Zillapi · OAuth Scopes

Zillapi OAuth Scopes

OAuth 2.0 searched

Zillapi publishes 1 OAuth 2.0 scope via the authorizationCode flow. Scopes are the fine-grained permissions an application requests at authorization time to act against the Zillapi API on a user’s behalf.

Tokens are issued from https://api.zillapi.com/oauth/token.

This index is generated from the provider’s OpenAPI security definitions (and, where available, its documented scope reference) and refreshes on every APIs.io network build. Browse every provider’s scopes at scopes.apis.io.

real estateproptechproperty datazillowzestimatevaluationAVMlistingsMCPAI agentREST API

Scopes: 1 Flows: authorizationCode Method: searched

OAuth endpoints

Authorization URL
https://api.zillapi.com/oauth/authorize

Token URL
https://api.zillapi.com/oauth/token

Flows
authorizationCode

Scopes (1)

Scope	Description	Flows
mcp:access	The single scope Zillapi issues. Grants an agent access to the hosted MCP server at https://api.zillapi.com/mcp and the same /v1 REST surface a long-lived API key reaches; both auth paths bill against the same account.	authorizationCode

📄 Provider scope reference: https://zillapi.com/auth.md

Source

OAuth Scopes

generated: '2026-08-09'
method: searched
source: https://zillapi.com/.well-known/oauth-authorization-server
docs: https://zillapi.com/auth.md
note: >-
  Not derivable from the OpenAPI — openapi/zillapi-openapi-original.json declares only the `bearerAuth`
  http scheme. The OAuth 2.1 surface and its single scope are published in the RFC 8414 authorization
  server metadata and the RFC 9728 protected resource metadata, both harvested to well-known/.
schemes:
  - name: oauth2
    source: well-known/zillapi-oauth-authorization-server.json
    issuer: https://api.zillapi.com
    flows:
      - flow: authorizationCode
        authorizationUrl: https://api.zillapi.com/oauth/authorize
        tokenUrl: https://api.zillapi.com/oauth/token
        pkce: S256
scopes:
  - scope: mcp:access
    description: >-
      The single scope Zillapi issues. Grants an agent access to the hosted MCP server at
      https://api.zillapi.com/mcp and the same /v1 REST surface a long-lived API key reaches; both auth
      paths bill against the same account.
    flows: [authorizationCode]
    sources:
      - well-known/zillapi-oauth-authorization-server.json
      - well-known/zillapi-oauth-protected-resource.json
      - well-known/zillapi-mcp-server-card.json
model:
  granularity: coarse
  notes: >-
    A single all-or-nothing scope — there is no read/write split and no per-resource scoping. An agent
    granted mcp:access can reach every /v1 operation, including webhook creation and revocation.
    Credit balance and plan, not scope, are what bound what a token can spend.