Measurabl Authentication

generated: '2026-08-01'
method: searched
source: openapi/measurabl-core-openapi.yml, openapi/measurabl-esgx-buildings-openapi.yml, openapi/measurabl-esgx-securities-compliance-files-openapi.yml,
  openapi/measurabl-esgx-securities-openapi.yml, openapi/measurabl-partners-openapi.yml ; upgraded from https://api.measurabl.com/api-docs/
  and https://www.measurabl.com/measurabl-api-faq/
summary:
  types:
  - oauth2
  oauth2_flows:
  - clientCredentials
  grant: client_credentials (RFC 6749 section 4.4)
  token_url: https://api.measurabl.com/token
  credential: client key + secret
  scopes_declared: 0
  applied_to_operations: 110
  coverage: '100% - every operation in all five specs declares security [{OAuth2: []}]'
schemes:
- name: OAuth2
  type: oauth2
  flows:
  - flow: clientCredentials
    tokenUrl: https://api.measurabl.com/token
    scopes: 0
  sources:
  - openapi/measurabl-core-openapi.yml
  - openapi/measurabl-esgx-buildings-openapi.yml
  - openapi/measurabl-esgx-securities-compliance-files-openapi.yml
  - openapi/measurabl-esgx-securities-openapi.yml
  - openapi/measurabl-partners-openapi.yml
docs: https://support.measurabl.com/hc/en-us/articles/15889532915085-How-do-I-authenticate-with-Measurabl-s-Core-API-
provisioning:
  self_serve: false
  eligibility: Premium Tier Measurabl customer, or a partner integrating on behalf of a customer
  process: Contact a Measurabl Customer Delivery Manager, who creates the API key and secret for the organization.
  sales_contact: sales@measurabl.com
  source: https://www.measurabl.com/measurabl-api-faq/
authorization_model:
  style: entitlement-based
  scopes: false
  note: The clientCredentials flow declares an EMPTY scopes map, so there is no scope-based authorization surface.
    Access is decided per portfolio/dataset entitlement on the credential, surfacing as 403 ("when authenticated
    but not authorized") rather than as a scope error. 86 operations declare a 403 response.
discovery:
  oauth_authorization_server_metadata: absent - /.well-known/oauth-authorization-server returns 404 on every host
  oauth_protected_resource_metadata: absent - /.well-known/oauth-protected-resource returns 404 on every host
  openid_configuration: absent - 404 on every host
  note: The token endpoint is only discoverable by reading the OpenAPI securityScheme.
token_transport: 'Authorization: Bearer <access_token>'
mfa_or_mtls: null
cross_links:
  scopes: scopes/measurabl-scopes.yml
  conventions: conventions/measurabl-conventions.yml
  well_known: well-known/measurabl-well-known.yml