National University of Singapore · OAuth Scopes

National University of Singapore OAuth Scopes

OAuth 2.0 probed

National University of Singapore publishes 9 OAuth 2.0 scopes. Scopes are the fine-grained permissions an application requests at authorization time to act against the National University of Singapore API on a user’s behalf.

This index is generated from the provider’s OpenAPI security definitions (and, where available, its documented scope reference) and refreshes on every APIs.io network build. Browse every provider’s scopes at scopes.apis.io.

UniversityHigher EducationEducationSingaporeResearchIdentity FederationResearch RepositoryCourse CatalogOpen AccessLMS

Scopes: 9 Flows: Method: probed

Scopes (9)

Scope	Description	Flows
openid	Requests an ID token; required for any OpenID Connect flow against this provider.
profile	Requests the end user's basic profile claims.
email	Requests the end user's email address claim.
allatclaims	ADFS-specific scope that asks the provider to place all claims from the access token into the ID token as well. Broad by construction — grant it deliberately, not by default.
user_impersonation	Permits a client to act on behalf of the signed-in user against a downstream NUS resource. The highest-consequence scope this provider advertises.
aza	Broker/primary-refresh-token scope used by Microsoft device authentication brokers.
logon_cert	Requests a logon certificate for the authenticated user.
vpn_cert	Requests a VPN client certificate for the authenticated user.
winhello_cert	Requests a Windows Hello for Business certificate for the authenticated user.

📄 Provider scope reference:

Source

OAuth Scopes

generated: '2026-08-19'
method: probed
source: >-
  scopes_supported and claims_supported read verbatim from
  https://vafs.nus.edu.sg/adfs/.well-known/openid-configuration (HTTP 200, fetched 2026-08-19)
provider: National University of Singapore
providerId: nus
x-operator: institution
description: >-
  The complete set of OAuth 2.0 / OpenID Connect scopes the National University of Singapore's
  own authorization server advertises to clients, plus the claims it will assert. These were
  read from the institution's live discovery document, not inferred. NUS publishes no prose
  documentation of these scopes anywhere public — the discovery document is the only
  description of them that exists on the open internet.
authorization_server: https://vafs.nus.edu.sg/adfs
scopes:
- name: openid
  standard: true
  description: Requests an ID token; required for any OpenID Connect flow against this provider.
- name: profile
  standard: true
  description: Requests the end user's basic profile claims.
- name: email
  standard: true
  description: Requests the end user's email address claim.
- name: allatclaims
  standard: false
  vendor: Microsoft ADFS
  description: >-
    ADFS-specific scope that asks the provider to place all claims from the access token into
    the ID token as well. Broad by construction — grant it deliberately, not by default.
- name: user_impersonation
  standard: false
  vendor: Microsoft ADFS
  description: >-
    Permits a client to act on behalf of the signed-in user against a downstream NUS resource.
    The highest-consequence scope this provider advertises.
- name: aza
  standard: false
  vendor: Microsoft ADFS
  description: Broker/primary-refresh-token scope used by Microsoft device authentication brokers.
- name: logon_cert
  standard: false
  vendor: Microsoft ADFS
  description: Requests a logon certificate for the authenticated user.
- name: vpn_cert
  standard: false
  vendor: Microsoft ADFS
  description: Requests a VPN client certificate for the authenticated user.
- name: winhello_cert
  standard: false
  vendor: Microsoft ADFS
  description: Requests a Windows Hello for Business certificate for the authenticated user.
claims_supported:
- aud
- iss
- iat
- exp
- auth_time
- nonce
- at_hash
- c_hash
- sub
- upn
- unique_name
- pwd_url
- pwd_exp
- mfa_auth_time
- sid
- nbf
notes: >-
  Three of the nine advertised scopes (logon_cert, vpn_cert, winhello_cert) mint credentials
  rather than grant data access, and two more (allatclaims, user_impersonation) are broad by
  design. Only three are standard OIDC scopes. An agent integrating with NUS should request
  `openid profile email` and nothing else; the remainder exist for Microsoft device and VPN
  enrolment flows and have no third-party use case.

Work with this as data

Every scope set here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for oauth scopes

4 MCP tools reach this

find_scopesBrowse and filter every scope set in the catalog.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This scope set

curl "https://apis.io/api/v1/scopes/nus-scopes"

All oauth scopes

curl "https://apis.io/api/v1/scopes?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.