generated: '2026-08-06'
method: probed
source: https://api.acrisure.com/.well-known/oauth-authorization-server
docs: null
docs_note: >-
  Acrisure publishes no scopes or permissions reference page. Every scope below is verbatim
  from the `scopes_supported` array of the RFC 8414 authorization-server metadata; the
  descriptions are our reading of the scope names, not Acrisure text.
schemes:
- name: AcrisureOAuth2
  source: https://api.acrisure.com/.well-known/oauth-authorization-server
  issuer: https://api.acrisure.com
  flows:
  - flow: authorizationCode
    authorizationUrl: https://api.acrisure.com/oauth/authorize
    tokenUrl: https://api.acrisure.com/oauth/token
scopes:
- scope: api://bc250bc0-7689-4f21-b164-72a6b57c273b/mcp_user
  description: >-
    Microsoft Entra ID application scope granting a user-delegated session against the
    Acrisure MCP server at https://api.acrisure.com/v1/mcp. Description inferred from the
    scope name; Acrisure publishes no scope reference.
  flows:
  - authorizationCode
  sources:
  - https://api.acrisure.com/.well-known/oauth-authorization-server
  resource_app_id: bc250bc0-7689-4f21-b164-72a6b57c273b
  protects: https://api.acrisure.com/v1/mcp
- scope: offline_access
  description: >-
    Standard OIDC scope. Permits issuance of a refresh token so an agent session can
    outlive the initial access token.
  flows:
  - authorizationCode
  sources:
  - https://api.acrisure.com/.well-known/oauth-authorization-server
  standard: true
summary:
  scope_count: 2
  provider_specific_scopes: 1
  standard_scopes: 1
  granularity: coarse
  granularity_note: >-
    A single provider-specific scope covers the entire MCP surface. There is no
    read/write split, no per-resource scope, and no least-privilege gradation, so any
    agent granted `mcp_user` receives whatever the full tool set can do.
x-evidence:
  fetched: '2026-08-06'
  url: https://api.acrisure.com/.well-known/oauth-authorization-server
  http_status: 200
  content_type: application/json