Great-West Lifeco OAuth Scopes

OAuth 2.0 searched

Great-West Lifeco uses OAuth 2.0 but publishes no discrete scopes — access is governed by the grant itself (e.g. client-credentials or role-based authorization) rather than per-scope consent.

Tokens are issued from https://api.canadalife.com/oauth2/v1/generate.

This index is generated from the provider’s OpenAPI security definitions (and, where available, its documented scope reference) and refreshes on every APIs.io network build. Browse every provider’s scopes at scopes.apis.io.

InsuranceCanadaLife InsuranceHealth InsuranceEmployee BenefitsRetirementWealth ManagementReinsuranceAnnuitiesPartner Gated

Scopes: 0 Flows: clientCredentials Method: searched

OAuth endpoints

Token URL
https://api.canadalife.com/oauth2/v1/generate

Flows
clientCredentials

Scopes (0)

Great-West Lifeco implements OAuth 2.0 but publishes no discrete scopes — access is governed by the grant itself (client-credentials or role-based authorization) rather than per-scope consent.

Both OAuth surfaces in the group are real and both withhold their scope vocabulary. This artifact records the authorization-server metadata that IS published and states plainly that no scope names are. Nothing is invented - the scopes list is empty because the providers publish an empty one.

📄 Provider scope reference:

Source

OAuth Scopes

generated: '2026-07-25'
method: searched
source: >-
  https://api.canadalife.com/.well-known/openid-configuration (HTTP 200);
  https://developer.empower.com/api-catalog/oauth2-api;
  https://developer.empower.com/docs/get-started
docs: null
note: >-
  Both OAuth surfaces in the group are real and both withhold their scope
  vocabulary. This artifact records the authorization-server metadata that IS
  published and states plainly that no scope names are. Nothing is invented -
  the scopes list is empty because the providers publish an empty one.
schemes:
- name: CanadaLifeGatewayOIDC
  entity: Canada Life
  source: well-known/great-west-lifeco-openid-configuration.json
  flows:
  - flow: clientCredentials
    tokenUrl: https://api.canadalife.com/oauth2/v1/generate
    authorizationUrl: null
    note: >-
      authorization_endpoint is published as
      https://api.canadalife.com/oauth2/v1/authorize-NOT-SUPPORTED - the
      interactive flow is explicitly disabled.
  scopes_supported: []
  scopes_supported_note: >-
    The discovery document advertises "scopes_supported": [] - an empty array.
    Scopes are provisioned per client profile rather than advertised.
- name: EmpowerOAuth2
  entity: Empower (U.S. retirement subsidiary)
  source: https://developer.empower.com/api-catalog/oauth2-api
  flows:
  - flow: clientCredentials
    tokenUrl: null
    note: >-
      The OAuth 2.0 API catalog entry documents /token and /auth endpoint paths
      but never their host; the authorization service endpoint is emailed to
      approved partners only.
  scopes_supported: []
  scopes_supported_note: >-
    Scopes demonstrably exist and are enforced - the public release notes for
    version 1.3.1 state that the "/token endpoint can result 400 status code
    with 'invalid_grant' error message if requested oauth scope is not
    configured in oauth client profile" - but no scope name is published
    anywhere on the portal. Scopes are configured per OAuth client profile
    during the approval process.
scopes: []
scope_count: 0
enforcement:
  model: per-client-profile
  evidence: >-
    Empower OAuth 2.0 API release notes v1.3.1 - a requested scope that is not
    configured on the client profile is rejected with HTTP 400 invalid_grant.