ButterflyMX · OAuth Scopes

ButterflyMX OAuth Scopes

OAuth 2.0 probed

ButterflyMX publishes 6 OAuth 2.0 scopes via the authorizationCode and clientCredentials flows. Scopes are the fine-grained permissions an application requests at authorization time to act against the ButterflyMX API on a user’s behalf.

Tokens are issued from https://accounts.butterflymx.com/oauth/token.

This index is generated from the provider’s OpenAPI security definitions (and, where available, its documented scope reference) and refreshes on every APIs.io network build. Browse every provider’s scopes at scopes.apis.io.

access-controlphysical-accesssmart-intercomproptechproperty-managementmultifamilybuilding-automationvisitor-managementiotsmart-locksoauth2webhooks

Scopes: 6 Flows: authorizationCode, clientCredentials Method: probed

OAuth endpoints

Authorization URL
https://accounts.butterflymx.com/oauth/authorize

Token URL
https://accounts.butterflymx.com/oauth/token

Flows
authorizationCodeclientCredentials

Scopes (6)

Scope	Description	Flows
public	Default scope returned in the documented sample token response; grants access to the public ButterflyMX API v4 surface for the authenticated tenant or admin.
openid	Standard OpenID Connect scope; requests an ID token.
profile	Standard OpenID Connect scope for basic profile claims.
email	Standard OpenID Connect scope for the `email` and `email_verified` claims.
os	undocumented — advertised by the authorization server but not explained in the public docs.
caterpillar	undocumented — advertised by the authorization server but not explained in the public docs.

📄 Provider scope reference: https://apidocs.butterflymx.com/docs/authorization

Source

OAuth Scopes

generated: '2026-08-08'
method: probed
source: https://accounts.butterflymx.com/.well-known/openid-configuration
docs: https://apidocs.butterflymx.com/docs/authorization
note: >-
  The published OpenAPI declares no oauth2 securityScheme, so no scopes are derivable from the spec. These
  scopes come from the live OAuth 2.0 / OpenID Connect discovery documents the ButterflyMX authorization
  server serves anonymously. ButterflyMX publishes no scope-reference page in its developer docs, so the
  descriptions below are marked `undocumented` where the provider does not explain the scope — they are NOT
  guessed. The sample token response in the authorization guide shows `"scope": "public"`, confirming
  `public` is the default scope granted to a developer application.
schemes:
- name: OAuth2
  source: https://accounts.butterflymx.com/.well-known/oauth-authorization-server
  flows:
  - flow: authorizationCode
    authorizationUrl: https://accounts.butterflymx.com/oauth/authorize
    tokenUrl: https://accounts.butterflymx.com/oauth/token
  - flow: clientCredentials
    tokenUrl: https://accounts.butterflymx.com/oauth/token
scopes:
- scope: public
  description: >-
    Default scope returned in the documented sample token response; grants access to the public ButterflyMX
    API v4 surface for the authenticated tenant or admin.
  documented: true
  sources:
  - https://apidocs.butterflymx.com/docs/authorization
  - https://accounts.butterflymx.com/.well-known/openid-configuration
- scope: openid
  description: Standard OpenID Connect scope; requests an ID token.
  documented: false
  standard: openid-connect-core
  sources:
  - https://accounts.butterflymx.com/.well-known/openid-configuration
- scope: profile
  description: Standard OpenID Connect scope for basic profile claims.
  documented: false
  standard: openid-connect-core
  sources:
  - https://accounts.butterflymx.com/.well-known/openid-configuration
- scope: email
  description: Standard OpenID Connect scope for the `email` and `email_verified` claims.
  documented: false
  standard: openid-connect-core
  sources:
  - https://accounts.butterflymx.com/.well-known/openid-configuration
- scope: os
  description: undocumented — advertised by the authorization server but not explained in the public docs.
  documented: false
  sources:
  - https://accounts.butterflymx.com/.well-known/openid-configuration
- scope: caterpillar
  description: undocumented — advertised by the authorization server but not explained in the public docs.
  documented: false
  sources:
  - https://accounts.butterflymx.com/.well-known/openid-configuration
claims_supported:
- iss
- sub
- aud
- exp
- iat
- email
- email_verified
gaps:
- >-
  There is no published scopes/permissions reference. Two of the six advertised scopes (`os`, `caterpillar`)
  are undocumented, and the OpenAPI does not bind any operation to a scope, so an integrator cannot
  determine least-privilege access from the contract.
x-evidence:
- url: https://accounts.butterflymx.com/.well-known/openid-configuration
  http_status: 200
  fetched: '2026-08-08'