Columbia University · OAuth Scopes

Columbia University OAuth Scopes

OAuth 2.0 probed

Columbia University uses OAuth 2.0 but publishes no discrete scopes — access is governed by the grant itself (e.g. client-credentials or role-based authorization) rather than per-scope consent.

This index is generated from the provider’s OpenAPI security definitions (and, where available, its documented scope reference) and refreshes on every APIs.io network build. Browse every provider’s scopes at scopes.apis.io.

UniversityHigher EducationEducationIvy LeaguePrivate Research UniversityUnited StatesNew YorkIdentity FederationLibraryOpen DataResearch RepositoryResearch DataCourse CatalogCampus Life
Scopes: 0 Flows: Method: probed

Scopes (0)

Columbia University implements OAuth 2.0 but publishes no discrete scopes — access is governed by the grant itself (client-credentials or role-based authorization) rather than per-scope consent.

📄 Provider scope reference:

Source

OAuth Scopes

Raw ↑ 
generated: '2026-08-19'
method: probed
source: >-
  Live probes of every Columbia University surface reachable without a credential on 2026-08-19,
  plus Columbia's published Shibboleth IdP metadata.
provider: Columbia University
providerId: columbia
description: >-
  Columbia University publishes no authorization scopes. This file records that as a measured
  absence rather than leaving the artifact off, because the reason for the absence is itself the
  finding: Columbia operates no OAuth 2.0 authorization server, no OpenID Connect provider and no
  API key programme, so there is no place a scope could be declared.
scopes: []
x-operator: institution
findings:
- surface: Columbia University Libraries Hours API
  baseURL: https://hours.library.columbia.edu/api/v1
  x-operator: institution
  scopes_declared: 0
  assessment: >-
    Read-only and fully anonymous. Both operations explicitly skip authentication and
    authorization in Columbia's own source; there is nothing to scope. An absent scope model is
    the correct design here, not a gap.
- surface: Columbia Shibboleth Identity Provider
  baseURL: https://shibboleth.columbia.edu/idp
  x-operator: institution
  scopes_declared: 0
  assessment: >-
    SAML 2.0, which uses attribute release policy rather than OAuth scopes. The published metadata
    declares a shibmd:Scope of columbia.edu — that is the SAML security-domain scope, an entirely
    different concept from an authorization scope, and it is deliberately not counted here. No
    attribute release policy or entity category (REFEDS R&S, CoCo) is declared in the published
    metadata.
- surface: Columbia Open Data Service
  baseURL: https://opendataservice.columbia.edu/
  x-operator: institution
  scopes_declared: 0
  assessment: >-
    Access is binary: a Columbia UNI grants it, anything else does not. There are no tiers,
    no per-feed permissions published, and no scope vocabulary.
- surface: CourseWorks (Instructure Canvas)
  baseURL: https://courseworks2.columbia.edu/api/v1
  x-operator: tenant
  scopes_declared: 0
  assessment: >-
    Canvas does implement a developer-key scope model, but it is Instructure's vocabulary and is
    not published by Columbia. Deliberately not credited to the institution.
summary:
  total_scopes: 0
  oauth_authorization_server: false
  openid_connect: false
  api_key_programme: false
notes: >-
  Zero is the true number. This file exists so that the zero is legible and sourced, rather than
  being read as an artifact that was never generated.