Virto Commerce · OAuth Scopes

Virto Commerce OAuth Scopes

OAuth 2.0 searched

Virto Commerce publishes 84 OAuth 2.0 scopes via the password and clientCredentials flows. Scopes are the fine-grained permissions an application requests at authorization time to act against the Virto Commerce API on a user’s behalf.

Tokens are issued from /connect/token.

This index is generated from the provider’s OpenAPI security definitions (and, where available, its documented scope reference) and refreshes on every APIs.io network build. Browse every provider’s scopes at scopes.apis.io.

B2B E-CommerceCatalog ManagementOrder ManagementPricingInventoryShopping CartCustomer ManagementMarketingPaymentsShippingSubscriptionHeadless CommerceOpen-Source.NETWebhookEvent-DrivenCloudEventsGraphQLReturnsMCPB2B Quotes

Scopes: 84 Flows: password, clientCredentials Method: searched

OAuth endpoints

Token URL
/connect/token

Flows
passwordclientCredentials

Scopes (84)

Scope	Description	Flows
background_jobs:manage
cache:reset
cart:create
cart:delete
cart:read
cart:update
catalog:access
catalog:configurations:read
catalog:configurations:update
catalog:create
catalog:delete
catalog:dictionary-property:edit
catalog:read
catalog:update
customer:create
customer:delete
customer:invite
customer:read
customer:update
eventbus:events:read
eventbus:subscriptions:delete
eventbus:subscriptions:read
eventbus:subscriptions:update
eventbus:subscriptions:сreate
inventory:fulfillment:delete
inventory:fulfillment:edit
inventory:fulfillment:read
inventory:read
inventory:update
marketing:create
marketing:delete
marketing:read
marketing:update
measures:access
measures:create
measures:delete
measures:read
measures:update
order:capture_payment
order:create
order:dashboardstatistics:view
order:payment:execute_callback
order:refund
order:update_shipments
platform:developer-tools:access
platform:dynamic_properties:create
platform:dynamic_properties:delete
platform:dynamic_properties:read
platform:dynamic_properties:update
platform:module:manage
platform:module:read
platform:security:confirmEmail
platform:security:create
platform:security:delete
platform:security:generateToken
platform:security:oauth_applications:create
platform:security:oauth_applications:delete
platform:security:oauth_applications:read
platform:security:oauth_applications:update
platform:security:read
platform:security:revokeToken
platform:security:update
platform:security:verifyEmail
platform:security:verifyToken
platform:setting:read
platform:setting:update
pricing:create
pricing:delete
pricing:read
pricing:update
quote:create
quote:delete
quote:read
quote:update
return:delete
return:read
return:update
store:create
store:read
store:update
webhooks:delete
webhooks:feed:read
webhooks:read
webhooks:update

📄 Provider scope reference: https://docs.virtocommerce.org/platform/developer-guide/Fundamentals/Security/

Source

OAuth Scopes

generated: '2026-08-13'
method: searched
source: 'openapi/virto-commerce-catalog-api-openapi.yml, openapi/virto-commerce-companies-and-contacts-api-openapi.yml,
  openapi/virto-commerce-event-bus-api-openapi.yml, openapi/virto-commerce-inventory-api-openapi.yml,
  openapi/virto-commerce-marketing-api-openapi.yml, openapi/virto-commerce-order-management-api-openapi.yml,
  openapi/virto-commerce-pricing-api-openapi.yml, openapi/virto-commerce-quotes-api-openapi.yml, openapi/virto-commerce-returns-api-openapi.yml,
  openapi/virto-commerce-shopping-cart-api-openapi.yml, openapi/virto-commerce-store-api-openapi.yml,
  openapi/virto-commerce-virtocommerce-platform-api-openapi.yml, openapi/virto-commerce-webhooks-api-openapi.yml

  ; upgraded 2026-08-13 with the live discovery document https://virtostart-demo-admin.govirto.com/.well-known/openid-configuration
  (HTTP 200)'
schemes:
- name: oauth2
  source: openapi/virto-commerce-catalog-api-openapi.yml
  flows:
  - flow: password
    tokenUrl: /connect/token
  - flow: clientCredentials
    tokenUrl: /connect/token
  description: OAuth2 Resource Owner Password Grant flow
- name: oauth2
  source: openapi/virto-commerce-companies-and-contacts-api-openapi.yml
  flows:
  - flow: password
    tokenUrl: /connect/token
  - flow: clientCredentials
    tokenUrl: /connect/token
  description: OAuth2 Resource Owner Password Grant flow
- name: oauth2
  source: openapi/virto-commerce-event-bus-api-openapi.yml
  flows:
  - flow: password
    tokenUrl: /connect/token
  - flow: clientCredentials
    tokenUrl: /connect/token
  description: OAuth2 Resource Owner Password Grant flow
- name: oauth2
  source: openapi/virto-commerce-inventory-api-openapi.yml
  flows:
  - flow: password
    tokenUrl: /connect/token
  - flow: clientCredentials
    tokenUrl: /connect/token
  description: OAuth2 Resource Owner Password Grant flow
- name: oauth2
  source: openapi/virto-commerce-marketing-api-openapi.yml
  flows:
  - flow: password
    tokenUrl: /connect/token
  - flow: clientCredentials
    tokenUrl: /connect/token
  description: OAuth2 Resource Owner Password Grant flow
- name: oauth2
  source: openapi/virto-commerce-order-management-api-openapi.yml
  flows:
  - flow: password
    tokenUrl: /connect/token
  - flow: clientCredentials
    tokenUrl: /connect/token
  description: OAuth2 Resource Owner Password Grant flow
- name: oauth2
  source: openapi/virto-commerce-pricing-api-openapi.yml
  flows:
  - flow: password
    tokenUrl: /connect/token
  - flow: clientCredentials
    tokenUrl: /connect/token
  description: OAuth2 Resource Owner Password Grant flow
- name: oauth2
  source: openapi/virto-commerce-quotes-api-openapi.yml
  flows:
  - flow: password
    tokenUrl: /connect/token
  - flow: clientCredentials
    tokenUrl: /connect/token
  description: OAuth2 Resource Owner Password Grant flow
- name: oauth2
  source: openapi/virto-commerce-returns-api-openapi.yml
  flows:
  - flow: password
    tokenUrl: /connect/token
  - flow: clientCredentials
    tokenUrl: /connect/token
  description: OAuth2 Resource Owner Password Grant flow
- name: oauth2
  source: openapi/virto-commerce-shopping-cart-api-openapi.yml
  flows:
  - flow: password
    tokenUrl: /connect/token
  - flow: clientCredentials
    tokenUrl: /connect/token
  description: OAuth2 Resource Owner Password Grant flow
- name: oauth2
  source: openapi/virto-commerce-store-api-openapi.yml
  flows:
  - flow: password
    tokenUrl: /connect/token
  - flow: clientCredentials
    tokenUrl: /connect/token
  description: OAuth2 Resource Owner Password Grant flow
- name: oauth2
  source: openapi/virto-commerce-virtocommerce-platform-api-openapi.yml
  flows:
  - flow: password
    tokenUrl: /connect/token
  - flow: clientCredentials
    tokenUrl: /connect/token
  description: OAuth2 Resource Owner Password Grant flow
- name: oauth2
  source: openapi/virto-commerce-webhooks-api-openapi.yml
  flows:
  - flow: password
    tokenUrl: /connect/token
  - flow: clientCredentials
    tokenUrl: /connect/token
  description: OAuth2 Resource Owner Password Grant flow
scopes:
- scope: background_jobs:manage
  sources:
  - openapi/virto-commerce-virtocommerce-platform-api-openapi.yml
- scope: cache:reset
  sources:
  - openapi/virto-commerce-virtocommerce-platform-api-openapi.yml
- scope: cart:create
  sources:
  - openapi/virto-commerce-shopping-cart-api-openapi.yml
- scope: cart:delete
  sources:
  - openapi/virto-commerce-shopping-cart-api-openapi.yml
- scope: cart:read
  sources:
  - openapi/virto-commerce-shopping-cart-api-openapi.yml
- scope: cart:update
  sources:
  - openapi/virto-commerce-shopping-cart-api-openapi.yml
- scope: catalog:access
  sources:
  - openapi/virto-commerce-catalog-api-openapi.yml
- scope: catalog:configurations:read
  sources:
  - openapi/virto-commerce-catalog-api-openapi.yml
- scope: catalog:configurations:update
  sources:
  - openapi/virto-commerce-catalog-api-openapi.yml
- scope: catalog:create
  sources:
  - openapi/virto-commerce-catalog-api-openapi.yml
- scope: catalog:delete
  sources:
  - openapi/virto-commerce-catalog-api-openapi.yml
- scope: catalog:dictionary-property:edit
  sources:
  - openapi/virto-commerce-catalog-api-openapi.yml
- scope: catalog:read
  sources:
  - openapi/virto-commerce-catalog-api-openapi.yml
- scope: catalog:update
  sources:
  - openapi/virto-commerce-catalog-api-openapi.yml
- scope: customer:create
  sources:
  - openapi/virto-commerce-companies-and-contacts-api-openapi.yml
- scope: customer:delete
  sources:
  - openapi/virto-commerce-companies-and-contacts-api-openapi.yml
- scope: customer:invite
  sources:
  - openapi/virto-commerce-companies-and-contacts-api-openapi.yml
- scope: customer:read
  sources:
  - openapi/virto-commerce-companies-and-contacts-api-openapi.yml
- scope: customer:update
  sources:
  - openapi/virto-commerce-companies-and-contacts-api-openapi.yml
- scope: eventbus:events:read
  sources:
  - openapi/virto-commerce-event-bus-api-openapi.yml
- scope: eventbus:subscriptions:delete
  sources:
  - openapi/virto-commerce-event-bus-api-openapi.yml
- scope: eventbus:subscriptions:read
  sources:
  - openapi/virto-commerce-event-bus-api-openapi.yml
- scope: eventbus:subscriptions:update
  sources:
  - openapi/virto-commerce-event-bus-api-openapi.yml
- scope: eventbus:subscriptions:сreate
  sources:
  - openapi/virto-commerce-event-bus-api-openapi.yml
- scope: inventory:fulfillment:delete
  sources:
  - openapi/virto-commerce-inventory-api-openapi.yml
- scope: inventory:fulfillment:edit
  sources:
  - openapi/virto-commerce-inventory-api-openapi.yml
- scope: inventory:fulfillment:read
  sources:
  - openapi/virto-commerce-inventory-api-openapi.yml
- scope: inventory:read
  sources:
  - openapi/virto-commerce-inventory-api-openapi.yml
- scope: inventory:update
  sources:
  - openapi/virto-commerce-inventory-api-openapi.yml
- scope: marketing:create
  sources:
  - openapi/virto-commerce-marketing-api-openapi.yml
- scope: marketing:delete
  sources:
  - openapi/virto-commerce-marketing-api-openapi.yml
- scope: marketing:read
  sources:
  - openapi/virto-commerce-marketing-api-openapi.yml
- scope: marketing:update
  sources:
  - openapi/virto-commerce-marketing-api-openapi.yml
- scope: measures:access
  sources:
  - openapi/virto-commerce-catalog-api-openapi.yml
- scope: measures:create
  sources:
  - openapi/virto-commerce-catalog-api-openapi.yml
- scope: measures:delete
  sources:
  - openapi/virto-commerce-catalog-api-openapi.yml
- scope: measures:read
  sources:
  - openapi/virto-commerce-catalog-api-openapi.yml
- scope: measures:update
  sources:
  - openapi/virto-commerce-catalog-api-openapi.yml
- scope: order:capture_payment
  sources:
  - openapi/virto-commerce-order-management-api-openapi.yml
- scope: order:create
  sources:
  - openapi/virto-commerce-order-management-api-openapi.yml
  - openapi/virto-commerce-quotes-api-openapi.yml
- scope: order:dashboardstatistics:view
  sources:
  - openapi/virto-commerce-order-management-api-openapi.yml
- scope: order:payment:execute_callback
  sources:
  - openapi/virto-commerce-order-management-api-openapi.yml
- scope: order:refund
  sources:
  - openapi/virto-commerce-order-management-api-openapi.yml
- scope: order:update_shipments
  sources:
  - openapi/virto-commerce-order-management-api-openapi.yml
- scope: platform:developer-tools:access
  sources:
  - openapi/virto-commerce-virtocommerce-platform-api-openapi.yml
- scope: platform:dynamic_properties:create
  sources:
  - openapi/virto-commerce-virtocommerce-platform-api-openapi.yml
- scope: platform:dynamic_properties:delete
  sources:
  - openapi/virto-commerce-virtocommerce-platform-api-openapi.yml
- scope: platform:dynamic_properties:read
  sources:
  - openapi/virto-commerce-virtocommerce-platform-api-openapi.yml
- scope: platform:dynamic_properties:update
  sources:
  - openapi/virto-commerce-virtocommerce-platform-api-openapi.yml
- scope: platform:module:manage
  sources:
  - openapi/virto-commerce-virtocommerce-platform-api-openapi.yml
- scope: platform:module:read
  sources:
  - openapi/virto-commerce-virtocommerce-platform-api-openapi.yml
- scope: platform:security:confirmEmail
  sources:
  - openapi/virto-commerce-virtocommerce-platform-api-openapi.yml
- scope: platform:security:create
  sources:
  - openapi/virto-commerce-virtocommerce-platform-api-openapi.yml
- scope: platform:security:delete
  sources:
  - openapi/virto-commerce-virtocommerce-platform-api-openapi.yml
- scope: platform:security:generateToken
  sources:
  - openapi/virto-commerce-virtocommerce-platform-api-openapi.yml
- scope: platform:security:oauth_applications:create
  sources:
  - openapi/virto-commerce-virtocommerce-platform-api-openapi.yml
- scope: platform:security:oauth_applications:delete
  sources:
  - openapi/virto-commerce-virtocommerce-platform-api-openapi.yml
- scope: platform:security:oauth_applications:read
  sources:
  - openapi/virto-commerce-virtocommerce-platform-api-openapi.yml
- scope: platform:security:oauth_applications:update
  sources:
  - openapi/virto-commerce-virtocommerce-platform-api-openapi.yml
- scope: platform:security:read
  sources:
  - openapi/virto-commerce-virtocommerce-platform-api-openapi.yml
- scope: platform:security:revokeToken
  sources:
  - openapi/virto-commerce-virtocommerce-platform-api-openapi.yml
- scope: platform:security:update
  sources:
  - openapi/virto-commerce-virtocommerce-platform-api-openapi.yml
- scope: platform:security:verifyEmail
  sources:
  - openapi/virto-commerce-virtocommerce-platform-api-openapi.yml
- scope: platform:security:verifyToken
  sources:
  - openapi/virto-commerce-virtocommerce-platform-api-openapi.yml
- scope: platform:setting:read
  sources:
  - openapi/virto-commerce-virtocommerce-platform-api-openapi.yml
- scope: platform:setting:update
  sources:
  - openapi/virto-commerce-virtocommerce-platform-api-openapi.yml
- scope: pricing:create
  sources:
  - openapi/virto-commerce-pricing-api-openapi.yml
- scope: pricing:delete
  sources:
  - openapi/virto-commerce-pricing-api-openapi.yml
- scope: pricing:read
  sources:
  - openapi/virto-commerce-pricing-api-openapi.yml
- scope: pricing:update
  sources:
  - openapi/virto-commerce-pricing-api-openapi.yml
- scope: quote:create
  sources:
  - openapi/virto-commerce-quotes-api-openapi.yml
- scope: quote:delete
  sources:
  - openapi/virto-commerce-quotes-api-openapi.yml
- scope: quote:read
  sources:
  - openapi/virto-commerce-quotes-api-openapi.yml
- scope: quote:update
  sources:
  - openapi/virto-commerce-quotes-api-openapi.yml
- scope: return:delete
  sources:
  - openapi/virto-commerce-returns-api-openapi.yml
- scope: return:read
  sources:
  - openapi/virto-commerce-returns-api-openapi.yml
- scope: return:update
  sources:
  - openapi/virto-commerce-returns-api-openapi.yml
- scope: store:create
  sources:
  - openapi/virto-commerce-store-api-openapi.yml
- scope: store:read
  sources:
  - openapi/virto-commerce-store-api-openapi.yml
- scope: store:update
  sources:
  - openapi/virto-commerce-store-api-openapi.yml
- scope: webhooks:delete
  sources:
  - openapi/virto-commerce-webhooks-api-openapi.yml
- scope: webhooks:feed:read
  sources:
  - openapi/virto-commerce-webhooks-api-openapi.yml
- scope: webhooks:read
  sources:
  - openapi/virto-commerce-webhooks-api-openapi.yml
- scope: webhooks:update
  sources:
  - openapi/virto-commerce-webhooks-api-openapi.yml
docs: https://docs.virtocommerce.org/platform/developer-guide/Fundamentals/Security/
scopes_supported_live:
- openid
- offline_access
finding: The OAuth2 securitySchemes declare an empty scopes map in every one of the 13 module documents,
  and the live authorization server advertises only openid and offline_access. Virto Commerce does NOT
  use OAuth scopes for API authorization — access is governed by the platform permission system (colon-namespaced
  strings such as webhooks:read, catalog:update) attached to roles. Any scope names listed below are derived
  from the spec structure, not an authorization vocabulary a client can request.

Work with this as data

Every scope set here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for oauth scopes

4 MCP tools reach this

find_scopesBrowse and filter every scope set in the catalog.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools

Call it yourself

curl for this page

This scope set

curl "https://apis.io/api/v1/scopes/virto-commerce-scopes"

All oauth scopes

curl "https://apis.io/api/v1/scopes?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no email required.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.