Fundrise · OAuth Scopes

Fundrise OAuth Scopes

OAuth 2.0 searched

Fundrise publishes 2 OAuth 2.0 scopes. Scopes are the fine-grained permissions an application requests at authorization time to act against the Fundrise API on a user’s behalf.

This index is generated from the provider’s OpenAPI security definitions (and, where available, its documented scope reference) and refreshes on every APIs.io network build. Browse every provider’s scopes at scopes.apis.io.

CompanyFinancial ServicesInvestingReal EstatePrivate CreditVenture CapitalAlternative AssetsWealth ManagementFintechEmbedded Investing

Scopes: 2 Flows: Method: searched

Scopes (2)

Scope	Description	Flows
openid	OpenID Connect authentication — requests an ID token asserting the end user's identity. Published in scopes_supported of the Fundrise OIDC discovery document.	authorizationCode
offline_access	Requests a refresh token so the client can obtain new access tokens without the end user being present. Published in scopes_supported of the Fundrise OIDC discovery document, and consistent with the non-expiring refresh token the Connect API issues at Client creation.	authorizationCode

📄 Provider scope reference: https://connect.fundrise.com/#tag/Authentication

Source

OAuth Scopes

generated: '2026-08-04'
method: searched
source: https://fundrise.com/.well-known/openid-configuration
docs: https://connect.fundrise.com/#tag/Authentication
notes: >-
  The Fundrise Connect OpenAPI declares no oauth2 securityScheme — both schemes are
  HTTP (basic for Partners, bearer for Clients) — so 0-working/derive-oauth-scopes.py
  produced nothing. Fundrise nevertheless runs a real OAuth surface, published two
  ways, and this file records both rather than leaving the provider with no scope
  artifact.

  1. The consumer OAuth authorization server, advertised anonymously at
     https://fundrise.com/.well-known/openid-configuration, publishes an explicit
     scopes_supported list.
  2. The Connect partner API issues Client-scoped access tokens from a non-expiring
     refresh token via POST /v1/oauth/token (operationId GetAccessToken). Its
     OAuth2AccessTokenResponse schema carries a `scope` field, but the OpenAPI does
     not enumerate the permitted values, so no named partner scopes are asserted here.
authorization_server:
  issuer_host: fundrise.com
  discovery: https://fundrise.com/.well-known/openid-configuration
  authorization_endpoint: https://fundrise.com/oauth/authorize
  token_endpoint: https://api.fundrise.com/oauth/token
  response_types_supported:
  - code
  token_endpoint_auth_methods:
  - client_secret_basic
  grant_types_observed:
  - authorization_code
  - refresh_token
scopes:
- scope: openid
  description: >-
    OpenID Connect authentication — requests an ID token asserting the end user's
    identity. Published in scopes_supported of the Fundrise OIDC discovery document.
  flows:
  - authorizationCode
  sources:
  - well-known/fundrise-openid-configuration.json
- scope: offline_access
  description: >-
    Requests a refresh token so the client can obtain new access tokens without the
    end user being present. Published in scopes_supported of the Fundrise OIDC
    discovery document, and consistent with the non-expiring refresh token the
    Connect API issues at Client creation.
  flows:
  - authorizationCode
  sources:
  - well-known/fundrise-openid-configuration.json
connect_api_tokens:
  operation: GetAccessToken
  path: /v1/oauth/token
  grant: refresh_token
  response_schema: OAuth2AccessTokenResponse
  scope_field_present: true
  named_scopes_published: false
  note: >-
    Access tokens are scoped to a single Client rather than to named permission
    scopes. Endpoint-level authorization is expressed instead by which of the two
    security schemes an operation requires (PartnerBasicAuthentication vs
    ClientBearerAuthentication), and Fundrise applies additional per-partner access
    controls out of band — the Authentication tag states that documented capabilities
    may be inaccessible until permissions are granted by connect@fundrise.com.
x-evidence:
- fetched: '2026-08-04'
  url: https://fundrise.com/.well-known/openid-configuration
  http_status: 200
  content_type: application/json
- fetched: '2026-08-04'
  url: https://connect.fundrise.com/
  http_status: 200
  note: OpenAPI 3.1.0 extracted from the published Redocly documentation bundle.