Kelvin · OAuth Scopes

Kelvin OAuth Scopes

OAuth 2.0 derived

Kelvin uses OAuth 2.0 but publishes no discrete scopes — access is governed by the grant itself (e.g. client-credentials or role-based authorization) rather than per-scope consent.

This index is generated from the provider’s OpenAPI security definitions (and, where available, its documented scope reference) and refreshes on every APIs.io network build. Browse every provider’s scopes at scopes.apis.io.

CompanyEnergyEnergy EfficiencyHome RenovationConstructionArtificial IntelligenceLead GenerationSales EnablementFranceSustainability
Scopes: 0 Flows: Method: derived

Scopes (0)

Kelvin implements OAuth 2.0 but publishes no discrete scopes — access is governed by the grant itself (client-credentials or role-based authorization) rather than per-scope consent.

kelvin does not run OAuth 2.0 — there is no authorization server, no securityScheme of type oauth2 and no scopes map in either spec, so derive-oauth-scopes.py finds nothing. Authorization is nevertheless scope-based: the team API key carries scopes, and the specification's 403 descriptions name one of them explicitly and refer to others generically ("Scope manquant"). Only the scope kelvin actually names is recorded below; the rest are recorded as an unenumerated set rather than guessed.

📄 Provider scope reference: https://app.go-kelvin.com/api/docs

Source

OAuth Scopes

Raw ↑ 
generated: '2026-08-14'
method: derived
source: >-
  openapi/kelvin-api-openapi.yml — 403 response descriptions on the kelvin API v3
  specification harvested from https://app.go-kelvin.com/api/docs
docs: https://app.go-kelvin.com/api/docs
api: kelvin API
model: api-key-scopes
oauth2: false
note: >-
  kelvin does not run OAuth 2.0 — there is no authorization server, no securityScheme
  of type oauth2 and no scopes map in either spec, so derive-oauth-scopes.py finds
  nothing. Authorization is nevertheless scope-based: the team API key carries scopes,
  and the specification's 403 descriptions name one of them explicitly and refer to
  others generically ("Scope manquant"). Only the scope kelvin actually names is
  recorded below; the rest are recorded as an unenumerated set rather than guessed.
scopes:
- name: catalog:read
  documented: true
  source: >-
    403 description "Forbidden - scope catalog:read manquant" on the three
    /api/v3/catalog/enabled/* operations
  grants:
  - GET /api/v3/catalog/enabled/gestures
  - GET /api/v3/catalog/enabled/references
  - GET /api/v3/catalog/enabled/services
  description: >-
    Read the team's enabled catalogue of work gestures, services and pricing
    references.
unenumerated_scopes:
  count: unknown
  evidence:
  - description: 'Forbidden - Scope manquant ou document désactivé pour l''équipe.'
    operations:
    - POST /api/v3/simulations/{simulation_id}/documents/report
    - POST /api/v3/simulations/{simulation_id}/documents/contribution-framework
    - POST /api/v3/simulations/{simulation_id}/documents/dimensioning-note
    - POST /api/v3/simulations/{simulation_id}/documents/sworn-statement
  - description: 'Forbidden - Scope manquant ou devis désactivés pour l''équipe.'
    operations:
    - POST /api/v3/simulations/{simulation_id}/documents/commercial-offer
  note: >-
    Document generation and quote generation are gated by scopes whose names kelvin
    does not publish, and the same 403 also fires when the feature is merely disabled
    for the team. A caller cannot determine from the response which of the two applies,
    and cannot request a scope by name because no name exists in the documentation.
entitlement_tiers:
  note: >-
    The specification's tags double as commercial offers — "Endpoints disponibles dans
    l'offre Simulateur", "Endpoints disponibles dans l'offre Qualification", plus a
    Documents group. Access therefore depends on the purchased offer as well as the
    scope on the key. See plans/kelvin-plans-pricing.yml.
  tiers:
  - name: Simulateur
    operations: 6
  - name: Qualification
    operations: 12
  - name: Documents
    operations: 7