Northern Trust · OAuth Scopes

Northern Trust OAuth Scopes

OAuth 2.0 searched

Northern Trust publishes 10 OAuth 2.0 scopes via the authorizationCode flow. Scopes are the fine-grained permissions an application requests at authorization time to act against the Northern Trust API on a user’s behalf.

Tokens are issued from https://login.ntrs.com/oauth2/aus1m4yuzpqNFht7o0h8/v1/token.

This index is generated from the provider’s OpenAPI security definitions (and, where available, its documented scope reference) and refreshes on every APIs.io network build. Browse every provider’s scopes at scopes.apis.io.

Fortune 500BankingWealth ManagementAsset ServicingAsset ManagementFinancial ServicesUnited States

Scopes: 10 Flows: authorizationCode Method: searched

OAuth endpoints

Authorization URL
https://login.ntrs.com/oauth2/aus1m4yuzpqNFht7o0h8/v1/authorize

Token URL
https://login.ntrs.com/oauth2/aus1m4yuzpqNFht7o0h8/v1/token

Flows
authorizationCode

Scopes (10)

Scope	Description	Flows
openid	OpenID Connect — issue an ID token identifying the authenticated principal.
profile	Access to the principal's basic profile claims (name, etc.).
email	Access to the principal's email address claim.
address	Access to the principal's address claim.
phone	Access to the principal's phone-number claim.
offline_access	Issue a refresh token so the client can obtain new access tokens without re-prompting.
device_sso	Okta device single-sign-on scope enabling native SSO across device apps.
api.read	Provider-defined. Read access to the Northern Trust API Store resources exposed through the enterprise gateway. (Inferred — no public gloss.)
aor.role	Provider-defined role/entitlement scope carried on the access token to convey the caller's authorized role for API-Store access. (Inferred — no public gloss.)
interclient_access	Provider-defined scope authorizing cross-client / delegated access between registered client applications. (Inferred — no public gloss.)

📄 Provider scope reference: https://developer.ntrs.com/get-started

Source

OAuth Scopes

generated: '2026-07-23'
method: searched
source: >-
  https://login.ntrs.com/oauth2/aus1m4yuzpqNFht7o0h8/.well-known/openid-configuration
  (scopes_supported, live Okta OIDC discovery)
docs: https://developer.ntrs.com/get-started
notes: >-
  Scopes are read verbatim from the custom Okta authorization server's
  scopes_supported. Northern Trust does not publish a public scope-reference page
  (the developer portal is gated), so descriptions for the provider-defined
  scopes are inferred conservatively and marked as such; the standard OIDC scopes
  use their RFC-defined meaning. Okta platform scopes (okta.myAccount.*) are the
  identity-provider's own account scopes, not API-Store product scopes, and are
  omitted here.
schemes:
- name: NorthernTrustOIDC
  source: well-known/northern-trust-openid-configuration.json
  flows:
  - flow: authorizationCode
    authorizationUrl: https://login.ntrs.com/oauth2/aus1m4yuzpqNFht7o0h8/v1/authorize
    tokenUrl: https://login.ntrs.com/oauth2/aus1m4yuzpqNFht7o0h8/v1/token
scopes:
- scope: openid
  description: OpenID Connect — issue an ID token identifying the authenticated principal.
  standard: true
- scope: profile
  description: Access to the principal's basic profile claims (name, etc.).
  standard: true
- scope: email
  description: Access to the principal's email address claim.
  standard: true
- scope: address
  description: Access to the principal's address claim.
  standard: true
- scope: phone
  description: Access to the principal's phone-number claim.
  standard: true
- scope: offline_access
  description: Issue a refresh token so the client can obtain new access tokens without re-prompting.
  standard: true
- scope: device_sso
  description: Okta device single-sign-on scope enabling native SSO across device apps.
  standard: true
- scope: api.read
  description: >-
    Provider-defined. Read access to the Northern Trust API Store resources
    exposed through the enterprise gateway. (Inferred — no public gloss.)
  standard: false
- scope: aor.role
  description: >-
    Provider-defined role/entitlement scope carried on the access token to convey
    the caller's authorized role for API-Store access. (Inferred — no public gloss.)
  standard: false
- scope: interclient_access
  description: >-
    Provider-defined scope authorizing cross-client / delegated access between
    registered client applications. (Inferred — no public gloss.)
  standard: false