generated: '2026-08-23'
method: probed
source: >-
  https://app.kevala.com/ authorize redirect (observed 2026-08-23) +
  https://kevalaanalytics.auth0.com/.well-known/openid-configuration (HTTP 200)
docs: null
provider: Auth0
authorization_server: https://kevalaanalytics.auth0.com/
audience: https://api.kevala.com
summary: >-
  Only the standard OpenID Connect scope set is discoverable. Kevala's Auth0 tenant publishes
  scopes_supported in its OIDC discovery document, and the platform application requests
  "openid profile email offline_access" when it authorizes for the api.kevala.com audience.
  API-resource scopes (permissions attached to the https://api.kevala.com API in Auth0) are NOT
  published anonymously and cannot be enumerated without credentials — do not assume the OIDC list
  below describes what the DER API authorizes.
scopes:
- name: openid
  description: OpenID Connect authentication; requested by the Kevala platform application.
  requested_by_platform: true
- name: profile
  description: Basic profile claims; requested by the Kevala platform application.
  requested_by_platform: true
- name: email
  description: Email address claim; requested by the Kevala platform application.
  requested_by_platform: true
- name: offline_access
  description: Refresh-token issuance; requested by the Kevala platform application.
  requested_by_platform: true
- name: name
  description: Advertised in the tenant's scopes_supported.
  requested_by_platform: false
- name: given_name
  description: Advertised in the tenant's scopes_supported.
  requested_by_platform: false
- name: family_name
  description: Advertised in the tenant's scopes_supported.
  requested_by_platform: false
- name: nickname
  description: Advertised in the tenant's scopes_supported.
  requested_by_platform: false
- name: email_verified
  description: Advertised in the tenant's scopes_supported.
  requested_by_platform: false
- name: picture
  description: Advertised in the tenant's scopes_supported.
  requested_by_platform: false
- name: created_at
  description: Advertised in the tenant's scopes_supported.
  requested_by_platform: false
- name: identities
  description: Advertised in the tenant's scopes_supported.
  requested_by_platform: false
- name: phone
  description: Advertised in the tenant's scopes_supported.
  requested_by_platform: false
- name: address
  description: Advertised in the tenant's scopes_supported.
  requested_by_platform: false
api_resource_scopes:
  published: false
  note: >-
    No resource-server permission list is published. The gated OpenAPI at
    https://api.kevala.com/der/openapi/ would carry them; it returns 403 to anonymous callers.