Sarj AI Developer API OAuth Scopes

OAuth 2.0 probed

Sarj AI Developer API publishes 1 OAuth 2.0 scope via the authorizationCode flow. Scopes are the fine-grained permissions an application requests at authorization time to act against the Sarj AI Developer API API on a user’s behalf.

Tokens are issued from https://platform-api.sarj.ai/api/v1/oauth/token.

This index is generated from the provider’s OpenAPI security definitions (and, where available, its documented scope reference) and refreshes on every APIs.io network build. Browse every provider’s scopes at scopes.apis.io.

voice AIvoice agentsconversational AIArabic AIoutbound callstelephonyspeech to texttext to speechvoice cloningMCPagent-nativeSaudi ArabiaMENA

Scopes: 1 Flows: authorizationCode Method: probed

OAuth endpoints

Authorization URL
https://platform-api.sarj.ai/api/v1/oauth/authorize

Token URL
https://platform-api.sarj.ai/api/v1/oauth/token

Flows
authorizationCode

Scopes (1)

Scope	Description	Flows
openid	The only scope the authorization server advertises. Published verbatim in scopes_supported; the provider documents no scope reference page and no per-capability scopes.	authorizationCode

📄 Provider scope reference:

Source

OAuth Scopes

generated: '2026-08-09'
method: probed
source: https://platform-api.sarj.ai/.well-known/oauth-authorization-server
note: >-
  derive-oauth-scopes.py found no oauth2 securityScheme in any harvested OpenAPI — the REST APIs are bearer-API-key
  only. The OAuth surface exists solely to authorize the hosted MCP server, and is described by RFC 8414
  authorization-server metadata rather than by the specs. This artifact is built from that live metadata document,
  not derived from a spec and not searched from a docs scopes page (Sarj publishes none).
schemes:
  - name: MCP OAuth
    source: https://platform-api.sarj.ai/.well-known/oauth-authorization-server
    issuer: https://platform-api.sarj.ai
    applies_to: https://platform-api.sarj.ai/api/v1/mcp
    dynamic_client_registration: https://platform-api.sarj.ai/api/v1/oauth/register
    flows:
      - flow: authorizationCode
        authorizationUrl: https://platform-api.sarj.ai/api/v1/oauth/authorize
        tokenUrl: https://platform-api.sarj.ai/api/v1/oauth/token
        pkce: S256
        response_types: [code]
        response_modes: [query]
        token_endpoint_auth_methods: [none]
scopes:
  - scope: openid
    description: >-
      The only scope the authorization server advertises. Published verbatim in scopes_supported; the provider
      documents no scope reference page and no per-capability scopes.
    flows: [authorizationCode]
    sources:
      - https://platform-api.sarj.ai/.well-known/oauth-authorization-server
findings:
  - id: no-granular-scopes
    detail: >-
      scopes_supported is ["openid"] alone. An MCP client cannot request read-only access — the browser sign-in mints
      an account- and organization-scoped API key with the same authority as a dashboard-generated key, which the MCP
      Server documentation states explicitly. There is no least-privilege path for an agent.
  - id: public-clients-only
    detail: >-
      token_endpoint_auth_methods_supported is ["none"], so clients are public and security rests entirely on PKCE
      S256 plus redirect-URI validation. The developer OpenAPI carries an oauth_invalid_redirect_uri error payload,
      which is consistent with redirect-URI checking being the enforcement point.
x-evidence:
  - url: https://platform-api.sarj.ai/.well-known/oauth-authorization-server
    http_status: 200
    content_type: application/json