Checkly OAuth Scopes

generated: '2026-08-29'
method: probed
source: >-
  https://api.checklyhq.com/.well-known/oauth-protected-resource (HTTP 200, RFC 9728),
  https://www.checklyhq.com/.well-known/mcp.json (HTTP 200), the WWW-Authenticate challenge returned
  by an unauthenticated POST to https://api.checklyhq.com/mcp (HTTP 401), and
  https://auth.checklyhq.com/.well-known/oauth-authorization-server (HTTP 200).
docs: https://www.checklyhq.com/docs/ai/mcp-server/security-and-permissions
description: >-
  Checkly's OAuth scopes are published for its MCP surface, not its REST API. The REST Public API
  authenticates with a bearer API key plus an X-Checkly-Account header and declares no oauth2
  securityScheme in its OpenAPI. The 14 scopes below are machine-readable at the protected-resource
  document and are repeated verbatim in the 401 challenge, so an MCP client can discover the full
  permission surface without credentials.
resource: https://api.checklyhq.com/mcp
authorization_servers:
- https://auth.checklyhq.com/
authorization_endpoint: https://auth.checklyhq.com/authorize
token_endpoint: https://auth.checklyhq.com/oauth/token
registration_endpoint: https://auth.checklyhq.com/oidc/register
bearer_methods_supported:
- header
scopes:
- name: checkly:account:read
  description: Read account membership, plan and feature entitlement state.
  access: read
- name: checkly:account:invite
  description: Invite a user to the resolved account. Requires Owner or Admin role and sends email.
  access: write
- name: checkly:checks:read
  description: Read checks, their current pass/fail/degraded status and their results.
  access: read
- name: checkly:checks:write
  description: Modify checks.
  access: write
- name: checkly:checks:run
  description: Trigger existing deployed checks on demand. Consumes check-run execution quota.
  access: write
- name: checkly:incidents:read
  description: Read status page incidents and their updates.
  access: read
- name: checkly:incidents:write
  description: Create, update and resolve status page incidents, optionally notifying subscribers.
  access: write
- name: checkly:environment-variables:read
  description: List and read account-level environment variables. Secret values are returned as null.
  access: read
- name: checkly:environment-variables:write
  description: Create and update account-level variables and secrets.
  access: write
- name: checkly:status-pages:read
  description: Read status pages including their cards and services.
  access: read
- name: checkly:rca:read
  description: Read Rocky AI root cause analyses and their error groups.
  access: read
- name: checkly:rca:run
  description: Trigger a new root cause analysis. Consumes RCA invocation quota.
  access: write
- name: checkly:test-sessions:read
  description: Read test sessions and their result rows.
  access: read
- name: checkly:assets:read
  description: Read check-result and test-session-result asset manifests and asset contents.
  access: read
scope_count: 14
counts:
  read: 8
  write: 6
notes:
- >-
  Scope granularity is resource:action, and the read/write split is clean - an agent can be granted
  a strictly read-only Checkly session, which is the posture the MCP docs recommend for incident
  investigation.
- >-
  Scopes alone do not grant a write: the docs state some write tools additionally require a matching
  Checkly account role such as Owner, Admin or Read & Write.
- >-
  The REST Public API does not accept these scopes. It uses a bearer API key (user or service key)
  with the account selected by the X-Checkly-Account header.