Fixflo · OAuth Scopes

Fixflo OAuth Scopes

OAuth 2.0 searched

Fixflo publishes 4 OAuth 2.0 scopes. Scopes are the fine-grained permissions an application requests at authorization time to act against the Fixflo API on a user’s behalf.

This index is generated from the provider’s OpenAPI security definitions (and, where available, its documented scope reference) and refreshes on every APIs.io network build. Browse every provider’s scopes at scopes.apis.io.

Real EstateUnited KingdomProperty ManagementPropTechRepairs and MaintenanceBlock ManagementLettingsRentalsCommercial Real EstateContractors

Scopes: 4 Flows: Method: searched

Scopes (4)

Scope	Description	Flows
openid	Request an ID token and the OpenID Connect authentication response.	authorizationCode
profile	Profile claims about the authenticated Fixflo user (name, given_name, family_name, preferred_username).	authorizationCode
email	The authenticated Fixflo user's email claim.	authorizationCode
offline_access	Issue a refresh token so the client can obtain new access tokens without user interaction.	authorizationCode

📄 Provider scope reference: https://api.fixflo.com/.well-known/openid-configuration

Source

OAuth Scopes

generated: '2026-07-26'
method: searched
source: well-known/fixflo-oauth-authorization-server.json
docs: https://api.fixflo.com/.well-known/openid-configuration
scope: application-login-only
note: >-
  The documented Fixflo v2 REST API has NO scope surface — it is authorised by a
  single opaque bearer token whose privileges are those of the Fixflo user who
  generated it, and the published OpenAPI declares no oauth2 security scheme.
  The scopes below are the real, anonymously published scopes of the SEPARATE
  Fixflo application authorization server at api.fixflo.com (RFC 8414 metadata +
  OIDC discovery). They govern the Fixflo web application login, not v2 REST
  authorisation. Recorded because they are genuinely published; not presented as
  API scopes.
authorization_server:
  issuer: https://api.fixflo.com/
  metadata:
  - https://api.fixflo.com/.well-known/oauth-authorization-server
  - https://api.fixflo.com/.well-known/openid-configuration
  authorizationUrl: https://api.fixflo.com/api/oauth2/authorize
  tokenUrl: https://api.fixflo.com/api/oauth2/token
  introspectionUrl: https://api.fixflo.com/api/oauth2/introspection
  grant_types:
  - authorization_code
  - password
  - refresh_token
  pkce:
  - S256
  - plain
scopes:
- scope: openid
  description: Request an ID token and the OpenID Connect authentication response.
  flows: [authorizationCode]
  sources: [well-known/fixflo-oauth-authorization-server.json]
- scope: profile
  description: >-
    Profile claims about the authenticated Fixflo user (name, given_name,
    family_name, preferred_username).
  flows: [authorizationCode]
  sources: [well-known/fixflo-oauth-authorization-server.json]
- scope: email
  description: The authenticated Fixflo user's email claim.
  flows: [authorizationCode]
  sources: [well-known/fixflo-oauth-authorization-server.json]
- scope: offline_access
  description: Issue a refresh token so the client can obtain new access tokens without user interaction.
  flows: [authorizationCode]
  sources: [well-known/fixflo-oauth-authorization-server.json]
rest_api_scopes:
  count: 0
  reason: >-
    Fixflo API v2 uses a single-privilege bearer token, not scoped OAuth. There
    is no documented per-resource or per-verb scope, and no way to request a
    reduced-privilege API token.