Embrace · OAuth Scopes

Embrace OAuth Scopes

OAuth 2.0 probed

Embrace publishes 3 OAuth 2.0 scopes via the authorizationCode flow. Scopes are the fine-grained permissions an application requests at authorization time to act against the Embrace API on a user’s behalf.

Tokens are issued from https://dash-api.embrace.io/oauth/token.

This index is generated from the provider’s OpenAPI security definitions (and, where available, its documented scope reference) and refreshes on every APIs.io network build. Browse every provider’s scopes at scopes.apis.io.

CompanyObservabilityMonitoringMobileReal User MonitoringOpenTelemetryMetricsCrash ReportingApplication Performance MonitoringDeveloper ToolsModel Context Protocol

Scopes: 3 Flows: authorizationCode Method: probed

OAuth endpoints

Authorization URL
https://dash.embrace.io/oauth/authorize

Token URL
https://dash-api.embrace.io/oauth/token

Flows
authorizationCode

Scopes (3)

Scope	Description	Flows
mcp:tools:call	Invoke MCP tools. Required for any MCP access — a token without it cannot call a single tool regardless of what else it carries.	authorizationCode
mcp:read	Read data through the MCP server.	authorizationCode
mcp:write	Write data through the MCP server.	authorizationCode

📄 Provider scope reference: https://embrace.io/docs/product/settings/service-accounts/

Source

OAuth Scopes

generated: '2026-08-12'
method: probed
source: https://mcp.embrace.io/.well-known/oauth-authorization-server
docs: https://embrace.io/docs/product/settings/service-accounts/
description: >-
  Embrace's only OAuth scope surface is the MCP server. Three scopes are advertised in both the
  RFC 8414 authorization-server metadata and the RFC 9728 protected-resource metadata, and the
  same three are selectable when issuing a service-account bearer token in the dashboard. There
  is no OpenAPI document declaring oauth2 securitySchemes, so the derive-oauth-scopes.py pass has
  nothing to read; this file is built from the live discovery documents plus the docs, which is a
  stronger source than a derivation.
  The Metrics and Custom Metrics APIs are bearer-token APIs with no scope model at all.
schemes:
  - name: EmbraceMcpOAuth2
    source: well-known/embrace-mcp-oauth-authorization-server.json
    resource: https://mcp.embrace.io/mcp
    resource_name: Embrace MCP
    authorization_servers: [https://dash-api.embrace.io]
    bearer_methods_supported: [header]
    flows:
      - flow: authorizationCode
        authorizationUrl: https://dash.embrace.io/oauth/authorize
        tokenUrl: https://dash-api.embrace.io/oauth/token
        pkce: S256
scopes:
  - scope: mcp:tools:call
    description: >-
      Invoke MCP tools. Required for any MCP access — a token without it cannot call a single
      tool regardless of what else it carries.
    flows: [authorizationCode]
    required: true
    sources: [well-known/embrace-mcp-oauth-authorization-server.json, https://embrace.io/docs/product/settings/service-accounts/]
  - scope: mcp:read
    description: Read data through the MCP server.
    flows: [authorizationCode]
    required: false
    sources: [well-known/embrace-mcp-oauth-authorization-server.json, https://embrace.io/docs/product/settings/service-accounts/]
  - scope: mcp:write
    description: Write data through the MCP server.
    flows: [authorizationCode]
    required: false
    sources: [well-known/embrace-mcp-oauth-authorization-server.json, https://embrace.io/docs/product/settings/service-accounts/]
notes:
  - >-
    All 19 published MCP tools are read-oriented (list_/get_), so what mcp:write currently grants
    is not documented. Recorded as advertised, not interpreted.
  - >-
    The WordPress site MCP at https://embrace.io/wp-json/mcp/mcp-oauth-server advertises a single
    coarse "mcp" scope from a separate issuer (https://embrace.io). It is not part of the product
    API and is not merged into the scope list above.
scope_count: 3