generated: '2026-07-18'
method: searched
source: https://login.bpsnap.com/.well-known/openid-configuration
docs: https://login.bpsnap.com/.well-known/openid-configuration
notes: >-
  Blackpoint CompassOne authenticates through an Auth0 OIDC tenant
  (login.bpsnap.com). Scopes below are the standard OIDC/Auth0 scopes advertised
  by the tenant's discovery document, plus the runtime scope string the
  CompassOne web app requests. Fine-grained CompassOne API permission scopes are
  not published on a public reference page (the product API at
  api.blackpointcyber.com is gated).
schemes:
- name: CompassOneOIDC
  source: https://login.bpsnap.com/.well-known/openid-configuration
  flows:
  - flow: authorizationCode
    authorizationUrl: https://login.bpsnap.com/authorize
    tokenUrl: https://login.bpsnap.com/oauth/token
  - flow: clientCredentials
    tokenUrl: https://login.bpsnap.com/oauth/token
runtime_scope_request: "openid profile email roles groups offline_access"
scopes:
- scope: openid
  description: OpenID Connect sign-in; issue an ID token.
- scope: profile
  description: Access to the user's basic profile claims.
- scope: email
  description: Access to the user's email address and verification status.
- scope: offline_access
  description: Issue a refresh token for long-lived access.
- scope: roles
  description: Include the user's CompassOne roles in the token (Auth0 custom scope).
- scope: groups
  description: Include the user's group memberships in the token (Auth0 custom scope).