Mitiga · OAuth Scopes

Mitiga OAuth Scopes

OAuth 2.0 probed

Mitiga publishes 14 OAuth 2.0 scopes via the authorizationCode, clientCredentials, and deviceCode flows. Scopes are the fine-grained permissions an application requests at authorization time to act against the Mitiga API on a user’s behalf.

Tokens are issued from https://api.mitiga.cloud/oauth-2/token.

This index is generated from the provider’s OpenAPI security definitions (and, where available, its documented scope reference) and refreshes on every APIs.io network build. Browse every provider’s scopes at scopes.apis.io.

CompanySecurityCloud SecuritySaaS SecurityCloud Detection and ResponseIncident ResponseThreat DetectionIdentity SecurityManaged Security ServicesArtificial Intelligence

Scopes: 14 Flows: authorizationCode, clientCredentials, deviceCode Method: probed

OAuth endpoints

Authorization URL
https://api.mitiga.cloud/oauth-2/authorize

Token URL
https://api.mitiga.cloud/oauth-2/token

Flows
authorizationCodeclientCredentialsdeviceCode

Scopes (14)

Scope	Description	Flows
openid	Request an ID token — OpenID Connect authentication.	authorizationCode, deviceCode
profile	Basic profile claims for the authenticated user.	authorizationCode, deviceCode
offline_access	Issue a refresh token for long-lived access.	authorizationCode, deviceCode
email	The user's email address.
email_verified	Whether the user's email address has been verified.
name	The user's full name claim.
given_name	The user's given name claim.
family_name	The user's family name claim.
nickname	The user's nickname claim.
picture	The user's profile picture URL claim.
created_at	The account creation timestamp claim.
identities	Linked identity-provider identities for the user.
phone	The user's phone number claims.
address	The user's address claim.

📄 Provider scope reference:

Source

OAuth Scopes

generated: '2026-08-04'
method: probed
source: https://api.mitiga.cloud/.well-known/oauth-authorization-server
docs: null
description: >-
  The only scopes Mitiga advertises anonymously are the standard OpenID Connect and
  Auth0 profile-claim scopes carried in the authorization-server metadata on its API
  host. No product-specific scopes (alerts, investigations, data lake, response actions)
  are published; those would require authenticated introspection of a customer tenant.
  Recorded honestly rather than inferred.
schemes:
- name: oauth2
  source: well-known/mitiga-oauth-authorization-server.json
  flows:
  - flow: authorizationCode
    authorizationUrl: https://api.mitiga.cloud/oauth-2/authorize
    tokenUrl: https://api.mitiga.cloud/oauth-2/token
  - flow: clientCredentials
    tokenUrl: https://api.mitiga.cloud/oauth-2/token
  - flow: deviceCode
    deviceAuthorizationUrl: https://auth.mitiga.cloud/oauth/device/code
    tokenUrl: https://api.mitiga.cloud/oauth-2/token
scopes:
- scope: openid
  description: Request an ID token — OpenID Connect authentication.
  standard: true
  flows: [authorizationCode, deviceCode]
  sources: [well-known/mitiga-oauth-authorization-server.json]
- scope: profile
  description: Basic profile claims for the authenticated user.
  standard: true
  flows: [authorizationCode, deviceCode]
  sources: [well-known/mitiga-oauth-authorization-server.json]
- scope: offline_access
  description: Issue a refresh token for long-lived access.
  standard: true
  flows: [authorizationCode, deviceCode]
  sources: [well-known/mitiga-oauth-authorization-server.json]
- scope: email
  description: The user's email address.
  standard: true
  sources: [well-known/mitiga-oauth-authorization-server.json]
- scope: email_verified
  description: Whether the user's email address has been verified.
  standard: true
  sources: [well-known/mitiga-oauth-authorization-server.json]
- scope: name
  description: The user's full name claim.
  standard: true
  sources: [well-known/mitiga-oauth-authorization-server.json]
- scope: given_name
  description: The user's given name claim.
  standard: true
  sources: [well-known/mitiga-oauth-authorization-server.json]
- scope: family_name
  description: The user's family name claim.
  standard: true
  sources: [well-known/mitiga-oauth-authorization-server.json]
- scope: nickname
  description: The user's nickname claim.
  standard: true
  sources: [well-known/mitiga-oauth-authorization-server.json]
- scope: picture
  description: The user's profile picture URL claim.
  standard: true
  sources: [well-known/mitiga-oauth-authorization-server.json]
- scope: created_at
  description: The account creation timestamp claim.
  standard: true
  sources: [well-known/mitiga-oauth-authorization-server.json]
- scope: identities
  description: Linked identity-provider identities for the user.
  standard: false
  sources: [well-known/mitiga-oauth-authorization-server.json]
- scope: phone
  description: The user's phone number claims.
  standard: true
  sources: [well-known/mitiga-oauth-authorization-server.json]
- scope: address
  description: The user's address claim.
  standard: true
  sources: [well-known/mitiga-oauth-authorization-server.json]
gaps:
- >-
  No product/resource scopes are published. An integrator cannot tell from the public
  surface what a client_credentials token is authorized to do against the Mitiga platform.
x-evidence:
- url: https://api.mitiga.cloud/.well-known/oauth-authorization-server
  http_status: 200
  fetched: '2026-08-04'