List assignable token scopes

GET /tokens/scopes

Auth Console session Role Owner or Manager

The scope catalogue used by the token dialog: every scope that POST /tokens accepts, its group and resource, whether it needs an expiry (and the maximum lifetime in days, 0 for no maximum), which roles may grant it and whether its public routes are live (enabled). Requires a console session of an Owner or Manager; an API token is refused with 403.

Example

curl "https://api.autociso.io/api/v1/tokens/scopes" \
  -H "Authorization: Bearer <console-session-token>"

import requests

response = requests.get(
    "https://api.autociso.io/api/v1/tokens/scopes",
    headers={"Authorization": "Bearer <console-session-token>"},
)
print(response.json())

const response = await fetch("https://api.autociso.io/api/v1/tokens/scopes", {
  method: "GET",
  headers: { "Authorization": "Bearer <console-session-token>" },
});
console.log(await response.json());

Response 200

{
  "data": [
    {
      "scope": "risk:read",
      "group": "risk",
      "resource": "risk",
      "requiresExpiry": false,
      "maxExpiryDays": 0,
      "creatorRoles": [
        "owner",
        "manager"
      ],
      "enabled": true
    },
    {
      "scope": "jml:read",
      "group": "jml",
      "resource": "jml",
      "requiresExpiry": true,
      "maxExpiryDays": 365,
      "creatorRoles": [
        "owner",
        "manager"
      ],
      "enabled": true
    }
  ]
}

Returns

The data field of the standard { data, error, meta } envelope:

An array of object:

scope string required
The scope name to send in POST /tokens.
group string required
resource string required
requiresExpiry boolean required
maxExpiryDays integer required
Maximum lifetime in days; 0 for no maximum.
creatorRoles array of string required
Roles that may grant the scope.
enabled boolean required
Whether its public routes are live.
No other fields.

Errors

Status	Code	Retry	Meaning
401	`UNAUTHORIZED`	no	No signed-in session. code UNAUTHORIZED.
403	`FORBIDDEN`	no	The caller is not an Owner or Manager of the organization, or the request carries an API token (FORBIDDEN), or the session is a support session (SUPPORT_SESSION_NO_MINT on create and revoke).

Last reviewed: 2026-10-13

Was this page helpful?