University of Wisconsin-Madison · OAuth Scopes

University of Wisconsin-Madison OAuth Scopes

OAuth 2.0 derived

University of Wisconsin-Madison uses OAuth 2.0 but publishes no discrete scopes — access is governed by the grant itself (e.g. client-credentials or role-based authorization) rather than per-scope consent.

This index is generated from the provider’s OpenAPI security definitions (and, where available, its documented scope reference) and refreshes on every APIs.io network build. Browse every provider’s scopes at scopes.apis.io.

UniversityHigher EducationEducationPublic Research UniversityUnited StatesWisconsinBig TenAssociation of American UniversitiesIdentityIdentity FederationCourse CatalogResearch RepositoryStudent Information SystemHuman ResourcesFinanceCurriculum

Scopes: 0 Flows: Method: derived

Scopes (0)

University of Wisconsin-Madison implements OAuth 2.0 but publishes no discrete scopes — access is governed by the grant itself (client-credentials or role-based authorization) rather than per-scope consent.

📄 Provider scope reference:

Source

OAuth Scopes

generated: '2026-08-19'
method: derived
source: openapi/ (12 contracts)
x-operator: institution
summary:
  scopes_declared: 0
  detail: >-
    UW-Madison declares ZERO OAuth scopes. Every one of the 10 contracts carrying
    OAuth2ClientCredentials declares `scopes: {}` — an empty scope object — and no operation
    attaches a scope requirement. This is a real, measurable gap, not missing data on our side:
    authorization is decided outside the contract, by which Apigee API products a client
    application has been manually approved for. The contracts therefore cannot tell a consumer
    or an agent what a token will actually permit.
  consequence: >-
    Least-privilege is not expressible. A token is scoped by product grant, and the product
    grant is not machine-readable from anything UW-Madison publishes.
scopes: []
authorization_model:
  mechanism: apigee-api-product
  products_observed:
  - name: api-team-manifest-api
    display: Manifest API
    approval: manual
  - name: eces-api-enterprise-billing
    display: Enterprise Billing API
    approval: manual
  detail: >-
    Read from the developer portal's own catalog endpoint
    (/portals/api/sites/{siteId}/liveportal/apis). Every listed API product uses
    approvalType "manual".