generated: '2026-09-12' method: searched docs: https://docs.kinde.com/developer-tools/kinde-api/api-scopes/ source: >- https://docs.kinde.com/developer-tools/kinde-api/api-scopes/ ("Kinde Management API Scopes", last updated 2026-05-02) for the Management API scope table; https://app.kinde.com/.well-known/openid-configuration (probed 2026-09-12, HTTP 200) for scopes_supported on the OIDC surface; https://docs.kinde.com/mcp-servers/operations-and-scopes/ for the MCP subset. The derive-oauth-scopes.py baseline produced nothing because the published OpenAPI declares only an http/bearer securityScheme with no oauth2 flows block — the scope model is real and documented, but it is absent from the machine-readable contract. provider: Kinde providerId: kinde description: >- Kinde operates three distinct scope namespaces. (1) OIDC scopes on the authorization endpoint, published in the discovery document. (2) Management API M2M scopes in verb:resource form, granted per M2M application and narrowable per token. (3) The MCP subset, restricted to read and create only. The Management API scope model is granular and well documented, but it does NOT appear in the OpenAPI, so a generated SDK cannot tell a caller which scope an operation needs. contract_gap: spec_declares_oauth2: false spec_security_schemes: [kindeBearerAuth (http/bearer, JWT)] consequence: >- All 169 Management API operations declare a 403, but the contract never says which scope prevents it. The scope-to-operation mapping exists only in prose. This is the single largest machine-readability gap in an otherwise strong contract. oidc_scopes: source: https://app.kinde.com/.well-known/openid-configuration probed: '2026-09-12' http_status: 200 scopes: - name: openid description: Required for OpenID Connect; requests an ID token. - name: profile description: Basic profile claims. - name: email description: Email address claim. - name: phone description: Phone number claim. - name: address description: Address claim. - name: offline description: Requests a refresh token (Kinde's spelling of offline_access). - name: event_hooks description: Kinde-specific scope enabling event-hook delivery for the authorized session. management_api_scopes: form: 'verb:resource' granted_at: M2M application (Settings > Applications > APIs > Manage scopes) token_narrowing: >- Pass a space-delimited `scope` parameter in the client_credentials token request body to issue a token carrying fewer scopes than the application holds. docs: https://docs.kinde.com/developer-tools/kinde-api/api-scopes/ completeness_note: >- Kinde describes this table as "the most commonly used scopes" and says the dashboard shows the full list when configuring an M2M application. It is therefore a published subset, not a guaranteed-complete enumeration. groups: - group: Users scopes: - {name: 'read:users', description: Read user details} - {name: 'create:users', description: Create users} - {name: 'update:users', description: Update user details} - {name: 'delete:users', description: Delete users} - {name: 'read:user_identities', description: Read linked identity providers for a user} - group: Organizations scopes: - {name: 'read:organizations', description: Read organizations} - {name: 'create:organizations', description: Create organizations} - {name: 'update:organizations', description: Update organizations} - {name: 'delete:organizations', description: Delete organizations} - group: Organization users scopes: - {name: 'read:organization_users', description: Read users in an organization} - {name: 'create:organization_users', description: Add users to an organization} - {name: 'update:organization_users', description: Update organization user details} - {name: 'delete:organization_users', description: Remove users from an organization} - group: Roles scopes: - {name: 'read:roles', description: Read roles} - {name: 'create:roles', description: Create roles} - {name: 'update:roles', description: Update roles} - {name: 'delete:roles', description: Delete roles} - {name: 'read:organization_user_roles', description: Read roles assigned to organization users} - {name: 'create:organization_user_roles', description: Assign roles to organization users} - {name: 'delete:organization_user_roles', description: Remove roles from organization users} - {name: 'read:role_permissions', description: Read the permissions attached to a role} - group: Permissions scopes: - {name: 'read:permissions', description: Read permissions} - {name: 'create:permissions', description: Create permissions} - {name: 'update:permissions', description: Update permissions} - {name: 'delete:permissions', description: Delete permissions} - group: Applications scopes: - {name: 'read:applications', description: Read application details} - {name: 'create:applications', description: Create applications} - {name: 'update:applications', description: Update application details} - {name: 'delete:applications', description: Delete applications} - group: Feature flags scopes: - {name: 'read:feature_flags', description: Read feature flags} - {name: 'create:feature_flags', description: Create feature flags} - {name: 'update:feature_flags', description: Update feature flags} - {name: 'delete:feature_flags', description: Delete feature flags} - group: Environments scopes: - {name: 'read:environments', description: Read environment details} - {name: 'update:environments', description: Update environment settings} - {name: 'read:environment_variables', description: Read environment variables} - {name: 'create:environment_variables', description: Create environment variables} - {name: 'update:environment_variables', description: Update environment variables} - {name: 'delete:environment_variables', description: Delete environment variables} - group: Connections scopes: - {name: 'read:connections', description: Read connection details} - {name: 'create:connections', description: Create connections} - {name: 'update:connections', description: Update connections} - {name: 'delete:connections', description: Delete connections} - group: Webhooks scopes: - {name: 'read:webhooks', description: Read webhooks} - {name: 'create:webhooks', description: Create webhooks} - {name: 'update:webhooks', description: Update webhooks} - {name: 'delete:webhooks', description: Delete webhooks} - group: Properties and subscribers note: >- Named in the MCP operations reference rather than the main scopes table; included here because the MCP reference states them explicitly. scopes: - {name: 'read:properties', description: Read custom properties} - {name: 'create:properties', description: Create custom properties} - {name: 'read:subscribers', description: Read subscribers} - {name: 'create:subscribers', description: Create subscribers} - group: APIs and MCP connections scopes: - {name: 'read:apis', description: View MCP connections, tools and audit} - {name: 'update:apis', description: Create, delete and authorize APIs; configure backend auth} mcp_scope_subset: docs: https://docs.kinde.com/mcp-servers/operations-and-scopes/ policy: read-and-create-only rationale: >- Kinde will not grant update: or delete: scopes to an MCP server, stating that AI clients can misinterpret requests or hallucinate. scopes: - 'read:users' - 'read:user_identities' - 'read:organizations' - 'read:organization_users' - 'read:feature_flags' - 'read:roles' - 'create:roles' - 'read:permissions' - 'create:permissions' - 'read:role_permissions' - 'read:environments' - 'read:properties' - 'create:properties' - 'create:feature_flags' - 'create:environment_variables' - 'read:subscribers' - 'create:subscribers' counts: oidc_scopes: 7 management_scopes: 53 mcp_scopes: 17