generated: '2026-08-28' method: probed source: https://login.mutualofamerica.com/.well-known/openid-configuration issuer: https://login.mutualofamerica.com note: >- Read verbatim from `scopes_supported` in the two discovery documents saved under well-known/. IMPORTANT READING NOTE: the OpenID Connect document advertises the standard OIDC scope set and nothing bespoke — Mutual of America has defined no product scopes of its own, because it ships no public API. The RFC 8414 document additionally advertises the full `okta.*` management scope set; those are the identity vendor's platform-administration scopes present on every Okta org authorization server, NOT scopes Mutual of America authored or exposes to third parties. They are recorded here for completeness and marked `vendor_platform: true` so they are never mistaken for a Mutual of America API surface. scope_count: 7 scopes: - name: openid description: Required for OpenID Connect; requests an ID token. - name: email description: Email address and email_verified claims. - name: profile description: Default profile claims (name, family_name, given_name, locale, zoneinfo…). - name: address description: End-user postal address claim. - name: phone description: phone_number and phone_number_verified claims. - name: offline_access description: Requests a refresh token for long-lived sessions. - name: groups description: Group membership claim, used to drive portal entitlements. vendor_platform_scopes: vendor_platform: true source: https://login.mutualofamerica.com/.well-known/oauth-authorization-server count: 82 note: >- Okta org-management scopes (okta.users.*, okta.groups.*, okta.apps.*, okta.policies.*, okta.logs.read, okta.apiTokens.*, …) advertised by the Okta org authorization server. Reachable only by administrators of the tenant. Not a Mutual of America API product. docs: null docs_note: >- No scopes/permissions reference page is published. Mutual of America has no developer portal.