Adobe Experience Cloud · OAuth Scopes

Adobe Experience Cloud OAuth Scopes

OAuth 2.0 probed

Adobe Experience Cloud uses OAuth 2.0 but publishes no discrete scopes — access is governed by the grant itself (e.g. client-credentials or role-based authorization) rather than per-scope consent.

This index is generated from the provider’s OpenAPI security definitions (and, where available, its documented scope reference) and refreshes on every APIs.io network build. Browse every provider’s scopes at scopes.apis.io.

AnalyticsCustomer ExperienceDigital MarketingPersonalizationCampaign ManagementJourney Orchestration
Scopes: 0 Flows: Method: probed

Scopes (0)

Adobe Experience Cloud implements OAuth 2.0 but publishes no discrete scopes — access is governed by the grant itself (client-credentials or role-based authorization) rather than per-scope consent.

The OpenAPI contracts in this repo declare NO oauth2 securityScheme — they declare http/bearer plus an apiKey header — so derive-oauth-scopes.py produced nothing. Every scope below therefore comes from a live discovery document, not from the spec. That is the stronger evidence, and it is why this artifact is method: probed rather than derived.

📄 Provider scope reference: https://developer.adobe.com/developer-console/docs/guides/authentication/

Source

OAuth Scopes

Raw ↑ 
generated: '2026-08-13'
method: probed
source: https://oauth.adobeaemcloud.com/.well-known/oauth-authorization-server,
  https://aa-mcp.adobe.io/.well-known/oauth-authorization-server,
  https://cja-mcp.adobe.io/.well-known/oauth-authorization-server,
  https://ims-na1.adobelogin.com/.well-known/openid-configuration — all fetched
  unauthenticated on 2026-08-13
docs: https://developer.adobe.com/developer-console/docs/guides/authentication/
description: >-
  OAuth scopes Adobe Experience Cloud actually advertises, read from live RFC 8414 /
  OpenID Connect discovery documents rather than from prose. Three authorization servers
  publish scopes_supported: Adobe IMS itself (the base identity scopes), the AEM MCP
  authorization server (the only place Adobe publishes fine-grained product scopes), and
  the Adobe Analytics / CJA MCP servers (which reuse the IMS base plus a product-context
  scope).
note: >-
  The OpenAPI contracts in this repo declare NO oauth2 securityScheme — they declare
  http/bearer plus an apiKey header — so derive-oauth-scopes.py produced nothing. Every
  scope below therefore comes from a live discovery document, not from the spec. That is
  the stronger evidence, and it is why this artifact is method: probed rather than derived.
summary:
  authorization_servers: 4
  distinct_scopes: 15
  product_scopes: 8
  pkce: S256
  dynamic_client_registration: true
authorization_servers:
  - name: Adobe IMS
    issuer: https://ims-na1.adobelogin.com
    discovery: https://ims-na1.adobelogin.com/.well-known/openid-configuration
    http_status: 200
    authorization_endpoint: https://ims-na1.adobelogin.com/ims/authorize/v2
    token_endpoint: https://ims-na1.adobelogin.com/ims/token/v3
    jwks_uri: https://ims-na1.adobelogin.com/ims/keys
    scopes:
      - openid
      - email
      - profile
  - name: AEM Cloud Service OAuth (fronts the AEM MCP servers)
    issuer: https://oauth.adobeaemcloud.com
    discovery: https://oauth.adobeaemcloud.com/.well-known/oauth-authorization-server
    http_status: 200
    authorization_endpoint: https://oauth.adobeaemcloud.com/oauth/authorize
    token_endpoint: https://oauth.adobeaemcloud.com/oauth/token
    revocation_endpoint: https://oauth.adobeaemcloud.com/oauth/revoke
    registration_endpoint: https://oauth.adobeaemcloud.com/register
    jwks_uri: https://oauth.adobeaemcloud.com/jwks
    grant_types:
      - authorization_code
      - refresh_token
    pkce: S256
    token_endpoint_auth_methods:
      - client_secret_post
  - name: Adobe Analytics MCP
    issuer: https://aa-mcp.adobe.io
    discovery: https://aa-mcp.adobe.io/.well-known/oauth-authorization-server
    http_status: 200
    registration_endpoint: https://aa-mcp.adobe.io/register
    delegates_to: https://ims-na1.adobelogin.com
    token_endpoint_auth_methods:
      - none
    pkce: S256
  - name: Adobe Customer Journey Analytics MCP
    issuer: https://cja-mcp.adobe.io
    discovery: https://cja-mcp.adobe.io/.well-known/oauth-authorization-server
    http_status: 200
    registration_endpoint: https://cja-mcp.adobe.io/register
    delegates_to: https://ims-na1.adobelogin.com
    pkce: S256
scopes:
  - name: openid
    kind: identity
    servers:
      - ims
      - aem
      - aa-mcp
      - cja-mcp
    description: OpenID Connect base scope.
  - name: email
    kind: identity
    servers:
      - ims
    description: Release the authenticated user's email address.
  - name: profile
    kind: identity
    servers:
      - ims
    description: Release the authenticated user's profile claims.
  - name: AdobeID
    kind: identity
    servers:
      - aem
      - aa-mcp
      - cja-mcp
    description: Adobe ID identity scope — the base scope for every Adobe API call.
  - name: read_organizations
    kind: identity
    servers:
      - aem
    description: Read the IMS organizations the user belongs to.
  - name: additional_info
    kind: identity
    servers:
      - aem
    description: Additional IMS profile information.
  - name: additional_info.ownerOrg
    kind: identity
    servers:
      - aem
    description: The owning IMS organization of the authenticated identity.
  - name: additional_info.projectedProductContext
    kind: entitlement
    servers:
      - aem
      - aa-mcp
      - cja-mcp
    description: >-
      The user's projected product entitlements. This is the scope that carries Experience
      Cloud product authorization — it is what turns an authenticated Adobe ID into an
      identity that may call Analytics or CJA.
  - name: aem.sites
    kind: product
    product: Adobe Experience Manager
    servers:
      - aem
    description: AEM Sites — pages and site content.
  - name: aem.assets.author
    kind: product
    product: Adobe Experience Manager Assets
    servers:
      - aem
    description: Author-tier access to AEM Assets.
  - name: aem.assets.delivery
    kind: product
    product: Adobe Experience Manager Assets
    servers:
      - aem
    description: Delivery-tier access to AEM Assets.
  - name: aem.fragments.management
    kind: product
    product: Adobe Experience Manager
    servers:
      - aem
    description: Content fragment management — create, read, patch fragments and models.
  - name: aem.folders
    kind: product
    product: Adobe Experience Manager
    servers:
      - aem
    description: Folder operations.
  - name: aem.repository
    kind: product
    product: Adobe Experience Manager
    servers:
      - aem
    description: Repository-level access.
  - name: aem.contentai
    kind: product
    product: Adobe Experience Manager Content AI
    servers:
      - aem
    description: Content AI indexes — keyword, semantic, hybrid and natural-language search.
  - name: aem.adobe.experimental
    kind: product
    product: Adobe Experience Manager
    servers:
      - aem
    description: Experimental AEM capabilities.
gaps:
  - >-
    Analytics, Target, Campaign, Journey Optimizer and Experience Platform publish no
    fine-grained OAuth scopes. Authorization for those products is granted out-of-band as
    product profiles in the Adobe Admin Console and surfaces to the token only as
    additional_info.projectedProductContext. An agent cannot request least-privilege access
    to Adobe Analytics the way it can to AEM Sites.
  - >-
    The OpenAPI contracts declare bearer + apiKey rather than an oauth2 flow, so the scopes
    above are invisible to any tool that reads only the spec.