PEXA · OAuth Scopes

PEXA OAuth Scopes

OAuth 2.0 searched

PEXA publishes 11 OAuth 2.0 scopes via the clientCredentials and authorizationCode flows. Scopes are the fine-grained permissions an application requests at authorization time to act against the PEXA API on a user’s behalf.

Tokens are issued from https://auth.pexa.com.au/oauth/token.

This index is generated from the provider’s OpenAPI security definitions (and, where available, its documented scope reference) and refreshes on every APIs.io network build. Browse every provider’s scopes at scopes.apis.io.

Real EstateAustraliaConveyancingProperty SettlementLand RegistryTitlePropTechMortgageDigital SigningWebhooks

Scopes: 11 Flows: clientCredentials, authorizationCode Method: searched

OAuth endpoints

Authorization URL
https://host.kubernetes.internal/auth/realms/pexa/protocol/openid-connect/auth https://'{{auth2_env}}'/authorize

Token URL
https://auth.pexa.com.au/oauth/token https://host.kubernetes.internal/auth/realms/pexa/protocol/openid-connect/token https://'{{auth2_env}}'/oauth/token

Flows
clientCredentialsauthorizationCode

Scopes (11)

Scope	Description	Flows
au:projects:notification:read
au:projects:project:write	Grant project write access	authorizationCode, clientCredentials
au:projects:status:read	Grant project status read access	authorizationCode, clientCredentials
au:projects:workspaces:read	Grant project workspaces read access	authorizationCode, clientCredentials
au:projects:workspaces:write
create:notification_registrations	Create registrations	clientCredentials
create:notification_registrations_secret_rotation	Rotate shared secret	clientCredentials
delete:notification_registrations	Delete registrations	clientCredentials
edit:notification_registrations	Edit registrations	clientCredentials
view:notification_registrations	View registrations	clientCredentials
{{api_scope}}	API scope	authorizationCode, clientCredentials

📄 Provider scope reference: https://developer.pexa.com.au/Exchange/docs/documentation/

Source

OAuth Scopes

generated: '2026-07-26'
method: searched
source: openapi/pexa-notification-service-openapi.yaml, openapi/pexa-projects-api-v4-openapi.yaml, openapi/pexa-standalone-discharge-experience-api-openapi.yaml
schemes:
- name: oauth2
  source: openapi/pexa-notification-service-openapi.yaml
  flows:
  - flow: clientCredentials
    tokenUrl: https://auth.pexa.com.au/oauth/token
- name: oauth2
  source: openapi/pexa-projects-api-v4-openapi.yaml
  flows:
  - flow: authorizationCode
    authorizationUrl: https://host.kubernetes.internal/auth/realms/pexa/protocol/openid-connect/auth
    tokenUrl: https://host.kubernetes.internal/auth/realms/pexa/protocol/openid-connect/token
  - flow: clientCredentials
    tokenUrl: https://host.kubernetes.internal/auth/realms/pexa/protocol/openid-connect/token
- name: oauth2
  source: openapi/pexa-standalone-discharge-experience-api-openapi.yaml
  flows:
  - flow: authorizationCode
    authorizationUrl: https://'{{auth2_env}}'/authorize
    tokenUrl: https://'{{auth2_env}}'/oauth/token
  - flow: clientCredentials
    tokenUrl: https://'{{auth2_env}}'/oauth/token
scopes:
- scope: au:projects:notification:read
  sources:
  - openapi/pexa-projects-api-v4-openapi.yaml
- scope: au:projects:project:write
  description: Grant project write access
  flows:
  - authorizationCode
  - clientCredentials
  sources:
  - openapi/pexa-projects-api-v4-openapi.yaml
- scope: au:projects:status:read
  description: Grant project status read access
  flows:
  - authorizationCode
  - clientCredentials
  sources:
  - openapi/pexa-projects-api-v4-openapi.yaml
- scope: au:projects:workspaces:read
  description: Grant project workspaces read access
  flows:
  - authorizationCode
  - clientCredentials
  sources:
  - openapi/pexa-projects-api-v4-openapi.yaml
- scope: au:projects:workspaces:write
  sources:
  - openapi/pexa-projects-api-v4-openapi.yaml
- scope: create:notification_registrations
  description: Create registrations
  flows:
  - clientCredentials
  sources:
  - openapi/pexa-notification-service-openapi.yaml
- scope: create:notification_registrations_secret_rotation
  description: Rotate shared secret
  flows:
  - clientCredentials
  sources:
  - openapi/pexa-notification-service-openapi.yaml
- scope: delete:notification_registrations
  description: Delete registrations
  flows:
  - clientCredentials
  sources:
  - openapi/pexa-notification-service-openapi.yaml
- scope: edit:notification_registrations
  description: Edit registrations
  flows:
  - clientCredentials
  sources:
  - openapi/pexa-notification-service-openapi.yaml
- scope: view:notification_registrations
  description: View registrations
  flows:
  - clientCredentials
  sources:
  - openapi/pexa-notification-service-openapi.yaml
- scope: '{{api_scope}}'
  description: API scope
  flows:
  - authorizationCode
  - clientCredentials
  sources:
  - openapi/pexa-standalone-discharge-experience-api-openapi.yaml
docs: https://developer.pexa.com.au/Exchange/docs/documentation/
docs_note: PEXA does not publish a single consolidated scopes reference page. Scopes are declared per endpoint in
  the developer portal API reference (login-gated) and, for the Notification Service, restated in the PEXA Webhooks
  Guide. The Exchange Swagger 2.0 contracts declare no securityDefinitions at all, so Exchange scope names do not
  appear in any machine-readable artifact - the only Exchange scope PEXA publishes in the open is the worked example
  au_pub_tst_pexa_conversation_api_v2_read.
naming_conventions:
- family: notification-service
  pattern: <verb>:notification_registrations[_<qualifier>]
  source: openapi/pexa-notification-service-openapi.yaml + https://developer.pexa.com.au/Webhooks/docs/definitions/webhooks/
  environments: the same five scope names apply in both non-prod and prod
- family: projects
  pattern: au:projects:<resource>:<read|write>
  source: openapi/pexa-projects-api-v4-openapi.yaml
- family: exchange
  pattern: au_<visibility>_<env>_pexa_<api>_<version>_<read|write>
  example: au_pub_tst_pexa_conversation_api_v2_read
  source: https://developer.pexa.com.au/Exchange/docs/documentation/
  note: Environment appears to be encoded in the scope name itself (tst), so scope strings differ between test and
    production.
token_request: Scope is passed on the OAuth 2.0 token request (client_credentials) or on the authorize request (authorization_code);
  each endpoint requires specific scopes.
unresolved:
- scope: '{{api_scope}}'
  source: openapi/pexa-standalone-discharge-experience-api-openapi.yaml
  note: Unresolved template shipped in the contract, not a real scope name. Recorded verbatim rather than guessed.
scope_count: 11