generated: '2026-08-01'
method: searched
source: >-
  https://platform.happyrobot.ai/.well-known/oauth-authorization-server,
  https://docs.happyrobot.ai/.well-known/oauth-authorization-server,
  https://auth.happyrobot.ai/.well-known/openid-configuration
notes: >-
  Neither OpenAPI document declares an oauth2 securityScheme — the Public API uses a bearer API key — so
  `derive-oauth-scopes.py` correctly found nothing. The scopes below were instead read from the three live
  RFC 8414 / OIDC discovery documents Happyrobot publishes. Two of the three planes expose exactly one
  coarse scope each; there is no per-resource or read/write scope taxonomy on either MCP surface.
schemes:
- name: platform-mcp
  kind: oauth2
  source: https://platform.happyrobot.ai/.well-known/oauth-authorization-server
  issuer: https://platform.happyrobot.ai
  flows:
  - flow: authorizationCode
    authorizationUrl: https://platform.happyrobot.ai/mcp/authorize
    tokenUrl: https://platform.happyrobot.ai/api/mcp/token
    pkce: S256
  - flow: clientCredentials
    tokenUrl: https://platform.happyrobot.ai/api/mcp/token
  registration_endpoint: https://platform.happyrobot.ai/api/mcp/register
  token_endpoint_auth_methods:
  - none
- name: docs-mcp
  kind: oauth2
  source: https://docs.happyrobot.ai/.well-known/oauth-authorization-server
  issuer: https://docs.happyrobot.ai/mcp/oauth
  flows:
  - flow: authorizationCode
    authorizationUrl: https://docs.happyrobot.ai/mcp/oauth/authorize
    tokenUrl: https://docs.happyrobot.ai/mcp/oauth/token
    pkce: S256
  - flow: clientCredentials
    tokenUrl: https://docs.happyrobot.ai/mcp/oauth/token
  registration_endpoint: https://docs.happyrobot.ai/mcp/oauth/register
  token_endpoint_auth_methods:
  - none
  - client_secret_post
  - client_secret_basic
- name: console-oidc
  kind: openIdConnect
  source: https://auth.happyrobot.ai/.well-known/openid-configuration
  issuer: https://auth.happyrobot.ai/
  flows:
  - flow: authorizationCode
    authorizationUrl: https://auth.happyrobot.ai/authorize
    tokenUrl: https://auth.happyrobot.ai/oauth/token
    pkce: S256
scopes:
- scope: mcp:full
  description: >-
    Full access to the Happyrobot platform MCP surface. The only scope the platform authorization server
    advertises; there is no narrower read-only or per-resource alternative.
  schemes:
  - platform-mcp
  sources:
  - https://platform.happyrobot.ai/.well-known/oauth-authorization-server
- scope: mcp:search
  description: Search the Happyrobot documentation through the docs MCP server.
  schemes:
  - docs-mcp
  sources:
  - https://docs.happyrobot.ai/.well-known/oauth-authorization-server
- scope: openid
  description: Standard OIDC scope requesting an ID token.
  schemes:
  - console-oidc
  sources:
  - https://auth.happyrobot.ai/.well-known/openid-configuration
- scope: profile
  description: Standard OIDC scope for the end user's profile claims.
  schemes:
  - console-oidc
- scope: email
  description: Standard OIDC scope for the end user's email address and verification status.
  schemes:
  - console-oidc
- scope: offline_access
  description: Requests a refresh token for long-lived console sessions.
  schemes:
  - console-oidc
- scope: phone
  description: Standard OIDC scope for phone_number claims (advertised by the tenant).
  schemes:
  - console-oidc
- scope: address
  description: Standard OIDC scope for address claims (advertised by the tenant).
  schemes:
  - console-oidc
observed_console_request:
  url: https://app.happyrobot.ai/login
  redirects_to: https://auth.happyrobot.ai/authorize
  scope: openid profile email offline_access
  response_type: code
  code_challenge_method: S256
gaps:
- The Public API itself has no OAuth scope model — a bearer API key is all-or-nothing within its
  organization and environment.
- The platform MCP server advertises a single `mcp:full` scope, so an agent granted MCP access to the
  platform inherits the full 205-operation surface, including destructive operations such as
  DELETE /workflows/{workflow_id} and POST /runs/{run_id}/cancel.
x-evidence:
  fetched: '2026-08-01'
  probes:
  - url: https://platform.happyrobot.ai/.well-known/oauth-authorization-server
    http_status: 200
  - url: https://docs.happyrobot.ai/.well-known/oauth-authorization-server
    http_status: 200
  - url: https://auth.happyrobot.ai/.well-known/openid-configuration
    http_status: 200