Agora Data · OAuth Scopes

Agora Data OAuth Scopes

OAuth 2.0 searched

Agora Data publishes 6 OAuth 2.0 scopes via the authorizationCode flow. Scopes are the fine-grained permissions an application requests at authorization time to act against the Agora Data API on a user’s behalf.

Tokens are issued from https://agora-data.us.auth0.com/oauth/token.

This index is generated from the provider’s OpenAPI security definitions (and, where available, its documented scope reference) and refreshes on every APIs.io network build. Browse every provider’s scopes at scopes.apis.io.

CompanyAuto FinanceAutomotiveLendingFinancial ServicesFintechLoan OriginationData AnalyticsArtificial IntelligenceCapital Markets

Scopes: 6 Flows: authorizationCode Method: searched

OAuth endpoints

Authorization URL
https://agora-data.us.auth0.com/authorize https://api.agoradata.com/oauth/authorize

Token URL
https://agora-data.us.auth0.com/oauth/token https://api.agoradata.com/oauth/token

Flows
authorizationCode

Scopes (6)

Scope	Description	Flows
openid	Request an OIDC ID token.	authorizationCode
profile	Basic profile claims (name, given_name, family_name, nickname, picture).	authorizationCode
email	Email address and email_verified claim.	authorizationCode
offline_access	Issue a refresh token so the portal session can be renewed.	authorizationCode
address	Address claim.	authorizationCode
phone	Phone number claim.	authorizationCode

📄 Provider scope reference: https://agora-data.us.auth0.com/.well-known/openid-configuration

Source

OAuth Scopes

generated: '2026-08-06'
method: searched
source: well-known/agora-data-openid-configuration.json
docs: https://agora-data.us.auth0.com/.well-known/openid-configuration
notes: >-
  Agora Data's loan-import API at api.agoradata.com hosts its own /oauth/authorize and
  /oauth/token endpoints and returns a `scope` field on TokenRequestResponse, but it
  publishes NO scope vocabulary — the OpenAPI declares no oauth2 securityScheme and no
  flow `scopes` map, and there is no public scopes/permissions reference page. The only
  scope vocabulary Agora Data actually publishes is the standard OIDC set advertised by
  the Auth0 tenant that fronts AgoraPortal. Those are identity scopes for the portal, not
  authorization scopes for the loan-import API. Nothing below is invented; the API's own
  scope vocabulary remains undocumented.
schemes:
- name: agora-portal-oidc
  source: well-known/agora-data-openid-configuration.json
  issuer: https://agora-data.us.auth0.com/
  flows:
  - flow: authorizationCode
    authorizationUrl: https://agora-data.us.auth0.com/authorize
    tokenUrl: https://agora-data.us.auth0.com/oauth/token
    pkce: S256
- name: agora-api-oauth
  source: openapi/agora-data-openapi-original.json
  flows:
  - flow: authorizationCode
    authorizationUrl: https://api.agoradata.com/oauth/authorize
    tokenUrl: https://api.agoradata.com/oauth/token
  scopes_published: false
scopes:
- scope: openid
  description: Request an OIDC ID token.
  flows: [authorizationCode]
  sources: [well-known/agora-data-openid-configuration.json]
- scope: profile
  description: Basic profile claims (name, given_name, family_name, nickname, picture).
  flows: [authorizationCode]
  sources: [well-known/agora-data-openid-configuration.json]
- scope: email
  description: Email address and email_verified claim.
  flows: [authorizationCode]
  sources: [well-known/agora-data-openid-configuration.json]
- scope: offline_access
  description: Issue a refresh token so the portal session can be renewed.
  flows: [authorizationCode]
  sources: [well-known/agora-data-openid-configuration.json]
- scope: address
  description: Address claim.
  flows: [authorizationCode]
  sources: [well-known/agora-data-openid-configuration.json]
- scope: phone
  description: Phone number claim.
  flows: [authorizationCode]
  sources: [well-known/agora-data-openid-configuration.json]
observed_portal_request:
  audience: dealer-portal
  scope: openid profile email offline_access
  source: https://portal.agoradata.com/ 302 redirect
gaps:
- The loan-import API returns a `scope` on its token response but publishes no scope vocabulary.