specification: API Commons OAuth Scopes
specificationVersion: '0.1'
provider: Bloomberg Data
providerId: bloomberg-data
generated: '2026-08-27'
method: searched
source: >-
  https://bsso.blpprofessional.com/.well-known/oauth-authorization-server (200) and
  https://www.bloomberg.com/.well-known/openid-configuration (200)
docs: null
description: >-
  OAuth scopes Bloomberg actually advertises in its published authorization-server metadata.
  There is no public scope reference page — these are read verbatim from scopes_supported.
  Note the shape of the finding: every scope Bloomberg publishes is an IDENTITY scope. The
  Data License data-plane entitlements (which catalogs, datasets and fields a client may
  read) are provisioned per contract in the Bloomberg Enterprise Console and are NOT
  expressed as OAuth scopes, so an agent cannot reason about its own data authority from
  the token.
authorization_servers:
  - issuer: https://bsso.blpprofessional.com
    applies_to:
      - Bloomberg Data License API
    scopes:
      - name: openid
        description: OpenID Connect — request an ID token.
      - name: profile
        description: Standard OIDC profile claims.
      - name: email
        description: Standard OIDC email claim.
      - name: name
        description: Subject display name claim.
      - name: firmid
        description: Bloomberg firm identifier for the authenticated principal.
      - name: employeeid
        description: Bloomberg employee identifier for the authenticated principal.
      - name: bbprofile
        description: Bloomberg profile claim set.
  - issuer: https://www.bloomberg.com
    applies_to:
      - bloomberg.com account identity (not the Data License data plane)
    scopes:
      - name: openid
        description: OpenID Connect — request an ID token.
      - name: user
        description: bloomberg.com user profile.
      - name: entitlements
        description: bloomberg.com subscription entitlements.
grant_types_supported:
  - authorization_code
  - refresh_token
  - client_credentials
  - password
  - implicit
  - urn:ietf:params:oauth:grant-type:jwt-bearer
  - urn:ietf:params:oauth:grant-type:saml2-bearer
  - urn:ietf:params:oauth:grant-type:device_code
  - urn:ietf:params:oauth:grant-type:token-exchange
  - urn:openid:params:grant-type:ciba
  - urn:pingidentity.com:oauth2:grant_type:validate_bearer
token_endpoint_auth_methods_supported:
  - client_secret_basic
  - client_secret_post
  - client_secret_jwt
  - private_key_jwt
  - tls_client_auth
gaps:
  - No published scope-to-operation mapping; data entitlements are contractual, not scoped.
maintainers:
  - FN: Kin Lane
    email: kin@apievangelist.com