Lev · OAuth Scopes

Lev OAuth Scopes

OAuth 2.0 searched

Lev publishes 11 OAuth 2.0 scopes via the authorizationCode flow. Scopes are the fine-grained permissions an application requests at authorization time to act against the Lev API on a user’s behalf.

Tokens are issued from https://auth.lev.com/oauth/token.

This index is generated from the provider’s OpenAPI security definitions (and, where available, its documented scope reference) and refreshes on every APIs.io network build. Browse every provider’s scopes at scopes.apis.io.

CompanyCommercial Real EstateReal EstateProptechCRE FinancingLendingCRMArtificial IntelligenceAI AgentsDeal ManagementMarket DataDocuments

Scopes: 11 Flows: authorizationCode Method: searched

OAuth endpoints

Authorization URL
https://auth.lev.com/authorize

Token URL
https://auth.lev.com/oauth/token

Flows
authorizationCode

Scopes (11)

Scope	Description	Flows
deals:read	Read access to deals and their sub-resources (financials, properties, team, documents, vaults, checklists, memos, notes, indexed facts).
deals:write	Create, update, archive deals and write deal sub-resources including notes, checklist tasks, and recorded index facts.
contacts:read	Read access to CRM contacts and contact notes.
contacts:write	Create and update CRM contacts and contact notes.
companies:read	Read access to CRM companies and company notes.
companies:write	Create and update CRM companies and company notes.
lenders:read	Read access to the lender directory, individual lender records, and their lending programs. Read-only — the docs list no lenders:write counterpart.
ai:actions	Gates AI-powered, credit-consuming actions separately from ordinary reads and writes. Required by postContactsContactIdActionsUnlock, which reveals an AI-recommended lender contact and charges credits.
openid	Standard OIDC scope requested by MCP clients during the Auth0 authorization-code flow.
email	Standard OIDC scope granting the user's email address to the MCP client.
offline_access	Requests a refresh token so the MCP client can silently refresh without re-prompting the user.

📄 Provider scope reference: https://www.lev.com/docs/build/authentication

Source

OAuth Scopes

generated: '2026-07-19'
method: searched
source: https://www.lev.com/docs/build/authentication
docs: https://www.lev.com/docs/build/authentication
summary: Lev runs two distinct scope surfaces. The REST API uses a domain-based
  read/write scope list attached to each API key (the OpenAPI does not declare an
  oauth2 securityScheme, so these scopes are documented rather than machine-readable
  in the spec). The hosted MCP server uses OAuth 2.1 against Auth0 with standard
  OIDC scopes; per-user Lev permissions are enforced behind the token rather than
  expressed as OAuth scopes.
schemes:
- name: apiKeyScopes
  kind: api-key
  source: https://www.lev.com/docs/build/authentication
  note: Each API key carries a scopes list controlling which endpoints it can access.
    Keys are issued at one of two permission levels — full_access (default, all
    scopes) or read_only (read scopes only). The authenticated scope list is
    returned by postAuthValidateApiKey and by getMe.
- name: mcpOAuth
  kind: oauth2
  source: well-known/lev-oauth-authorization-server.json
  flows:
  - flow: authorizationCode
    authorizationUrl: https://auth.lev.com/authorize
    tokenUrl: https://auth.lev.com/oauth/token
scopes:
- scope: deals:read
  description: Read access to deals and their sub-resources (financials, properties,
    team, documents, vaults, checklists, memos, notes, indexed facts).
  domain: deals
  access: read
  schemes:
  - apiKeyScopes
- scope: deals:write
  description: Create, update, archive deals and write deal sub-resources including
    notes, checklist tasks, and recorded index facts.
  domain: deals
  access: write
  schemes:
  - apiKeyScopes
- scope: contacts:read
  description: Read access to CRM contacts and contact notes.
  domain: contacts
  access: read
  schemes:
  - apiKeyScopes
- scope: contacts:write
  description: Create and update CRM contacts and contact notes.
  domain: contacts
  access: write
  schemes:
  - apiKeyScopes
- scope: companies:read
  description: Read access to CRM companies and company notes.
  domain: companies
  access: read
  schemes:
  - apiKeyScopes
- scope: companies:write
  description: Create and update CRM companies and company notes.
  domain: companies
  access: write
  schemes:
  - apiKeyScopes
- scope: lenders:read
  description: Read access to the lender directory, individual lender records, and
    their lending programs. Read-only — the docs list no lenders:write counterpart.
  domain: lenders
  access: read
  schemes:
  - apiKeyScopes
- scope: ai:actions
  description: Gates AI-powered, credit-consuming actions separately from ordinary
    reads and writes. Required by postContactsContactIdActionsUnlock, which reveals
    an AI-recommended lender contact and charges credits.
  domain: ai
  access: action
  schemes:
  - apiKeyScopes
- scope: openid
  description: Standard OIDC scope requested by MCP clients during the Auth0
    authorization-code flow.
  domain: oidc
  access: identity
  schemes:
  - mcpOAuth
- scope: email
  description: Standard OIDC scope granting the user's email address to the MCP
    client.
  domain: oidc
  access: identity
  schemes:
  - mcpOAuth
- scope: offline_access
  description: Requests a refresh token so the MCP client can silently refresh
    without re-prompting the user.
  domain: oidc
  access: identity
  schemes:
  - mcpOAuth
related:
  authentication: authentication/lev-authentication.yml
  well_known: well-known/lev-well-known.yml