generated: '2026-08-26' method: probed source: https://id.mercedes-benz.com/.well-known/openid-configuration docs: https://developer.mercedes-benz.com/content-page/oauth-documentation evidence: - url: https://id.mercedes-benz.com/.well-known/openid-configuration status: 200 content_type: application/json note: saved verbatim to well-known/mercedes-me-id-openid-configuration.json - url: https://id.mercedes-benz.com/.well-known/oauth-authorization-server status: 200 content_type: application/json note: saved verbatim to well-known/mercedes-me-id-oauth-authorization-server.json description: >- The Mercedes-Benz connected-vehicle APIs authenticate against the Mercedes-Benz customer identity provider at https://id.mercedes-benz.com (PingFederate). Its OpenID Connect discovery document is public and unauthenticated, and it publishes the complete scopes_supported list — 81 scopes, of which 38 are Mercedes-Benz product scopes. This artifact records those scopes verbatim as probed, together with the API product each scope string names. Mercedes-Benz publishes NO OpenAPI securitySchemes for the connected-vehicle products (the four Swagger 2.0 documents in openapi/ carry no securityDefinitions at all), so the discovery document is the only machine-readable scope reference the provider publishes. authorization_server: issuer: https://id.mercedes-benz.com authorization_endpoint: https://id.mercedes-benz.com/as/authorization.oauth2 token_endpoint: https://id.mercedes-benz.com/as/token.oauth2 revocation_endpoint: https://id.mercedes-benz.com/as/revoke_token.oauth2 introspection_endpoint: https://id.mercedes-benz.com/as/introspect.oauth2 userinfo_endpoint: https://id.mercedes-benz.com/idp/userinfo.openid jwks_uri: https://id.mercedes-benz.com/pf/JWKS registration_endpoint: https://id.mercedes-benz.com/as/clients.oauth2 pushed_authorization_request_endpoint_present: true device_authorization_endpoint_present: true end_session_endpoint_present: true code_challenge_methods_supported: [plain, S256] grant_types_supported: - authorization_code - refresh_token - client_credentials - implicit - password - urn:ietf:params:oauth:grant-type:jwt-bearer - urn:ietf:params:oauth:grant-type:saml2-bearer - urn:ietf:params:oauth:grant-type:device_code - urn:ietf:params:oauth:grant-type:token-exchange - urn:openid:params:grant-type:ciba - urn:pingidentity.com:oauth2:grant_type:validate_bearer token_endpoint_auth_methods_supported: - client_secret_basic - client_secret_post - client_secret_jwt - private_key_jwt - tls_client_auth - none scope_count: 81 product_scope_count: 38 scopes: # --- Connected vehicle data products (the Mercedes me / connected-vehicle API family) --- - scope: mb:vehicle:mbdata:vehiclestatus product: Vehicle Status API grants: Door, window, deck-lid, sunroof, tyre-pressure and overall lock state by VIN. mapping_confidence: high mapping_basis: scope string names the product (mbdata + vehiclestatus) - scope: mb:vehicle:mbdata:vehiclestatus15 product: Vehicle Status API grants: Extended Vehicle Status signal set (15-signal variant). mapping_confidence: medium mapping_basis: scope string names the product; the "15" suffix is not explained in any public Mercedes-Benz document we could read - scope: mb:vehicle:mbdata:vehiclelock product: Vehicle Lock Status API grants: Door-lock, deck-lid and position-lock state by VIN. mapping_confidence: high mapping_basis: scope string names the product - scope: mb:vehicle:mbdata:fuelstatus product: Fuel Status API grants: Tank level and remaining fuel range by VIN. mapping_confidence: high mapping_basis: scope string names the product - scope: mb:vehicle:mbdata:evstatus product: Electric Vehicle Status API (v1) grants: State of charge, electric range and charge status. mapping_confidence: high mapping_basis: scope string names the product - scope: mb:vehicle:mbdata:evstatus2.0 product: Electric Vehicle Status API (v2) grants: v2 signal set, including remote charge control surface. mapping_confidence: high mapping_basis: scope string names the product and its version - scope: mb:vehicle:mbdata:evstatus3.0 product: Electric Vehicle Status API (v3) grants: v3 signal set — the version currently listed on the developer portal. mapping_confidence: high mapping_basis: scope string names the product and its version - scope: mb:vehicle:mbdata:payasyoudrive product: Pay As You Drive Insurance API (v1) grants: Odometer reading and geographic position for usage-based insurance. mapping_confidence: high mapping_basis: scope string names the product - scope: mb:vehicle:mbdata:payasyoudrive2.0 product: Pay As You Drive 2.0 API grants: v2 odometer + position signal set. mapping_confidence: high mapping_basis: scope string names the product and its version - scope: mb:vehicle:image product: Vehicle Images API grants: Vehicle and component imagery for a FIN/VIN or configuration. mapping_confidence: high mapping_basis: scope string names the product - scope: mb:vehicle:rds:reader product: Remote Diagnostic Support API grants: Read access to DTC, DTC-snapshot, ECU and resource readouts. (rds = Remote Diagnostic Support.) mapping_confidence: high mapping_basis: acronym matches the product name and the readout operations in openapi/mercedes-me-*-readouts specs - scope: mb:vehicle:rms:reader product: unmapped grants: Read scope on an "rms" vehicle service. mapping_confidence: low mapping_basis: no Mercedes-Benz public document we could read expands "rms"; recorded because it is published, not because we can attribute it # --- Vehicle command / action scopes --- - scope: mb:vehicle:action:doors product: Remote door commands grants: Remote lock/unlock of vehicle doors. WRITE scope — a safety-relevant actuation. mapping_confidence: high mapping_basis: scope string names the action - scope: mb:vehicle:action:general product: Remote vehicle commands (general) grants: General remote-command surface. WRITE scope. mapping_confidence: high mapping_basis: scope string names the action - scope: mb:vehicle:status:writer product: Vehicle status write grants: Write access to vehicle status. WRITE scope. mapping_confidence: medium mapping_basis: scope string names a writer role on vehicle status; no public reference page describes it - scope: mb:vehicle:status:general product: Vehicle status (general) grants: General vehicle-status read scope. Commonly paired with mb:user:pool:reader in Mercedes-Benz OAuth examples. mapping_confidence: medium mapping_basis: scope string; pairing observed in third-party integration write-ups, not in a Mercedes-Benz reference page we could read - scope: mb:vehicle:status:location product: Vehicle location grants: Vehicle geographic position. mapping_confidence: high mapping_basis: scope string names the signal # --- Vehicle / user pool --- - scope: mb:user:pool:reader product: Vehicle pool grants: Read the set of vehicles the consenting customer has assigned to the application. mapping_confidence: high mapping_basis: scope string - scope: mb:user:cv_exp:reader product: Connected-vehicle experience (read) mapping_confidence: low mapping_basis: scope string only - scope: mb:vehicle:cv_exp:general product: Connected-vehicle experience (general) mapping_confidence: low mapping_basis: scope string only - scope: mb.vehicle product: unmapped legacy scope mapping_confidence: low mapping_basis: dot-delimited legacy form; recorded verbatim as published # --- EUDA (EU Data Act) vehicle-data categories --- - scope: mb:vehicle:mbdata:euda:vehicleoperation product: EU Data Act vehicle-data category — vehicle operation mapping_confidence: high mapping_basis: 'the "euda" segment plus the category name' - scope: mb:vehicle:mbdata:euda:maintenancediagnostic product: EU Data Act vehicle-data category — maintenance and diagnostics mapping_confidence: high mapping_basis: 'the "euda" segment plus the category name' - scope: mb:vehicle:mbdata:euda:navigationpositioning product: EU Data Act vehicle-data category — navigation and positioning mapping_confidence: high mapping_basis: 'the "euda" segment plus the category name' - scope: mb:vehicle:mbdata:euda:bodyfeature product: EU Data Act vehicle-data category — body features mapping_confidence: high mapping_basis: 'the "euda" segment plus the category name' - scope: mb:vehicle:mbdata:euda:bodymountingwork product: EU Data Act vehicle-data category — body mounting work (van upfitters) mapping_confidence: high mapping_basis: 'the "euda" segment plus the category name' - scope: mb:vehicle:mbdata:euda:climatecomfort product: EU Data Act vehicle-data category — climate and comfort mapping_confidence: high mapping_basis: 'the "euda" segment plus the category name' - scope: mb:vehicle:mbdata:euda:energyconsumption product: EU Data Act vehicle-data category — energy consumption mapping_confidence: high mapping_basis: 'the "euda" segment plus the category name' - scope: mb:vehicle:mbdata:euda:infotainmentuserinteraction product: EU Data Act vehicle-data category — infotainment user interaction mapping_confidence: high mapping_basis: 'the "euda" segment plus the category name' - scope: mb:wallbox:mbdata:euda:wallbox product: EU Data Act data category — home wallbox charger mapping_confidence: high mapping_basis: 'the "euda" segment plus the category name' # --- Adjacent Mercedes-Benz products --- - scope: mb:digital:eqready:userdata product: EQ Ready mapping_confidence: medium mapping_basis: scope string names the Mercedes-Benz EQ Ready app - scope: mb:service:incardelivery product: In-car delivery service mapping_confidence: medium mapping_basis: scope string names the service - scope: mb:company-id product: Company identifier claim mapping_confidence: medium mapping_basis: matches the company-id claim in claims_supported - scope: mb:internal product: internal mapping_confidence: high mapping_basis: not for third-party use — published in discovery but named internal - scope: mb:rduhackathon product: hackathon scope mapping_confidence: high mapping_basis: scope string; not a production product - scope: oneapi:vehicle:light product: OneAPI vehicle (light) mapping_confidence: low mapping_basis: scope string only - scope: oneapi:testapi product: OneAPI test mapping_confidence: high mapping_basis: test scope, not a production product - scope: oneapi:nil product: OneAPI placeholder mapping_confidence: high mapping_basis: placeholder scope standard_scopes: - openid - profile - email - phone - address - offline_access notes: - >- Scope-to-product mapping is stated with an explicit confidence on every row. Where Mercedes-Benz publishes no readable reference for a scope string, the row says so rather than guessing — the developer portal is a client-rendered SPA whose reference pages return an empty HTML shell to any non-browser client, so the per-product scope tables could not be read. - >- The eleven Car Configurator / Dealer / Vehicle Images / Remote Diagnostic Support OpenAPI documents in openapi/ authenticate with an API key, not OAuth — their 401 response description reads "Failed to resolve API Key query parameter / Invalid API Key". The OAuth scopes above apply to the connected-vehicle product family, which publishes no OpenAPI. - >- The presence of an mb:vehicle:mbdata:euda:* scope family is a substantive finding: Mercedes-Benz has provisioned EU Data Act in-vehicle data categories as first-class OAuth scopes on its production identity provider.