Datavant · OAuth Scopes

Datavant OAuth Scopes

OAuth 2.0 probed

Datavant uses OAuth 2.0 but publishes no discrete scopes — access is governed by the grant itself (e.g. client-credentials or role-based authorization) rather than per-scope consent.

Tokens are issued from https://api.datavant.io/v2/oauth2/token.

This index is generated from the provider’s OpenAPI security definitions (and, where available, its documented scope reference) and refreshes on every APIs.io network build. Browse every provider’s scopes at scopes.apis.io.

HealthcareUnited StatesInteroperabilityHealth DataDe-IdentificationTokenizationReal-World DataRecord RetrievalData ConnectivityLife SciencesHIPAAMedical RecordsRelease of InformationPrivacyOAuth 2.0Health Information Exchange
Scopes: 0 Flows: clientCredentials, authorizationCode Method: probed

OAuth endpoints

Authorization URL
https://datavant.auth0.com/authorize
Token URL
https://api.datavant.io/v2/oauth2/token https://datavant.auth0.com/oauth/token
Flows
clientCredentialsauthorizationCode

Scopes (0)

Datavant implements OAuth 2.0 but publishes no discrete scopes — access is governed by the grant itself (client-credentials or role-based authorization) rather than per-scope consent.

The Datavant REST API declares an oauth2 clientCredentials scheme with an EMPTY scopes map, and no operation narrows security[], so the REST contract publishes ZERO API scopes - a token is all-or-nothing across all 54 operations. The scopes recorded below are the OIDC scopes advertised by Datavant's Auth0 tenant (probed anonymously at auth.datavant.com/.well-known/openid-configuration and captured verbatim to well-known/datavant-openid-configuration.json). They are identity/profile scopes for the Portal login flow, NOT authorization scopes for the record-retrieval API. This distinction is the finding: there is no published least-privilege surface for the REST API.

📄 Provider scope reference: https://auth.datavant.com/.well-known/openid-configuration

Source

OAuth Scopes

Raw ↑ 
generated: '2026-08-14'
method: probed
source: openapi/datavant-rest-api-openapi.yml
docs: https://auth.datavant.com/.well-known/openid-configuration
note: >-
  The Datavant REST API declares an oauth2 clientCredentials scheme with an EMPTY scopes map,
  and no operation narrows security[], so the REST contract publishes ZERO API scopes - a
  token is all-or-nothing across all 54 operations. The scopes recorded below are the OIDC
  scopes advertised by Datavant's Auth0 tenant (probed anonymously at
  auth.datavant.com/.well-known/openid-configuration and captured verbatim to
  well-known/datavant-openid-configuration.json). They are identity/profile scopes for the
  Portal login flow, NOT authorization scopes for the record-retrieval API. This distinction
  is the finding: there is no published least-privilege surface for the REST API.
schemes:
  - name: oauth2
    source: openapi/datavant-rest-api-openapi.yml
    kind: api
    flows:
      - flow: clientCredentials
        tokenUrl: https://api.datavant.io/v2/oauth2/token
        refreshUrl: https://api.datavant.io/v2/oauth2/token
        scopes_declared: 0
  - name: auth0-oidc
    source: well-known/datavant-openid-configuration.json
    kind: identity
    issuer: https://datavant.auth0.com/
    flows:
      - flow: authorizationCode
        authorizationUrl: https://datavant.auth0.com/authorize
        tokenUrl: https://datavant.auth0.com/oauth/token
        scopes_declared: 14
api_scopes: []
api_scope_count: 0
identity_scopes:
  - scope: openid
    description: Request an ID token (OIDC core).
    flows: [authorizationCode]
    sources: [well-known/datavant-openid-configuration.json]
  - scope: profile
    description: Basic profile claims.
    flows: [authorizationCode]
    sources: [well-known/datavant-openid-configuration.json]
  - scope: offline_access
    description: Issue a refresh token.
    flows: [authorizationCode]
    sources: [well-known/datavant-openid-configuration.json]
  - scope: name
    description: Full name claim.
    flows: [authorizationCode]
    sources: [well-known/datavant-openid-configuration.json]
  - scope: given_name
    description: Given name claim.
    flows: [authorizationCode]
    sources: [well-known/datavant-openid-configuration.json]
  - scope: family_name
    description: Family name claim.
    flows: [authorizationCode]
    sources: [well-known/datavant-openid-configuration.json]
  - scope: nickname
    description: Nickname claim.
    flows: [authorizationCode]
    sources: [well-known/datavant-openid-configuration.json]
  - scope: email
    description: Email address claim.
    flows: [authorizationCode]
    sources: [well-known/datavant-openid-configuration.json]
  - scope: email_verified
    description: Email verification status claim.
    flows: [authorizationCode]
    sources: [well-known/datavant-openid-configuration.json]
  - scope: picture
    description: Profile picture claim.
    flows: [authorizationCode]
    sources: [well-known/datavant-openid-configuration.json]
  - scope: created_at
    description: Account creation timestamp claim.
    flows: [authorizationCode]
    sources: [well-known/datavant-openid-configuration.json]
  - scope: identities
    description: Linked identity providers claim.
    flows: [authorizationCode]
    sources: [well-known/datavant-openid-configuration.json]
  - scope: phone
    description: Phone number claim.
    flows: [authorizationCode]
    sources: [well-known/datavant-openid-configuration.json]
  - scope: address
    description: Address claim.
    flows: [authorizationCode]
    sources: [well-known/datavant-openid-configuration.json]
identity_scope_count: 14