devotel.io/llms.txt > Use this file to discover all available pages before exploring further. # Download the OAuth app-registration manifest > Returns the deterministic OAuth 2.0 client-registration manifest (RFC 7591-shaped) for building a marketplace app, pre-wired to your API host with the standard authorization-code + PKCE flow metadata and the full grantable-scope catalog. Fill in the client name, redirect URIs, and scope, then submit it to register an app customers install with a scoped grant instead of a full-access API key. Sent as a downloadable attachment (`orbit-.oauth-app.json`) that embeds no credential. Requires an authenticated owner, admin, or developer session. ## OpenAPI ````yaml /openapi.yaml get /api/v1/developers/oauth/manifest openapi: 3.1.0 info: title: Devotel CPaaS API description: Orbit by Devotel — Communications Platform as a Service API version: 1.0.0 contact: name: Devotel url: https://devotel.io email: support@devotel.io license: name: Proprietary servers: - url: https://api.orbit.devotel.io description: Production security: - Bearer: [] - ApiKey: [] tags: - name: Messages description: >- Send and manage messages across all channels (SMS, WhatsApp, RCS, Email, Viber, etc.) - name: Fax description: >- List and track fax (MMS/T.38) transmissions on Telnyx-backed fax numbers (sending flows through the Messaging API) - name: Agents description: AI agent creation, configuration, and execution - name: Voice description: Voice calls, IVR, conferencing, and SIP trunking - name: OnCall description: On-call rotations and escalation policy planning for incident alerting - name: Webhooks description: Webhook endpoint management and delivery logs - name: Numbers description: Phone number search, provisioning, and configuration - name: Brand Identity description: >- Unified cross-channel brand trust posture (10DLC, toll-free, WhatsApp, RCS, branded calling, number KYC) - name: Contacts description: Contact management, segmentation, and lifecycle tracking - name: Campaigns description: Marketing campaign orchestration and analytics - name: Flows description: Automation flow builder and execution engine - name: Templates description: Message template management and approval workflows - name: Settings description: Organization, channel, and user preference settings - name: Verify description: OTP generation and verification across channels - name: Push description: Push notification delivery via FCM and APNs - name: Integrations description: Third-party service connections and OAuth management - name: CDP description: >- Customer Data Platform — activation surface (CRM object sync, streaming destinations, ad-audience activation) - name: Files description: >- Server-to-server media upload, listing, retrieval, and deletion (signed-URL backed) - name: Commerce description: >- Omnichannel conversational-commerce — persistent cart + checkout state machine, channel-agnostic hosted pay-by-link, native WhatsApp checkout, and AP2-style agent payment mandates. - name: Sync description: >- Real-time shared-state primitive (Twilio Sync parity) — Documents, Maps, Lists, and ephemeral Streams, with change events relayed over the /api/v1/ws/sync WebSocket gateway - name: Risk description: >- Unified cross-channel Trust & Fraud risk scoring — fuses SMS-pumping, URL-reputation, Verify Fraud Guard, and Voice Biometrics signals into one composite verdict queryable before a send or a call. - name: Orby description: >- In-dashboard Orby operator assistant: streamed assistant turns, conversation threads, product knowledge-base search, and the tool-action approval gate. Available to signed-in operators only (dashboard session auth — API-key requests are rejected). paths: /api/v1/developers/oauth/manifest: get: tags: - Developer summary: Download the OAuth app-registration manifest description: >- Returns the deterministic OAuth 2.0 client-registration manifest (RFC 7591-shaped) for building a marketplace app, pre-wired to your API host with the standard authorization-code + PKCE flow metadata and the full grantable-scope catalog. Fill in the client name, redirect URIs, and scope, then submit it to register an app customers install with a scoped grant instead of a full-access API key. Sent as a downloadable attachment (`orbit-.oauth-app.json`) that embeds no credential. Requires an authenticated owner, admin, or developer session. responses: '200': description: >- The OAuth app-registration manifest, sent as a downloadable attachment. content: application/json: schema: type: object properties: schema: type: string enum: - orbit.oauth-app/v1 description: Manifest schema marker. appVersion: type: string description: App-definition semver. connectionLabel: type: string description: Human label for the tenant the manifest targets. authorization: type: object description: >- Authorization-code + PKCE flow metadata and the authorization/token/revocation endpoints under your host. client: type: object description: >- Placeholder client fields (name, redirect URIs, default scope, logo/homepage) the developer replaces. scopeCatalog: type: array description: The full grantable-scope catalog for the scope picker. items: type: object required: - schema - appVersion - authorization - client - scopeCatalog example: schema: orbit.oauth-app/v1 appVersion: 1.0.0 connectionLabel: Orbit (Acme Inc) authorization: grantTypes: - authorization_code - refresh_token responseTypes: - code tokenEndpointAuthMethods: - client_secret_basic - client_secret_post codeChallengeMethods: - S256 authorizationEndpoint: https://api.orbit.devotel.io/api/v1/oauth/authorize tokenEndpoint: https://api.orbit.devotel.io/api/v1/oauth/token revocationEndpoint: https://api.orbit.devotel.io/api/v1/oauth/revoke client: clientName: My Marketplace App redirectUris: - https://example.com/oauth/callback scope: messages:read contacts:read conversations:read logoUri: https://example.com/logo.png homepageUri: https://example.com scopeCatalog: - scope: messages:read resource: messages access: read label: Read messages consent: Read your SMS, MMS, WhatsApp and email message history. role: viewer components: securitySchemes: Bearer: type: http scheme: bearer bearerFormat: JWT description: Dashboard JWT token from Clerk ApiKey: type: apiKey name: X-API-Key in: header description: Server-to-server API key (dv_live_sk_*) ````