Hilbert's AI · OAuth Scopes

Hilbert's AI OAuth Scopes

OAuth 2.0 probed

Hilbert’s AI publishes 14 OAuth 2.0 scopes via the authorizationCode, clientCredentials, and deviceCode flows. Scopes are the fine-grained permissions an application requests at authorization time to act against the Hilbert’s AI API on a user’s behalf.

Tokens are issued from https://hilbert-app.us.auth0.com/oauth/token.

This index is generated from the provider’s OpenAPI security definitions (and, where available, its documented scope reference) and refreshes on every APIs.io network build. Browse every provider’s scopes at scopes.apis.io.

CompanyArtificial IntelligenceGrowthAnalyticsMarketingData ScienceAutomationAgentic AIB2C

Scopes: 14 Flows: authorizationCode, clientCredentials, deviceCode Method: probed

OAuth endpoints

Authorization URL
https://hilbert-app.us.auth0.com/authorize

Token URL
https://hilbert-app.us.auth0.com/oauth/token

Flows
authorizationCodeclientCredentialsdeviceCode

Scopes (14)

Scope	Description	Flows
openid	Request an ID token
profile	Basic profile claims
offline_access	Issue a refresh token
email
email_verified
name
given_name
family_name
nickname
picture
phone
address
created_at
identities

📄 Provider scope reference:

Source

OAuth Scopes

generated: '2026-08-13'
method: probed
source: https://hilbert-app.us.auth0.com/.well-known/openid-configuration
docs: null
note: >-
  The published OpenAPI declares no oauth2 securityScheme, so derive-oauth-scopes.py
  found nothing to derive (0 oauth2 schemes, 0 scopes). Hilbert nevertheless runs OAuth
  2.0 / OIDC: the application authenticates against the Auth0 tenant
  hilbert-app.us.auth0.com with audience https://app-api.hilberts.ai. The scopes below
  are the tenant's own advertised scopes_supported, read verbatim from its discovery
  document. These are OIDC identity scopes, not Hilbert API permission scopes. The one
  API-permission string Hilbert does name anywhere public is admin:project, described in
  the MetricCalculationRequest schema of the OpenAPI; it is recorded separately below
  because it is a documented authorization requirement, not a scope the discovery
  document advertises. No public scopes/permissions reference page exists.
schemes:
- name: auth0-oidc
  type: oauth2
  source: https://hilbert-app.us.auth0.com/.well-known/openid-configuration
  issuer: https://hilbert-app.us.auth0.com/
  audience: https://app-api.hilberts.ai
  flows:
  - flow: authorizationCode
    authorizationUrl: https://hilbert-app.us.auth0.com/authorize
    tokenUrl: https://hilbert-app.us.auth0.com/oauth/token
    pkce: true
    code_challenge_methods: [S256, plain]
  - flow: clientCredentials
    tokenUrl: https://hilbert-app.us.auth0.com/oauth/token
  - flow: deviceCode
    deviceAuthorizationUrl: https://hilbert-app.us.auth0.com/oauth/device/code
    tokenUrl: https://hilbert-app.us.auth0.com/oauth/token
scopes:
- scope: openid
  kind: oidc
  description: Request an ID token
- scope: profile
  kind: oidc
  description: Basic profile claims
- scope: offline_access
  kind: oidc
  description: Issue a refresh token
- scope: email
  kind: oidc
- scope: email_verified
  kind: oidc
- scope: name
  kind: oidc
- scope: given_name
  kind: oidc
- scope: family_name
  kind: oidc
- scope: nickname
  kind: oidc
- scope: picture
  kind: oidc
- scope: phone
  kind: oidc
- scope: address
  kind: oidc
- scope: created_at
  kind: oidc
- scope: identities
  kind: oidc
api_permissions:
- name: admin:project
  source: openapi/hilberts-ai-program-api-openapi.yml#/components/schemas/MetricCalculationRequest
  description: >-
    Named in the spec as the authorization under which organizationId must be supplied
    on a metric calculation request. Hilbert publishes no permissions reference, so the
    full permission set is unknown.
x-evidence:
  fetched: '2026-08-13'
  url: https://hilbert-app.us.auth0.com/.well-known/openid-configuration
  http_status: 200
  content_type: application/json