Arkestro · OAuth Scopes

Arkestro OAuth Scopes

OAuth 2.0 probed

Arkestro publishes 3 OAuth 2.0 scopes via the authorizationCode flow. Scopes are the fine-grained permissions an application requests at authorization time to act against the Arkestro API on a user’s behalf.

Tokens are issued from https://api.arkestro.com/oauth/token.

This index is generated from the provider’s OpenAPI security definitions (and, where available, its documented scope reference) and refreshes on every APIs.io network build. Browse every provider’s scopes at scopes.apis.io.

procurementsourcingsupply-chainspend-managemente-sourcingsupplier-managementpurchase-ordersprocurement-analyticsenterprise-softwarepredictive-procurementmcpwebhooks

Scopes: 3 Flows: authorizationCode Method: probed

OAuth endpoints

Authorization URL
https://api.arkestro.com/oauth/authorize

Token URL
https://api.arkestro.com/oauth/token

Flows
authorizationCode

Scopes (3)

Scope	Description	Flows
mcp:read	Read access through the MCP server.	authorizationCode
mcp:write	Write access through the MCP server.	authorizationCode
offline_access	Issue a refresh token so the client can act without the user present.	authorizationCode

📄 Provider scope reference:

Source

OAuth Scopes

generated: '2026-08-06'
method: probed
source: https://api.arkestro.com/.well-known/oauth-authorization-server
note: >-
  These scopes are not derivable from the OpenAPI — the published spec declares only an
  apiKey scheme. They come from Arkestro's live RFC 8414 authorization-server metadata and
  govern the remote MCP server at https://api.arkestro.com/api/v2/mcp, not the REST API V2.
  Arkestro publishes no scope reference page; descriptions below are the plain reading of
  the scope names and are marked as such rather than quoted from documentation.
schemes:
- name: OAuth2
  source: well-known/arkestro-oauth-authorization-server.json
  issuer: https://api.arkestro.com
  flows:
  - flow: authorizationCode
    authorizationUrl: https://api.arkestro.com/oauth/authorize
    tokenUrl: https://api.arkestro.com/oauth/token
    pkce_required: true
    code_challenge_methods:
    - S256
scopes:
- scope: mcp:read
  description: Read access through the MCP server.
  description_source: inferred-from-scope-name
  flows:
  - authorizationCode
  sources:
  - well-known/arkestro-oauth-authorization-server.json
- scope: mcp:write
  description: Write access through the MCP server.
  description_source: inferred-from-scope-name
  flows:
  - authorizationCode
  sources:
  - well-known/arkestro-oauth-authorization-server.json
- scope: offline_access
  description: Issue a refresh token so the client can act without the user present.
  description_source: standard-oidc-scope
  flows:
  - authorizationCode
  sources:
  - well-known/arkestro-oauth-authorization-server.json
coverage:
  scopes_published: 3
  granularity: coarse
  note: >-
    Two functional scopes for an entire procurement platform. A read/write split alone
    cannot express least privilege across events, awards, purchase orders, supplier
    organizations and analytics — an agent granted mcp:write to schedule an event also
    holds whatever write reach the server exposes over awards and purchase orders.
x-evidence:
- url: https://api.arkestro.com/.well-known/oauth-authorization-server
  http_status: 200
  fetched: '2026-08-06'