Lumos · OAuth Scopes

Lumos OAuth Scopes

OAuth 2.0 probed

Lumos uses OAuth 2.0 but publishes no discrete scopes — access is governed by the grant itself (e.g. client-credentials or role-based authorization) rather than per-scope consent.

This index is generated from the provider’s OpenAPI security definitions (and, where available, its documented scope reference) and refreshes on every APIs.io network build. Browse every provider’s scopes at scopes.apis.io.

Access ManagementAccess ReviewsDeprovisioningIdentity GovernanceIdentity PlatformLeast PrivilegeProvisioningSaaS ManagementShadow IT
Scopes: 0 Flows: Method: probed

Scopes (0)

Lumos implements OAuth 2.0 but publishes no discrete scopes — access is governed by the grant itself (client-credentials or role-based authorization) rather than per-scope consent.

📄 Provider scope reference: https://developers.lumos.com/docs/lumos-admin-mcp

Source

OAuth Scopes

Raw ↑ 
generated: '2026-08-29'
method: probed
source: >-
  https://api.lumos.com/.well-known/oauth-authorization-server (302 -> b.app.lumosidentity.com),
  https://api.lumos.com/.well-known/oauth-protected-resource/mcp/user,
  https://api.lumos.com/.well-known/oauth-protected-resource/mcp/admin
docs: https://developers.lumos.com/docs/lumos-admin-mcp
description: >-
  Lumos publishes its OAuth scope vocabulary in RFC 8414 authorization-server metadata rather than in
  the OpenAPI, which declares only HTTPBearer. These 14 scopes govern the two hosted MCP servers; the
  REST API itself is authenticated with an lsk_ API key and is NOT scope-partitioned.
issuer: https://b.app.lumosidentity.com
flows:
  authorization_code:
    authorizationUrl: https://b.app.lumosidentity.com/b/oauth/authorize
    tokenUrl: https://b.app.lumosidentity.com/b/oauth/token
    revocationUrl: https://b.app.lumosidentity.com/b/oauth/revoke
    registrationUrl: https://b.app.lumosidentity.com/b/oauth/register
    pkce: S256
    refresh_token: true
scope_count: 14
scopes:
- name: lumos:user:read
  description: Read the signing-in user's own apps, requestable permissions, and access requests.
  resource: https://api.lumos.com/mcp/user
- name: lumos:user:write
  description: Submit and cancel access requests on the signing-in user's behalf.
  resource: https://api.lumos.com/mcp/user
- name: lumos:admin:access-policies:read
  description: Read domain access policies.
  resource: https://api.lumos.com/mcp/admin
- name: lumos:admin:access-policies:write
  description: Create, update, and delete domain access policies.
  resource: https://api.lumos.com/mcp/admin
- name: lumos:admin:appstore:read
  description: Inspect AppStore apps, requestable permissions, and approval configuration.
  resource: https://api.lumos.com/mcp/admin
  toolset: appstore
- name: lumos:admin:appstore:write
  description: Configure AppStore approval workflows and permission configuration.
  resource: https://api.lumos.com/mcp/admin
  toolset: appstore
- name: lumos:admin:knowledge-hub:read
  description: List and read Knowledge Hub entries for the domain.
  resource: https://api.lumos.com/mcp/admin
  toolset: knowledge-hub
- name: lumos:admin:knowledge-hub:write
  description: Create, update, and archive Knowledge Hub entries.
  resource: https://api.lumos.com/mcp/admin
  toolset: knowledge-hub
- name: lumos:admin:mcp-governance:read
  description: Read Lumos MCP governance configuration.
  resource: https://api.lumos.com/mcp/admin
  note: >-
    Advertised by the authorization server but no matching toolset is documented on the admin MCP
    page. Recorded as published, not as reachable.
- name: lumos:admin:mcp-governance:write
  description: Write Lumos MCP governance configuration.
  resource: https://api.lumos.com/mcp/admin
  note: Advertised by the authorization server; no documented toolset yet.
- name: lumos:admin:task-center:read
  description: Read manual approval, provisioning, and error tasks.
  resource: https://api.lumos.com/mcp/admin
  toolset: task-center
- name: lumos:admin:task-center:write
  description: Act on, reassign, complete, and dismiss tasks.
  resource: https://api.lumos.com/mcp/admin
  toolset: task-center
- name: lumos:admin:workflows:read
  description: Read workflow configuration.
  resource: https://api.lumos.com/mcp/admin
- name: lumos:admin:workflows:write
  description: Write workflow configuration.
  resource: https://api.lumos.com/mcp/admin
x-evidence:
- url: https://api.lumos.com/.well-known/oauth-authorization-server
  status: 200
- url: https://api.lumos.com/.well-known/oauth-protected-resource/mcp/user
  status: 200
- url: https://api.lumos.com/.well-known/oauth-protected-resource/mcp/admin
  status: 200

Work with this as data

Every scope set here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for oauth scopes

4 MCP tools reach this
  • find_scopesBrowse and filter every scope set in the catalog.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This scope set 
curl "https://apis.io/api/v1/scopes/lumos-scopes"
All oauth scopes 
curl "https://apis.io/api/v1/scopes?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.