Adaptive Automation Technologies OAuth Scopes

generated: '2026-09-07'
method: searched
source: https://documentation.adaptive.live/developer-guide/adaptive-api
docs: https://documentation.adaptive.live/developer-guide/adaptive-api
description: >-
  Adaptive publishes a closed, ten-entry scope vocabulary that governs BOTH restricted Client
  App API keys and the consent screen an interactive MCP client sees. Scopes are selected at
  key creation and are immutable thereafter — changing them means deleting the key and
  issuing a new one. A key created before scopes existed carries Full access. These are
  operation scopes on a REST/MCP surface rather than OAuth 2.0 scopes negotiated per
  authorization request, but the MCP OAuth flow presents the same vocabulary and intersects
  it with any bound Client App.
scope_model:
  default: Full access — the key can call every Client API endpoint
  restricted: Restricted to selected operations — any other endpoint returns 403
  mutable_after_creation: false
  ceiling: >-
    For MCP tokens the offered list is always capped at the connecting user's own role, so an
    agent can never exceed the human who authorized it.
  denial: '403 operation not permitted for this key'
scopes:
- name: users:read
  description: List Users — all users and teams in the organization.
  operations: [GET /api/v3/client/users/list]
- name: resources:read
  description: List Resources — all resources in the organization.
  operations: [GET /api/v3/client/resources/list]
- name: endpoints:read
  description: List Endpoints — all endpoints in the organization.
  operations: [GET /api/v3/client/endpoints/list]
- name: authorizations:read
  description: >-
    List Authorizations — metadata only; the permission policy body lives in an encrypted
    field and is not returned.
  operations: [GET /api/v3/client/authorizations/list]
- name: scripts:read
  description: >-
    List Scripts — non-sensitive metadata only; the script body is never returned because a
    script command can embed inline credentials.
  operations: [GET /api/v3/client/scripts/list]
- name: schema:read
  description: >-
    Fetch Schema — the table/column schema of a database resource. Supported for MySQL,
    PostgreSQL and SQL Server resources only.
  operations: ['GET /api/v3/client/schema/{resourceId}/info']
- name: team:read
  description: List Teams, List Users of a Team, List Endpoints of a Team.
  operations:
  - GET /api/v3/client/teams/list
  - 'GET /api/v3/client/team/{teamId}/users/list/'
  - 'GET /api/v3/client/team/{teamId}/endpoint/list/'
- name: team:write
  description: >-
    Add and remove users and endpoints on a team. Only API-managed teams may be modified.
  operations:
  - POST /api/v3/client/team/users/add
  - POST /api/v3/client/team/users/remove
  - POST /api/v3/client/team/endpoint/add
  - POST /api/v3/client/team/endpoint/remove
- name: activity:read
  description: >-
    Fetch Activity Log — streams workspace activity as CSV for compliance export and SIEM
    ingestion.
  operations: [POST /api/v3/client/activity-log]
- name: access-request:write
  description: >-
    Create and Decide Access Requests — raise an access request and approve or reject it in
    one call, for externally-secured approval workflows.
  operations: [POST /api/v3/client/access-request]
compound_requirements:
- operation: GET /api/v3/client/endpoints/with-users
  requires: [endpoints:read, users:read]
  rationale: >-
    Provider-stated: a restricted key holding only one of the two is rejected with 403. This
    deliberately keeps endpoints:read from implicitly granting the ability to enumerate
    users.
scope_count: 10