EquipmentShare OAuth Scopes

generated: '2026-07-19'
method: searched
source: https://github.com/EquipmentShare/t3os-examples
docs: https://github.com/EquipmentShare/t3os-examples/tree/main/apps/oauth-hello-world
# T3OS user-delegated OAuth uses granular per-resource read scopes following the pattern
# `<resource>_reader`. The consent UI shows the user every scope an app requests; integrations
# are advised to request the narrowest scope that satisfies their queries. Standard OIDC scopes
# are served by the underlying Auth0 tenant (verified from its openid-configuration).
schemes:
- name: T3OS OAuth2
  source: https://github.com/EquipmentShare/t3os-examples
  flows:
  - flow: authorizationCode
    pkce: true
    authorizationUrl: https://equipmentshare-erp.us.auth0.com/authorize
    tokenUrl: https://equipmentshare-erp.us.auth0.com/oauth/token
    audience: https://api.equipmentshare.com/es-erp-api/delegated
scopes:
- scope: all_resources_reader
  description: Broadest read-only scope — read access across all T3OS resources the user can see.
  flows: [authorizationCode]
  sources: [https://github.com/EquipmentShare/t3os-examples/tree/main/apps/oauth-hello-world]
- scope: contact_reader
  description: Read access to contacts only (example of the narrow, per-resource read scope pattern).
  flows: [authorizationCode]
  sources: [https://github.com/EquipmentShare/t3os-examples/tree/main/apps/oauth-hello-world]
scope_pattern: "<resource>_reader"
oidc_scopes:
  source: https://equipmentshare-erp.us.auth0.com/.well-known/openid-configuration
  scopes: [openid, profile, email, offline_access, name, given_name, family_name, nickname, phone, address, picture]
notes: >-
  Only two scope names are published verbatim in the reference apps (all_resources_reader,
  contact_reader); the documented convention is per-resource `_reader` scopes. The full scope
  registry lives behind the T3OS dev portal (app.t3os.ai) and app registration.