Business Software and Services Reviews | G2 OAuth Scopes

generated: '2026-08-14'
method: searched
source: >-
  openapi/business-software-and-services-reviews-g2-v2-openapi.yml and
  openapi/business-software-and-services-reviews-g2-data-solutions-openapi.yml
  (declared flows + operation-level security requirements), enriched from
  https://documentation.g2.com/docs/g2-mcp-server (published scope table) and
  https://mcp.g2.com/.well-known/oauth-protected-resource/mcp (RFC 9728
  scopes_supported).
docs: https://documentation.g2.com/docs/g2-mcp-server
description: >-
  G2's OAuth 2.0 scope surface, reconciled across three sources that do not
  agree. The OpenAPI securityScheme declares only six scopes in its flows map but
  requires ten distinct scopes at the operation level; the MCP documentation
  publishes an eight-row table; the MCP protected-resource metadata advertises
  ten. The union is sixteen. `origin` on each entry records which sources name
  it, because a scope declared in only one place is a scope a client may not be
  able to request.
authorization_server: https://www.g2.com/
discovery: well-known/business-software-and-services-reviews-g2-openid-configuration.json
registration:
  url: https://my.g2.com/developers
  dynamic_client_registration: false
  note: >-
    OAuth apps must be pre-registered in the G2 Developer Portal. Permissions are
    selected per endpoint at registration; a scope requested in the flow must have
    a matching Read permission enabled on the app or the authorization server
    returns "requested scope is invalid, unknown, or malformed".
schemes:
  - name: G2OAuth
    type: oauth2
    flows:
      - flow: authorizationCode
        authorizationUrl: https://www.g2.com/oauth/authorize
        tokenUrl: https://www.g2.com/oauth/token
        pkce: true
        pkce_methods: [S256, plain]
    sources:
      - openapi/business-software-and-services-reviews-g2-v2-openapi.yml
      - openapi/business-software-and-services-reviews-g2-data-solutions-openapi.yml
  - name: AccountAPIToken
    type: http
    scheme: bearer
    note: >-
      Non-OAuth path. Developer Portal access tokens carry per-endpoint
      permissions rather than scopes, and expire one year after creation. One
      operation (getGridReports) declares a scope-shaped requirement
      "reports.read" against this bearer scheme rather than against G2OAuth.
scope_count: 16
scopes:
  - scope: openid
    description: OpenID Connect default scope. Required for OAuth authentication.
    origin: [openapi-flows, mcp-docs, protected-resource, oidc-discovery]
  - scope: profile
    description: Profile information on current user. Required for OAuth authentication.
    origin: [openapi-flows, mcp-docs, protected-resource, oidc-discovery]
  - scope: products.read
    description: Read product catalog data.
    origin: [mcp-docs, protected-resource]
  - scope: products.reviews.read
    description: Read product reviews.
    origin: [mcp-docs, protected-resource]
  - scope: vendors.read
    description: Read vendor data.
    origin: [mcp-docs, protected-resource]
  - scope: buyer_intent.read
    description: Read buyer intent signals.
    origin: [mcp-docs, protected-resource]
  - scope: research_boards.read
    description: Read research boards.
    origin: [mcp-docs, protected-resource]
  - scope: research_boards.write
    description: Create, update, and delete research boards.
    origin: [mcp-docs, protected-resource]
  - scope: ds_reviews.read
    description: >-
      Read Data Solutions reviews — the flat, firmographically enriched review
      projection. Required by getDataSolutionsReviews.
    origin: [protected-resource, openapi-operations]
  - scope: g2_activate.read
    description: >-
      Read G2 Activate company unlock data. Required by the four G2 Activate
      operations; a 403 titled "Missing g2_activate.read scope" is declared.
    origin: [protected-resource, openapi-operations]
  - scope: performance_analytics.read
    description: >-
      Read Performance Analytics data. Required by the five Performance Analytics
      operations; a 403 titled "Missing performance_analytics.read scope" is declared.
    origin: [openapi-flows, openapi-operations]
    note: Declared in the spec's flows map and required by operations, but absent from both MCP sources.
  - scope: data_subscriptions.read
    description: Read Data Subscription records.
    origin: [openapi-flows, openapi-operations]
  - scope: data_subscriptions.read_write
    description: Modify Data Subscription records.
    origin: [openapi-flows, openapi-operations]
  - scope: data_subscriptions.write
    description: Write Data Subscription records.
    origin: [openapi-operations]
    note: >-
      Required by createPartnerDataSubscription but NOT declared in the
      securityScheme flows map — a client reading only the flows map would never
      know to request it.
  - scope: 'partner:partner-id.read'
    description: Access records created in Partner realm.
    origin: [openapi-flows, openapi-operations]
    note: >-
      Templated scope — "partner-id" is a placeholder for the partner's own
      identifier, not a literal value.
  - scope: snippets
    description: Access product snippets. Required by getProductSnippets.
    origin: [openapi-operations]
    note: >-
      Bare noun with no read/write suffix, unlike every other G2 scope, and
      declared nowhere but on the operation. Likely legacy.
oidc_scopes_supported:
  scopes:
    - openid
    - openid_admin
    - profile
    - profile_admin
  note: >-
    The OIDC discovery document at www.g2.com advertises only these four. The
    API and MCP scopes above are not listed there, so scopes_supported in
    discovery is not a usable inventory of G2's API authorization surface.
inconsistencies:
  - >-
    The OpenAPI flows map declares 6 scopes; operations require 10; the union
    across all published sources is 16. No single G2 document lists them all.
  - >-
    data_subscriptions.write and snippets are required by operations but appear
    in no flows map and no documentation.
  - >-
    performance_analytics.read and the data_subscriptions family appear in the
    spec but not in the MCP protected-resource metadata, so they are presumably
    unavailable to MCP clients.
  - >-
    getGridReports attaches "reports.read" to the AccountAPIToken bearer scheme,
    which has no scope model at all.