Thought Machine · OAuth Scopes

Thought Machine OAuth Scopes

OAuth 2.0 probed

Thought Machine publishes 5 OAuth 2.0 scopes via the authorizationCode, clientCredentials, and deviceCode flows. Scopes are the fine-grained permissions an application requests at authorization time to act against the Thought Machine API on a user’s behalf.

Tokens are issued from https://auth.thoughtmachine.net/application/o/token/.

This index is generated from the provider’s OpenAPI security definitions (and, where available, its documented scope reference) and refreshes on every APIs.io network build. Browse every provider’s scopes at scopes.apis.io.

CompanyBankingCore BankingFinancial ServicesPaymentsCloud NativeSmart ContractsISO 20022LedgerFintechUnited Kingdom

Scopes: 5 Flows: authorizationCode, clientCredentials, deviceCode Method: probed

OAuth endpoints

Authorization URL
https://auth.thoughtmachine.net/application/o/authorize/

Token URL
https://auth.thoughtmachine.net/application/o/token/

Flows
authorizationCodeclientCredentialsdeviceCode

Scopes (5)

Scope	Description	Flows
openid	OpenID Connect authentication; issues an ID token for the portal user.	authorizationCode
email	Release the user's email address and email_verified claim.	authorizationCode
profile	Release profile claims (name, given_name, preferred_username, nickname, groups).	authorizationCode
entitlements	Release the entitlements claim used to authorise portal/documentation access.	authorizationCode
role	Release the roles claim for the authenticated portal user.	authorizationCode

📄 Provider scope reference:

Source

OAuth Scopes

generated: '2026-08-02'
method: probed
source: https://auth.thoughtmachine.net/application/o/vault-portal/.well-known/openid-configuration
x-scope-of-this-file: >-
  These are the OAuth 2.0 / OIDC scopes advertised by the Thought Machine identity provider
  (auth.thoughtmachine.net, Authentik) for the vault-portal client — the SSO in front of the
  Vault documentation and enablement portals. They are NOT the authorization scopes of the
  Vault Core or Vault Payments data APIs, which are documented behind the partner login and
  were not anonymously observable. No scope list has been invented.
schemes:
- name: vault-portal-oidc
  source: well-known/thought-machine-openid-configuration.json
  issuer: https://auth.thoughtmachine.net/application/o/vault-portal/
  flows:
  - flow: authorizationCode
    authorizationUrl: https://auth.thoughtmachine.net/application/o/authorize/
    tokenUrl: https://auth.thoughtmachine.net/application/o/token/
    pkce: S256
  - flow: clientCredentials
    tokenUrl: https://auth.thoughtmachine.net/application/o/token/
  - flow: deviceCode
    deviceAuthorizationUrl: https://auth.thoughtmachine.net/application/o/device/
    tokenUrl: https://auth.thoughtmachine.net/application/o/token/
scopes:
- scope: openid
  description: OpenID Connect authentication; issues an ID token for the portal user.
  flows: [authorizationCode]
  sources: [well-known/thought-machine-openid-configuration.json]
- scope: email
  description: Release the user's email address and email_verified claim.
  flows: [authorizationCode]
  sources: [well-known/thought-machine-openid-configuration.json]
- scope: profile
  description: Release profile claims (name, given_name, preferred_username, nickname, groups).
  flows: [authorizationCode]
  sources: [well-known/thought-machine-openid-configuration.json]
- scope: entitlements
  description: Release the entitlements claim used to authorise portal/documentation access.
  flows: [authorizationCode]
  sources: [well-known/thought-machine-openid-configuration.json]
- scope: role
  description: Release the roles claim for the authenticated portal user.
  flows: [authorizationCode]
  sources: [well-known/thought-machine-openid-configuration.json]
claims_supported:
- sub
- iss
- aud
- exp
- iat
- auth_time
- acr
- amr
- nonce
- email
- email_verified
- entitlements
- roles
- name
- given_name
- preferred_username
- nickname
- groups