Reference
Scopes
A caller must hold every scope a procedure lists (AND). A missing or invalid credential is UNAUTHENTICATED; a valid one without the scopes is FORBIDDEN, naming all the required scopes at once. Some procedures need one more scope for part of their input; their summaries say so. Index.
| Scope | Grants | Procedures that require it |
|---|---|---|
account:read | Read your own account and sign-in sessions; a user principal only | account.sessions, account.grants, invitations.received |
account:write | Change your own account, revoke your sessions, create orgs; a user principal only | account.revokeSession, account.reauthenticate, account.revokeGrant, orgs.create, members.leave, invitations.accept |
org:read | Read an org and its members | orgs.get, members.list, invitations.list |
org:manage | Change an org, its members and its invitations | orgs.update, orgs.setPlacementScope, members.updateRole, members.remove, invitations.create, invitations.revoke, quotas.setProject, issuers.create, issuers.list, issuers.update, issuers.suspend, issuers.remove, connections.create, connections.list, connections.remove, credentials.uploadAscKey, credentials.createAndroidKeystore, credentials.uploadAndroidKeystore, credentials.rotate, credentials.updateAllowList, credentials.delete |
projects:read | Read an org's projects | projects.list, projects.get, projects.resolve |
projects:write | Create, change and archive projects | projects.create, projects.update, projects.archive, projects.ensure |
keys:read | List an org's API keys | keys.list |
keys:write | Create and revoke API keys | keys.create, keys.revoke |
usage:read | Read an org's usage | usage.get, quotas.get |
builds:read | Read builds and follow their logs | builds.get, builds.list, builds.logs |
builds:write | Start and cancel builds, and upload their sources | builds.create, builds.cancel, uploads.grant, uploads.complete |
artifacts:read | Read artifacts and mint their download URLs | artifacts.list, artifacts.get, artifacts.download |
artifacts:write | Upload artifacts (later rounds) | — |
signing:use | Read signing credentials' metadata and name one in a store build | credentials.list, credentials.get |
admin:read | Staff only, on the admin origin | — |
admin:write | Staff only, on the admin origin | — |
public (no credential): none.
session (any authenticated principal): account.get, orgs.list.
Trust-class (locally only the runtime owner token; in the cloud only an interactive user session re-authenticated within 15 minutes; never an API key or an MCP token): orgs.setPlacementScope, members.updateRole, members.remove, invitations.create, keys.create, issuers.create, issuers.update, connections.create, credentials.uploadAscKey, credentials.createAndroidKeystore, credentials.uploadAndroidKeystore, credentials.rotate, credentials.updateAllowList, credentials.delete.