Choose PAT scopes
Each Management API operation requires one or more scopes. Start with the smallest set that covers the client’s workflow.
| Resource | Read | Write | Additional sensitive scope |
|---|---|---|---|
| Overview | overview:read | — | — |
| Apps | apps:read | apps:write | app-keys:read, app-keys:write |
| Gateways | gateways:read | gateways:write | — |
| Endpoints | endpoints:read | endpoints:write | endpoint-secrets:read |
| Providers | providers:read | providers:write | — |
| Routes | routes:read | routes:write | — |
| Usage | usage:read | — | — |
| Metadata | meta:read | — | — |
| Accounts | accounts:read | accounts:write | Admin only |
| Rate-limit policies | policies:read | policies:write | Admin only |
Workflow scope combinations
| Workflow | Required scopes |
|---|---|
| Inspect Provider deletion impact | providers:read |
| List or inspect Provider sync runs | providers:read |
| Start a Provider sync | providers:write |
| Start a Provider sync and poll its run to completion | providers:write and providers:read |
| Set or clear an App Provider | apps:write and routes:write |
Grant every scope listed for a combined workflow. A client that starts a Provider sync and then polls the persistent sync run typically uses both Provider scopes.
Use endpoint-secrets:read to receive effective URLs in Endpoint detail responses. Provider credential reveal is a dashboard-only operation authenticated by the dashboard session. Creating or rotating an App API Key returns the newly issued Key, while listing existing Keys requires app-keys:read.
The OpenAPI contract exposes the required scopes for each operation through x-required-pat-scopes.
Last updated on