B3 (Brasil Bolsa Balcão) OAuth Scopes

OAuth 2.0 derived

B3 (Brasil Bolsa Balcão) publishes 2 OAuth 2.0 scopes via the clientCredentials and password flows. Scopes are the fine-grained permissions an application requests at authorization time to act against the B3 (Brasil Bolsa Balcão) API on a user’s behalf.

Tokens are issued from https://localhost:8089/api/oauth/token.

This index is generated from the provider’s OpenAPI security definitions (and, where available, its documented scope reference) and refreshes on every APIs.io network build. Browse every provider’s scopes at scopes.apis.io.

FinancialMarket DataStocksTradingExchangeDerivativesFixed IncomeReal-TimeReference DataBrazil

Scopes: 2 Flows: clientCredentials, password Method: derived

OAuth endpoints

Token URL
https://localhost:8089/api/oauth/token

Flows
clientCredentialspassword

Scopes (2)

Scope	Description	Flows
resource.READ	Read access to the API resource (portal-wide OAuth 2.0 security profile, any-scope matching).	clientCredentials, password
resource.WRITE	Write access to the API resource (portal-wide OAuth 2.0 security profile, any-scope matching).	clientCredentials, password

📄 Provider scope reference: https://developers.b3.com.br/apis/autenticacao

Source

OAuth Scopes

generated: '2026-07-22'
method: derived
source: openapi/ (Swagger 1.1 authorizations + securityProfile blocks, 12 of 14 definitions)
docs: https://developers.b3.com.br/apis/autenticacao
schemes:
  - name: OAuth2
    type: oauth2
    flows:
      - flow: clientCredentials
        tokenUrl: https://localhost:8089/api/oauth/token
        note: >-
          Placeholder host in the published Swagger definitions - the portal
          substitutes the client's entitled gateway host at runtime. The
          documented token model APIs POST to /aapi/oauth/token (client
          credentials) and /api/oauth/token (ROPC).
      - flow: password
        note: Resource Owner Password Credentials model APIs (plain and category_ID variants).
scopes:
  - scope: resource.READ
    description: Read access to the API resource (portal-wide OAuth 2.0 security profile, any-scope matching).
    flows: [clientCredentials, password]
    sources:
      - openapi/ (12 harvested Swagger 1.1 definitions)
  - scope: resource.WRITE
    description: Write access to the API resource (portal-wide OAuth 2.0 security profile, any-scope matching).
    flows: [clientCredentials, password]
    sources:
      - openapi/ (12 harvested Swagger 1.1 definitions)
notes: >-
  B3 uses a coarse two-scope model (resource.READ / resource.WRITE) applied
  uniformly across the developer-portal catalog rather than per-product scopes.
  Some Client Credentials variants add a category_ID, key, or scope request
  parameter at the token endpoint.