generated: '2026-08-29'
method: probed
source: >-
  MSAL protected-resource map and `environment` constant read verbatim from ABM's own production
  bundle https://connect.abm.com/chunk-QN7SXVIA.js, cross-checked against the Azure AD B2C
  discovery document at
  https://connect2abm.b2clogin.com/connect2abm.onmicrosoft.com/B2C_1_cft-signin/v2.0/.well-known/openid-configuration
  (HTTP 200), 2026-08-29.
provider: ABM Industries
providerId: abm-industries
api: ABM Connect
docs: null
note: >-
  ABM publishes no scopes reference page. What follows is not a reconstruction — it is the
  authorisation configuration ABM's own first-party client ships to every browser. ABM Connect
  uses a SINGLE coarse application scope across every protected resource: there is no per-resource
  or per-verb scoping, so a token that can read a service location can also reach finance,
  talent-management and safety resources. That is a real, material finding for anyone assessing
  delegated access.
scope_model: single coarse application scope
scope_count: 2
scopes:
  - name: https://connect2ABM.onmicrosoft.com/31f16065-3479-4b3c-a3cd-e337cafc33c9/cft_client_access
    description: >-
      The one application scope MSAL requests for every ABM Connect protected resource. Granted
      against ABM's Azure AD B2C application (app ID URI connect2ABM.onmicrosoft.com).
    applies_to: all resources listed under protected_resources
  - name: openid
    description: >-
      The only scope advertised in `scopes_supported` by ABM's B2C discovery document.
    source: b2c-discovery
protected_resources:
  base_url: https://connectapi.abm.com/cust-api/
  note: >-
    Resource paths are relative to base_url unless an absolute host is shown. Names are ABM's own
    identifiers. `internal/*` resources are shipped in the customer bundle but are for ABM staff.
  resources:
    - { name: UserAccessApi, path: UserAccess/ }
    - { name: ManageUserApi, path: ManageUser/ }
    - { name: MyAccountApi, path: MyAccount/ }
    - { name: PowerBiEmbedApi, path: PowerBIEmbed/ }
    - { name: WorkOrderApi, path: WorkOrder/ }
    - { name: QualityApi, path: Quality/ }
    - { name: SwopApi, path: SWOP/ }
    - { name: FinanceApi, path: Finance/ }
    - { name: ServiceLocationApi, path: ServiceLocation/ }
    - { name: SafetyApi, path: Safety/ }
    - { name: TalentManagementApi, path: TalentManagement/ }
    - { name: AbmConnectApi, path: abm-connect/ }
    - { name: UserLog, path: abm-connect/user/ }
    - { name: DocumentApi, path: Documents/ }
    - { name: SurveyApi, path: survey }
    - { name: DynamicPageApi, path: DynamicPage/ }
    - { name: AviationServicesApi, path: AviationServices/ }
    - { name: AviationQualityApi, path: AviationQuality/ }
    - { name: Global_WorkOrderApi, path: Global/WorkOrder/ }
    - { name: Global_QualityApi, path: Global/Quality/ }
    - { name: Global_FinanceApi, path: Global/Finance/ }
    - { name: Global_ServiceLocationApi, path: Global/ServiceLocation/ }
    - { name: Global_SafetyApi, path: Global/Safety/ }
    - { name: Global_TalentManagementApi, path: Global/TalentManagement/ }
    - { name: Global_InsightsApi, path: Global/Insights/ }
    - { name: Global_CustomerRel, path: Global/CustomerRel/ }
    - { name: Global_SocialSafety, path: Global/Social/ }
    - { name: Global_EnvironmentApi, path: Global/Env/ }
    - { name: GlobalHomeApi, path: Global/Home/ }
    - { name: In_GlobalScoreCardApi, path: internal/globalScorecard/, audience: abm-internal }
    - { name: In_ScoreCardApi, path: internal/scorecard/, audience: abm-internal }
    - { name: In_FinanceApi, path: internal/finance/, audience: abm-internal }
    - { name: In_WorkOrderApi, path: internal/workOrders/, audience: abm-internal }
    - { name: In_SwopApi, path: internal/SWOP/, audience: abm-internal }
    - { name: In_SafetyApi, path: internal/safety/, audience: abm-internal }
    - { name: In_QualityApi, path: internal/quality/, audience: abm-internal }
    - { name: In_TalentManagementApi, path: internal/talentmanagement/, audience: abm-internal }
    - { name: WebAssetsApi, url: https://connectapi.abm.com/web-assets/ }
    - { name: DocumentApi.blobUrl, url: https://connectapi.abm.com/emp-documents/ }
    - { name: InvoiceEndpoint, url: https://connectapi.abm.com/emp-invoices-clone/ }
    - { name: TaskManagementOpsApi, url: https://appservices.abm.com/external/task-mgmt/cust-api/ }
    - { name: OpsConnectApi, url: https://appservices.abm.com/external/task-mgmt/cust-api/ }
    - { name: RoutesApi, url: https://appservices-uat.abm.com/external/task-mgmt/tasks-api/, note: points at a UAT host in production }
    - { name: TaskAIManagementOpsApi, url: https://appservices-uat.abm.com/external/task-mgmt/ai-assitant/, note: points at a UAT host in production }
resource_count: 44
evidence:
  - url: https://connect.abm.com/chunk-QN7SXVIA.js
    status: 200
  - url: https://connect2abm.b2clogin.com/connect2abm.onmicrosoft.com/B2C_1_cft-signin/v2.0/.well-known/openid-configuration
    status: 200
maintainers:
  - FN: Kin Lane
    email: kin@apievangelist.com