New OAuth Clients Require Scopes

What is the change?

Qualtrics introduced OAuth 2.0 into our Public API in 2018 as a major security improvement. In order to follow industry security best practices and to provide greater control over how your data is accessed, we are now introducing OAuth Scopes into the Public API. Scopes are an OAuth authorization value that can be used to limit what API calls a given token can make.

A list of which Scopes are required for each endpoint is provided on the OAuth Scopes page of the Qualtrics API documentation. Additionally, each API endpoint will list which Scopes are required in the Authorization section of the documentation for that endpoint.

Starting in 2021, newly created OAuth clients will be required to specify Scopes. Existing clients that were created without scopes will continue to function normally, but they will not be editable.

What action do I need to take?

No action is required at this time, as existing OAuth clients will continue to function as they have previously. However, please be aware that if you create a new OAuth client, it will need to use OAuth Scopes. Instructions for creating clients with scopes can be found here (ClientCredential) and here (AuthCode). Please also note that if your OAuth client uses Scopes, you will also need to update your OAuth token creation code token to specify the Scopes.

For example:

curl -X POST -d "grant_type=client_credentials&scope=read:users" -u "{clientID}:{client secret}" https://{your data center id}.qualtrics.com/oauth2/token

What if I have questions?

If you have a question about New OAuth Clients Requiring Scopes, please visit the Public API documentation site. It’s also always worth checking the XM Community to see if any other users have the same question. If you’d rather speak to a specialist, our Support Team is always ready to assist. To contact them, please log into your Support Portal.