generated: '2026-09-04'
method: searched
source: https://open.ximalaya.com/doc/detailApi?categoryId=9&articleId=5 (OAuth2 标准登录授权API)
docs: https://open.ximalaya.com/doc/detailApi?categoryId=9&articleId=75
note: >-
  Derived by SEARCH, not by derive-oauth-scopes.py: Ximalaya publishes no OpenAPI, so
  there are no oauth2 securityScheme flows to read. The scope list below is quoted
  verbatim from the scope string returned in the documented /oauth2/v2/access_token
  response example.

authorization_endpoint: https://api.ximalaya.com/oauth2/v2/authorize
token_endpoint: https://api.ximalaya.com/oauth2/v2/access_token
scope_delimiter: ','
scope_count: 6

scopes:
- name: profile:read
  description: Read the authorizing user's basic profile and persona data.
  backing_operations:
  - /profile/user_info
  - /profile/persona
- name: subscribe:read
  description: Read the authorizing user's album subscriptions.
  backing_operations:
  - /v2/subscribe/get_albums_by_uid
  - /v2/subscribe/is_subscribed
- name: subscribe:write
  description: Add or remove album subscriptions for the authorizing user.
  backing_operations:
  - /subscribe/add_or_delete
  - /subscribe/batch_add
- name: play_history:read
  description: Read the authorizing user's cloud play history.
  backing_operations:
  - /play_history/get_by_uid
- name: play_history:write
  description: Upload or delete entries in the authorizing user's cloud play history.
  backing_operations:
  - /play_history/batch_upload
  - /play_history/batch_delete
- name: open_pay:read
  description: Read the authorizing user's paid-content entitlements and purchase state.
  backing_operations:
  - /open_pay/get_bought
  - /v2/open_pay/get_bought_albums
  - /open_pay/album_bought_status
  - /open_pay/track_bought_status

errors:
- code: 202
  string: ximalaya.oauth2.scope_grant_denied
  meaning: Scope authorization denied because the requested scope is invalid or exceeds
    what the application was granted.

gaps:
- Ximalaya does not publish a standalone scopes/permissions reference page; the scope
  set above is the one enumerated in the token-response example. Additional scopes may
  exist for partners with broader commercial agreements and would not be visible here.
- Scope-to-operation binding above is inferred from which documented endpoints require
  the user-private-data common parameter set (access_token + pack_id); Ximalaya does not
  publish a per-endpoint scope table.