Corporate Travel Management · OAuth Scopes

Corporate Travel Management OAuth Scopes

OAuth 2.0 searched

Corporate Travel Management publishes 14 OAuth 2.0 scopes via the authorizationCode, clientCredentials, deviceCode, and implicit flows. Scopes are the fine-grained permissions an application requests at authorization time to act against the Corporate Travel Management API on a user’s behalf.

Tokens are issued from https://travelctm-au-production.au.auth0.com/oauth/token.

This index is generated from the provider’s OpenAPI security definitions (and, where available, its documented scope reference) and refreshes on every APIs.io network build. Browse every provider’s scopes at scopes.apis.io.

TravelAustraliaCorporate TravelTravel Management CompanyAviationNDCDistributionBookingHotelsMeetings and Events

Scopes: 14 Flows: authorizationCode, clientCredentials, deviceCode, implicit Method: searched

OAuth endpoints

Authorization URL
https://travelctm-au-production.au.auth0.com/authorize

Token URL
https://travelctm-au-production.au.auth0.com/oauth/token

Flows
authorizationCodeclientCredentialsdeviceCodeimplicit

Scopes (14)

Scope	Description	Flows
openid	Request an ID token (OpenID Connect).
profile	Basic profile claims.
email	Email address claim.
email_verified	Email verification status claim.
offline_access	Issue a refresh token.
name	Full name claim.
given_name	Given name claim.
family_name	Family name claim.
nickname	Nickname claim.
picture	Profile picture claim.
phone	Phone number claim.
address	Address claim.
created_at	Account creation timestamp claim (Auth0 extension).
identities	Linked identity records claim (Auth0 extension).

📄 Provider scope reference:

Source

OAuth Scopes

generated: '2026-07-28'
method: searched
source: https://travelctm-au-production.au.auth0.com/.well-known/openid-configuration
docs: null
summary: >-
  Corporate Travel Management publishes no scope or permission reference — there is no public API to
  scope. The only scopes observable anywhere on a CTM property are the standard OpenID Connect
  scopes and claim-scopes advertised by CTM's Auth0 tenant discovery document. They are Auth0/OIDC
  defaults, not CTM-authored API permissions: no CTM resource scope (`read:bookings`,
  `write:travellers`, …) is published, and the CTM Portal host API declares no
  oauth-protected-resource metadata.
schemes:
- name: Auth0 OIDC (CTM Portal)
  source: well-known/corporate-travel-management-openid-configuration.json
  flows:
  - flow: authorizationCode
    authorizationUrl: https://travelctm-au-production.au.auth0.com/authorize
    tokenUrl: https://travelctm-au-production.au.auth0.com/oauth/token
    pkce: [S256, plain]
  - flow: clientCredentials
    tokenUrl: https://travelctm-au-production.au.auth0.com/oauth/token
  - flow: deviceCode
    deviceAuthorizationUrl: https://travelctm-au-production.au.auth0.com/oauth/device/code
  - flow: implicit
    authorizationUrl: https://travelctm-au-production.au.auth0.com/authorize
scopes:
- scope: openid
  description: Request an ID token (OpenID Connect).
  kind: oidc-standard
- scope: profile
  description: Basic profile claims.
  kind: oidc-standard
- scope: email
  description: Email address claim.
  kind: oidc-standard
- scope: email_verified
  description: Email verification status claim.
  kind: oidc-claim
- scope: offline_access
  description: Issue a refresh token.
  kind: oidc-standard
- scope: name
  description: Full name claim.
  kind: oidc-claim
- scope: given_name
  description: Given name claim.
  kind: oidc-claim
- scope: family_name
  description: Family name claim.
  kind: oidc-claim
- scope: nickname
  description: Nickname claim.
  kind: oidc-claim
- scope: picture
  description: Profile picture claim.
  kind: oidc-claim
- scope: phone
  description: Phone number claim.
  kind: oidc-standard
- scope: address
  description: Address claim.
  kind: oidc-standard
- scope: created_at
  description: Account creation timestamp claim (Auth0 extension).
  kind: auth0-extension
- scope: identities
  description: Linked identity records claim (Auth0 extension).
  kind: auth0-extension
ctm_resource_scopes: []
notes: >-
  Recorded because the discovery document is real and anonymously fetchable, not because CTM
  operates a scoped API programme. Any CTM-defined API scopes would live on an Auth0 API (audience)
  registration, which is not publicly enumerable.