Fullcast · OAuth Scopes

Fullcast OAuth Scopes

OAuth 2.0 probed

Fullcast publishes 7 OAuth 2.0 scopes via the authorizationCode flow. Scopes are the fine-grained permissions an application requests at authorization time to act against the Fullcast API on a user’s behalf.

Tokens are issued from https://assistant.fullcast.io/oauth/token.

This index is generated from the provider’s OpenAPI security definitions (and, where available, its documented scope reference) and refreshes on every APIs.io network build. Browse every provider’s scopes at scopes.apis.io.

CompanyEnterpriseRevenue OperationsSales PlanningTerritory ManagementGo-to-MarketIncentive CompensationForecastingLead RoutingMCPAI AgentsModel Context ProtocolSales Compensation

Scopes: 7 Flows: authorizationCode Method: probed

OAuth endpoints

Authorization URL
https://assistant.fullcast.io/oauth/authorize https://app.fullcast.io/mcp/authorize

Token URL
https://assistant.fullcast.io/oauth/token https://app.fullcast.io/mcp/token

Flows
authorizationCode

Scopes (7)

Scope	Description	Flows
openid	OpenID Connect subject identifier (standard scope meaning; not provider-documented)	authorizationCode
email	User email address (standard scope meaning; not provider-documented)	authorizationCode
profile	Basic user profile claims (standard scope meaning; not provider-documented)	authorizationCode
offline_access	Issue a refresh token for long-lived agent sessions	authorizationCode
mcp:tools	Call MCP tools on the Fullcast Assistant MCP server	authorizationCode
mcp:resources	Read MCP resources (the fullcast://resource/* guidance documents)	authorizationCode
mcp:prompts	Read MCP prompts exposed by the server	authorizationCode

📄 Provider scope reference:

Source

OAuth Scopes

generated: '2026-08-13'
method: probed
source: https://assistant.fullcast.io/.well-known/oauth-authorization-server
sources:
- https://assistant.fullcast.io/.well-known/oauth-authorization-server
- https://assistant.fullcast.io/.well-known/oauth-protected-resource
- https://app.fullcast.io/mcp/.well-known/oauth-authorization-server
note: >-
  Fullcast's OpenAPI declares no oauth2 security scheme, so the mechanical derive pass found
  nothing. The scopes below were read directly from live RFC 8414 / RFC 9728 metadata on the
  MCP hosts, which is where Fullcast's real OAuth surface is described. No human-readable
  scopes reference page is published; descriptions below are the standard meaning of each
  registered scope, marked as such.
schemes:
- name: Fullcast Assistant OAuth 2.1
  issuer: https://assistant.fullcast.io
  source: well-known/fullcast-assistant-oauth-authorization-server.json
  dynamic_client_registration: https://assistant.fullcast.io/oauth/register
  flows:
  - flow: authorizationCode
    authorizationUrl: https://assistant.fullcast.io/oauth/authorize
    tokenUrl: https://assistant.fullcast.io/oauth/token
    userinfoUrl: https://assistant.fullcast.io/oauth/userinfo
    pkce: [plain, S256]
    token_endpoint_auth_methods: [client_secret_post, none]
- name: Fullcast MCP OAuth 2.1
  issuer: https://app.fullcast.io/mcp
  source: well-known/fullcast-app-mcp-oauth-authorization-server.json
  dynamic_client_registration: https://app.fullcast.io/mcp/register
  flows:
  - flow: authorizationCode
    authorizationUrl: https://app.fullcast.io/mcp/authorize
    tokenUrl: https://app.fullcast.io/mcp/token
    pkce: [S256]
    token_endpoint_auth_methods: [client_secret_post, none]
  note: this issuer advertises no scopes_supported in its metadata
scopes:
- scope: openid
  description: OpenID Connect subject identifier (standard scope meaning; not provider-documented)
  flows: [authorizationCode]
  sources: [https://assistant.fullcast.io/.well-known/oauth-authorization-server]
- scope: email
  description: User email address (standard scope meaning; not provider-documented)
  flows: [authorizationCode]
  sources: [https://assistant.fullcast.io/.well-known/oauth-authorization-server]
- scope: profile
  description: Basic user profile claims (standard scope meaning; not provider-documented)
  flows: [authorizationCode]
  sources: [https://assistant.fullcast.io/.well-known/oauth-authorization-server]
- scope: offline_access
  description: Issue a refresh token for long-lived agent sessions
  flows: [authorizationCode]
  sources: [https://assistant.fullcast.io/.well-known/oauth-authorization-server]
- scope: 'mcp:tools'
  description: Call MCP tools on the Fullcast Assistant MCP server
  flows: [authorizationCode]
  sources: [https://assistant.fullcast.io/.well-known/oauth-protected-resource]
- scope: 'mcp:resources'
  description: Read MCP resources (the fullcast://resource/* guidance documents)
  flows: [authorizationCode]
  sources: [https://assistant.fullcast.io/.well-known/oauth-protected-resource]
- scope: 'mcp:prompts'
  description: Read MCP prompts exposed by the server
  flows: [authorizationCode]
  sources: [https://assistant.fullcast.io/.well-known/oauth-protected-resource]
gaps:
- No scopes reference page is published for developers.
- >-
  Scopes are surface-level (mcp:tools covers all 17 verified tools), not capability-scoped.
  There is no read-only scope, so an agent granted mcp:tools can call move_account and
  end_coverage with the same token it uses to call get_account.
- The app.fullcast.io/mcp issuer publishes no scopes_supported at all.