Application access
OAuth 2.0 and OpenID Connect
Use standards-based, scoped bearer tokens when an application needs to call the ThreatPrevent API. OAuth application access is separate from Enterprise SSO for workforce sign-in.
Client Credentials
Server-to-server integrations with no end user.
View flow →Authorization Code + PKCE
Applications acting with a signed-in user's consent.
View flow →Device Authorization
CLI tools and input-constrained devices.
View flow →Endpoints
| Discovery | GET /.well-known/oauth-authorization-server |
|---|---|
| OpenID discovery | GET /.well-known/openid-configuration |
| Signing keys | GET /.well-known/jwks.json |
| Authorization | GET /oauth/authorize |
| Token | POST /oauth/token |
| Device authorization | POST /oauth/device_authorization |
| Revocation | POST /oauth/revoke |
| Introspection | POST /oauth/introspect |
Available API scopes
risk:paymentrisk:supply-chainrisk:infrastructurerisk:bulkbilling:readbilling:writeorganisation:readorganisation:writeopenidprofileemailoffline_accessA client can request only scopes allowed in its registration. Request openid for an ID token and offline_access when rotating refresh tokens are required.
https://api.threatprevent.ioUse discovery rather than hard-coding metadata wherever your OAuth library supports it.