OAuth 2.0 Scope and Granular Access
Scope
The Apple Business API uses a single generic scope, business, in the three-legged OAuth authorization flow. The business scope is not tied to a specific resource or action. It serves as a top-level authorization identifier.
business
The business scope grants a third-party partner authorization to act on behalf of an organization.
Granular Access
Granular access — fine-grained access control over which capabilities and brands the partner can manage — is controlled by two dimensions: features and brand access.
Features
Features define which capabilities the partner can access on behalf of the organization. Permissions vary based on the brand access level granted:
| Feature | Description | All Current and Future Brands | Specific Brands | Apple Approval Required |
|---|---|---|---|---|
BRAND_PROFILES | Manage brand profile information and assets | Read, update, create | Read, update | No |
LOCATIONS | Manage location information, assets, and showcases. Read access to insights. | Read, update, create | Read, update | No |
BUSINESS_CALLER_ID | Manage business caller ID for brands. Limited to one approved agency per brand. | Not available | Read, update | Yes |
BRANDED_MAIL | Manage branded email identifiers for brands. | Coming soon | Coming soon | Yes |
VERIFY_WITH_WALLET_ON_THE_WEB | Manage wallet-based identity verification on the web. | Coming soon | Coming soon | Yes |
| Feature | Description | All Current and Future Brands | Specific Brands | Apple Approval Required |
|---|---|---|---|---|
BRAND_PROFILES | Manage brand profile information and assets | Read, update, create | Read, update | No |
LOCATIONS | Manage location information, assets, and showcases. Read access to insights. | Read, update, create | Read, update | No |
BRANDED_MAIL | Manage branded email identifiers for brands. | Coming soon | Coming soon | Yes |
VERIFY_WITH_WALLET_ON_THE_WEB | Manage wallet-based identity verification on the web. | Coming soon | Coming soon | Yes |
Brand Access
Brand access determines which brands the partner can act on behalf of:
| Brand Access | Description |
|---|---|
| Specific brands | Access is scoped to a defined set of brands |
| All current and future brands | Access applies to all brands the organization currently manages, as well as any new brands added in the future |