Cox Automotive · OAuth Scopes

Cox Automotive OAuth Scopes

OAuth 2.0 searched

Cox Automotive uses OAuth 2.0 but publishes no discrete scopes — access is governed by the grant itself (e.g. client-credentials or role-based authorization) rather than per-scope consent.

Tokens are issued from https://api.manheim.com/oauth2/token.oauth2.

This index is generated from the provider’s OpenAPI security definitions (and, where available, its documented scope reference) and refreshes on every APIs.io network build. Browse every provider’s scopes at scopes.apis.io.

AutomotiveVehicle DataVehicle ValuationsAuctionsDealer SoftwareAutomotive RetailVIN DecodingInventory ManagementRemarketingEventWebhook

Scopes: 0 Flows: clientCredentials, password Method: searched

OAuth endpoints

Token URL
https://api.manheim.com/oauth2/token.oauth2 https://uat.api.manheim.com/oauth2/token.oauth2

Flows
clientCredentialspassword

Scopes (0)

Cox Automotive implements OAuth 2.0 but publishes no discrete scopes — access is governed by the grant itself (client-credentials or role-based authorization) rather than per-scope consent.

Manheim's OAuth 2.0 implementation is scope-aware — the token request accepts a space-delimited `scope` parameter and the authorization server, per RFC 6749, attaches no scopes unless the client sends them — but Cox Automotive does NOT publish a scope registry. The documentation states only that "Manheim determines which scope(s) are appropriate for each API client" and shows an opaque example (`scope=APP1%3AABC%20APP@%3ACDE`), implying an `APP:ACCOUNT` shaped value assigned per client rather than a fixed vocabulary. A client that omits `scope` still receives a token, but any call to a scope-protected endpoint then fails. No scope list is derivable from the five harvested Kelley Blue Book Swagger 2.0 contracts either — all of them declare apiKey security, not oauth2.

📄 Provider scope reference: https://developer.manheim.com/pages/authentication.html

Source

OAuth Scopes

generated: '2026-09-13'
method: searched
source: https://developer.manheim.com/pages/authentication.html
docs: https://developer.manheim.com/pages/authentication.html
note: >-
  Manheim's OAuth 2.0 implementation is scope-aware — the token request accepts a space-delimited
  `scope` parameter and the authorization server, per RFC 6749, attaches no scopes unless the client
  sends them — but Cox Automotive does NOT publish a scope registry. The documentation states only that
  "Manheim determines which scope(s) are appropriate for each API client" and shows an opaque example
  (`scope=APP1%3AABC%20APP@%3ACDE`), implying an `APP:ACCOUNT` shaped value assigned per client rather
  than a fixed vocabulary. A client that omits `scope` still receives a token, but any call to a
  scope-protected endpoint then fails. No scope list is derivable from the five harvested Kelley Blue
  Book Swagger 2.0 contracts either — all of them declare apiKey security, not oauth2.
schemes:
- name: ManheimOAuth2
  source: https://developer.manheim.com/pages/authentication.html
  flows:
  - flow: clientCredentials
    tokenUrl: https://api.manheim.com/oauth2/token.oauth2
  - flow: clientCredentials
    tokenUrl: https://uat.api.manheim.com/oauth2/token.oauth2
  - flow: password
    tokenUrl: https://api.manheim.com/oauth2/token.oauth2
scopes: []
scope_count: 0
scope_registry_published: false
gap:
  finding: >-
    Scopes are enforced but undocumented. An integrator cannot discover which scopes an API requires
    before requesting access, and cannot self-diagnose a scope-related 401/403.
  remedy: >-
    Publish the scope vocabulary per API on developer.manheim.com and in the storefront product pages,
    and declare oauth2 securitySchemes with a populated `scopes` map in the machine-readable contracts.

Work with this as data

Every scope set here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for oauth scopes

4 MCP tools reach this

find_scopesBrowse and filter every scope set in the catalog.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This scope set

curl "https://apis.io/api/v1/scopes/cox-automotive-scopes"

All oauth scopes

curl "https://apis.io/api/v1/scopes?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.