Dun & Bradstreet · OAuth Scopes

Dun & Bradstreet OAuth Scopes

OAuth 2.0 probed

Dun & Bradstreet publishes 6 OAuth 2.0 scopes via the authorizationCode and clientCredentials flows. Scopes are the fine-grained permissions an application requests at authorization time to act against the Dun & Bradstreet API on a user’s behalf.

Tokens are issued from https://agents.riskanalytics.dnb.com/token.

This index is generated from the provider’s OpenAPI security definitions (and, where available, its documented scope reference) and refreshes on every APIs.io network build. Browse every provider’s scopes at scopes.apis.io.

Business DataCompany DataD-U-N-S NumberCreditRiskMaster DataData EnrichmentIdentity ResolutionComplianceSupply ChainSales IntelligenceMonitoring

Scopes: 6 Flows: authorizationCode, clientCredentials Method: probed

OAuth endpoints

Authorization URL
https://agents.riskanalytics.dnb.com/authorize

Token URL
https://agents.riskanalytics.dnb.com/token

Flows
authorizationCodeclientCredentials

Scopes (6)

Scope	Description	Flows
mcp.read	Read access to the D&B Risk Analytics MCP surface. Description is inferred from the scope name; D&B publishes no scope reference page.	authorizationCode, clientCredentials
mcp.write	Write access to the D&B Risk Analytics MCP surface. Description is inferred from the scope name; D&B publishes no scope reference page.	authorizationCode, clientCredentials
offline_access	Issue a refresh token so the client can reconnect without re-authorizing.	authorizationCode
openid	OpenID Connect authentication (standard OIDC scope).	authorizationCode
email	Release the authenticated user's email address (standard OIDC scope).	authorizationCode
profile	Release the authenticated user's profile claims (standard OIDC scope).	authorizationCode

📄 Provider scope reference:

Source

OAuth Scopes

generated: '2026-08-13'
method: probed
source: https://agents.riskanalytics.dnb.com/.well-known/oauth-authorization-server
description: >-
  OAuth scope surface for Dun & Bradstreet. The Direct+ REST OpenAPI declares
  no oauth2 securityScheme (it models the token exchange as an explicit
  operation plus http basic/bearer), so derive-oauth-scopes.py finds nothing
  there. The real scope surface is published by the D&B Risk Analytics remote
  MCP server, which serves RFC 8414 authorization-server metadata anonymously.
  Every scope below was read verbatim from that document.

schemes:
  - name: D&B Risk Analytics MCP authorization server
    source: https://agents.riskanalytics.dnb.com/.well-known/oauth-authorization-server
    issuer: https://agents.riskanalytics.dnb.com
    protected_resource: https://agents.riskanalytics.dnb.com/mcp
    flows:
      - flow: authorizationCode
        authorizationUrl: https://agents.riskanalytics.dnb.com/authorize
        tokenUrl: https://agents.riskanalytics.dnb.com/token
        pkce: [S256, plain]
      - flow: clientCredentials
        tokenUrl: https://agents.riskanalytics.dnb.com/token
    refresh_token: true
    token_endpoint_auth_methods: [client_secret_basic, client_secret_post]

scopes:
  - scope: mcp.read
    description: >-
      Read access to the D&B Risk Analytics MCP surface. Description is
      inferred from the scope name; D&B publishes no scope reference page.
    flows: [authorizationCode, clientCredentials]
    sources: [https://agents.riskanalytics.dnb.com/.well-known/oauth-authorization-server]
  - scope: mcp.write
    description: >-
      Write access to the D&B Risk Analytics MCP surface. Description is
      inferred from the scope name; D&B publishes no scope reference page.
    flows: [authorizationCode, clientCredentials]
    sources: [https://agents.riskanalytics.dnb.com/.well-known/oauth-authorization-server]
  - scope: offline_access
    description: Issue a refresh token so the client can reconnect without re-authorizing.
    flows: [authorizationCode]
    sources: [https://agents.riskanalytics.dnb.com/.well-known/oauth-authorization-server]
  - scope: openid
    description: OpenID Connect authentication (standard OIDC scope).
    flows: [authorizationCode]
    sources: [https://agents.riskanalytics.dnb.com/.well-known/oauth-authorization-server]
  - scope: email
    description: Release the authenticated user's email address (standard OIDC scope).
    flows: [authorizationCode]
    sources: [https://agents.riskanalytics.dnb.com/.well-known/oauth-authorization-server]
  - scope: profile
    description: Release the authenticated user's profile claims (standard OIDC scope).
    flows: [authorizationCode]
    sources: [https://agents.riskanalytics.dnb.com/.well-known/oauth-authorization-server]

other_credentials:
  - name: Direct+ client_credentials token exchange
    scopes: none
    note: >-
      POST https://plus.dnb.com/v3/token with grant_type=client_credentials
      and HTTP Basic (consumer key : consumer secret) returns a bearer JWT.
      The exchange carries NO scope parameter — Direct+ entitlement is
      contract-driven (which Data Blocks a customer licensed), not
      scope-driven. See authentication/dun-and-bradstreet-authentication.yml.
  - name: Dplus-API-Key
    scopes: none
    note: >-
      The Commercial Graph / Direct+ MCP server authenticates with a single
      API key header and exposes no scope surface.

absences:
  - No scope reference / permissions page published by D&B.
  - >-
    The scopes_supported list advertises openid/email/profile but the host
    serves no /.well-known/openid-configuration (404).
  - The Direct+ REST API has no OAuth scope model at all.