generated: '2026-09-02'
method: probed
source: https://portal.vanderhallusa.com/.well-known/oauth-authorization-server
docs: null
docs_note: >-
  Vanderhall publishes no scopes/permissions reference page. The scope list below is taken verbatim
  from the `scopes_supported` array of the live RFC 8414 authorization-server metadata document and
  nothing has been added to it. The human-readable description is API Evangelist's, derived from the
  protected resource the scope guards; Vanderhall states no description of its own.
authorization_server: https://portal.vanderhallusa.com
scope_count: 1
scopes:
- name: mcp
  description: >-
    Grants a client access to the Vanderhall Admin Portal MCP endpoint at
    https://portal.vanderhallusa.com/mcp. It is the only scope the authorization server advertises,
    so the MCP surface is all-or-nothing — there is no read/write split, no per-resource scope, and
    no way for a consumer to request least privilege.
  protected_resource: https://portal.vanderhallusa.com/mcp
  source: scopes_supported[0]
grants:
- authorization_code
- refresh_token
pkce_methods:
- S256