Dust Identity OAuth Scopes

generated: '2026-08-12'
method: probed
source: https://authd.dustid.io/.well-known/openid-configuration
docs: https://docs.dustid.io/api/authentication/
note: >-
  The DUST API's own OpenAPI declares a single `Bearer` http/JWT scheme with no oauth2
  block, so the mechanical derivation from the spec found zero scopes. The scope surface
  is instead published by AuthD, the account service, in its OpenID Connect discovery
  document — which is anonymous and was fetched directly. Two facts a consumer needs:
  (1) the DUST API does not perform per-scope authorization on /api/v1/* — authorization
  is evaluated from the Service Account's team memberships and grants, named by the
  Dust-Ctx-Org-Id / Dust-Ctx-Team-Id context headers, not from token scopes; (2) the
  non-OIDC entries in scopes_supported below, `read:widgets` and `write:widgets`, are
  the stock placeholder scopes shipped by the underlying auth library and do not
  correspond to any documented DUST capability. They are recorded verbatim because the
  provider serves them, and flagged because an integrator should not build against them.
schemes:
- name: DUST AuthD OpenID Connect
  source: well-known/dust-identity-openid-configuration.json
  issuer: https://authd.dustid.io/api/auth
  flows:
  - flow: authorizationCode
    authorizationUrl: https://authd.dustid.io/api/auth/oauth2/authorize
    tokenUrl: https://authd.dustid.io/api/auth/oauth2/token
    pkce: [S256]
    response_types: [code]
    response_modes: [query]
  - flow: refreshToken
    tokenUrl: https://authd.dustid.io/api/auth/oauth2/token
  - flow: clientCredentials
    tokenUrl: https://authd.dustid.io/api/auth/dust/service-accounts/token
    source: https://docs.dustid.io/api/authentication/
    note: >-
      The Service Account client_credentials endpoint is documented on the authentication
      page but is not listed in the OIDC discovery document, which advertises only
      authorization_code and refresh_token. This is the grant enterprise middleware
      (SAP Integration Suite, MuleSoft, Boomi) is directed to use.
  token_endpoint_auth_methods: [client_secret_basic, client_secret_post]
  introspection_endpoint: https://authd.dustid.io/api/auth/oauth2/introspect
  revocation_endpoint: https://authd.dustid.io/api/auth/oauth2/revoke
  userinfo_endpoint: https://authd.dustid.io/api/auth/oauth2/userinfo
  jwks_uri: https://authd.dustid.io/api/auth/jwks
  end_session_endpoint: https://authd.dustid.io/api/auth/oauth2/end-session
  id_token_signing_alg: [EdDSA]
scopes:
- scope: openid
  description: Standard OpenID Connect scope — request an ID token.
  flows: [authorizationCode]
  standard: oidc
  sources: [well-known/dust-identity-openid-configuration.json]
- scope: email
  description: Release the `email` and `email_verified` claims.
  flows: [authorizationCode]
  standard: oidc
  sources: [well-known/dust-identity-openid-configuration.json]
- scope: profile
  description: Release the `name`, `picture`, `given_name` and `family_name` claims.
  flows: [authorizationCode]
  standard: oidc
  sources: [well-known/dust-identity-openid-configuration.json]
- scope: offline_access
  description: Issue a refresh token so the client can renew without user interaction.
  flows: [authorizationCode, refreshToken]
  standard: oidc
  sources: [well-known/dust-identity-openid-configuration.json]
- scope: read:widgets
  description: null
  flows: [authorizationCode]
  standard: null
  status: placeholder
  sources: [well-known/dust-identity-openid-configuration.json]
  note: >-
    Advertised in scopes_supported but undocumented and unmapped to any DUST resource.
    "Widgets" is the stock example scope of the auth library; DUST has no widget
    resource. Do not build against it.
- scope: write:widgets
  description: null
  flows: [authorizationCode]
  standard: null
  status: placeholder
  sources: [well-known/dust-identity-openid-configuration.json]
  note: See read:widgets — placeholder scope, not a DUST capability.
claims_supported: [sub, iss, aud, exp, iat, sid, scope, azp, email, email_verified,
  name, picture, family_name, given_name]
acr_values_supported: [urn:mace:incommon:iap:bronze]
prompt_values_supported: [login, consent, create, select_account, none]
authorization_model:
  api_authorization: team-membership
  detail: >-
    /api/v1/* authorization is evaluated for the caller acting in the team named by the
    Dust-Ctx-Team-Id header — what it can list, read and write is that team's own records
    plus whatever has been shared with it. OAuth scopes do not gate DUST API operations.
  see: conventions/dust-identity-conventions.yml
summary:
  scope_count: 6
  oidc_standard_scopes: 4
  dust_specific_scopes: 0
  placeholder_scopes: 2
  api_gated_by_scopes: false