Very Good Security OAuth Scopes

OAuth 2.0 searched

Very Good Security publishes 3 OAuth 2.0 scopes via the clientCredentials flow. Scopes are the fine-grained permissions an application requests at authorization time to act against the Very Good Security API on a user’s behalf.

Tokens are issued from https://auth.verygoodsecurity.com/auth/realms/vgs/protocol/openid-connect/token.

This index is generated from the provider’s OpenAPI security definitions (and, where available, its documented scope reference) and refreshes on every APIs.io network build. Browse every provider’s scopes at scopes.apis.io.

CompanyData SecurityTokenizationPaymentsVaultPCI ComplianceData PrivacyCard ManagementNetwork TokensSecurity

Scopes: 3 Flows: clientCredentials Method: searched

OAuth endpoints

Token URL
https://auth.verygoodsecurity.com/auth/realms/vgs/protocol/openid-connect/token

Flows
clientCredentials

Scopes (3)

Scope	Description	Flows
aliases:read	read the entire vault data object using the associated alias	clientCredentials
aliases:write	create new aliases by value	clientCredentials
aliases:delete	delete any alias	clientCredentials

📄 Provider scope reference: https://docs.verygoodsecurity.com/vault/developer-tools/apis/vault-api/authentication-and-authorization

Source

OAuth Scopes

generated: '2026-07-21'
method: searched
source: https://docs.verygoodsecurity.com/vault/developer-tools/apis/vault-api/authentication-and-authorization
docs: https://docs.verygoodsecurity.com/vault/developer-tools/apis/vault-api/authentication-and-authorization
notes: >-
  The harvested Vault HTTP API OpenAPI declares only basic auth, so nothing was
  derivable from the spec; these scopes come from the Vault API auth docs and the
  live Keycloak OIDC discovery document (well-known/very-good-security-openid-configuration.json),
  whose scopes_supported lists 150+ platform scopes. Documented Vault API scopes
  are below; credentials must also be assigned to specific vaults or requests
  return 401 even with correct scopes.
schemes:
- name: OAuth2 client credentials (vgs realm)
  source: https://auth.verygoodsecurity.com/auth/realms/vgs/.well-known/openid-configuration
  flows:
  - flow: clientCredentials
    tokenUrl: https://auth.verygoodsecurity.com/auth/realms/vgs/protocol/openid-connect/token
scopes:
- scope: aliases:read
  description: read the entire vault data object using the associated alias
  flows: [clientCredentials]
- scope: aliases:write
  description: create new aliases by value
  flows: [clientCredentials]
- scope: aliases:delete
  description: delete any alias
  flows: [clientCredentials]
platform_scope_registry:
  source: well-known/very-good-security-openid-configuration.json
  count: 150+
  examples:
  - routes:read
  - routes:write
  - vaults:read
  - vaults:write
  - credentials:read
  - credentials:write
  - network-tokens:read
  - network-tokens:write
  - cards:read
  - cards:write
  - cards:read-pci
  - 3ds:read
  - 3ds:write
  - access-logs:read
  - audit-logs:read
  - certificates:read
  - certificates:write
  - account-validations:read
  - account-validations:write
  - financial-instruments:read
  - financial-instruments:write