AmTrust Financial Services · OAuth Scopes

AmTrust Financial Services OAuth Scopes

OAuth 2.0 searched

AmTrust Financial Services uses OAuth 2.0 but publishes no discrete scopes — access is governed by the grant itself (e.g. client-credentials or role-based authorization) rather than per-scope consent.

This index is generated from the provider’s OpenAPI security definitions (and, where available, its documented scope reference) and refreshes on every APIs.io network build. Browse every provider’s scopes at scopes.apis.io.

Commercial InsuranceInsuranceProperty and CasualtySmall BusinessWorkers CompensationFortune 1000UnderwritingClaimsPolicyReinsuranceCyber InsuranceSurety
Scopes: 0 Flows: Method: searched

Scopes (0)

AmTrust Financial Services implements OAuth 2.0 but publishes no discrete scopes — access is governed by the grant itself (client-credentials or role-based authorization) rather than per-scope consent.

These scopes come from AmTrust's own OpenID Connect discovery document, not from any OpenAPI securityScheme — none of the nine harvested OpenAPI documents declares an oauth2 or openIdConnect scheme, so `derive-oauth-scopes.py` correctly found nothing to derive. The scope set is coarse: it authenticates the caller and carries legacy portal identity, and does NOT partition the API surface. There is no read/write split, no per-product scope (workers' comp vs BOP vs claims vs reinsurance), and no per-operation scope. Authorization to a given API is enforced by the Azure API Management subscription (which product a subscriber_id is entitled to), not by the token.

📄 Provider scope reference: https://apiportal.amtrustgroup.com/authentication

Source

OAuth Scopes

Raw ↑ 
generated: '2026-09-02'
method: searched
source: >-
  https://auth.amtrustgroup.com/AuthServer/.well-known/openid-configuration (HTTP 200) and
  https://apiportal.amtrustgroup.com/authentication (HTTP 200) — probed 2026-09-02
docs: https://apiportal.amtrustgroup.com/authentication
provider: AmTrust Financial Services
providerId: amtrust-financial-services
issuer: https://auth.amtrustgroup.com/AuthServer
token_endpoint: https://auth.amtrustgroup.com/AuthServer/OpenIDConnect/Token
note: >-
  These scopes come from AmTrust's own OpenID Connect discovery document, not from any OpenAPI
  securityScheme — none of the nine harvested OpenAPI documents declares an oauth2 or openIdConnect
  scheme, so `derive-oauth-scopes.py` correctly found nothing to derive. The scope set is coarse: it
  authenticates the caller and carries legacy portal identity, and does NOT partition the API surface.
  There is no read/write split, no per-product scope (workers' comp vs BOP vs claims vs reinsurance),
  and no per-operation scope. Authorization to a given API is enforced by the Azure API Management
  subscription (which product a subscriber_id is entitled to), not by the token.
scope_count: 7
scopes:
- name: openid
  description: Standard OIDC scope. Requests an ID token identifying the caller.
  requested_by: both documented flows
- name: profile
  description: Standard OIDC profile claims.
  requested_by: both documented flows
- name: offline_access
  description: Requests a refresh token.
  requested_by: advertised in discovery; not shown in the portal's documented flows
- name: user
  description: >-
    AmTrust-specific. Advertised in discovery; the portal does not document it and does not state what
    it grants.
  requested_by: advertised in discovery only
- name: legacy_id
  description: >-
    AmTrust-specific. Carries the caller's legacy AmTrust portal user identifier into the token.
    Documented on the portal as part of the User Authenticated Token request.
  requested_by: User Authenticated Token (password grant)
- name: legacy_info
  description: >-
    AmTrust-specific. Carries legacy AmTrust portal user information into the token. Documented on the
    portal as part of the User Authenticated Token request.
  requested_by: User Authenticated Token (password grant)
- name: legacy_permission
  description: >-
    AmTrust-specific. Advertised in discovery; the portal does not document it and does not state what
    permissions it conveys.
  requested_by: advertised in discovery only
documented_combinations:
- flow: General Access Token
  grant_type: client_credentials
  scope: openid profile
- flow: User Authenticated Token
  grant_type: password
  scope: openid profile legacy_info legacy_id
gaps:
- No scope maps to an API product or an operation, so a token cannot express least privilege.
- Three advertised scopes (user, legacy_permission, offline_access) are undocumented.

Work with this as data

Every scope set here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for oauth scopes

4 MCP tools reach this
  • find_scopesBrowse and filter every scope set in the catalog.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This scope set 
curl "https://apis.io/api/v1/scopes/amtrust-financial-services-scopes"
All oauth scopes 
curl "https://apis.io/api/v1/scopes?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.