DoubleVerify · OAuth Scopes

DoubleVerify OAuth Scopes

OAuth 2.0 probed

DoubleVerify publishes 21 OAuth 2.0 scopes via the authorizationCode, clientCredentials, and deviceCode flows. Scopes are the fine-grained permissions an application requests at authorization time to act against the DoubleVerify API on a user’s behalf.

Tokens are issued from https://dv-ciam.doubleverify.com/realms/pinnacle/protocol/openid-connect/token.

This index is generated from the provider’s OpenAPI security definitions (and, where available, its documented scope reference) and refreshes on every APIs.io network build. Browse every provider’s scopes at scopes.apis.io.

Ad VerificationAd MeasurementMedia QualityBrand SuitabilityViewabilityAttention MeasurementInvalid TrafficFraud DetectionContextual TargetingProgrammatic AdvertisingConnected TVSocial Media MeasurementCommerce MediaPublisher AnalyticsMRC AccreditedAdTech

Scopes: 21 Flows: authorizationCode, clientCredentials, deviceCode Method: probed

OAuth endpoints

Authorization URL
https://dv-ciam.doubleverify.com/realms/pinnacle/protocol/openid-connect/auth

Token URL
https://dv-ciam.doubleverify.com/realms/pinnacle/protocol/openid-connect/token

Flows
authorizationCodeclientCredentialsdeviceCode

Scopes (21)

Scope	Description	Flows
openid	Standard OIDC scope; requests an ID token.
email	Standard OIDC scope; releases the email and email_verified claims.
profile	Standard OIDC scope; releases basic profile claims.
address	Standard OIDC scope; releases the address claim.
phone	Standard OIDC scope; releases phone_number claims.
offline_access	Standard OIDC scope; requests a refresh token for offline use.
roles	Keycloak built-in; adds realm and client role mappings to the token.
roles-limited	A narrowed variant of the roles mapper.
web-origins	Keycloak built-in; adds allowed CORS web origins to the token.
microprofile-jwt	Keycloak built-in; emits MicroProfile JWT claims (upn, groups).
acr	Keycloak built-in; authentication context class reference.
amr	Keycloak built-in; authentication methods references.
basic	Keycloak built-in; core token claims (sub, auth_time).
service_account	Keycloak built-in; marks a client-credentials service-account token.
dv-agent-mcp-aud	DoubleVerify-specific audience scope for the DV Neura MCP agent surface. Its presence in the Pinnacle realm is the realm-side counterpart of the MCP server at mcp.doubleverify.com.
dv-agent-mcp-internal-aud	DoubleVerify-specific audience scope for an internal DV Neura MCP surface, distinct from the client-facing one above.
dv-apis-aud	DoubleVerify-specific audience scope for DV's API estate.
dv-attributes	DoubleVerify-specific scope releasing DV account/entitlement attributes into the token.
ums-aud	DoubleVerify-specific audience scope for a user-management service.
salesforce-id	DoubleVerify-specific scope releasing the linked Salesforce account identifier.
impersonation	Keycloak token-exchange impersonation scope.

📄 Provider scope reference:

Source

OAuth Scopes

generated: '2026-08-13'
method: probed
source: https://dv-ciam.doubleverify.com/realms/pinnacle/.well-known/openid-configuration
also_source: https://mcp.doubleverify.com/.well-known/oauth-protected-resource/mcp
docs: null
note: >-
  DoubleVerify publishes no scopes reference page — developer.doubleverify.com is behind a
  login. Every scope below is read verbatim from the `scopes_supported` array of the two
  discovery documents the provider serves anonymously. Descriptions marked
  `description_source: inferred` are our reading of the scope NAME and the realm it lives
  in, not text DoubleVerify published; they are labelled so they are never mistaken for a
  provider claim. No scope has been invented.

schemes:
- name: dv-ciam-pinnacle
  type: openIdConnect
  issuer: https://dv-ciam.doubleverify.com/realms/pinnacle
  flows:
  - flow: authorizationCode
    authorizationUrl: https://dv-ciam.doubleverify.com/realms/pinnacle/protocol/openid-connect/auth
    tokenUrl: https://dv-ciam.doubleverify.com/realms/pinnacle/protocol/openid-connect/token
  - flow: clientCredentials
    tokenUrl: https://dv-ciam.doubleverify.com/realms/pinnacle/protocol/openid-connect/token
  - flow: deviceCode
    deviceAuthorizationUrl: https://dv-ciam.doubleverify.com/realms/pinnacle/protocol/openid-connect/auth/device

resources:
- resource: https://mcp.doubleverify.com/mcp
  scopes_required:
  - openid
  - email
  - profile
  source: RFC 9728 protected-resource metadata

scopes:
- scope: openid
  description: Standard OIDC scope; requests an ID token.
  description_source: oidc-standard
  required_by:
  - https://mcp.doubleverify.com/mcp
- scope: email
  description: Standard OIDC scope; releases the email and email_verified claims.
  description_source: oidc-standard
  required_by:
  - https://mcp.doubleverify.com/mcp
- scope: profile
  description: Standard OIDC scope; releases basic profile claims.
  description_source: oidc-standard
  required_by:
  - https://mcp.doubleverify.com/mcp
- scope: address
  description: Standard OIDC scope; releases the address claim.
  description_source: oidc-standard
- scope: phone
  description: Standard OIDC scope; releases phone_number claims.
  description_source: oidc-standard
- scope: offline_access
  description: Standard OIDC scope; requests a refresh token for offline use.
  description_source: oidc-standard
- scope: roles
  description: Keycloak built-in; adds realm and client role mappings to the token.
  description_source: keycloak-builtin
- scope: roles-limited
  description: A narrowed variant of the roles mapper.
  description_source: inferred
- scope: web-origins
  description: Keycloak built-in; adds allowed CORS web origins to the token.
  description_source: keycloak-builtin
- scope: microprofile-jwt
  description: Keycloak built-in; emits MicroProfile JWT claims (upn, groups).
  description_source: keycloak-builtin
- scope: acr
  description: Keycloak built-in; authentication context class reference.
  description_source: keycloak-builtin
- scope: amr
  description: Keycloak built-in; authentication methods references.
  description_source: keycloak-builtin
- scope: basic
  description: Keycloak built-in; core token claims (sub, auth_time).
  description_source: keycloak-builtin
- scope: service_account
  description: Keycloak built-in; marks a client-credentials service-account token.
  description_source: keycloak-builtin
- scope: dv-agent-mcp-aud
  description: DoubleVerify-specific audience scope for the DV Neura MCP agent surface.
    Its presence in the Pinnacle realm is the realm-side counterpart of the MCP server at
    mcp.doubleverify.com.
  description_source: inferred
  vendor_specific: true
- scope: dv-agent-mcp-internal-aud
  description: DoubleVerify-specific audience scope for an internal DV Neura MCP surface,
    distinct from the client-facing one above.
  description_source: inferred
  vendor_specific: true
- scope: dv-apis-aud
  description: DoubleVerify-specific audience scope for DV's API estate.
  description_source: inferred
  vendor_specific: true
- scope: dv-attributes
  description: DoubleVerify-specific scope releasing DV account/entitlement attributes
    into the token.
  description_source: inferred
  vendor_specific: true
- scope: ums-aud
  description: DoubleVerify-specific audience scope for a user-management service.
  description_source: inferred
  vendor_specific: true
- scope: salesforce-id
  description: DoubleVerify-specific scope releasing the linked Salesforce account
    identifier.
  description_source: inferred
  vendor_specific: true
- scope: impersonation
  description: Keycloak token-exchange impersonation scope.
  description_source: keycloak-builtin

x-evidence:
  fetched: '2026-08-13'
  probes:
  - url: https://dv-ciam.doubleverify.com/realms/pinnacle/.well-known/openid-configuration
    http_status: 200
  - url: https://mcp.doubleverify.com/.well-known/oauth-protected-resource/mcp
    http_status: 200