May Mobility · OAuth Scopes

May Mobility OAuth Scopes

OAuth 2.0 searched

May Mobility uses OAuth 2.0 but publishes no discrete scopes — access is governed by the grant itself (e.g. client-credentials or role-based authorization) rather than per-scope consent.

This index is generated from the provider’s OpenAPI security definitions (and, where available, its documented scope reference) and refreshes on every APIs.io network build. Browse every provider’s scopes at scopes.apis.io.

CompanyAutonomous VehiclesTransportationMobilityRobotaxiFleet ManagementTelemetryPublic TransitAutomotiveStreaming
Scopes: 0 Flows: clientCredentials Method: searched

Scopes (0)

May Mobility implements OAuth 2.0 but publishes no discrete scopes — access is governed by the grant itself (client-credentials or role-based authorization) rather than per-scope consent.

📄 Provider scope reference: https://docs.maymobility.com/docs/fleet-api/connecting-to-fleet-api

Source

OAuth Scopes

may-mobility-scopes.yml Raw ↑ 
generated: '2026-08-01'
method: searched
source: https://docs.maymobility.com/docs/fleet-api/connecting-to-fleet-api
docs: https://docs.maymobility.com/docs/fleet-api/connecting-to-fleet-api
grant: clientCredentials
identity_provider: AWS Cognito
schemes:
- name: cognitoClientCredentials
  source: https://docs.maymobility.com/docs/fleet-api/connecting-to-fleet-api
  flows:
  - flow: clientCredentials
    tokenUrl: null
    tokenUrl_note: Issued per account by the Fleet API team; documented in code
      samples as 'provided-by-fleet-api-team'.
scopes: []
scopes_note: 'May Mobility documents that an OAuth 2.0 `scope` is REQUIRED on every
  token request and that the required scope DIFFERS between the Realtime and Batch
  surfaces — but it does not publish any scope string. Every published reference
  writes the value as `provided-by-fleet-api-team`. No scope values have been
  invented here; the list is deliberately empty.'
scope_classes:
- class: realtime
  description: Scope used to authorize the WebSocket Realtime API (telemetry and
    video modes).
  values_published: false
  evidence: https://docs.maymobility.com/docs/fleet-api/connecting-to-fleet-api
- class: batch
  description: Scope used to authorize the Batch (REST) endpoints. Documented
    separately on the last-active, shift-timing and LiDAR pages, each of which states
    that the scope required "may differ from the real-time API endpoints" and that
    the batch scope must be used.
  values_published: false
  evidence:
  - https://docs.maymobility.com/docs/fleet-api/topics-channels/last-active
  - https://docs.maymobility.com/docs/fleet-api/topics-channels/vehicle-shift-timing
  - https://docs.maymobility.com/docs/fleet-api/topics-channels/lidar
  quote: 'Scope: Scope to get authorization to this endpoint might vary with other
    endpoints.'
x-findings:
- id: scope-values-unpublished
  severity: medium
  detail: 'A per-surface scope model exists and is enforced, but no scope name is
    published anywhere in the documentation. A consumer cannot determine, before
    contacting the Fleet API team, what authority a token will carry or how narrowly
    it can be scoped. This is the single largest documentation gap in the May
    Mobility auth contract, and it also blocks any least-privilege review of an
    agent integration against a safety-relevant fleet surface.'