API Scopes

AutoCISO tokens carry one or more scopes. These four are the complete set — the server rejects any other value at token creation.

The four scopes

Implication is one-directional: a token with sbom:write can read, but a token with sbom:read cannot write. The two families are independent — sbom:write grants nothing over MCP, and mcp:write grants nothing over REST.

REST scope matrix

All paths are relative to https://api.autociso.io/api/v1. Every route below is additionally gated by the supply_chain_security plan feature.

SBOMs

Findings

Vendors

That is the entire REST surface available to an API token. See What an API Token Can Reach for what happens everywhere else.

MCP scope matrix

Over /mcp, scope determines which tools appear in tools/list. A token with mcp:read never sees the write tool at all — it is filtered out of the listing rather than failing at call time.

The write tool has a second gate: it is also hidden unless MCP writes are enabled for the deployment. A token with mcp:write against a deployment with writes disabled sees only the 22 read tools. See MCP Auth and Scopes.

Scope errors

A valid token calling an allowlisted endpoint without the needed scope gets 403:

{
  "data": null,
  "error": {
    "code": "INSUFFICIENT_SCOPE",
    "message": "this API token does not have the required scope: sbom:write"
  }
}

The message names the missing scope. Scopes are fixed at creation — to change them, create a new token and revoke the old one.

Next steps

• Obtaining an API Token
• What an API Token Can Reach
• MCP Auth and Scopes