RELEX Solutions OAuth Scopes

generated: '2026-08-26'
method: searched
source: https://identity.prod-eu.prod.cc.relexsolutions.com/.well-known/openid-configuration
docs: https://www.relexsolutions.com/api/retail-restapi-example-customer.html
derived_from:
- openapi/relex-data-api-openapi.json
- openapi/relex-monitoring-api-openapi.json
- well-known/relex-identity-eu-openid-configuration.json
note: >-
  RELEX publishes no scopes/permissions reference page. The authoritative public list is the
  `scopes_supported` array of RELEX Identity's own OpenID Connect discovery documents, which are
  served anonymously and are identical across all three authorities (root, /login/restapi_prod,
  /monitoring_api_prod) and both regions. That list is far richer than the contracts: the Data API
  declares ONE scope, the Monitoring API declares NONE, while RELEX Identity advertises 51.
  Scopes are granted per client during provisioning; there is no self-service consent screen for
  the client-credentials clients these APIs use.
schemes:
- name: OAuth2
  api: RELEX Data API
  source: openapi/relex-data-api-openapi.json
  flow: clientCredentials
  tokenUrl: https://identity.prod-eu.prod.cc.relexsolutions.com/login/restapi_prod/connect/token
  tokenUrl_us: https://identity.prod-us.prod.cc.relexsolutions.com/login/restapi_prod/connect/token
  declared_scopes:
  - openid_api
  description: The RELEX Data API uses OAuth 2 with the client credentials flow.
- name: oauth2
  api: RELEX Monitoring API
  source: openapi/relex-monitoring-api-openapi.json
  flow: clientCredentials
  tokenUrl: https://identity.prod-eu.prod.cc.relexsolutions.com/monitoring_api_prod/connect/token
  tokenUrl_us: https://identity.prod-us.prod.cc.relexsolutions.com/monitoring_api_prod/connect/token
  declared_scopes: []
  gap: >-
    The Monitoring API's securityScheme declares an EMPTY scopes map, so the contract alone does
    not tell a client what to request. RELEX Identity advertises four environment-scoped monitoring
    scopes (restapi_prod_monitoring, restapi_uat_monitoring, restapi_test_monitoring,
    restapi_dev_monitoring) that are almost certainly the ones this API expects.
scope_count: 51
scopes:
- scope: openid_api
  description: Internal use
  declared_in: openapi/relex-data-api-openapi.json
  flows:
  - clientCredentials
  note: The only scope either OpenAPI names. RELEX's own description of it is literally
    "Internal use", which tells an integrator nothing.
- scope: restapi_prod_monitoring
  group: monitoring
  description: Monitoring access to the production REST API environment (inferred from the name;
    RELEX publishes no description).
- scope: restapi_uat_monitoring
  group: monitoring
- scope: restapi_test_monitoring
  group: monitoring
- scope: restapi_dev_monitoring
  group: monitoring
- scope: openid
  group: oidc-standard
- scope: profile
  group: oidc-standard
- scope: email
  group: oidc-standard
- scope: offline_access
  group: oidc-standard
- scope: roles
  group: identity
- scope: tenant
  group: identity
- scope: groups
  group: identity
- scope: email-relex-saas
  group: identity
- scope: automation
  group: identity
- scope: healthcheck
  group: platform
- scope: scimhost
  group: provisioning
  note: >-
    Indicates a SCIM user-provisioning surface exists inside the platform. No SCIM base URL,
    /ServiceProviderConfig, /Schemas or urn:ietf:params:scim:schemas:* URN is published anywhere
    public — see conformance/relex-conformance.yml.
- scope: users:read
  group: administration
- scope: tenants:read
  group: administration
- scope: tenants:write
  group: administration
- scope: tenants:list
  group: administration
- scope: serviceproviders:read
  group: administration
- scope: serviceproviders:write
  group: administration
- scope: clients:read
  group: administration
- scope: clients:write
  group: administration
- scope: reports:read
  group: administration
- scope: AccountSettingsView
  group: application-permission
- scope: MasterDataView
  group: application-permission
- scope: SystemSettingsView
  group: application-permission
- scope: ReportView
  group: application-permission
- scope: ScmView
  group: application-permission
- scope: PerformanceDataEdit
  group: application-permission
- scope: ManualOrdersView
  group: application-permission
- scope: ManualOrdersEdit
  group: application-permission
- scope: StoreVersionView
  group: application-permission
- scope: FloorPlanView
  group: space-planning
- scope: FloorPlanEdit
  group: space-planning
- scope: FloorPlanAutomationView
  group: space-planning
- scope: FloorPlanDeliveryView
  group: space-planning
- scope: FloorPlanDeliveryEdit
  group: space-planning
- scope: PlanogramView
  group: space-planning
- scope: PlanogramEdit
  group: space-planning
- scope: PlanogramAssignmentView
  group: space-planning
- scope: PlanogramDeliverySpaceView
  group: space-planning
- scope: PlanogrammingDataIntegrationEdit
  group: space-planning
- scope: LocationLedAssignmentsView
  group: space-planning
- scope: MicroSpaceView
  group: space-planning
- scope: MicroSpaceEdit
  group: space-planning
- scope: MicroSpaceReviewsView
  group: space-planning
- scope: MicroSpaceWorkflowsView
  group: space-planning
- scope: GridEdit
  group: space-planning
- scope: PDREQ-7480
  group: unknown
  note: An internal ticket reference leaked into the public scope list. Recorded verbatim because
    it is genuinely advertised; it is not a scope an integrator should request.
identity_provider:
  product: RELEX Identity (Duende/IdentityServer-family)
  issuers:
  - https://identity.prod-eu.prod.cc.relexsolutions.com
  - https://identity.prod-eu.prod.cc.relexsolutions.com/login/restapi_prod
  - https://identity.prod-eu.prod.cc.relexsolutions.com/monitoring_api_prod
  - https://identity.prod-us.prod.cc.relexsolutions.com
  - https://identity.prod-us.prod.cc.relexsolutions.com/login/restapi_prod
  - https://identity.prod-us.prod.cc.relexsolutions.com/monitoring_api_prod
  grant_types_supported:
  - authorization_code
  - client_credentials
  - refresh_token
  - implicit
  - password
  - urn:ietf:params:oauth:grant-type:device_code
  - urn:openid:params:grant-type:ciba
  - urn:ietf:params:oauth:grant-type:token-exchange
  token_endpoint_auth_methods_supported:
  - client_secret_basic
  - client_secret_post
  code_challenge_methods_supported:
  - plain
  - S256
  note: >-
    The discovery documents advertise the full IdentityServer grant surface, including implicit and
    resource-owner password, which are discouraged by OAuth 2.1. That is the IdP's capability list,
    not what these two APIs use — both APIs use client_credentials only.