# List assignable token scopes

The scope catalogue used by the token dialog: every scope that POST /tokens accepts, its group and resource, whether it needs an expiry (and the maximum lifetime in days, 0 for no maximum), which roles may grant it and whether its public routes are live (`enabled`).

`GET /tokens/scopes`

Auth **Console session** | Role **Owner or Manager**

The scope catalogue used by the token dialog: every scope that POST /tokens accepts, its group and resource, whether it needs an expiry (and the maximum lifetime in days, 0 for no maximum), which roles may grant it and whether its public routes are live (`enabled`). Requires a console session of an Owner or Manager; an API token is refused with 403.

## Returns

The `data` field of the standard `{ data, error, meta }` envelope:

An array of object:
- `scope`: string The scope name to send in POST /tokens.
- `group`: string
- `resource`: string
- `requiresExpiry`: boolean
- `maxExpiryDays`: integer Maximum lifetime in days; 0 for no maximum.
- `creatorRoles`: array of string Roles that may grant the scope.
- `enabled`: boolean Whether its public routes are live.
- No other fields.

## Errors

| Status | Code | Retry | Meaning |
|---|---|---|---|
| 401 | `UNAUTHORIZED` | no | No signed-in session. code UNAUTHORIZED. |
| 403 | `FORBIDDEN` | no | The caller is not an Owner or Manager of the organization, or the request carries an API token (FORBIDDEN), or the session is a support session (SUPPORT_SESSION_NO_MINT on create and revoke). |

## Example

### curl

```bash
curl "https://api.autociso.io/api/v1/tokens/scopes" \
  -H "Authorization: Bearer <console-session-token>"
```

### Python

```python
import requests

response = requests.get(
    "https://api.autociso.io/api/v1/tokens/scopes",
    headers={"Authorization": "Bearer <console-session-token>"},
)
print(response.json())
```

### JavaScript

```javascript
const response = await fetch("https://api.autociso.io/api/v1/tokens/scopes", {
  method: "GET",
  headers: { "Authorization": "Bearer <console-session-token>" },
});
console.log(await response.json());
```

## Response (200)

```json
{
  "data": [
    {
      "scope": "risk:read",
      "group": "risk",
      "resource": "risk",
      "requiresExpiry": false,
      "maxExpiryDays": 0,
      "creatorRoles": [
        "owner",
        "manager"
      ],
      "enabled": true
    },
    {
      "scope": "jml:read",
      "group": "jml",
      "resource": "jml",
      "requiresExpiry": true,
      "maxExpiryDays": 365,
      "creatorRoles": [
        "owner",
        "manager"
      ],
      "enabled": true
    }
  ]
}
```