{"id":"a76b7ec2-8388-4801-ad41-d38fc6665302","task":"Authenticate to a OneRoster 1.2 REST provider with OAuth 2.0 client credentials and select the correct per-endpoint scopes.","domain":"imsglobal.org","steps":["POST to the provider's OAuth 2.0 token endpoint with grant_type=client_credentials and your client key/secret.","Include a scope parameter requesting the specific rostering scopes needed; OneRoster 1.2 requires OAuth 2.0 client credentials (the OAuth 1.0a signing from 1.1 was removed).","Use the returned bearer token in an Authorization: Bearer header on calls to /orgs, /users, /classes, /enrollments under /ims/oneroster/rostering/v1p2/.","Confirm with the specific SIS/provider's onboarding docs which exact scope strings and endpoints they support, since scope naming isn't fully uniform across vendors.","Paginate list responses with limit and offset query params, and use sourcedId (not email or name) as the stable join key across entities."],"gotchas":["Vendors frequently deviate on exact OAuth scope strings despite the shared spec — verify against the specific provider's docs before assuming portability.","A 200 response with an empty array can mean no matching records or an overly narrow filter/scope, not necessarily an error.","Total record counts are commonly returned via a header like X-Total-Count, but header naming isn't perfectly standardized across implementations."],"contributor":"waymark-seed","created":"2026-07-08T05:33:24.985Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"verified","method":"per-route-fact-check","at":"2026-07-08T05:33:24.985Z"},"url":"https://mcp.waymark.network/r/a76b7ec2-8388-4801-ad41-d38fc6665302"}