Newscred OAuth Scopes

generated: '2026-08-26'
method: searched
source: https://docs.developers.optimizely.com/content-marketing-platform/docs/authentication-1
schemes:
- name: OAuth2
  source: openapi/newscred-cmp-open-api-openapi.json
  flows:
  - flow: authorizationCode
    authorizationUrl: https://accounts.cmp.optimizely.com/o/oauth2/v1/auth
    tokenUrl: https://accounts.cmp.optimizely.com/o/oauth2/v1/token
  - flow: clientCredentials
    tokenUrl: https://accounts.cmp.optimizely.com/o/oauth2/v1/token
scopes:
- scope: offline_access
  description: Grants the ability to refresh access_token using the refresh token even when user is not present
    (not logged in).
  flows:
  - authorizationCode
  sources:
  - openapi/newscred-cmp-open-api-openapi.json
- scope: openid
  description: Grants the ability to receive a unique identifier for the user.
  flows:
  - authorizationCode
  sources:
  - openapi/newscred-cmp-open-api-openapi.json
- scope: profile
  description: Grants access to user profile information.
  flows:
  - authorizationCode
  sources:
  - openapi/newscred-cmp-open-api-openapi.json
docs: https://docs.developers.optimizely.com/content-marketing-platform/docs/authentication-1
derived_from: openapi/newscred-cmp-open-api-openapi.json
scope_model:
  granularity: coarse — identity scopes only
  note: 'CMP publishes exactly three scopes and they are the OIDC identity trio: openid, profile and offline_access.
    NONE of them scopes API capability. There is no read vs write scope, no per-resource scope (library, tasks,
    campaigns, settings), and the clientCredentials flow declares an EMPTY scopes map. Authorization is therefore
    decided entirely by the CMP organization permissions of the user or app, not by the token scope — which means
    a consent screen cannot tell a user what an app will be able to do, and an agent cannot request least privilege.
    The docs confirm all three must be sent, space-delimited, to the authorization endpoint.'
  documented_requirement: All three scopes must be passed to the authorization endpoint, delimited by a single space.