---
sourceDocument: Xanadu API Reference
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/xanadu/api-reference

 Release :

    - xanadu

ft:locale :

    - en-US

ft:publication_title :

    - Xanadu API Reference

ft:clusterId :

    - crapiref

bundleId :

    - crapiref

workflow :

    - Creator


---

# OAuth profiles and scopes

# OAuth profiles and scopes {#ariaid-title1}

* Release version: Xanadu
* 
* Updated August 1, 2024
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

In the OAuth provider scenario, profiles and scopes specify the grant type,
authorization type, and level of access.
In the OAuth provider scenario, the OAuth profile refers to a combination of a grant type
and at least one scope. The scope specifies the access that the user has to the protected
resource, such as read or write. You can
create a profile for each third-party provider and obtain the specific set of scopes from
the provider. See [Specify an OAuth profile](https://servicenow-prod.fluidtopics.net/hKjdoFDlwIH7i~rKuqo8cQ "An OAuth profile includes the grant type that the third-party OAuth provider needs to obtain access to the restricted resource.") and [Specify an OAuth scope](https://servicenow-prod.fluidtopics.net/ggEH07~Y7s0iQMmdevIzLA "Specify the OAuth scopes that you get from the provider. Scopes can be any level of access specified by the provider, such as read, write, or any string, including a URL.") for more information. The instance also uses
OAuth profiles when a REST call specifies OAuth 2.0 authentication. The instance
auto-creates a default profile for each third-party provider record that you create. There
can be only one default profile.  
Specify the following parameters, which are saved in the OAuth Requestor Profile \[OAuth_requestor_profile\] table: {#c_OAuthProviderAndScope__table_u14_lcp_vs__entry__2}

| Parameter | Description |
|-|-|
| `oauth_requestor` | The sys_id of the object, which can be a user record or an email account. |
| `oauth_requestor_context` | Descriptor that provides context for the OAuth requestor. As a good practice, use the name of the table where the `oauth_requestor` object is saved. |
| `oauth_provider_profile` | The sys_id of the OAuth profile record that is the default (see [Specify an OAuth profile](https://servicenow-prod.fluidtopics.net/hKjdoFDlwIH7i~rKuqo8cQ "An OAuth profile includes the grant type that the third-party OAuth provider needs to obtain access to the restricted resource.")). |
[Table 1. OAuth parameters for default profile support]

{#c_OAuthProviderAndScope__table_u14_lcp_vs}

When the user attempts to authenticate, the provider accesses the OAuth Requestor
Profile table to look for the user. If the user is found, the authentication is successful.
If not, the provider accesses the default profile to determine the grant type and how to
proceed with the authentication.
* **[Specify an OAuth profile](https://servicenow-prod.fluidtopics.net/hKjdoFDlwIH7i~rKuqo8cQ)**   
  An OAuth profile includes the grant type that the third-party OAuth provider needs to obtain access to the restricted resource.
* **[Specify an OAuth scope](https://servicenow-prod.fluidtopics.net/ggEH07~Y7s0iQMmdevIzLA)**   
  Specify the OAuth scopes that you get from the provider. Scopes can be any level of access specified by the provider, such as read, write, or any string, including a URL.