/api/apis/{api_server_id}/scopesAuthenticatedDefine a scope on an API server
Defines an API scope on the API server, e.g. notes:read. From then on an authorization request whose RFC 8707 resource names the API server may ask for it, and the access tokens minted for the API server carry it in their scope claim, where the API server's route guards enforce it (requiredScopes / required_scopes). An API server defines at most 100 scopes. Hardcoded API servers cannot define scopes.
post_api_apis_api_server_id_scopesAPI serversAuthentication & permissionsAuthenticated
Any authenticated user
- Accepted credentials
- Auth server session (refresh token cookie)
cookie "refresh_token_<auth_server_app_id>" - Access token (cookie)
cookie "access_token_<auth_server_app_id>" - Access token (Bearer)
Authorization: Bearer <JWT>
- Auth server session (refresh token cookie)
- Who may call
- Any authenticated user
- Notes
- Organization owners/admins of the owning organization, the owning user of a user-owned API server, or platform administrators.
Path parameters
| Name | Type | Description |
|---|---|---|
| api_server_id* | string | API server id |
Request body
Required
scope: a single RFC 6749 scope-token (printable ASCII without spaces, " or \, at most 128 characters) that is not an OpenID Connect scope name (openid, profile, email, address, phone, offline_access). description: 1 to 256 characters, shown to users. allow_dynamic_clients (default true): whether dynamically registered clients, which have no app connection, may be granted it. Unknown keys are rejected.| Property | Type | Description |
|---|---|---|
| scope* | string | minLength: 1maxLength: 128pattern: ^[\x21\x23-\x5B\x5D-\x7E]+$ |
| description* | string | minLength: 1maxLength: 256 |
| allow_dynamic_clients | boolean |
Responses
| Property | Type | Description |
|---|---|---|
| success* | true | |
| scope* | ApiServerScope | An OAuth 2.0 scope value (RFC 6749 §3.3) an API server defines for itself, with the description shown to users. Clients request it on an authorization request whose RFC 8707 |
| api_server_scope_id* | string (uuid) | |
| api_server_id* | string | minLength: 2maxLength: 64pattern: ^[a-z0-9_-]*$ |
| scope* | string | minLength: 1maxLength: 128pattern: ^[\x21\x23-\x5B\x5D-\x7E]+$ |
| description* | string | maxLength: 256 |
| allow_dynamic_clients* | boolean | |
| created_at* | number | minimum: 0 |
| created_by* | string (uuid) | null (uuid) | null |
Example request
curl -X POST 'https://auth.schemavaults.com/api/apis/<api_server_id>/scopes' \
-b 'refresh_token_<auth_server_app_id>=<value>' \
-H 'Content-Type: application/json' \
-d '{
"scope": "string",
"description": "string",
"allow_dynamic_clients": true
}'