Conga · OAuth Scopes

Conga OAuth Scopes

OAuth 2.0 searched

Conga publishes 28 OAuth 2.0 scopes via the authorizationCode and clientCredentials flows. Scopes are the fine-grained permissions an application requests at authorization time to act against the Conga API on a user’s behalf.

Tokens are issued from https://login-rls.congacloud.com/api/v1/auth/connect/token.

This index is generated from the provider’s OpenAPI security definitions (and, where available, its documented scope reference) and refreshes on every APIs.io network build. Browse every provider’s scopes at scopes.apis.io.

CompanyEnterprise SoftwareContract Lifecycle ManagementCPQRevenue Lifecycle ManagementDocument AutomationE-SignatureContract IntelligenceCRMOpenAPIMCPGraphQLBillingApprovals

Scopes: 28 Flows: authorizationCode, clientCredentials Method: searched

OAuth endpoints

Authorization URL
https://login-rls.congacloud.com/api/v1/auth/connect/authorize https://login.conga.com/authorize

Token URL
https://login-rls.congacloud.com/api/v1/auth/connect/token https://login.conga.com/oauth/token

Flows
authorizationCodeclientCredentials

Scopes (28)

Scope	Description	Flows
api.cart	CPQ cart operations - configuration, pricing and cart actions.
api.catalog	Product catalog - products, categories, price lists, product groups.
api.quote	Quote/proposal objects.
api.order	Order objects.
api.document-management	Document storage, retrieval and metadata.
api.user-management	Users, user groups, roles, permission groups and organization info.
api.metadata	Platform metadata / schema definitions.
api.data	Generic platform data access over business objects.
api.localization	Localization - languages, translations, locale settings.
api.revenue-admin	Revenue administration - the largest service in the catalogue (583 operations).
api.custom-api	Customer-authored extensibility endpoints.
api.email	Platform email service.
doc-gen.composer	Conga Composer document generation.
sign	Conga Sign e-signature.
sign.provisioning	Conga Sign account/tenant provisioning.
Auth.Api.Read	Read access to the authorization service's own API.
IngressIbis	Ingress service (document ingestion pipeline).
EUF-Reference-App	Reference-application client registration; not a general API scope.
CCI-Prod-RLS-PREVIEW	Preview environment client registration; not a general API scope.
https://rls-preview.congacloud.au/mcp	RFC 8707 resource indicator for Conga's MCP server. Present only in the AU discovery document; this string is how the otherwise-undocumented MCP surface was found. See mcp/conga-mcp.yml.
openid	OpenID Connect authentication; issue an ID token.
profile	Access to the user's default profile claims.
email	Access to the user's email and email_verified claims.
address	Access to the user's address claim.
phone	Access to the user's phone_number claims.
external_claims	Claims federated from an external identity provider.
force_login	Force re-authentication rather than reusing an existing session.
offline_access	Issue a refresh token for long-lived access.

📄 Provider scope reference: https://developer.conga.com/platform/reference/authentication

Source

OAuth Scopes

generated: '2026-08-13'
method: searched
source: https://login-rls.congacloud.com/api/v1/auth/.well-known/openid-configuration
docs: https://developer.conga.com/platform/reference/authentication
notes: >-
  Conga's developer documentation does not publish a scopes or permissions
  reference page - it describes the client_credentials flow and says access is
  governed by the Integration User's platform permissions. The platform's own
  OAuth authorization servers, however, advertise a full scope set in their OIDC
  discovery documents, and those scopes map cleanly onto the services in
  openapi/. The api.* scopes below are Conga's own published strings, read
  verbatim from the discovery documents of all three production regions. They
  are undocumented in prose, so the service mapping in `covers:` is our
  derivation from the matching OpenAPI document, marked as such.
schemes:
- name: CongaPlatformOAuth
  source: https://login-rls.congacloud.com/api/v1/auth/.well-known/openid-configuration
  issuer: https://login-rls.congacloud.com/api/v1/auth
  regions:
  - region: NA
    issuer: https://login-rls.congacloud.com/api/v1/auth
  - region: EU
    issuer: https://login.congacloud.eu/api/v1/auth
  - region: AU
    issuer: https://login.congacloud.au/api/v1/auth
  flows:
  - flow: authorizationCode
    authorizationUrl: https://login-rls.congacloud.com/api/v1/auth/connect/authorize
    tokenUrl: https://login-rls.congacloud.com/api/v1/auth/connect/token
  - flow: clientCredentials
    tokenUrl: https://login-rls.congacloud.com/api/v1/auth/connect/token
  grant_types_supported: [authorization_code, client_credentials, refresh_token, implicit,
    password, 'urn:ietf:params:oauth:grant-type:device_code', 'urn:openid:params:grant-type:ciba',
    'urn:ietf:params:oauth:grant-type:token-exchange']
  pkce: [S256, plain]
  introspection_endpoint: https://login-rls.congacloud.com/api/v1/auth/connect/introspect
  revocation_endpoint: https://login-rls.congacloud.com/api/v1/auth/connect/revocation
- name: DeveloperPortalOIDC
  source: https://login.conga.com/.well-known/openid-configuration
  issuer: https://login.conga.com/
  note: Auth0 tenant behind the developer portal login, not the platform API.
  flows:
  - flow: authorizationCode
    authorizationUrl: https://login.conga.com/authorize
    tokenUrl: https://login.conga.com/oauth/token
  - flow: clientCredentials
    tokenUrl: https://login.conga.com/oauth/token
scopes:
- scope: api.cart
  kind: api
  description: CPQ cart operations - configuration, pricing and cart actions.
  covers: openapi/conga-cart-v1.json
  covers_method: derived
- scope: api.catalog
  kind: api
  description: Product catalog - products, categories, price lists, product groups.
  covers: openapi/conga-catalog.json
  covers_method: derived
- scope: api.quote
  kind: api
  description: Quote/proposal objects.
  covers: openapi/conga-quote.json
  covers_method: derived
- scope: api.order
  kind: api
  description: Order objects.
  covers: openapi/conga-order.json
  covers_method: derived
- scope: api.document-management
  kind: api
  description: Document storage, retrieval and metadata.
  covers: openapi/conga-document-management.json
  covers_method: derived
- scope: api.user-management
  kind: api
  description: Users, user groups, roles, permission groups and organization info.
  covers: openapi/conga-user-management.json
  covers_method: derived
- scope: api.metadata
  kind: api
  description: Platform metadata / schema definitions.
  covers: openapi/conga-schema-manager.json
  covers_method: derived
- scope: api.data
  kind: api
  description: Generic platform data access over business objects.
  covers: openapi/conga-data.json
  covers_method: derived
- scope: api.localization
  kind: api
  description: Localization - languages, translations, locale settings.
  covers: openapi/conga-localization.json
  covers_method: derived
- scope: api.revenue-admin
  kind: api
  description: Revenue administration - the largest service in the catalogue (583 operations).
  covers: openapi/conga-administration.json
  covers_method: derived
- scope: api.custom-api
  kind: api
  description: Customer-authored extensibility endpoints.
  covers: openapi/conga-extensibility.json
  covers_method: derived
- scope: api.email
  kind: api
  description: Platform email service.
  covers: openapi/conga-email.json
  covers_method: derived
- scope: doc-gen.composer
  kind: api
  description: Conga Composer document generation.
  covers: null
  covers_method: derived
- scope: sign
  kind: api
  description: Conga Sign e-signature.
  covers: openapi/conga-conga-sign.json
  covers_method: derived
- scope: sign.provisioning
  kind: api
  description: Conga Sign account/tenant provisioning.
  covers: null
  covers_method: derived
- scope: Auth.Api.Read
  kind: api
  description: Read access to the authorization service's own API.
  covers: null
  covers_method: derived
- scope: IngressIbis
  kind: api
  description: Ingress service (document ingestion pipeline).
  covers: openapi/conga-ingress.json
  covers_method: derived
- scope: EUF-Reference-App
  kind: application
  description: Reference-application client registration; not a general API scope.
- scope: CCI-Prod-RLS-PREVIEW
  kind: application
  region: NA only
  description: Preview environment client registration; not a general API scope.
- scope: https://rls-preview.congacloud.au/mcp
  kind: resource
  region: AU only
  description: >-
    RFC 8707 resource indicator for Conga's MCP server. Present only in the AU
    discovery document; this string is how the otherwise-undocumented MCP surface
    was found. See mcp/conga-mcp.yml.
- scope: openid
  kind: oidc
  description: OpenID Connect authentication; issue an ID token.
- scope: profile
  kind: oidc
  description: Access to the user's default profile claims.
- scope: email
  kind: oidc
  description: Access to the user's email and email_verified claims.
- scope: address
  kind: oidc
  description: Access to the user's address claim.
- scope: phone
  kind: oidc
  description: Access to the user's phone_number claims.
- scope: external_claims
  kind: oidc
  description: Claims federated from an external identity provider.
- scope: force_login
  kind: oidc
  description: Force re-authentication rather than reusing an existing session.
- scope: offline_access
  kind: oidc
  description: Issue a refresh token for long-lived access.
regional_differences:
  note: >-
    The three production regions publish nearly identical scope sets. NA
    additionally advertises CCI-Prod-RLS-PREVIEW; AU additionally advertises the
    MCP resource indicator. EU advertises neither.
spec_declared_scopes:
  count: 0
  note: >-
    None of the 31 OpenAPI documents declare an oauth2 securityScheme - every one
    declares a single apiKey scheme named "Bearer" in the Authorization header
    ("Please insert JWT with Bearer into field"). The specs therefore carry no
    per-operation scope requirements, and the authorization surface is only
    visible from the OIDC discovery documents above. That mismatch is recorded in
    conformance/conga-conformance.yml.
checked: '2026-08-13'

Work with this as data

Every scope set here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for oauth scopes

4 MCP tools reach this

find_scopesBrowse and filter every scope set in the catalog.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This scope set

curl "https://apis.io/api/v1/scopes/conga-scopes"

All oauth scopes

curl "https://apis.io/api/v1/scopes?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.