Tricentis · OAuth Scopes

Tricentis OAuth Scopes

OAuth 2.0 searched

Tricentis publishes 1 OAuth 2.0 scope. Scopes are the fine-grained permissions an application requests at authorization time to act against the Tricentis API on a user’s behalf.

This index is generated from the provider’s OpenAPI security definitions (and, where available, its documented scope reference) and refreshes on every APIs.io network build. Browse every provider’s scopes at scopes.apis.io.

CompanyTestingTest AutomationQuality EngineeringTest ManagementPerformance TestingContinuous TestingDevOpsSAPData IntegrityAgentic Testing

Scopes: 1 Flows: Method: searched

Scopes (1)

Scope	Description	Flows
tta	The scope requested by the Tosca Cloud MCP client (client_id MCPServer). Tricentis publishes the value but no description of what it grants; it appears to cover the Tosca Test Automation surface as a whole rather than a specific resource.	authorizationCode

📄 Provider scope reference: https://docs.tricentis.com/tosca-cloud/en-us/content/ai_integration/connect_mcp_server.htm

Source

OAuth Scopes

generated: '2026-08-02'
method: searched
source: https://docs.tricentis.com/tosca-cloud/en-us/content/ai_integration/connect_mcp_server.htm
docs: https://docs.tricentis.com/tosca-cloud/en-us/content/ai_integration/connect_mcp_server.htm
summary: >-
  None of the nine harvested Tricentis OpenAPI/Swagger documents declares an oauth2
  security scheme — every REST surface is header-credential based (bearer token,
  API key, accountToken, x-access-token, HTTP Basic). The only OAuth surface Tricentis
  documents is the Tosca Cloud identity service, used by the Tosca Cloud MCP server
  and the toscactl CLI. Its published scope surface is a single coarse scope; no
  granular per-resource scope catalogue is published.
oauth_in_specs: false
schemes:
- name: Tosca Cloud identity
  kind: oauth2
  source: docs
  docs: https://docs.tricentis.com/tosca-cloud/en-us/content/ai_integration/connect_mcp_server.htm
  authorization_server: https://<tenant>.my.tricentis.com/_identity
  clients:
  - client_id: MCPServer
    used_by: Tosca Cloud MCP server (via npx mcp-remote, local callback port 56874)
  flows_documented:
  - flow: authorizationCode
    pkce: true
    note: toscactl login opens a browser for PKCE authentication by default.
  - flow: deviceCode
    note: toscactl login --headless, for CI and headless environments.
  - flow: clientCredentials
    note: non-interactive, via TOSCA_CLIENT_ID and TOSCA_CLIENT_SECRET.
scopes:
- scope: tta
  description: >-
    The scope requested by the Tosca Cloud MCP client (client_id MCPServer). Tricentis
    publishes the value but no description of what it grants; it appears to cover the
    Tosca Test Automation surface as a whole rather than a specific resource.
  flows: [authorizationCode]
  sources: [https://docs.tricentis.com/tosca-cloud/en-us/content/ai_integration/connect_mcp_server.htm]
key_auth_products:
  note: >-
    These products have no scope surface at all — they authenticate with a single
    credential carrying the caller's full role-based permissions. See
    authentication/tricentis-authentication.yml.
  products:
  - {product: qTest, credential: bearer token from POST /oauth/token, authorization: qTest
      project and site roles, not scopes}
  - {product: Tricentis Test Management for Jira, credential: API key in Authorization
      header, authorization: Jira project permissions}
  - {product: NeoLoad, credential: accountToken header}
  - {product: qTest Parameters, credential: x-access-token header}
  - {product: Tricentis Analytics, credential: HTTP Basic or apikey query parameter}
gaps:
- No /.well-known/oauth-authorization-server or /.well-known/openid-configuration is
  reachable on any anonymous Tricentis host, so the Tosca Cloud scope list could not be
  read from discovery metadata.
- qTest exposes an /oauth/token endpoint and an /oauth/status endpoint but declares no
  oauth2 scheme or scopes in its Swagger; the token is modelled as an apiKey header.