generated: '2026-08-05'
method: probed
source: well-known/place-sso-openid-configuration.json, well-known/place-sso-default-openid-configuration.json,
  well-known/place-hub-openid-configuration.json, well-known/place-sso-oauth-authorization-server.json
docs: null
note: >-
  These scopes come from the scopes_supported arrays of the OAuth 2.0 / OpenID Connect
  discovery documents PLACE serves from sso.place.com and hub.place.com. PLACE publishes
  no scopes reference page and no product API, so no PLACE-authored product scopes exist.
  The okta.* set is the Okta Org Authorization Server management scope catalog shipped by
  the identity vendor — it is recorded for fidelity and is explicitly NOT a PLACE product
  scope surface.
schemes:
- name: PLACE SSO
  issuer: https://sso.place.com
  source: well-known/place-sso-openid-configuration.json
  flows:
  - flow: authorizationCode
    authorizationUrl: https://sso.place.com/oauth2/v1/authorize
    tokenUrl: https://sso.place.com/oauth2/v1/token
- name: PLACE SSO default authorization server
  issuer: https://sso.place.com/oauth2/default
  source: well-known/place-sso-default-openid-configuration.json
  flows:
  - flow: authorizationCode
    authorizationUrl: https://sso.place.com/oauth2/default/v1/authorize
    tokenUrl: https://sso.place.com/oauth2/default/v1/token
- name: PLACE identity hub
  issuer: https://hub.place.com
  source: well-known/place-hub-openid-configuration.json
  flows:
  - flow: authorizationCode
    authorizationUrl: https://hub.place.com/oauth2/v1/authorize
    tokenUrl: https://hub.place.com/oauth2/v1/token
scopes:
- scope: openid
  description: OpenID Connect authentication; returns an ID token.
  standard: OpenID Connect Core 1.0
  issuers: [https://sso.place.com, 'https://sso.place.com/oauth2/default', https://hub.place.com]
- scope: profile
  description: Basic profile claims (name, family_name, given_name, locale, zoneinfo).
  standard: OpenID Connect Core 1.0
  issuers: [https://sso.place.com, 'https://sso.place.com/oauth2/default', https://hub.place.com]
- scope: email
  description: email and email_verified claims.
  standard: OpenID Connect Core 1.0
  issuers: [https://sso.place.com, 'https://sso.place.com/oauth2/default', https://hub.place.com]
- scope: address
  description: address claim.
  standard: OpenID Connect Core 1.0
  issuers: [https://sso.place.com, 'https://sso.place.com/oauth2/default', https://hub.place.com]
- scope: phone
  description: phone_number and phone_number_verified claims.
  standard: OpenID Connect Core 1.0
  issuers: [https://sso.place.com, 'https://sso.place.com/oauth2/default', https://hub.place.com]
- scope: offline_access
  description: Issues a refresh token for long-lived access.
  standard: OpenID Connect Core 1.0
  issuers: [https://sso.place.com, 'https://sso.place.com/oauth2/default', https://hub.place.com]
- scope: groups
  description: Group membership claim.
  standard: Okta extension
  issuers: [https://sso.place.com, 'https://sso.place.com/oauth2/default', https://hub.place.com]
- scope: device_sso
  description: Device single-sign-on token exchange.
  standard: Okta extension
  issuers: ['https://sso.place.com/oauth2/default']
vendor_scopes:
  vendor: Okta
  prefix: 'okta.'
  count: 80
  authored_by_place: false
  sources:
  - well-known/place-sso-oauth-authorization-server.json
  - well-known/place-hub-oauth-authorization-server.json
  description: >-
    Okta Org Authorization Server management scopes (okta.users.*, okta.groups.*,
    okta.apps.*, okta.policies.*, okta.logs.read, …). They govern administration of
    PLACE's Okta tenant, not any PLACE product API, and are shipped identically by
    every Okta org.