Spotwise, Inc. · OAuth Scopes

Spotwise, Inc. OAuth Scopes

OAuth 2.0 probed

Spotwise, Inc. uses OAuth 2.0 but publishes no discrete scopes — access is governed by the grant itself (e.g. client-credentials or role-based authorization) rather than per-scope consent.

This index is generated from the provider’s OpenAPI security definitions (and, where available, its documented scope reference) and refreshes on every APIs.io network build. Browse every provider’s scopes at scopes.apis.io.

CompanyBroadcast MediaAdvertisingMedia MonitoringSales IntelligenceLead GenerationArtificial IntelligenceRadioModel Context ProtocolAgentsAttribution

Scopes: 0 Flows: Method: probed

Scopes (0)

Spotwise, Inc. implements OAuth 2.0 but publishes no discrete scopes — access is governed by the grant itself (client-credentials or role-based authorization) rather than per-scope consent.

📄 Provider scope reference:

Source

OAuth Scopes

generated: '2026-08-12'
method: probed
source: >-
  https://spotwise.ai/.well-known/oauth-authorization-server,
  https://spotwise.ai/.well-known/oauth-protected-resource,
  https://app.spotwise.ai/.well-known/oauth-authorization-server,
  https://app.spotwise.ai/.well-known/oauth-protected-resource
docs: null
docs_note: >-
  Spotwise publishes no scopes/permissions reference page. Every scope below was read
  directly from a live RFC 8414 / RFC 9728 metadata document; descriptions are stated
  as the standard meaning of the scope name, and the two mcp:content.* descriptions
  are inferred from the resource_name ("Spotwise CMS MCP") of the resource that
  declares them. No scope has been invented.

authorization_servers:
- issuer: https://spotwise.ai/api/auth
  resource: https://spotwise.ai/api/mcp
  resource_name: Spotwise CMS MCP
  scopes:
  - name: openid
    description: OpenID Connect authentication; issues an ID token
    standard: OIDC Core
  - name: profile
    description: basic profile claims (name, given_name, family_name, picture)
    standard: OIDC Core
  - name: email
    description: email and email_verified claims
    standard: OIDC Core
  - name: offline_access
    description: permits issuance of a refresh token for long-lived agent sessions
    standard: OIDC Core
  - name: mcp:content.read
    description: read access to the Spotwise site content collections exposed over the
      CMS MCP server
    product_scope: true
  - name: mcp:content.write
    description: write access to the Spotwise site content collections exposed over the
      CMS MCP server
    product_scope: true

- issuer: https://app.spotwise.ai/api/auth
  resource: https://app.spotwise.ai/api/mcp
  resource_name: Spotwise Remote MCP
  scopes:
  - name: openid
    description: OpenID Connect authentication; issues an ID token
    standard: OIDC Core
  - name: profile
    description: basic profile claims
    standard: OIDC Core
  - name: email
    description: email and email_verified claims
    standard: OIDC Core
  - name: offline_access
    description: permits issuance of a refresh token
    standard: OIDC Core
  note: >-
    The product MCP server declares NO product-shaped scopes. Authorization to the
    ad-detection, lead-list, contact-finder and CRM surface is therefore bound to the
    authenticated user's workspace rather than expressed as delegatable OAuth scopes —
    an agent cannot request least-privilege access to a subset of the product.

summary:
  scope_count: 6
  product_scopes: 2
  identity_scopes: 4
  least_privilege_available_on_product_server: false

evidence:
- url: https://spotwise.ai/.well-known/oauth-authorization-server
  status: 200
- url: https://app.spotwise.ai/.well-known/oauth-protected-resource
  status: 200