The scopes collection at apis.io/scopes/ carries 1,747 provider scope documents describing 14,172 individual OAuth scopes — every named permission a provider will grant, enumerated rather than described.
Each entry captures the authorization and token URLs, the supported flows, the schemes, and the full scope list. It also records method — whether the scopes were found in a provider’s documentation or derived from its specifications — so you can tell published fact from inference.
Who enumerates the most
| Provider | Scopes |
|---|---|
| Zoom Phone | 435 |
| Atlassian | 288 |
| Auth0 | 221 |
| MEF | 218 |
| Arthur AI | 191 |
| Infobip | 159 |
| Emarsys | 156 |
Zoom Phone at 435 scopes is the outlier, and it is instructive. Telephony has genuinely fine-grained permissions — read a call log, modify a routing rule, access a recording, manage a device — and each is a distinct authorization decision with a distinct compliance consequence. That granularity is a feature, not sprawl.
Atlassian at 288 reflects the opposite pressure: many products (Jira, Confluence, Bitbucket) under one identity system, each contributing its own permission vocabulary.
Why this is the artifact that matters for agents
Yesterday’s authentication piece found 1,338 providers carrying the auth tag against an aggregate score of 35.8 — the most-implemented, least-described capability in the catalog. Scopes are the concrete remedy.
“We use OAuth 2.0” tells an integrator nothing actionable. A list of 435 named scopes tells them exactly which permission to request for the operation they intend to perform — and, just as importantly, which ones they should not request.
For agents this is the difference between usable and dangerous. An autonomous agent authorizing against an API needs to request least privilege, and least privilege is not computable from prose. It requires an enumerated permission vocabulary. 14,172 scopes across 1,747 providers is the machine-readable authorization layer, and against a catalog of more than 25,000 providers it is thin.
The flows field
Each document records supported flows — clientCredentials, authorizationCode, and the rest. That field answers a question that trips up most integrations early: is this an API a service can call on its own behalf, or does it require a human to approve a delegation?
An agent operating unattended can only use the former. Recording the flow makes that determinable before a single request is sent.
Takeaway
1,747 scope documents, 14,172 enumerated permissions, with flows and endpoints attached and provenance recorded. This is what closing the authentication gap actually looks like — not better prose about OAuth, but the permission vocabulary written down.
Browse it at apis.io/scopes/.