generated: '2026-08-05'
method: searched
source: https://api.serviceup.com/.well-known/oauth-protected-resource/mcp
docs: null
note: >-
  Scopes are taken verbatim from the OAuth metadata ServiceUp serves anonymously.
  ServiceUp publishes no scopes/permissions reference page, so there are no
  descriptions to enrich from — the descriptions below state only what the scope
  name and its RFC 9728 resource binding assert, and are marked accordingly.
schemes:
- name: ServiceUpOAuth2
  source: well-known/serviceup-oauth-authorization-server.json
  flows:
  - flow: authorizationCode
    authorizationUrl: https://auth.serviceup.com/api/auth/oauth2/authorize
    tokenUrl: https://auth.serviceup.com/api/auth/oauth2/token
    code_challenge_methods:
    - S256
scopes:
- scope: mcp:read
  description: Read access to the ServiceUp MCP server resource (scope name only; no published description).
  description_source: scope-name
  flows:
  - authorizationCode
  resources:
  - https://api.serviceup.com/mcp
  sources:
  - well-known/serviceup-oauth-protected-resource-mcp.json
  - well-known/serviceup-oauth-authorization-server.json
- scope: mcp:write
  description: Write access to the ServiceUp MCP server resource (scope name only; no published description).
  description_source: scope-name
  flows:
  - authorizationCode
  resources:
  - https://api.serviceup.com/mcp
  sources:
  - well-known/serviceup-oauth-protected-resource-mcp.json
  - well-known/serviceup-oauth-authorization-server.json
- scope: offline_access
  description: >-
    Standard OAuth 2.0 offline access scope (RFC 6749 / OIDC Core), requesting a
    refresh token. Advertised by the authorization server but not listed on the
    MCP protected-resource metadata.
  description_source: standard-scope
  flows:
  - authorizationCode
  resources: []
  sources:
  - well-known/serviceup-oauth-authorization-server.json
coverage:
  scopes_total: 3
  granularity: coarse
  note: >-
    Two coarse read/write scopes cover the entire MCP surface — there is no
    per-resource or per-tool scope decomposition (no fleet:, repair:, invoice:
    or payment: scopes are advertised), so an agent token cannot be narrowed
    below "read everything" or "write anything" on this endpoint.
x-evidence:
- url: https://api.serviceup.com/.well-known/oauth-protected-resource/mcp
  http_status: 200
  fetched: '2026-08-05'
- url: https://auth.serviceup.com/.well-known/oauth-authorization-server
  http_status: 200
  fetched: '2026-08-05'