Adobe Experience Cloud OAuth Scopes

OAuth 2.0 probed

Adobe Experience Cloud publishes 16 OAuth 2.0 scopes. Scopes are the fine-grained permissions an application requests at authorization time to act against the Adobe Experience Cloud API on a user’s behalf.

This index is generated from the provider’s OpenAPI security definitions (and, where available, its documented scope reference) and refreshes on every APIs.io network build. Browse every provider’s scopes at scopes.apis.io.

AnalyticsCustomer ExperienceDigital MarketingPersonalizationCampaign ManagementJourney Orchestration

Scopes: 16 Flows: Method: probed

Scopes (16)

Scope	Description	Flows
openid	OpenID Connect base scope.
email	Release the authenticated user's email address.
profile	Release the authenticated user's profile claims.
AdobeID	Adobe ID identity scope — the base scope for every Adobe API call.
read_organizations	Read the IMS organizations the user belongs to.
additional_info	Additional IMS profile information.
additional_info.ownerOrg	The owning IMS organization of the authenticated identity.
additional_info.projectedProductContext	The user's projected product entitlements. This is the scope that carries Experience Cloud product authorization — it is what turns an authenticated Adobe ID into an identity that may call Analytics or CJA.
aem.sites	AEM Sites — pages and site content.
aem.assets.author	Author-tier access to AEM Assets.
aem.assets.delivery	Delivery-tier access to AEM Assets.
aem.fragments.management	Content fragment management — create, read, patch fragments and models.
aem.folders	Folder operations.
aem.repository	Repository-level access.
aem.contentai	Content AI indexes — keyword, semantic, hybrid and natural-language search.
aem.adobe.experimental	Experimental AEM capabilities.

📄 Provider scope reference: https://developer.adobe.com/developer-console/docs/guides/authentication/

Source

OAuth Scopes

generated: '2026-08-13'
method: probed
source: https://oauth.adobeaemcloud.com/.well-known/oauth-authorization-server,
  https://aa-mcp.adobe.io/.well-known/oauth-authorization-server,
  https://cja-mcp.adobe.io/.well-known/oauth-authorization-server,
  https://ims-na1.adobelogin.com/.well-known/openid-configuration — all fetched
  unauthenticated on 2026-08-13
docs: https://developer.adobe.com/developer-console/docs/guides/authentication/
description: >-
  OAuth scopes Adobe Experience Cloud actually advertises, read from live RFC 8414 /
  OpenID Connect discovery documents rather than from prose. Three authorization servers
  publish scopes_supported: Adobe IMS itself (the base identity scopes), the AEM MCP
  authorization server (the only place Adobe publishes fine-grained product scopes), and
  the Adobe Analytics / CJA MCP servers (which reuse the IMS base plus a product-context
  scope).
note: >-
  The OpenAPI contracts in this repo declare NO oauth2 securityScheme — they declare
  http/bearer plus an apiKey header — so derive-oauth-scopes.py produced nothing. Every
  scope below therefore comes from a live discovery document, not from the spec. That is
  the stronger evidence, and it is why this artifact is method: probed rather than derived.
summary:
  authorization_servers: 4
  distinct_scopes: 15
  product_scopes: 8
  pkce: S256
  dynamic_client_registration: true
authorization_servers:
  - name: Adobe IMS
    issuer: https://ims-na1.adobelogin.com
    discovery: https://ims-na1.adobelogin.com/.well-known/openid-configuration
    http_status: 200
    authorization_endpoint: https://ims-na1.adobelogin.com/ims/authorize/v2
    token_endpoint: https://ims-na1.adobelogin.com/ims/token/v3
    jwks_uri: https://ims-na1.adobelogin.com/ims/keys
    scopes:
      - openid
      - email
      - profile
  - name: AEM Cloud Service OAuth (fronts the AEM MCP servers)
    issuer: https://oauth.adobeaemcloud.com
    discovery: https://oauth.adobeaemcloud.com/.well-known/oauth-authorization-server
    http_status: 200
    authorization_endpoint: https://oauth.adobeaemcloud.com/oauth/authorize
    token_endpoint: https://oauth.adobeaemcloud.com/oauth/token
    revocation_endpoint: https://oauth.adobeaemcloud.com/oauth/revoke
    registration_endpoint: https://oauth.adobeaemcloud.com/register
    jwks_uri: https://oauth.adobeaemcloud.com/jwks
    grant_types:
      - authorization_code
      - refresh_token
    pkce: S256
    token_endpoint_auth_methods:
      - client_secret_post
  - name: Adobe Analytics MCP
    issuer: https://aa-mcp.adobe.io
    discovery: https://aa-mcp.adobe.io/.well-known/oauth-authorization-server
    http_status: 200
    registration_endpoint: https://aa-mcp.adobe.io/register
    delegates_to: https://ims-na1.adobelogin.com
    token_endpoint_auth_methods:
      - none
    pkce: S256
  - name: Adobe Customer Journey Analytics MCP
    issuer: https://cja-mcp.adobe.io
    discovery: https://cja-mcp.adobe.io/.well-known/oauth-authorization-server
    http_status: 200
    registration_endpoint: https://cja-mcp.adobe.io/register
    delegates_to: https://ims-na1.adobelogin.com
    pkce: S256
scopes:
  - name: openid
    kind: identity
    servers:
      - ims
      - aem
      - aa-mcp
      - cja-mcp
    description: OpenID Connect base scope.
  - name: email
    kind: identity
    servers:
      - ims
    description: Release the authenticated user's email address.
  - name: profile
    kind: identity
    servers:
      - ims
    description: Release the authenticated user's profile claims.
  - name: AdobeID
    kind: identity
    servers:
      - aem
      - aa-mcp
      - cja-mcp
    description: Adobe ID identity scope — the base scope for every Adobe API call.
  - name: read_organizations
    kind: identity
    servers:
      - aem
    description: Read the IMS organizations the user belongs to.
  - name: additional_info
    kind: identity
    servers:
      - aem
    description: Additional IMS profile information.
  - name: additional_info.ownerOrg
    kind: identity
    servers:
      - aem
    description: The owning IMS organization of the authenticated identity.
  - name: additional_info.projectedProductContext
    kind: entitlement
    servers:
      - aem
      - aa-mcp
      - cja-mcp
    description: >-
      The user's projected product entitlements. This is the scope that carries Experience
      Cloud product authorization — it is what turns an authenticated Adobe ID into an
      identity that may call Analytics or CJA.
  - name: aem.sites
    kind: product
    product: Adobe Experience Manager
    servers:
      - aem
    description: AEM Sites — pages and site content.
  - name: aem.assets.author
    kind: product
    product: Adobe Experience Manager Assets
    servers:
      - aem
    description: Author-tier access to AEM Assets.
  - name: aem.assets.delivery
    kind: product
    product: Adobe Experience Manager Assets
    servers:
      - aem
    description: Delivery-tier access to AEM Assets.
  - name: aem.fragments.management
    kind: product
    product: Adobe Experience Manager
    servers:
      - aem
    description: Content fragment management — create, read, patch fragments and models.
  - name: aem.folders
    kind: product
    product: Adobe Experience Manager
    servers:
      - aem
    description: Folder operations.
  - name: aem.repository
    kind: product
    product: Adobe Experience Manager
    servers:
      - aem
    description: Repository-level access.
  - name: aem.contentai
    kind: product
    product: Adobe Experience Manager Content AI
    servers:
      - aem
    description: Content AI indexes — keyword, semantic, hybrid and natural-language search.
  - name: aem.adobe.experimental
    kind: product
    product: Adobe Experience Manager
    servers:
      - aem
    description: Experimental AEM capabilities.
gaps:
  - >-
    Analytics, Target, Campaign, Journey Optimizer and Experience Platform publish no
    fine-grained OAuth scopes. Authorization for those products is granted out-of-band as
    product profiles in the Adobe Admin Console and surfaces to the token only as
    additional_info.projectedProductContext. An agent cannot request least-privilege access
    to Adobe Analytics the way it can to AEM Sites.
  - >-
    The OpenAPI contracts declare bearer + apiKey rather than an oauth2 flow, so the scopes
    above are invisible to any tool that reads only the spec.

Work with this as data

Every scope set here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for oauth scopes

4 MCP tools reach this

find_scopesBrowse and filter every scope set in the catalog.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This scope set

curl "https://apis.io/api/v1/scopes/adobe-experience-cloud-scopes"

All oauth scopes

curl "https://apis.io/api/v1/scopes?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.