List API-key scopes

OpenAPI contract

Method

GET

Path

/api/v1/api-keys/scopes

Security

jwtBearer (bearer)

Response status

200 400 401 403 404 429 500

Request and response schemas

JSON

{
  "requestBody": {},
  "responses": {
    "200": {
      "description": "Supported API-key scopes",
      "content": {
        "application/json": {
          "items": {
            "$ref": "#/components/schemas/ApiKeyScopeResponse"
          },
          "type": "array"
        }
      }
    },
    "400": {
      "description": "Invalid request",
      "content": {
        "application/json": {
          "$ref": "#/components/schemas/RequestError"
        }
      }
    },
    "401": {
      "description": "Authentication required or invalid",
      "content": {
        "application/json": {
          "$ref": "#/components/schemas/SecurityError"
        }
      }
    },
    "403": {
      "description": "Authenticated but not permitted",
      "content": {
        "application/json": {
          "$ref": "#/components/schemas/SecurityError"
        }
      }
    },
    "404": {
      "description": "Requested API key was not found",
      "content": {
        "application/json": {
          "$ref": "#/components/schemas/ApiError"
        }
      }
    },
    "429": {
      "description": "Rate limit exceeded",
      "content": {
        "application/json": {
          "$ref": "#/components/schemas/SecurityError"
        }
      }
    },
    "500": {
      "description": "Unexpected server error",
      "content": {
        "application/json": {
          "$ref": "#/components/schemas/ApiError"
        }
      }
    }
  }
}

GET /api/v1/api-keys/scopes is JWT-only. It returns the fixed permission catalog used by the API-key editor. Each item includes the machine-readable scope, display label, description, resource group, access kind (READ or WRITE), and any impliedScopes.

The current catalog contains build:read, build:write, artifact:read, project:read, project:write, processor:read, processor:write, and analytics:read. No scope currently implies another scope, so callers must grant every permission the integration needs. An nfy_ automation key cannot call this control-plane operation.

http

GET /api/v1/api-keys/scopes
Authorization: Bearer <access token>