Impact · OAuth Scopes

Impact OAuth Scopes

OAuth 2.0 probed

Impact uses OAuth 2.0 but publishes no discrete scopes — access is governed by the grant itself (e.g. client-credentials or role-based authorization) rather than per-scope consent.

This index is generated from the provider’s OpenAPI security definitions (and, where available, its documented scope reference) and refreshes on every APIs.io network build. Browse every provider’s scopes at scopes.apis.io.

AffiliatesPartnershipsPerformance MarketingCommissionTrackingCreator EconomyPartner ManagementReferralAttributionPayoutsMarketingAdvertisingMCPAgents
Scopes: 0 Flows: Method: probed

Scopes (0)

Impact implements OAuth 2.0 but publishes no discrete scopes — access is governed by the grant itself (client-credentials or role-based authorization) rather than per-scope consent.

📄 Provider scope reference: "https://integrations.impact.com/ai-solutions/mcp-quick-start", "migrate_to_scoped_tokens" => "https://help.impact.com/other/reference-documentation/api-access-tokens-and-changelog/migrate-to-scoped-tokens", "scoped_token_best_practices" => "https://help.impact.com/other/reference-documentation/api-access-tokens-and-changelog/scoped-tokens-best-practices", "scoped_tokens" => "https://integrations.impact.com/rest-apis/api-quick-start/create-an-api-key"}" target="_blank" rel="noopener">{"mcp" => "https://integrations.impact.com/ai-solutions/mcp-quick-start", "migrate_to_scoped_tokens" => "https://help.impact.com/other/reference-documentation/api-access-tokens-and-changelog/migrate-to-scoped-tokens", "scoped_token_best_practices" => "https://help.impact.com/other/reference-documentation/api-access-tokens-and-changelog/scoped-tokens-best-practices", "scoped_tokens" => "https://integrations.impact.com/rest-apis/api-quick-start/create-an-api-key"}

Source

OAuth Scopes

Raw ↑ 
name: Impact OAuth Scopes and Token Scoping
description: The OAuth 2.1 scopes impact.com publishes for its MCP server, and the scoped-token
  model that governs REST API access.
generated: '2026-08-13'
method: probed
source: https://app.impact.com/.well-known/oauth-protected-resource
docs:
  mcp: https://integrations.impact.com/ai-solutions/mcp-quick-start
  scoped_tokens: https://integrations.impact.com/rest-apis/api-quick-start/create-an-api-key
  scoped_token_best_practices: https://help.impact.com/other/reference-documentation/api-access-tokens-and-changelog/scoped-tokens-best-practices
  migrate_to_scoped_tokens: https://help.impact.com/other/reference-documentation/api-access-tokens-and-changelog/migrate-to-scoped-tokens
oauth:
  issuer: https://app.impact.com
  protected_resource: https://mcp.impact.com/mcp
  metadata_url: https://app.impact.com/.well-known/oauth-protected-resource
  http_status: 200
  probed: '2026-08-13'
  bearer_methods_supported: [header]
  scopes:
    - name: mcp:read
      description: Read access through the MCP server, further constrained by the consenting
        user's own platform permissions.
    - name: mcp:write
      description: Write access through the MCP server (creating campaigns, updating settings,
        managing partners, creating tracking links), further constrained by the consenting
        user's own platform permissions.
    - name: openid
      description: Advertised by the OpenID Connect discovery document as the only supported
        OIDC scope.
      source: https://app.impact.com/.well-known/openid-configuration
rest_token_scoping:
  model: scoped access tokens
  since: April 2025
  granularity: API category toggle plus per-endpoint selection
  enforcement_status: 403
  enumerable: false
  note: The REST scope vocabulary is not published as a machine-readable list. Scopes are
    chosen from category and endpoint toggles inside the impact.com UI when a token is minted,
    so the full scope set can only be enumerated from an authenticated account. No OpenAPI
    document declares an oauth2 securityScheme with a scopes map.
  categories_observed_from_published_endpoint_groups:
    - Accounts
    - Actions
    - Action Inquiries
    - Ads
    - Call Data
    - Catalogs
    - Clicks
    - Contacts
    - Contracts
    - Conversions
    - Deals
    - Exception Lists
    - Invoices
    - Jobs
    - Notes
    - Partners
    - Partner Groups
    - Programs
    - Promo Codes
    - Promo Code Exception Lists
    - Reports
    - Routing Rules
    - Submissions
    - Tasks
    - Tracking Links
    - Tracking Value Requests
  categories_note: Derived from the tag/endpoint groups in the 69 published OpenAPI documents,
    not from a published scope registry. Treat as the shape of the scope surface, not as
    literal scope strings.
findings:
  - Only the MCP surface has a published, machine-readable scope vocabulary, and it is exactly
    two scopes - mcp:read and mcp:write - covering every one of the fifteen documented tools.
  - The REST surface has genuinely fine-grained scoping but publishes no scope registry, so an
    integrator cannot request or document least-privilege access without logging in.
provider_action: Publish the scoped-token category and endpoint vocabulary as data, and declare
  it as an oauth2 or apiKey securityScheme with a scopes map in the OpenAPI documents.