generated: '2026-08-12'
method: probed
source: https://signin.paramark.com/.well-known/openid-configuration
note: >-
  Read verbatim from the scopes_supported array of Paramark's own OpenID Connect discovery
  document and confirmed identical in its OAuth 2.0 Authorization Server Metadata document.
  These are the four standard OIDC scopes; Paramark advertises no product- or resource-scoped
  permissions at the authorization server, and publishes no scopes/permissions reference page.
  Nothing here is inferred — no API-level scope vocabulary was found, and none is invented.
issuer: https://signin.paramark.com
authorization_endpoint: https://signin.paramark.com/oauth2/authorize
token_endpoint: https://signin.paramark.com/oauth2/token
flows:
- authorization_code
- client_credentials
- refresh_token
- urn:ietf:params:oauth:grant-type:device_code
scope_count: 4
scopes:
- name: openid
  description: Standard OIDC scope; requests an ID token identifying the authenticated
    end user.
  standard: true
- name: profile
  description: Standard OIDC scope; requests the end user's default profile claims.
  standard: true
- name: email
  description: Standard OIDC scope; requests the end user's email address and its
    verification status.
  standard: true
- name: offline_access
  description: Standard OIDC scope; requests a refresh token so the client can obtain
    new access tokens without the end user present.
  standard: true
product_scopes_published: false
docs: null
x-evidence:
  fetched: '2026-08-12'
  url: https://signin.paramark.com/.well-known/openid-configuration
  http_status: 200