diff --git a/full/src/main/java/de/ids_mannheim/korap/oauth2/dao/OAuth2ClientDao.java b/full/src/main/java/de/ids_mannheim/korap/oauth2/dao/OAuth2ClientDao.java
index 989deb2..c528e86 100644
--- a/full/src/main/java/de/ids_mannheim/korap/oauth2/dao/OAuth2ClientDao.java
+++ b/full/src/main/java/de/ids_mannheim/korap/oauth2/dao/OAuth2ClientDao.java
@@ -23,6 +23,7 @@
 
 import de.ids_mannheim.korap.config.Attributes;
 import de.ids_mannheim.korap.config.FullConfiguration;
+import de.ids_mannheim.korap.dao.AdminDao;
 import de.ids_mannheim.korap.exceptions.KustvaktException;
 import de.ids_mannheim.korap.exceptions.StatusCodes;
 import de.ids_mannheim.korap.oauth2.constant.OAuth2ClientType;
@@ -48,6 +49,8 @@
     private EntityManager entityManager;
     @Autowired
     private FullConfiguration config;
+    @Autowired
+    private AdminDao adminDao;
 
     public void registerClient (String id, String secretHashcode, String name,
             OAuth2ClientType type, String url, String redirectURI,
@@ -194,4 +197,25 @@
         return q.getResultList();
     }
 
+    public List<OAuth2Client> retrievePlugins (boolean isPermittedOnly)
+            throws KustvaktException {
+        CriteriaBuilder builder = entityManager.getCriteriaBuilder();
+        CriteriaQuery<OAuth2Client> query =
+                builder.createQuery(OAuth2Client.class);
+
+        Root<OAuth2Client> client = query.from(OAuth2Client.class);
+        Predicate restrictions =
+                builder.isNotNull(client.get(OAuth2Client_.SOURCE));
+        if (isPermittedOnly) {
+            restrictions = builder.and(restrictions,
+                    builder.isTrue(client.get(OAuth2Client_.IS_PERMITTED)));
+        }
+
+        query.select(client);
+        query.where(restrictions);
+        query.distinct(true);
+        TypedQuery<OAuth2Client> q = entityManager.createQuery(query);
+        return q.getResultList();
+    }
+
 }
diff --git a/full/src/main/java/de/ids_mannheim/korap/oauth2/service/OAuth2ClientService.java b/full/src/main/java/de/ids_mannheim/korap/oauth2/service/OAuth2ClientService.java
index f013023..45dbd6b 100644
--- a/full/src/main/java/de/ids_mannheim/korap/oauth2/service/OAuth2ClientService.java
+++ b/full/src/main/java/de/ids_mannheim/korap/oauth2/service/OAuth2ClientService.java
@@ -367,6 +367,15 @@
         return createClientDtos(userClients);
     }
     
+       
+    public List<OAuth2UserClientDto> listPlugins (boolean isPermitted)
+            throws KustvaktException {
+
+        List<OAuth2Client> plugins = clientDao.retrievePlugins(isPermitted);
+        Collections.sort(plugins);
+        return createClientDtos(plugins);
+    }
+
     private List<OAuth2UserClientDto> createClientDtos (
             List<OAuth2Client> userClients) throws KustvaktException {
         List<OAuth2UserClientDto> dtoList = new ArrayList<>(userClients.size());
@@ -391,4 +400,6 @@
                     OAuth2Error.UNAUTHORIZED_CLIENT);
         }
     }
+
+    
 }
diff --git a/full/src/main/java/de/ids_mannheim/korap/web/controller/OAuthClientController.java b/full/src/main/java/de/ids_mannheim/korap/web/controller/OAuthClientController.java
index 63499cf..ee2a46e 100644
--- a/full/src/main/java/de/ids_mannheim/korap/web/controller/OAuthClientController.java
+++ b/full/src/main/java/de/ids_mannheim/korap/web/controller/OAuthClientController.java
@@ -206,7 +206,7 @@
     @Path("/list")
     @Consumes(MediaType.APPLICATION_FORM_URLENCODED)
     @Produces(MediaType.APPLICATION_JSON + ";charset=utf-8")
-    public List<OAuth2UserClientDto> listUserAuthorizedClients (
+    public List<OAuth2UserClientDto> listUserClients (
             @Context SecurityContext context,
             @FormParam("super_client_id") String superClientId,
             @FormParam("super_client_secret") String superClientSecret,
@@ -231,4 +231,28 @@
             throw responseHandler.throwit(e);
         }
     }
+    
+    @POST
+    @Path("/plugins")
+    @Consumes(MediaType.APPLICATION_FORM_URLENCODED)
+    @Produces(MediaType.APPLICATION_JSON + ";charset=utf-8")
+    public List<OAuth2UserClientDto> listPlugins (
+            @Context SecurityContext context,
+            @FormParam("super_client_id") String superClientId,
+            @FormParam("super_client_secret") String superClientSecret,
+            @FormParam("permitted_only") boolean permittedOnly) {
+
+        TokenContext tokenContext = (TokenContext) context.getUserPrincipal();
+
+        try {
+            scopeService.verifyScope(tokenContext,
+                    OAuth2Scope.LIST_USER_CLIENT);
+
+            clientService.verifySuperClient(superClientId, superClientSecret);
+            return clientService.listPlugins(permittedOnly);
+        }
+        catch (KustvaktException e) {
+            throw responseHandler.throwit(e);
+        }
+    }
 }
diff --git a/full/src/main/resources/db/test/V3.5__insert_oauth2_clients.sql b/full/src/main/resources/db/test/V3.5__insert_oauth2_clients.sql
index 159c713..4e803d2 100644
--- a/full/src/main/resources/db/test/V3.5__insert_oauth2_clients.sql
+++ b/full/src/main/resources/db/test/V3.5__insert_oauth2_clients.sql
@@ -25,28 +25,28 @@
 
 INSERT INTO oauth2_client(id,name,secret,type,super,
   registered_by, description,url, registration_date, 
-  is_permitted) 
+  is_permitted,source) 
 VALUES ("52atrL0ajex_3_5imd9Mgw","confidential client 2",
   "$2a$08$vi1FbuN3p6GcI1tSxMAoeuIYL8Yw3j6A8wJthaN8ZboVnrQaTwLPq",
   "CONFIDENTIAL", 0,"system",
   "This is a test nonsuper confidential client.",
-  "http://example.client.de", CURRENT_TIMESTAMP, 1);
+  "http://example.client.de", CURRENT_TIMESTAMP, 1,'{"key":"value"}');
 
 INSERT INTO oauth2_client(id,name,secret,type,super,
   redirect_uri, registered_by, description, url, registration_date, 
-  is_permitted)
-VALUES ("8bIDtZnH6NvRkW2Fq","third party client",null,
-  "PUBLIC", 0,
+  is_permitted,source)
+VALUES ("8bIDtZnH6NvRkW2Fq","public client plugin with redirect uri",
+  null, "PUBLIC", 0,
   "https://third.party.client.com/redirect","system",
-  "This is a test public client.",
-  "http://third.party.client.com", CURRENT_TIMESTAMP,1);
+  "A public client that is a plugin with registered redirect URI",
+  "http://third.party.client.com", CURRENT_TIMESTAMP,1,'{"key":"value"}');
 
   
 INSERT INTO oauth2_client(id,name,secret,type,super,
   registered_by, description, url, registration_date, 
   is_permitted) 
 VALUES ("nW5qM63Rb2a7KdT9L","test public client",null,
-  "PUBLIC", 0, "https://korap.ids-mannheim.de/public/redirect",
+  "PUBLIC", 0, "without redirect uri",
   "system", "http://korap.ids-mannheim.de/public", 
   CURRENT_TIMESTAMP, 1);