NationGraph · OAuth Scopes

NationGraph OAuth Scopes

OAuth 2.0 probed

NationGraph uses OAuth 2.0 but publishes no discrete scopes — access is governed by the grant itself (e.g. client-credentials or role-based authorization) rather than per-scope consent.

This index is generated from the provider’s OpenAPI security definitions (and, where available, its documented scope reference) and refreshes on every APIs.io network build. Browse every provider’s scopes at scopes.apis.io.

CompanySales IntelligencePublic SectorGovernmentSLEDGovTechProcurementRFPDataSales
Scopes: 0 Flows: Method: probed

Scopes (0)

NationGraph implements OAuth 2.0 but publishes no discrete scopes — access is governed by the grant itself (client-credentials or role-based authorization) rather than per-scope consent.

📄 Provider scope reference:

Source

OAuth Scopes

Raw ↑ 
generated: '2026-08-14'
method: probed
source: https://api.nationgraph.com/.well-known/oauth-authorization-server
docs: null
summary: >-
  NationGraph's authorization server publishes its scope set in machine-readable form via RFC 8414
  / OpenID Connect Discovery. These five scopes are read verbatim from that live document, not
  from prose and not from the OpenAPI — the harvested OpenAPI declares only an opaque HTTP Bearer
  scheme and carries no oauth2 securityScheme at all, so `derive-oauth-scopes.py` finds nothing
  here. The provider publishes NO human-readable scopes or permissions reference page; this
  discovery document is the only scope documentation NationGraph offers.
authorization_server: https://api.nationgraph.com/auth
scope_count: 5
scopes:
- name: openid
  type: openid-connect
  description: >-
    Standard OIDC scope. Requests an ID token identifying the authenticated end user.
  standard: true
- name: profile
  type: openid-connect
  description: >-
    Standard OIDC scope. Grants access to the end user's basic profile claims via the userinfo
    endpoint.
  standard: true
- name: email
  type: openid-connect
  description: >-
    Standard OIDC scope. Grants access to the end user's email address claim.
  standard: true
- name: offline_access
  type: openid-connect
  description: >-
    Standard OIDC scope. Requests a refresh token so a client can act without the user present —
    the scope that makes long-running agent sessions possible against this API.
  standard: true
  applies_to_resource: https://api.nationgraph.com/internal/mcp
- name: mcp:read
  type: resource
  description: >-
    First-party, NationGraph-specific scope. Grants READ access to the NationGraph MCP server at
    https://api.nationgraph.com/internal/mcp. Required — the endpoint's WWW-Authenticate challenge
    names this scope explicitly on an unauthenticated request.
  standard: false
  applies_to_resource: https://api.nationgraph.com/internal/mcp
  ref: mcp/nationgraph-mcp.yml
protected_resources:
- resource: https://api.nationgraph.com/internal/mcp
  resource_name: NationGraph
  scopes_supported: [mcp:read, offline_access]
  source: https://api.nationgraph.com/.well-known/oauth-protected-resource
observations:
- >-
  The ONLY resource-specific scope NationGraph defines is `mcp:read`. There is no write scope, and
  no scope of any kind covering the /api/v3 REST surface — those 253 operations sit behind an
  opaque bearer token with no published scope model. The scope vocabulary that exists is
  agent-facing and read-only.
- >-
  `mcp:read` being read-only is a deliberate, legible boundary: an agent granted this scope can
  query NationGraph's government-signal corpus but cannot write into a customer's workspace,
  lists, or CRM sync.
endpoints:
  authorization: https://api.nationgraph.com/auth/oauth2/authorize
  token: https://api.nationgraph.com/auth/oauth2/token
  registration: https://api.nationgraph.com/auth/oauth2/register
  introspection: https://api.nationgraph.com/auth/oauth2/introspect
  revocation: https://api.nationgraph.com/auth/oauth2/revoke
  userinfo: https://api.nationgraph.com/auth/oauth2/userinfo
  end_session: https://api.nationgraph.com/auth/oauth2/end-session
  jwks: https://api.nationgraph.com/auth/.well-known/jwks.json
cross_links:
  authentication: authentication/nationgraph-authentication.yml
  mcp: mcp/nationgraph-mcp.yml
  well_known: well-known/nationgraph-well-known.yml
  conformance: conformance/nationgraph-conformance.yml
x-evidence:
  fetched: '2026-08-14'
  probes:
  - {url: 'https://api.nationgraph.com/.well-known/oauth-authorization-server', http_status: 200}
  - {url: 'https://api.nationgraph.com/.well-known/openid-configuration', http_status: 200}
  - {url: 'https://api.nationgraph.com/.well-known/oauth-protected-resource', http_status: 200}
  - {url: 'https://api.nationgraph.com/internal/mcp', http_status: 401, note: 'WWW-Authenticate names scope="mcp:read"'}