Lawmatics · OAuth Scopes

Lawmatics OAuth Scopes

OAuth 2.0 searched

Lawmatics uses OAuth 2.0 but publishes no discrete scopes — access is governed by the grant itself (e.g. client-credentials or role-based authorization) rather than per-scope consent.

Tokens are issued from https://api.lawmatics.com/oauth/token.

This index is generated from the provider’s OpenAPI security definitions (and, where available, its documented scope reference) and refreshes on every APIs.io network build. Browse every provider’s scopes at scopes.apis.io.

LegalCRMLaw FirmsClient IntakeMarketing AutomationMatter ManagementE-SignatureWorkflow-AutomationLegal TechTime and BillingWebhookAuthentication
Scopes: 0 Flows: authorizationCode Method: searched

OAuth endpoints

Authorization URL
https://app.lawmatics.com/oauth/authorize
Token URL
https://api.lawmatics.com/oauth/token
Flows
authorizationCode

Scopes (0)

Lawmatics implements OAuth 2.0 but publishes no discrete scopes — access is governed by the grant itself (client-credentials or role-based authorization) rather than per-scope consent.

📄 Provider scope reference: https://docs.lawmatics.com/

Source

OAuth Scopes

Raw ↑ 
generated: '2026-08-13'
method: searched
source: https://docs.lawmatics.com/
docs: https://docs.lawmatics.com/
derived_from: openapi/lawmatics-openapi.yml
schemes:
- name: oauth2
  source: openapi/lawmatics-openapi.yml
  flows:
  - flow: authorizationCode
    authorizationUrl: https://app.lawmatics.com/oauth/authorize
    tokenUrl: https://api.lawmatics.com/oauth/token
  description: OAuth 2.0 authorization code grant. Register a developer app at https://app.lawmatics.com/settings/developers
    (developer settings must be enabled by Lawmatics support). Access tokens are non-expiring; no refresh
    tokens are issued and scopes are not supported.
scopes: []
scope_count: 0
supported: false
finding: 'Lawmatics runs OAuth 2.0 but implements NO scopes, and says so in its own documentation: "We
  currently do not support scopes. Once a user authenticates your app, they are giving you full CRUD access
  to their account." The empty scopes list below is therefore a measured fact, not a harvesting failure.
  Combined with non-expiring tokens and no deauthorization endpoint, an authorized integration holds permanent
  unrestricted access to a law firm''s client data - there is no least-privilege posture available to
  an integrator, and no way to issue a read-only credential to an agent.'