ETSI · OAuth Scopes

ETSI OAuth Scopes

OAuth 2.0 searched

ETSI publishes 13 OAuth 2.0 scopes via the authorizationCode and clientCredentials flows. Scopes are the fine-grained permissions an application requests at authorization time to act against the ETSI API on a user’s behalf.

Tokens are issued from https://portal.openslice.eu/auth/realms/openslice/protocol/openid-connect/token.

This index is generated from the provider’s OpenAPI security definitions (and, where available, its documented scope reference) and refreshes on every APIs.io network build. Browse every provider’s scopes at scopes.apis.io.

TelecommunicationsFranceStandardsStandards BodyNetwork APIsEdge ComputingMECNFV5GCAMARATM Forum3GPPCAPIFNGSI-LDIoTOpen SourceEuropeOpenAPINetwork SlicingBroadband

Scopes: 13 Flows: authorizationCode, clientCredentials Method: searched

OAuth endpoints

Authorization URL
https://portal.openslice.eu/auth/realms/openslice/protocol/openid-connect/auth

Token URL
https://portal.openslice.eu/auth/realms/openslice/protocol/openid-connect/token {tokenUrl}

Flows
authorizationCodeclientCredentials

Scopes (13)

Scope	Description	Flows
read	Read access to the ETSI OpenSlice TM Forum Open API resources	authorizationCode
write	Write access to the ETSI OpenSlice TM Forum Open API resources	authorizationCode
admin	Administrative access to the OpenSlice realm	authorizationCode
openapi	Realm client scope used by the OpenSlice Swagger UI to obtain a token for try-it calls	authorizationCode
openid	Standard OpenID Connect scope	authorizationCode
profile	Standard OIDC profile claims	authorizationCode
email	Standard OIDC email claim	authorizationCode
roles	Keycloak realm/client role claims	authorizationCode
address	Standard OIDC address claim	authorizationCode
phone	Standard OIDC phone claim	authorizationCode
microprofile-jwt	MicroProfile JWT claim mapper scope	authorizationCode
web-origins	Keycloak CORS web-origins scope	authorizationCode
offline_access	Issues a refresh token usable while the user is offline	authorizationCode

📄 Provider scope reference: https://portal.openslice.eu/auth/realms/openslice/.well-known/openid-configurationhttps://forge.etsi.org/rep/.well-known/openid-configuration

Source

OAuth Scopes

generated: '2026-07-25'
method: searched
source: >-
  derived from the oauth2 securitySchemes in openapi/openslice-tmf/ and openapi/capif/, then
  upgraded with scopes_supported from the live OIDC discovery documents in well-known/
docs:
- https://portal.openslice.eu/auth/realms/openslice/.well-known/openid-configuration
- https://forge.etsi.org/rep/.well-known/openid-configuration
schemes:
- name: security_auth
  source: openapi/openslice-tmf/
  issuer: https://portal.openslice.eu/auth/realms/openslice
  flows:
  - flow: authorizationCode
    authorizationUrl: https://portal.openslice.eu/auth/realms/openslice/protocol/openid-connect/auth
    tokenUrl: https://portal.openslice.eu/auth/realms/openslice/protocol/openid-connect/token
- name: oAuth2ClientCredentials
  source: openapi/capif/
  flows:
  - flow: clientCredentials
    tokenUrl: '{tokenUrl}'
    note: OpenCAPIF issues no static scope list; access is governed by per-invoker access control policy
scopes:
- scope: read
  description: Read access to the ETSI OpenSlice TM Forum Open API resources
  flows: [authorizationCode]
  sources: [openapi/openslice-tmf/, well-known/etsi-openslice-openid-configuration.json]
- scope: write
  description: Write access to the ETSI OpenSlice TM Forum Open API resources
  flows: [authorizationCode]
  sources: [openapi/openslice-tmf/, well-known/etsi-openslice-openid-configuration.json]
- scope: admin
  description: Administrative access to the OpenSlice realm
  flows: [authorizationCode]
  sources: [well-known/etsi-openslice-openid-configuration.json]
  note: advertised by the Keycloak realm, not declared in any published OpenAPI
- scope: openapi
  description: Realm client scope used by the OpenSlice Swagger UI to obtain a token for try-it calls
  flows: [authorizationCode]
  sources: [well-known/etsi-openslice-openid-configuration.json]
- scope: openid
  description: Standard OpenID Connect scope
  flows: [authorizationCode]
  sources: [well-known/etsi-openslice-openid-configuration.json, well-known/etsi-forge-openid-configuration.json]
- scope: profile
  description: Standard OIDC profile claims
  flows: [authorizationCode]
  sources: [well-known/etsi-openslice-openid-configuration.json, well-known/etsi-forge-openid-configuration.json]
- scope: email
  description: Standard OIDC email claim
  flows: [authorizationCode]
  sources: [well-known/etsi-openslice-openid-configuration.json, well-known/etsi-forge-openid-configuration.json]
- scope: roles
  description: Keycloak realm/client role claims
  flows: [authorizationCode]
  sources: [well-known/etsi-openslice-openid-configuration.json]
- scope: address
  description: Standard OIDC address claim
  flows: [authorizationCode]
  sources: [well-known/etsi-openslice-openid-configuration.json]
- scope: phone
  description: Standard OIDC phone claim
  flows: [authorizationCode]
  sources: [well-known/etsi-openslice-openid-configuration.json]
- scope: microprofile-jwt
  description: MicroProfile JWT claim mapper scope
  flows: [authorizationCode]
  sources: [well-known/etsi-openslice-openid-configuration.json]
- scope: web-origins
  description: Keycloak CORS web-origins scope
  flows: [authorizationCode]
  sources: [well-known/etsi-openslice-openid-configuration.json]
- scope: offline_access
  description: Issues a refresh token usable while the user is offline
  flows: [authorizationCode]
  sources: [well-known/etsi-openslice-openid-configuration.json]
gitlab_platform_scopes:
  note: >-
    The two GitLab instances that host every machine-readable ETSI artefact are themselves OAuth
    2.0 authorization servers. These are GitLab platform scopes, not ETSI-authored ones, but they
    are the scopes any agent must request to write to forge.etsi.org or labs.etsi.org.
  issuers: [https://forge.etsi.org/rep, https://labs.etsi.org/rep]
  source: well-known/etsi-forge-openid-configuration.json
  scopes: [api, read_api, read_user, create_runner, manage_runner, k8s_proxy, self_rotate,
    mcp, mcp_orbit, read_repository, write_repository, read_registry, write_registry,
    read_virtual_registry, write_virtual_registry, read_observability, write_observability,
    ai_features, sudo, admin_mode, read_service_ping, openid, profile, email, ai_workflows, 'user:*']
  mcp_scopes:
  - scope: mcp
    description: Access the GitLab MCP server at /api/v4/mcp
    protected_resource: well-known/etsi-forge-oauth-protected-resource.json
  - scope: mcp_orbit
    description: Access the GitLab Orbit MCP server at /api/v4/orbit/mcp
    protected_resource: well-known/etsi-forge-oauth-protected-resource.json