Acrisure · OAuth Scopes

Acrisure OAuth Scopes

OAuth 2.0 probed

Acrisure publishes 2 OAuth 2.0 scopes via the authorizationCode flow. Scopes are the fine-grained permissions an application requests at authorization time to act against the Acrisure API on a user’s behalf.

Tokens are issued from https://api.acrisure.com/oauth/token.

This index is generated from the provider’s OpenAPI security definitions (and, where available, its documented scope reference) and refreshes on every APIs.io network build. Browse every provider’s scopes at scopes.apis.io.

insuranceinsurance-brokeragefintechemployee-benefitspayroll-hrreinsurancerisk-managementcybersecuritymortgagesurety-bondsmcpoauth2

Scopes: 2 Flows: authorizationCode Method: probed

OAuth endpoints

Authorization URL
https://api.acrisure.com/oauth/authorize

Token URL
https://api.acrisure.com/oauth/token

Flows
authorizationCode

Scopes (2)

Scope	Description	Flows
api://bc250bc0-7689-4f21-b164-72a6b57c273b/mcp_user	Microsoft Entra ID application scope granting a user-delegated session against the Acrisure MCP server at https://api.acrisure.com/v1/mcp. Description inferred from the scope name; Acrisure publishes no scope reference.	authorizationCode
offline_access	Standard OIDC scope. Permits issuance of a refresh token so an agent session can outlive the initial access token.	authorizationCode

📄 Provider scope reference:

Source

OAuth Scopes

generated: '2026-08-06'
method: probed
source: https://api.acrisure.com/.well-known/oauth-authorization-server
docs: null
docs_note: >-
  Acrisure publishes no scopes or permissions reference page. Every scope below is verbatim
  from the `scopes_supported` array of the RFC 8414 authorization-server metadata; the
  descriptions are our reading of the scope names, not Acrisure text.
schemes:
- name: AcrisureOAuth2
  source: https://api.acrisure.com/.well-known/oauth-authorization-server
  issuer: https://api.acrisure.com
  flows:
  - flow: authorizationCode
    authorizationUrl: https://api.acrisure.com/oauth/authorize
    tokenUrl: https://api.acrisure.com/oauth/token
scopes:
- scope: api://bc250bc0-7689-4f21-b164-72a6b57c273b/mcp_user
  description: >-
    Microsoft Entra ID application scope granting a user-delegated session against the
    Acrisure MCP server at https://api.acrisure.com/v1/mcp. Description inferred from the
    scope name; Acrisure publishes no scope reference.
  flows:
  - authorizationCode
  sources:
  - https://api.acrisure.com/.well-known/oauth-authorization-server
  resource_app_id: bc250bc0-7689-4f21-b164-72a6b57c273b
  protects: https://api.acrisure.com/v1/mcp
- scope: offline_access
  description: >-
    Standard OIDC scope. Permits issuance of a refresh token so an agent session can
    outlive the initial access token.
  flows:
  - authorizationCode
  sources:
  - https://api.acrisure.com/.well-known/oauth-authorization-server
  standard: true
summary:
  scope_count: 2
  provider_specific_scopes: 1
  standard_scopes: 1
  granularity: coarse
  granularity_note: >-
    A single provider-specific scope covers the entire MCP surface. There is no
    read/write split, no per-resource scope, and no least-privilege gradation, so any
    agent granted `mcp_user` receives whatever the full tool set can do.
x-evidence:
  fetched: '2026-08-06'
  url: https://api.acrisure.com/.well-known/oauth-authorization-server
  http_status: 200
  content_type: application/json