Hometrack · OAuth Scopes

Hometrack OAuth Scopes

OAuth 2.0 searched

Hometrack publishes 2 OAuth 2.0 scopes via the clientCredentials flow. Scopes are the fine-grained permissions an application requests at authorization time to act against the Hometrack API on a user’s behalf.

Tokens are issued from https://hometrack-prod.eu.auth0.com/oauth/token.

This index is generated from the provider’s OpenAPI security definitions (and, where available, its documented scope reference) and refreshes on every APIs.io network build. Browse every provider’s scopes at scopes.apis.io.

Real EstateUnited KingdomPropTechValuationAVMMortgageProperty DataClimate RiskLendingSurveying

Scopes: 2 Flows: clientCredentials Method: searched

OAuth endpoints

Token URL
https://hometrack-prod.eu.auth0.com/oauth/token

Flows
clientCredentials

Scopes (2)

Scope	Description	Flows
read:valuations	Read access to valuations. Named verbatim in the token-response example on Hometrack's API authentication page; no separate scope reference documents what it covers.	clientCredentials
write:valuations	Write access to valuations (ordering / instructing a valuation). Named verbatim in the same token-response example.	clientCredentials

📄 Provider scope reference: https://developer.hometrack.com/api-authentication

Source

OAuth Scopes

generated: '2026-07-26'
method: searched
docs: https://developer.hometrack.com/api-authentication
source: >-
  https://developer.hometrack.com/api-authentication (worked token-response
  example) + well-known/hometrack-auth0-openid-configuration.json.
summary: >-
  Hometrack documents OAuth 2.0 client credentials but publishes no scope
  reference page. The only scopes visible anywhere on its public surface are the
  two shown in the worked token-response example on the authentication page:
  read:valuations and write:valuations. No harvested OpenAPI declares an oauth2
  security scheme, so nothing further can be derived — the running derivation
  (0-working/derive-oauth-scopes.py) correctly returns zero. Any additional
  scopes (climate, PRH case management, reporting) exist only inside the
  commercial agreement and are not published.
schemes:
- name: OAuth2ClientCredentials
  source: https://developer.hometrack.com/api-authentication
  provider: Auth0
  flows:
  - flow: clientCredentials
    tokenUrl: https://hometrack-prod.eu.auth0.com/oauth/token
    audience: https://api.hometrack.com
scopes:
- scope: read:valuations
  description: >-
    Read access to valuations. Named verbatim in the token-response example on
    Hometrack's API authentication page; no separate scope reference documents
    what it covers.
  flows: [clientCredentials]
  sources: [https://developer.hometrack.com/api-authentication]
- scope: write:valuations
  description: >-
    Write access to valuations (ordering / instructing a valuation). Named
    verbatim in the same token-response example.
  flows: [clientCredentials]
  sources: [https://developer.hometrack.com/api-authentication]
scope_reference_page: null
idp_scopes_supported:
  source: well-known/hometrack-auth0-openid-configuration.json
  note: >-
    The Auth0 tenant's scopes_supported list (openid, profile, offline_access,
    name, given_name, family_name, nickname, email, email_verified, picture,
    created_at, identities, phone, address) is the standard OIDC user-profile
    set advertised by every Auth0 tenant. It is NOT Hometrack's API permission
    model and is recorded here only so it is not mistaken for one.
gaps:
- No published scope-to-operation mapping.
- No scopes documented for the Climate, PRH Core External Client, Broker AVM or Public APIs.
- OpenAPI documents declare only APIM subscription-key schemes, so scopes cannot be derived from the specs.
cross_links:
  authentication: authentication/hometrack-authentication.yml
  well_known: well-known/hometrack-well-known.yml