Canix OAuth Scopes

generated: '2026-08-09'
method: probed
source: https://api.canix.com/.well-known/oauth-authorization-server
docs: null
description: >-
  Canix's OAuth surface belongs to the MCP server, not to the REST API. The REST API in
  openapi/canix-openapi-original.yml declares a single apiKey scheme (X-API-KEY) and no
  oauth2 security scheme, so 0-working/derive-oauth-scopes.py finds nothing there. The
  scopes below were probed from Canix's own RFC 8414 authorization-server metadata, which
  advertises exactly one scope.
schemes:
- name: CanixMCPOAuth
  type: oauth2
  source: https://api.canix.com/.well-known/oauth-authorization-server
  issuer: https://api.canix.com
  protected_resource: https://api.canix.com/mcp
  dynamic_client_registration: https://api.canix.com/oidc/register
  token_endpoint_auth_methods:
  - none
  - client_secret_basic
  - client_secret_post
  code_challenge_methods:
  - S256
  flows:
  - flow: authorizationCode
    authorizationUrl: https://api.canix.com/oauth/authorize
    tokenUrl: https://api.canix.com/oauth/token
    revocationUrl: https://api.canix.com/oauth/revoke
    refreshSupported: true
scopes:
- scope: mcp
  description: >-
    The only scope Canix advertises. It is coarse: a single grant covering the whole MCP
    surface, with no read/write split, no per-resource scope, and no separation between the
    live sales-reporting capability and the announced inventory capability.
  flows:
  - authorizationCode
  sources:
  - https://api.canix.com/.well-known/oauth-authorization-server
  - https://api.canix.com/.well-known/oauth-protected-resource
assessment:
  granularity: coarse
  gap: >-
    One undifferentiated `mcp` scope means an agent authorized for sales reporting will
    hold the same grant when inventory access ships. A read-scoped variant would let an
    operator delegate analytics without also delegating whatever writes arrive later.
  no_scope_documentation_page: >-
    Canix publishes no scopes or permissions reference page. The scope list here comes only
    from the machine-readable authorization-server metadata.
x-evidence:
- url: https://api.canix.com/.well-known/oauth-authorization-server
  http_status: 200
  fetched: '2026-08-09'
- url: https://api.canix.com/.well-known/oauth-protected-resource
  http_status: 200
  fetched: '2026-08-09'