CoreLogic Australia OAuth Scopes

OAuth 2.0 searched

CoreLogic Australia publishes 5 OAuth 2.0 scopes via the authorizationCode, clientCredentials, and implicit flows. Scopes are the fine-grained permissions an application requests at authorization time to act against the CoreLogic Australia API on a user’s behalf.

Tokens are issued from https://auth.corelogic.asia/as/token.oauth2.

This index is generated from the provider’s OpenAPI security definitions (and, where available, its documented scope reference) and refreshes on every APIs.io network build. Browse every provider’s scopes at scopes.apis.io.

Real EstateAustraliaProperty DataValuationAVMPropTechProperty ListingsRentalsAuction DataCommercial Real EstateMortgageLand RegistryCotalityRP Data

Scopes: 5 Flows: authorizationCode, clientCredentials, implicit Method: searched

OAuth endpoints

Authorization URL
https://auth.corelogic.asia/as/authorization.oauth2

Token URL
https://auth.corelogic.asia/as/token.oauth2

Flows
authorizationCodeclientCredentialsimplicit

Scopes (5)

Scope	Description	Flows
openid	OpenID Connect base scope. The only scope observed in Cotality's own published data-API token requests (client_credentials against access.api.cotality.com.au).	authorizationCode, clientCredentials, implicit
profile	Standard OIDC profile claims for the portal user.	authorizationCode, implicit
email	Standard OIDC email claim for the portal user.	authorizationCode, implicit
phone	Standard OIDC phone claim for the portal user.	authorizationCode, implicit
address	Standard OIDC address claim for the portal user.	authorizationCode, implicit

📄 Provider scope reference: https://developer.corelogic.asia/guides/api-authentication

Source

OAuth Scopes

generated: '2026-07-26'
method: searched
source: https://auth.corelogic.asia/.well-known/openid-configuration
docs: https://developer.corelogic.asia/guides/api-authentication
finding: >-
  CoreLogic Australia has NO data-product OAuth scope surface. The only scopes published anywhere
  on the estate are the five PingFederate identity scopes advertised by the developer-portal
  identity provider, which govern human login to the portal — not access to property, valuation,
  auction or statistics data. The vendor's own published sample client_credentials token requests
  carry scope "openid" and nothing else; entitlement to data products is carried in JWT claims
  (roles, geo_codes, authorities) provisioned against a signed commercial licence, so a developer
  cannot request finer-grained access by asking for a scope. This is the recorded model, not an
  absence of research.
authorization_model: claims-based (roles / geo_codes / authorities in the JWT), not scope-based
schemes:
- name: CotalityDeveloperPortalOIDC
  source: well-known/corelogic-au-openid-configuration.json
  issuer: https://auth.corelogic.asia
  applies_to: developer portal human login
  flows:
  - flow: authorizationCode
    authorizationUrl: https://auth.corelogic.asia/as/authorization.oauth2
    tokenUrl: https://auth.corelogic.asia/as/token.oauth2
  - flow: clientCredentials
    tokenUrl: https://auth.corelogic.asia/as/token.oauth2
  - flow: implicit
    authorizationUrl: https://auth.corelogic.asia/as/authorization.oauth2
scopes:
- scope: openid
  description: >-
    OpenID Connect base scope. The only scope observed in Cotality's own published data-API token
    requests (client_credentials against access.api.cotality.com.au).
  flows: [authorizationCode, clientCredentials, implicit]
  sources: [well-known/corelogic-au-openid-configuration.json]
- scope: profile
  description: Standard OIDC profile claims for the portal user.
  flows: [authorizationCode, implicit]
  sources: [well-known/corelogic-au-openid-configuration.json]
- scope: email
  description: Standard OIDC email claim for the portal user.
  flows: [authorizationCode, implicit]
  sources: [well-known/corelogic-au-openid-configuration.json]
- scope: phone
  description: Standard OIDC phone claim for the portal user.
  flows: [authorizationCode, implicit]
  sources: [well-known/corelogic-au-openid-configuration.json]
- scope: address
  description: Standard OIDC address claim for the portal user.
  flows: [authorizationCode, implicit]
  sources: [well-known/corelogic-au-openid-configuration.json]
grant_types_supported:
- implicit
- authorization_code
- refresh_token
- password
- client_credentials
- urn:pingidentity.com:oauth2:grant_type:validate_bearer
- urn:ietf:params:oauth:grant-type:jwt-bearer
- urn:ietf:params:oauth:grant-type:saml2-bearer
- urn:ietf:params:oauth:grant-type:device_code
- urn:ietf:params:oauth:grant-type:token-exchange
- urn:openid:params:grant-type:ciba
data_api_grant_types_documented: [client_credentials, authorization_code, refresh_token]