DoiT · OAuth Scopes

DoiT OAuth Scopes

OAuth 2.0 searched

DoiT publishes 4 OAuth 2.0 scopes via the authorizationCode flow. Scopes are the fine-grained permissions an application requests at authorization time to act against the DoiT API on a user’s behalf.

Tokens are issued from https://console.doit.com/api/auth/token.

This index is generated from the provider’s OpenAPI security definitions (and, where available, its documented scope reference) and refreshes on every APIs.io network build. Browse every provider’s scopes at scopes.apis.io.

CompanyFinOpsCloud Cost ManagementCloud IntelligenceCost OptimizationMulticloudKubernetesAnalyticsMCPArtificial Intelligence

Scopes: 4 Flows: authorizationCode Method: searched

OAuth endpoints

Authorization URL
https://console.doit.com/sign-in/oauth

Token URL
https://console.doit.com/api/auth/token

Flows
authorizationCode

Scopes (4)

Scope	Description	Flows
dci	Access All Data	authorizationCode
mcp:tools	Invoke tools exposed by the DoiT MCP server
mcp:resources	Read resources exposed by the DoiT MCP server
offline_access	Obtain a refresh token for long-lived access without re-authorization

📄 Provider scope reference: https://developer.doit.com/docs/start

Source

OAuth Scopes

generated: '2026-08-12'
method: searched
source: openapi/doit-openapi-original.yml + https://mcp.doit.com/.well-known/oauth-protected-resource
docs: https://developer.doit.com/docs/start
note: DoiT runs two OAuth surfaces from one authorization server. The DoiT Platform API
  declares a single coarse scope (dci — "Access All Data"), and the MCP resource declares
  three of its own. Neither surface publishes a fine-grained read/write scope taxonomy;
  authorization is enforced by the DoiT role or service-account permissions behind the
  token, not by scope. An agent cannot request least privilege through scopes here.
authorization_server:
  issuer: https://console.doit.com
  metadata: https://console.doit.com/.well-known/oauth-authorization-server
  authorization_endpoint: https://console.doit.com/oauth/authorize
  token_endpoint: https://console.doit.com/api/auth/token
  registration_endpoint: https://console.doit.com/api/oauth/register
  revocation_endpoint: https://console.doit.com/api/oauth/revoke
  jwks_uri: https://console.doit.com/.well-known/jwks.json
  grant_types:
  - authorization_code
  - refresh_token
  - urn:ietf:params:oauth:grant-type:token-exchange
  pkce: S256
  resource_indicators_supported: true
schemes:
- name: oauth2
  source: openapi/doit-openapi-original.yml
  flows:
  - flow: authorizationCode
    authorizationUrl: https://console.doit.com/sign-in/oauth
    tokenUrl: https://console.doit.com/api/auth/token
- name: mcp-oauth
  source: https://mcp.doit.com/.well-known/oauth-protected-resource
  resource: https://mcp.doit.com
  authorization_servers:
  - https://console.doit.com
  bearer_methods_supported:
  - header
scopes:
- scope: dci
  description: Access All Data
  surface: DoiT Platform API (https://api.doit.com)
  flows:
  - authorizationCode
  sources:
  - openapi/doit-openapi-original.yml
  note: The only scope the API contract declares. It is all-or-nothing — there is no
    read-only variant.
- scope: mcp:tools
  description: Invoke tools exposed by the DoiT MCP server
  surface: DoiT MCP server (https://mcp.doit.com)
  sources:
  - https://mcp.doit.com/.well-known/oauth-protected-resource
- scope: mcp:resources
  description: Read resources exposed by the DoiT MCP server
  surface: DoiT MCP server (https://mcp.doit.com)
  sources:
  - https://mcp.doit.com/.well-known/oauth-protected-resource
- scope: offline_access
  description: Obtain a refresh token for long-lived access without re-authorization
  surface: DoiT MCP server (https://mcp.doit.com)
  sources:
  - https://mcp.doit.com/.well-known/oauth-protected-resource
permission_model:
  mechanism: role-based, enforced per operation behind the token
  detail: Personal API tokens inherit the creating user's role permissions and narrow
    if that role changes. Service-account tokens use the service account's current permissions,
    with changes effective immediately and removed permissions producing 403 on affected
    endpoints. Each API operation enforces its own permissions independently of scope.
  docs: https://developer.doit.com/docs/start
x-evidence:
- url: https://api.doit.com/openapi.yaml
  http_status: 200
  fetched: '2026-08-12'
- url: https://mcp.doit.com/.well-known/oauth-protected-resource
  http_status: 200
  fetched: '2026-08-12'
- url: https://console.doit.com/.well-known/oauth-authorization-server
  http_status: 200
  fetched: '2026-08-12'
- url: https://developer.doit.com/docs/start
  http_status: 200
  fetched: '2026-08-12'