Scopes

OAuth scopes declared for each V1 endpoint.

OAuth scopes describe which operations an access token is intended to perform. Each V1 business endpoint declares an intended scope in the OpenAPI spec. Configure matching scopes on your OAuth client in the developer dashboard when requesting tokens.

Configure scopes on your OAuth client

Each endpoint documents its intended scope in OpenAPI. Request matching scopes when exchanging client credentials, and inspect the current token with GET /v1/me.

Client-credentials scopes (V1 Web API)

These scopes apply to server-to-server integrations using grant_type=client_credentials. Only scopes for implemented endpoints are listed.

Scope Used by
catalog.read Customer catalogue and inventory (tracks/artists/releases/works), ingestion read endpoints.
catalog.write Write customer catalogue data.
musimap_catalog.read Read MusiMap canonical catalogue data.
musimap_catalog.write Write MusiMap canonical catalogue data.
ingestion.read Read ingestion batches and status.
ingestion.write POST /v1/ingestions — create a new ingestion batch.
advanced_search.read Advanced search endpoints (separate from dataset access).
storage.browse GET /v1/storage/config, GET /v1/storage/inbound/objects (list and lookup).
storage.upload POST /v1/storage/inbound/uploads (presigned URL).
storage.stream Stream storage objects (when exposed).
storage.download Download storage objects (when exposed).
storage.delete DELETE /v1/storage/inbound/objects.
storage.credentials.read GET /v1/storage/credentials — list credential metadata.
storage.credentials.write POST /v1/storage/credentials, DELETE /v1/storage/credentials/{id} (revoke).
audio.tagging.write POST /v1/audio/tagging — live MusiTag from an authorised S3 object.
audio.tagging.read GET /v1/audio/tagging — stored tagging for a catalogued track.
audio.features.write POST /v1/audio/features — live low-level audio features.
profiling.write POST /v1/profiling/tracks — MusiProfile aggregate profiling.

GET /v1/me and GET /v1/me/context do not require a business scope beyond a valid bearer token.

OIDC scopes (Sign in with MusiMap)

End-user sign-in uses the authorisation code flow with PKCE, not client credentials. These standard OIDC scopes are declared in OpenAPI for the authorisation endpoint:

Scope Used by
openid Sign in with MusiMap — OIDC sub claim.
profile User profile claims (name, preferred_username, picture, locale).
email User email and email_verified claims.
offline_access Allow issuance of a refresh token.