Auth0 End-of-Life Rollout: Allow Connections Management without Options Scopes

Auth0 Management API access to a connection's options field now requires options-specific scopes, as operating without them is deprecated and has reached end-of-life. The content below outlines the rollout phases, affected endpoints, and migration path.

Rollout Transitions Tenants in Phases

The phase dates mark the beginning of each sequential rollout stage. Each phase may take several weeks, so tenants within the same phase may receive the change at different times.

Auth0 applies the transition based on the tenant's environment tag when the rollout for that environment occurs. Changing a non-production tenant to production after its phase is deployed does not restore access to the deprecated behavior.

For tenants targeted by the third phase and until the final phase, the Dashboard migration toggle, Allow Connections Management without Options Scopes, allows a temporary reversion to the deprecated behavior.

Which Endpoints Require the Options-Specific Scopes?

Once a tenant transitions to the new behavior, accessing or updating a connection's options field requires the corresponding options-specific scopes in the following connection management operations:

• Retrieving multiple connections using GET /api/v2/connections.

• Retrieving a connection using GET /api/v2/connections/{id}.

• Updating a connection using PATCH /api/v2/connections/{id}.

Without the read:connections_options scope, the options field is omitted from GET response payloads. Without the update:connections_options scope, PATCH requests that include the options field receive a 403 Forbidden response:

{
  "statusCode": 403,
  "error": "Forbidden",
  "message": "Updating the \"options\" property requires the \ "update:connections_options\" scope.",
  "errorCode": "insufficient_scope"
}

Options-Specific Scopes Provide Finer-Grained Access Control

The new scopes provide increased control over application access to connection data. Update authorization grants for client applications that read or update a connection's options field to include the additional options-specific scopes alongside the previously required scopes:

• Add read:connections_options in addition to read:connections for GET operations that need to return the options field.

• Add update:connections_options in addition to update:connections for PATCH operations that include the options field.

Adding Options-Specific Scopes to a Client Application Grant

To add the required scopes using the Auth0 Dashboard:

1. Navigate to Applications > Applications and choose the application that requires calling the relevant Management API endpoints.

2. Select the API Access tab. Then, select Edit next to Auth0 Management API to open the permission management panel.

3. In the Client Access tab, search for connections_options. Enable one or both of the new permissions. Then, choose Save to confirm the changes.

Why is Auth0 Making these Changes?

Auth0 updated this behavior as part of a calendar-year 2025 change to improve access control for connection management endpoints. The change was announced on October 25, 2024, via product notification, with a target end-of-life date of April 24, 2025.