Balbix · OAuth Scopes

Balbix OAuth Scopes

OAuth 2.0 probed

Balbix publishes 7 OAuth 2.0 scopes via the authorizationCode flow. Scopes are the fine-grained permissions an application requests at authorization time to act against the Balbix API on a user’s behalf.

Tokens are issued from https://login.balbix.net/oauth2/aus9g844oA86yTqSo356/v1/token.

This index is generated from the provider’s OpenAPI security definitions (and, where available, its documented scope reference) and refreshes on every APIs.io network build. Browse every provider’s scopes at scopes.apis.io.

CompanyCybersecuritySecurityRisk ManagementVulnerability ManagementExposure ManagementAsset ManagementCyber Asset Attack Surface ManagementContinuous Threat Exposure ManagementCyber Risk QuantificationApplication Security

Scopes: 7 Flows: authorizationCode Method: probed

OAuth endpoints

Authorization URL
https://login.balbix.net/oauth2/aus9g844oA86yTqSo356/v1/authorize

Token URL
https://login.balbix.net/oauth2/aus9g844oA86yTqSo356/v1/token

Flows
authorizationCode

Scopes (7)

Scope	Description	Flows
openid	Required OpenID Connect scope; requests an ID token.	authorizationCode
profile	Requests the end-user's default profile claims (name, family_name, given_name, preferred_username, picture, locale, updated_at and related).	authorizationCode
email	Requests the email and email_verified claims.
address	Requests the address claim.
phone	Requests the phone_number and phone_number_verified claims.
offline_access	Requests a refresh token so the client can obtain new access tokens without user interaction.
device_sso	Okta device single sign-on scope; issues a device secret for native SSO across applications on the same device.

📄 Provider scope reference: https://docs.safe.security/balbixhelp/docs/provisioning-users-for-sso-enabled-customers

Source

OAuth Scopes

generated: '2026-08-02'
method: probed
source: https://login.balbix.net/oauth2/aus9g844oA86yTqSo356/.well-known/openid-configuration
docs: https://docs.safe.security/balbixhelp/docs/provisioning-users-for-sso-enabled-customers
note: Balbix's REST API v1 is not OAuth-protected — it uses HTTP Basic token exchange
  plus a Client-API-Key header (see authentication/balbix-authentication.yml). The
  scopes recorded here belong to the Okta-hosted OpenID Connect authorization server
  that fronts the Balbix platform web application, harvested anonymously from its
  published discovery document. They are the standard OIDC scope set; Balbix publishes
  no custom API scopes.
schemes:
- name: BalbixOkta
  provider: Okta
  issuer: https://login.balbix.net/oauth2/aus9g844oA86yTqSo356
  source: well-known/balbix-openid-configuration.json
  flows:
  - flow: authorizationCode
    authorizationUrl: https://login.balbix.net/oauth2/aus9g844oA86yTqSo356/v1/authorize
    tokenUrl: https://login.balbix.net/oauth2/aus9g844oA86yTqSo356/v1/token
scopes:
- scope: openid
  description: Required OpenID Connect scope; requests an ID token.
  standard: OpenID Connect Core 1.0
  requested_by_app: true
  flows:
  - authorizationCode
  sources:
  - well-known/balbix-openid-configuration.json
- scope: profile
  description: Requests the end-user's default profile claims (name, family_name,
    given_name, preferred_username, picture, locale, updated_at and related).
  standard: OpenID Connect Core 1.0
  requested_by_app: true
  flows:
  - authorizationCode
  sources:
  - well-known/balbix-openid-configuration.json
- scope: email
  description: Requests the email and email_verified claims.
  standard: OpenID Connect Core 1.0
  requested_by_app: false
  sources:
  - well-known/balbix-openid-configuration.json
- scope: address
  description: Requests the address claim.
  standard: OpenID Connect Core 1.0
  requested_by_app: false
  sources:
  - well-known/balbix-openid-configuration.json
- scope: phone
  description: Requests the phone_number and phone_number_verified claims.
  standard: OpenID Connect Core 1.0
  requested_by_app: false
  sources:
  - well-known/balbix-openid-configuration.json
- scope: offline_access
  description: Requests a refresh token so the client can obtain new access tokens
    without user interaction.
  standard: OpenID Connect Core 1.0
  requested_by_app: false
  sources:
  - well-known/balbix-openid-configuration.json
- scope: device_sso
  description: Okta device single sign-on scope; issues a device secret for native
    SSO across applications on the same device.
  standard: Okta extension
  requested_by_app: false
  sources:
  - well-known/balbix-openid-configuration.json
x-evidence:
  fetched: '2026-08-02'
  url: https://login.balbix.net/oauth2/aus9g844oA86yTqSo356/.well-known/openid-configuration
  http_status: 200
  content_type: application/json