Scopes
OAuth scopes declared for each V1 endpoint.
OAuth scopes are the effective public authorization contract. Each business endpoint requires one or more scopes. Configure matching scopes on your OAuth client in the developer dashboard, then request them when exchanging client credentials.
Organization capabilities are the dashboard view of which products your
organisation can use (see
Capabilities).
OAuth scopes are what you delegate to a client and what appears on access tokens.
You can only grant scopes your organisation is entitled to use.
GET /v1/me exposes token scopes and derived capabilities
only — not a separate entitlements list.
Client-credentials scopes (Web API)
These scopes apply to server-to-server integrations using
grant_type=client_credentials.
| Scope | Used by |
|---|---|
catalog.read |
GET /v1/catalogs, Workspace inventory reads (/v1/workspace/*). |
catalog.write |
Workspace entity create and update (POST/PATCH under /v1/workspace/*). |
atlas.read |
Atlas inventory (/v1/atlas/*) and MusiSearch when include_atlas / targets include atlas. |
ingestion.read |
GET /v1/ingestions and related items, entities, and stats endpoints. |
ingestion.write |
POST /v1/ingestions. |
storage.read |
GET /v1/storage/config, GET /v1/storage/inbound/objects. |
storage.write |
POST /v1/storage/inbound/uploads, DELETE /v1/storage/inbound/objects. |
storage.manage |
GET/POST /v1/storage/credentials, DELETE /v1/storage/credentials/{id}. |
tagging.read |
GET /v1/tagging/results, /v1/tagging/taxonomy, /v1/tagging/matrix. |
tagging.write |
POST /v1/tagging (live MusiTag, optional persist). |
audio.write |
POST /v1/audio/features (low-level features, not MusiTag). |
search.read |
POST /v1/search/tracks (MusiSearch). |
profiling.read |
GET /v1/profiling/profiles, GET /v1/profiling/profiles/{id}. |
profiling.write |
POST /v1/profiling/profiles. |
credits.read |
GET /v1/me/credits, GET /v1/me/credits/history. |
GET /v1/me and GET /v1/me/scopes require a valid bearer token
but no additional business scope.
Taxonomy, matrix, and stored tagging reads use tagging.read.
OIDC scopes (Sign in with MusiMap)
End-user sign-in uses the authorisation code flow with PKCE, not client credentials.
| Scope | Used by |
|---|---|
openid |
Sign in with MusiMap. OIDC sub claim. |
profile |
User profile claims (name, preferred_username, picture, locale). |
email |
User email and email_verified claims. |
offline_access |
Allow issuance of a refresh token. |
Related documentation
- Authentication (OAuth2): token exchange and scope errors.
- OpenAPI spec: scope notes on each operation.
- Errors:
insufficient_scope,entitlement_required,entitlement_revoked. - Atlas: Atlas access with
atlas.read.