AltoIRA · OAuth Scopes

AltoIRA OAuth Scopes

OAuth 2.0 derived

AltoIRA uses OAuth 2.0 but publishes no discrete scopes — access is governed by the grant itself (e.g. client-credentials or role-based authorization) rather than per-scope consent.

Tokens are issued from https://altoira.sandbox.altoira.com/oauth/token.

This index is generated from the provider’s OpenAPI security definitions (and, where available, its documented scope reference) and refreshes on every APIs.io network build. Browse every provider’s scopes at scopes.apis.io.

CompanyFinancial-ServicesRetirementSelf-Directed IRAAlternative InvestmentsPrivate MarketsFintechCustodyCryptocurrencyWealth ManagementInvestingCapital Raising
Scopes: 0 Flows: authorizationCode Method: derived

OAuth endpoints

Authorization URL
https://altoira.sandbox.altoira.com/oauth/authorize
Token URL
https://altoira.sandbox.altoira.com/oauth/token
Flows
authorizationCode

Scopes (0)

AltoIRA implements OAuth 2.0 but publishes no discrete scopes — access is governed by the grant itself (client-credentials or role-based authorization) rather than per-scope consent.

The partner API's oauth2 authorizationCode flow declares an EMPTY scopes map, and Alto's developer hub documents no scope reference page. The /oauth/authorize operation accepts a `scope` query parameter but no permitted values are published, so an integrator cannot determine what to send. This is a provider-fixable documentation gap. Separately, Alto runs an Auth0 tenant at auth.altoira.com for the investor/issuer web application which DOES publish scopes_supported (openid, profile, offline_access, name, given_name, family_name, nickname, email, email_verified, picture, created_at, identities, phone, address). That is a DIFFERENT authorization server from the partner API's own OAuth endpoints and its scopes are deliberately NOT listed as partner-API scopes here. See well-known/altoira-well-known.yml.

📄 Provider scope reference:

Source

OAuth Scopes

Raw ↑ 
generated: '2026-08-06'
method: derived
source: openapi/altoira-partner-api-openapi.yml
schemes:
- name: UserOauth
  source: openapi/altoira-partner-api-openapi.yml
  flows:
  - flow: authorizationCode
    authorizationUrl: https://altoira.sandbox.altoira.com/oauth/authorize
    tokenUrl: https://altoira.sandbox.altoira.com/oauth/token
  description: Redirect your users to /oauth/authorize to get started (see the OAuth section on this
    documentation)
scopes: []
docs: null
note: 'The partner API''s oauth2 authorizationCode flow declares an EMPTY scopes map, and Alto''s
  developer hub documents no scope reference page. The /oauth/authorize operation accepts a `scope`
  query parameter but no permitted values are published, so an integrator cannot determine what to
  send. This is a provider-fixable documentation gap.

  Separately, Alto runs an Auth0 tenant at auth.altoira.com for the investor/issuer web application
  which DOES publish scopes_supported (openid, profile, offline_access, name, given_name, family_name,
  nickname, email, email_verified, picture, created_at, identities, phone, address). That is a DIFFERENT
  authorization server from the partner API''s own OAuth endpoints and its scopes are deliberately
  NOT listed as partner-API scopes here. See well-known/altoira-well-known.yml.'
separate_authorization_server:
  issuer: https://auth.altoira.com/
  provider: Auth0
  role: investor + issuer web application login (app.altoira.com)
  discovery: well-known/altoira-openid-configuration.json
  scopes_supported:
  - openid
  - profile
  - offline_access
  - name
  - given_name
  - family_name
  - nickname
  - email
  - email_verified
  - picture
  - created_at
  - identities
  - phone
  - address

Work with this as data

Every scope set here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for oauth scopes

4 MCP tools reach this
  • find_scopesBrowse and filter every scope set in the catalog.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This scope set 
curl "https://apis.io/api/v1/scopes/altoira-scopes"
All oauth scopes 
curl "https://apis.io/api/v1/scopes?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.