ServiceUp · OAuth Scopes

ServiceUp OAuth Scopes

OAuth 2.0 searched

ServiceUp publishes 3 OAuth 2.0 scopes via the authorizationCode flow. Scopes are the fine-grained permissions an application requests at authorization time to act against the ServiceUp API on a user’s behalf.

Tokens are issued from https://auth.serviceup.com/api/auth/oauth2/token.

This index is generated from the provider’s OpenAPI security definitions (and, where available, its documented scope reference) and refreshes on every APIs.io network build. Browse every provider’s scopes at scopes.apis.io.

CompanyFleet ManagementVehicle RepairAutomotiveInsuranceMaintenanceAgentic AIModel Context ProtocolTransportation

Scopes: 3 Flows: authorizationCode Method: searched

OAuth endpoints

Authorization URL
https://auth.serviceup.com/api/auth/oauth2/authorize

Token URL
https://auth.serviceup.com/api/auth/oauth2/token

Flows
authorizationCode

Scopes (3)

Scope	Description	Flows
mcp:read	Read access to the ServiceUp MCP server resource (scope name only; no published description).	authorizationCode
mcp:write	Write access to the ServiceUp MCP server resource (scope name only; no published description).	authorizationCode
offline_access	Standard OAuth 2.0 offline access scope (RFC 6749 / OIDC Core), requesting a refresh token. Advertised by the authorization server but not listed on the MCP protected-resource metadata.	authorizationCode

📄 Provider scope reference:

Source

OAuth Scopes

generated: '2026-08-05'
method: searched
source: https://api.serviceup.com/.well-known/oauth-protected-resource/mcp
docs: null
note: >-
  Scopes are taken verbatim from the OAuth metadata ServiceUp serves anonymously.
  ServiceUp publishes no scopes/permissions reference page, so there are no
  descriptions to enrich from — the descriptions below state only what the scope
  name and its RFC 9728 resource binding assert, and are marked accordingly.
schemes:
- name: ServiceUpOAuth2
  source: well-known/serviceup-oauth-authorization-server.json
  flows:
  - flow: authorizationCode
    authorizationUrl: https://auth.serviceup.com/api/auth/oauth2/authorize
    tokenUrl: https://auth.serviceup.com/api/auth/oauth2/token
    code_challenge_methods:
    - S256
scopes:
- scope: mcp:read
  description: Read access to the ServiceUp MCP server resource (scope name only; no published description).
  description_source: scope-name
  flows:
  - authorizationCode
  resources:
  - https://api.serviceup.com/mcp
  sources:
  - well-known/serviceup-oauth-protected-resource-mcp.json
  - well-known/serviceup-oauth-authorization-server.json
- scope: mcp:write
  description: Write access to the ServiceUp MCP server resource (scope name only; no published description).
  description_source: scope-name
  flows:
  - authorizationCode
  resources:
  - https://api.serviceup.com/mcp
  sources:
  - well-known/serviceup-oauth-protected-resource-mcp.json
  - well-known/serviceup-oauth-authorization-server.json
- scope: offline_access
  description: >-
    Standard OAuth 2.0 offline access scope (RFC 6749 / OIDC Core), requesting a
    refresh token. Advertised by the authorization server but not listed on the
    MCP protected-resource metadata.
  description_source: standard-scope
  flows:
  - authorizationCode
  resources: []
  sources:
  - well-known/serviceup-oauth-authorization-server.json
coverage:
  scopes_total: 3
  granularity: coarse
  note: >-
    Two coarse read/write scopes cover the entire MCP surface — there is no
    per-resource or per-tool scope decomposition (no fleet:, repair:, invoice:
    or payment: scopes are advertised), so an agent token cannot be narrowed
    below "read everything" or "write anything" on this endpoint.
x-evidence:
- url: https://api.serviceup.com/.well-known/oauth-protected-resource/mcp
  http_status: 200
  fetched: '2026-08-05'
- url: https://auth.serviceup.com/.well-known/oauth-authorization-server
  http_status: 200
  fetched: '2026-08-05'