Tradeshift · OAuth Scopes

Tradeshift OAuth Scopes

OAuth 2.0 searched

Tradeshift publishes 7 OAuth 2.0 scopes via the clientCredentials and implicit flows. Scopes are the fine-grained permissions an application requests at authorization time to act against the Tradeshift API on a user’s behalf.

Tokens are issued from https://mcp.tradeshift.com/oauth/token.

This index is generated from the provider’s OpenAPI security definitions (and, where available, its documented scope reference) and refreshes on every APIs.io network build. Browse every provider’s scopes at scopes.apis.io.

e-invoicingaccounts-payableap-automationprocure-to-paysupply-chainb2b-commerceinvoicingublpeppole-invoicing-compliancesupplier-networkbusiness-documentsfintechmcpagent-native

Scopes: 7 Flows: clientCredentials, implicit Method: searched

OAuth endpoints

Authorization URL
https://go.tradeshift.com/oauth2/authorize

Token URL
https://mcp.tradeshift.com/oauth/token https://api.tradeshift.com/tradeshift/auth/token

Flows
clientCredentialsimplicit

Scopes (7)

Scope	Description	Flows
core	Core services domain of the Tradeshift MCP server.	clientCredentials
network	Supplier network domain — connections, connection properties, network requests.	clientCredentials
documents	Documents domain — business documents, search, validation.	clientCredentials
company	Company data domain — accounts, branches, legal entities, tax identifiers.	clientCredentials
bfr	Business Firewall domain.	clientCredentials
askada	AskAda AI assistant / Ada AI document intelligence domain.	clientCredentials
all	All MCP capability domains.	clientCredentials

📄 Provider scope reference: https://developers.tradeshift.com/docs/guides/oauth

Source

OAuth Scopes

generated: '2026-08-02'
method: searched
source: https://mcp.tradeshift.com/.well-known/oauth-protected-resource
docs: https://developers.tradeshift.com/docs/guides/oauth
note: >-
  The Tradeshift External API OpenAPI declares no securitySchemes, so no scopes can be derived from it — the
  derive-oauth-scopes.py pass found zero oauth2 schemes. The scopes below are the ones Tradeshift actually publishes,
  anonymously, on the MCP server's RFC 8414 authorization-server metadata and RFC 9728 protected-resource metadata.
  They correspond one-to-one with the six MCP capability domains. Descriptions are the Tradeshift-published domain
  labels, not invented scope prose.
schemes:
  - name: TradeshiftMCPOAuth2
    type: oauth2
    source: https://mcp.tradeshift.com/.well-known/oauth-authorization-server
    issuer: https://mcp.tradeshift.com
    resource: https://mcp.tradeshift.com/mcp
    flows:
      - flow: clientCredentials
        tokenUrl: https://mcp.tradeshift.com/oauth/token
        token_endpoint_auth_methods_supported:
          - client_secret_post
        response_types_supported:
          - token
    bearer_methods_supported:
      - header
  - name: TradeshiftPlatformOAuth2
    type: oauth2
    source: https://api.tradeshift.com/tradeshift/.well-known/oauth-authorization-server
    issuer: https://api.tradeshift.com/tradeshift/
    flows:
      - flow: implicit
        authorizationUrl: https://go.tradeshift.com/oauth2/authorize
        tokenUrl: https://api.tradeshift.com/tradeshift/auth/token
        response_types_supported:
          - token
    jwks_uri: https://api.tradeshift.com/tradeshift/auth/jwks
    userinfo_endpoint: https://api.tradeshift.com/tradeshift/auth/userinfo
    scopes_published: false
    note: >-
      The platform authorization-server metadata advertises no scopes_supported. App permissions on the Tradeshift
      platform are configured per app in the Developer App (the "Permissions" field on app registration) rather than
      declared as OAuth scope strings in a public document.
scopes:
  - scope: core
    description: Core services domain of the Tradeshift MCP server.
    flows: [clientCredentials]
    sources: [https://mcp.tradeshift.com/.well-known/oauth-protected-resource]
  - scope: network
    description: Supplier network domain — connections, connection properties, network requests.
    flows: [clientCredentials]
    sources: [https://mcp.tradeshift.com/.well-known/oauth-protected-resource]
  - scope: documents
    description: Documents domain — business documents, search, validation.
    flows: [clientCredentials]
    sources: [https://mcp.tradeshift.com/.well-known/oauth-protected-resource]
  - scope: company
    description: Company data domain — accounts, branches, legal entities, tax identifiers.
    flows: [clientCredentials]
    sources: [https://mcp.tradeshift.com/.well-known/oauth-protected-resource]
  - scope: bfr
    description: Business Firewall domain.
    flows: [clientCredentials]
    sources: [https://mcp.tradeshift.com/.well-known/oauth-protected-resource]
  - scope: askada
    description: AskAda AI assistant / Ada AI document intelligence domain.
    flows: [clientCredentials]
    sources: [https://mcp.tradeshift.com/.well-known/oauth-protected-resource]
  - scope: all
    description: All MCP capability domains.
    flows: [clientCredentials]
    sources: [https://mcp.tradeshift.com/.well-known/oauth-protected-resource]
x-evidence:
  fetched: '2026-08-02'
  url: https://mcp.tradeshift.com/.well-known/oauth-protected-resource
  http_status: 200
  content_type: application/json