Fortify Software · OAuth Scopes

Fortify Software OAuth Scopes

OAuth 2.0 searched

Fortify Software publishes 13 OAuth 2.0 scopes via the clientCredentials flow. Scopes are the fine-grained permissions an application requests at authorization time to act against the Fortify Software API on a user’s behalf.

Tokens are issued from https://api.ams.fortify.com/oauth/token.

This index is generated from the provider’s OpenAPI security definitions (and, where available, its documented scope reference) and refreshes on every APIs.io network build. Browse every provider’s scopes at scopes.apis.io.

CompanySecurityApplication SecurityAppSecSASTDASTVulnerability ManagementDevSecOpsSoftware Composition AnalysisAPI Security

Scopes: 13 Flows: clientCredentials Method: searched

OAuth endpoints

Token URL
https://api.ams.fortify.com/oauth/token

Flows
clientCredentials

Scopes (13)

Scope	Description	Flows
api-tenant	Broad tenant-level API access scope.
view-apps	Read access to applications and releases.
manage-apps	Read-write access to applications and releases.
view-issues	Read access to vulnerabilities / issues.
manage-issues	Read-write access to vulnerabilities / issues (audit, suppress, comment).
start-scans	Permission to start static, dynamic, mobile and open-source scans.
view-reports	Read access to reports and data exports.
manage-reports	Read-write access to create and manage reports and data exports.
view-users	Read access to users and user groups.
manage-users	Read-write access to users and user groups.
manage-user	Manage an individual user account.
view-tenant-data	Read access to tenant-level data (entitlements, summaries, heatmaps).
manage-notifications	Read-write access to notifications.

📄 Provider scope reference: https://www.microfocus.com/documentation/fortify-on-demand/

Source

OAuth Scopes

generated: '2026-07-19'
method: searched
source: openapi/fortify-software-fod-openapi.json
docs: https://www.microfocus.com/documentation/fortify-on-demand/
notes: >-
  Scopes extracted verbatim from the "Allowed Scopes:" clause in every operation
  description of the Fortify on Demand v3 Swagger document, cross-referenced with
  the FoD API access documentation. FoD uses OAuth 2.0 client-credentials; the
  requested `scope` gates operation access. `api-tenant` is the broad tenant scope;
  the view-*/manage-* pairs are read vs. read-write per domain.
schemes:
- name: OAuth2ClientCredentials
  source: openapi/fortify-software-fod-openapi.json
  flows:
  - flow: clientCredentials
    tokenUrl: https://api.ams.fortify.com/oauth/token
scopes:
- scope: api-tenant
  description: Broad tenant-level API access scope.
- scope: view-apps
  description: Read access to applications and releases.
- scope: manage-apps
  description: Read-write access to applications and releases.
- scope: view-issues
  description: Read access to vulnerabilities / issues.
- scope: manage-issues
  description: Read-write access to vulnerabilities / issues (audit, suppress, comment).
- scope: start-scans
  description: Permission to start static, dynamic, mobile and open-source scans.
- scope: view-reports
  description: Read access to reports and data exports.
- scope: manage-reports
  description: Read-write access to create and manage reports and data exports.
- scope: view-users
  description: Read access to users and user groups.
- scope: manage-users
  description: Read-write access to users and user groups.
- scope: manage-user
  description: Manage an individual user account.
- scope: view-tenant-data
  description: Read access to tenant-level data (entitlements, summaries, heatmaps).
- scope: manage-notifications
  description: Read-write access to notifications.