generated: '2026-09-02'
method: probed
source: https://efile.aphis.usda.gov/.well-known/openid-configuration (HTTP 200), identical scopes_supported
  on acir.aphis.usda.gov and aphis.my.site.com
specification: API Commons OAuth Scopes
specificationVersion: '0.1'
provider: Animal and Plant Health Inspection Service
providerId: animal-and-plant-health-inspection-service
docs: null
note: 'These 36 scopes are read verbatim from the scopes_supported array of the OpenID Connect Discovery
  documents APHIS serves on its three Salesforce Experience Cloud hosts. They are the Salesforce platform
  default scope set, not a permission model APHIS authored or documents: APHIS publishes no scope reference
  page, and no APHIS document maps any of these scopes to an APHIS operation. Recorded because the surface
  is genuinely served by APHIS-controlled issuers; descriptions below state what each platform scope grants
  and are derived from the OAuth/OIDC and Salesforce platform meanings, not from APHIS documentation.'
issuers:
- https://efile.aphis.usda.gov
- https://acir.aphis.usda.gov
- https://aphis.my.site.com
scope_count: 36
authored_by_provider: false
scopes:
- name: address
  description: Standard OIDC address claim.
  source: scopes_supported
- name: api
  description: Access the Salesforce REST/SOAP data APIs of the org as the signed-in user.
  source: scopes_supported
- name: cdp_api
  description: Data Cloud (CDP) API.
  source: scopes_supported
- name: cdp_calculated_insight_api
  description: Data Cloud calculated insights API.
  source: scopes_supported
- name: cdp_identityresolution_api
  description: Data Cloud identity resolution API.
  source: scopes_supported
- name: cdp_ingest_api
  description: Data Cloud ingestion API.
  source: scopes_supported
- name: cdp_profile_api
  description: Data Cloud profile API.
  source: scopes_supported
- name: cdp_query_api
  description: Data Cloud query API.
  source: scopes_supported
- name: cdp_segment_api
  description: Data Cloud segmentation API.
  source: scopes_supported
- name: chatbot_api
  description: Einstein Bots API.
  source: scopes_supported
- name: chatter_api
  description: Access the Connect (Chatter) REST API.
  source: scopes_supported
- name: content
  description: Access Salesforce Files / ContentDocument.
  source: scopes_supported
- name: custom_permissions
  description: Return the org custom permissions granted to the user.
  source: scopes_supported
- name: data_cloud_user_claims
  description: Data Cloud user claims in the id_token.
  source: scopes_supported
- name: eclair_api
  description: CRM Analytics chart/visualization API.
  source: scopes_supported
- name: einstein_gpt_api
  description: Einstein GPT API.
  source: scopes_supported
- name: email
  description: Standard OIDC email + email_verified claims.
  source: scopes_supported
- name: forgot_password
  description: Password-reset API for Experience Cloud users.
  source: scopes_supported
- name: full
  description: Full access to all data the signed-in user can reach (excludes refresh token).
  source: scopes_supported
- name: id
  description: Salesforce identity URL access.
  source: scopes_supported
- name: interaction_api
  description: Interaction/Flow runtime API.
  source: scopes_supported
- name: lightning
  description: Access Lightning Experience pages.
  source: scopes_supported
- name: mcp_api
  description: Salesforce Model Context Protocol API scope (platform capability; no APHIS MCP server is
    published).
  source: scopes_supported
- name: offline_access
  description: Issue a refresh token so the client can act after the access token expires.
  source: scopes_supported
- name: openid
  description: OpenID Connect - return an id_token identifying the signed-in user.
  source: scopes_supported
- name: pardot_api
  description: Account Engagement (Pardot) API.
  source: scopes_supported
- name: phone
  description: Standard OIDC phone_number + phone_number_verified claims.
  source: scopes_supported
- name: profile
  description: Standard OIDC profile claims (name, preferred_username, picture, locale).
  source: scopes_supported
- name: pwdless_login_api
  description: Passwordless login API.
  source: scopes_supported
- name: refresh_token
  description: Legacy Salesforce alias for offline_access.
  source: scopes_supported
- name: scrt_api
  description: Service Cloud Real-Time (Messaging) API.
  source: scopes_supported
- name: sfap_api
  description: Salesforce AI platform (models) API.
  source: scopes_supported
- name: user_registration_api
  description: Self-registration API for Experience Cloud users.
  source: scopes_supported
- name: visualforce
  description: Access Visualforce pages.
  source: scopes_supported
- name: wave_api
  description: CRM Analytics (Wave) REST API.
  source: scopes_supported
- name: web
  description: Open a web session in the org using the access token.
  source: scopes_supported
maintainers:
- FN: Kin Lane
  email: info@apievangelist.com