Instasent OAuth Scopes

generated: '2026-10-28'
method: derived
source: openapi/product.openapi.yaml
schemes:
- name: OAuth2
  source: openapi/product.openapi.yaml
  flows:
  - flow: authorizationCode
    authorizationUrl: https://api.instasent.com/oauth/authorize
    tokenUrl: https://api.instasent.com/oauth/token
  description: |-
    OAuth 2.1 Authorization Code flow with PKCE, for applications that act in a
    user's name instead of using a token the user pasted. The resulting access
    token is an ordinary Product API bearer token (`isoa_` prefix) with a
    24-hour lifetime, refreshed through `POST /oauth/token`.

    Register the client first with `POST /oauth/register`, or use a `client_id`
    issued by Instasent. PKCE is mandatory and only `S256` is accepted; there is
    no client secret. Discover these URLs at runtime from
    `/.well-known/oauth-authorization-server` rather than hard-coding them. All
    three are on this API host; the authorization URL is a browser redirect that
    hands the user to the dashboard's consent screen.

    The scopes below are the same product permissions the API returns in
    `GET /` and the dashboard shows when creating a token. Which of them a
    client may be granted depends on its lane: MCP clients are limited to a
    curated, agent-safe subset, while API clients may be offered the full set.
    The final grant is always intersected with the authorizing user's roles and
    the organization's plan.
scopes:
- scope: ACCOUNT_READ
  description: Read access to organization account details and funds
  flows:
  - authorizationCode
  sources:
  - openapi/product.openapi.yaml
- scope: PROJECT_AGGREGATIONS
  description: Access to audience and event aggregations
  flows:
  - authorizationCode
  sources:
  - openapi/product.openapi.yaml
- scope: PROJECT_AUDIENCE_DATA_BASIC
  description: Access to basic contact data
  flows:
  - authorizationCode
  sources:
  - openapi/product.openapi.yaml
- scope: PROJECT_AUDIENCE_DATA_EVENTS
  description: Access to audience events
  flows:
  - authorizationCode
  sources:
  - openapi/product.openapi.yaml
- scope: PROJECT_AUDIENCE_DATA_FULL
  description: Access to full contact data
  flows:
  - authorizationCode
  sources:
  - openapi/product.openapi.yaml
- scope: PROJECT_AUDIENCE_LIST
  description: List and scroll audience contacts
  flows:
  - authorizationCode
  sources:
  - openapi/product.openapi.yaml
- scope: PROJECT_AUDIENCE_READ
  description: Read access to audience contacts
  flows:
  - authorizationCode
  sources:
  - openapi/product.openapi.yaml
- scope: PROJECT_AUDIENCE_WRITE
  description: Write access to audience contacts
  flows:
  - authorizationCode
  sources:
  - openapi/product.openapi.yaml
- scope: PROJECT_AUTOMATION_READ
  description: Read access to automations
  flows:
  - authorizationCode
  sources:
  - openapi/product.openapi.yaml
- scope: PROJECT_CAMPAIGN_READ
  description: Read access to campaigns
  flows:
  - authorizationCode
  sources:
  - openapi/product.openapi.yaml
- scope: PROJECT_CAMPAIGN_WRITE
  description: Create a campaign draft
  flows:
  - authorizationCode
  sources:
  - openapi/product.openapi.yaml
- scope: PROJECT_DATASOURCE_READ
  description: Read-only access to datasources
  flows:
  - authorizationCode
  sources:
  - openapi/product.openapi.yaml
- scope: PROJECT_DATASOURCE_WRITE
  description: Create and modify datasources
  flows:
  - authorizationCode
  sources:
  - openapi/product.openapi.yaml
- scope: PROJECT_DIRECT_READ
  description: Messaging read access
  flows:
  - authorizationCode
  sources:
  - openapi/product.openapi.yaml
- scope: PROJECT_DIRECT_WRITE
  description: Messaging write access
  flows:
  - authorizationCode
  sources:
  - openapi/product.openapi.yaml
- scope: PROJECT_SEGMENT_WRITE
  description: Save an audience filter as a segment
  flows:
  - authorizationCode
  sources:
  - openapi/product.openapi.yaml