Yardi Canada · OAuth Scopes

Yardi Canada OAuth Scopes

OAuth 2.0 searched

Yardi Canada publishes 4 OAuth 2.0 scopes via the authorizationCode flow. Scopes are the fine-grained permissions an application requests at authorization time to act against the Yardi Canada API on a user’s behalf.

Tokens are issued from https://mcp.virtuoso.ai/oauth/token.

This index is generated from the provider’s OpenAPI security definitions (and, where available, its documented scope reference) and refreshes on every APIs.io network build. Browse every provider’s scopes at scopes.apis.io.

Real EstateCanadaProperty ManagementRentalsCommercial Real EstatePropTechMultifamilyAffordable HousingSenior LivingInvestment ManagementTenancyPaymentsMCPAI

Scopes: 4 Flows: authorizationCode Method: searched

OAuth endpoints

Authorization URL
https://mcp.virtuoso.ai/oauth/authorize

Token URL
https://mcp.virtuoso.ai/oauth/token

Flows
authorizationCode

Scopes (4)

Scope	Description	Flows
openid	Standard OpenID Connect scope; requests an ID token for the signed-in Yardi user.	authorizationCode
profile	Standard OIDC scope for basic profile claims about the signed-in Yardi user.	authorizationCode
email	Standard OIDC scope for the signed-in user's email claim.	authorizationCode
offline_access	Requests a refresh token so the agent can keep operating without re-consent.	authorizationCode

📄 Provider scope reference:

Source

OAuth Scopes

generated: '2026-07-26'
method: searched
source: https://mcp.virtuoso.ai/.well-known/oauth-authorization-server
sources:
  - https://mcp.virtuoso.ai/.well-known/oauth-authorization-server
  - https://mcp.virtuoso.ai/.well-known/oauth-protected-resource
summary: >-
  Yardi's only published OAuth scope vocabulary belongs to the Yardi Virtuoso MCP
  server, and it is deliberately thin: four standard OIDC/OAuth scopes, no
  product-domain scopes. That is the whole authorization story an agent can read
  anonymously. Data authorization is not expressed as scopes at all — Yardi states
  the connector "authenticates through Yardi, so data access automatically follows
  existing user permissions", which means the Voyager/Breeze/RentCafe role of the
  signed-in Yardi user is the real permission boundary. No scope reference page is
  published; the metadata document is the reference.
schemes:
  - name: virtuoso-mcp-oauth
    type: oauth2
    source: https://mcp.virtuoso.ai/.well-known/oauth-authorization-server
    issuer: https://mcp.virtuoso.ai
    flows:
      - flow: authorizationCode
        authorizationUrl: https://mcp.virtuoso.ai/oauth/authorize
        tokenUrl: https://mcp.virtuoso.ai/oauth/token
        registrationUrl: https://mcp.virtuoso.ai/oauth/register
        pkce: [S256]
        grant_types: [authorization_code, refresh_token]
        token_endpoint_auth_methods: [client_secret_post, client_secret_basic, none]
scopes:
  - scope: openid
    description: Standard OpenID Connect scope; requests an ID token for the signed-in Yardi user.
    flows: [authorizationCode]
    sources: [https://mcp.virtuoso.ai/.well-known/oauth-authorization-server]
  - scope: profile
    description: Standard OIDC scope for basic profile claims about the signed-in Yardi user.
    flows: [authorizationCode]
    sources: [https://mcp.virtuoso.ai/.well-known/oauth-authorization-server]
  - scope: email
    description: Standard OIDC scope for the signed-in user's email claim.
    flows: [authorizationCode]
    sources: [https://mcp.virtuoso.ai/.well-known/oauth-authorization-server]
  - scope: offline_access
    description: Requests a refresh token so the agent can keep operating without re-consent.
    flows: [authorizationCode]
    sources: [https://mcp.virtuoso.ai/.well-known/oauth-authorization-server]
notes:
  - No product-domain scopes (property, lease, ledger, work-order) are published; the connector is declared Read & Write with no scope-level separation of the two.
  - No OAuth surface of any kind exists on www.yardi.com or www.yardibreeze.ca — /.well-known/openid-configuration and /.well-known/oauth-authorization-server both 404 there.
  - The Voyager Standard Interfaces and the RentCafe API are not OAuth; they use a contract-issued access token (see authentication/).