CrowdStrike · OAuth Scopes

CrowdStrike OAuth Scopes

OAuth 2.0 searched

CrowdStrike publishes 187 OAuth 2.0 scopes. Scopes are the fine-grained permissions an application requests at authorization time to act against the CrowdStrike API on a user’s behalf.

This index is generated from the provider’s OpenAPI security definitions (and, where available, its documented scope reference) and refreshes on every APIs.io network build. Browse every provider’s scopes at scopes.apis.io.

CybersecurityEndpoint SecurityEDRThreat IntelligenceCloud SecurityIdentity ProtectionVulnerability ManagementSIEMSecurity OperationsMCP

Scopes: 187 Flows: Method: searched

Scopes (187)

Scope	Description	Flows
API integrations: READ
API integrations: WRITE
ASPM Admin: READ
ASPM Admin: WRITE
ASPM Analyst: WRITE
ASPM Falcon Admin: WRITE
ASPM Read-Only: READ
AWS accounts: READ
AWS accounts: WRITE
Access Scope: READ
Actors (Falcon Intelligence): READ
Alerts: READ
Alerts: WRITE
Api Client Mgmt: READ
Api Client Mgmt: WRITE
App Logs: READ
App Logs: WRITE
Apps: READ
Assets: READ
Assets: WRITE
Bulk uninstallation token: WRITE
CAO Hunting: READ
CAO Incidents: READ
CSPM registration: READ
CSPM registration: WRITE
Case Templates: READ
Case Templates: WRITE
Cases: READ
Cases: WRITE
Charlotte AI Agent Definition: READ
Charlotte AI Agent Definition: WRITE
Cloud Registration: WRITE
Cloud Security API Assets: READ
Cloud Security API Detections: READ
Cloud Security API Risks: READ
Cloud Security AWS Registration: READ
Cloud Security AWS Registration: WRITE
Cloud Security Azure Registration: READ
Cloud Security Azure Registration: WRITE
Cloud Security Google Cloud Registration: READ
Cloud Security Google Cloud Registration: WRITE
Cloud Security OCI Registration: READ
Cloud Security OCI Registration: WRITE
Cloud Security Policies: READ
Cloud Security Policies: WRITE
Cloud Security Tools Download: READ
Configuration Assessment: READ
Content Update Policy: READ
Content Update Policy: WRITE
Correlation Rules Admin: WRITE
Correlation Rules: READ
Correlation Rules: WRITE
Custom IOA rules: READ
Custom IOA rules: WRITE
Custom storage: READ
Custom storage: WRITE
D4C registration: READ
D4C registration: WRITE
Data Protection: READ
Data Protection: WRITE
Delete Managed Assets: WRITE
Delivery Settings: READ
Delivery Settings: WRITE
Deployment Coordinator: READ
Detections: READ
Detections: WRITE
Device Content: READ
Device control policies: READ
Device control policies: WRITE
Event streams: READ
Falcon Complete Dashboard: READ
Falcon Container CLI: READ
Falcon Container CLI: WRITE
Falcon Container Image: READ
Falcon Container Image: WRITE
Falcon Container Policies: READ
Falcon Container Policies: WRITE
Falcon Data Replicator: READ
Falcon Discover IoT: READ
Falcon FileVantage Content: READ
Falcon FileVantage: READ
Falcon FileVantage: WRITE
Falcon Id: READ
Falcon Id: WRITE
Falcon Indicator Graph: READ
Firewall management: READ
Firewall management: WRITE
Flight Control: READ
Flight Control: WRITE
Host Migration: READ
Host Migration: WRITE
Host groups: READ
Host groups: WRITE
Hosts: READ
Hosts: WRITE
IOA Exclusions: READ
IOA Exclusions: WRITE
IOC Management: READ
IOC Management: WRITE
IOCs (Indicators of Compromise): READ
IT Automation - Policies: READ
IT Automation - Policies: WRITE
IT Automation - Task Executions: READ
IT Automation - Task Executions: WRITE
IT Automation - Tasks: READ
IT Automation - Tasks: WRITE
IT Automation - User Groups: READ
IT Automation - User Groups: WRITE
Identity Protection Entities: READ
Identity Protection GraphQL: WRITE
Identity Protection Policy Rules: READ
Identity Protection Policy Rules: WRITE
Indicators (Falcon Intelligence): READ
Infrastructure as Code (IaC): READ
Installation Tokens Settings: WRITE
Installation Tokens: READ
Installation Tokens: WRITE
Kubernetes Protection: READ
Kubernetes Protection: WRITE
Machine Learning Exclusions: READ
Machine Learning Exclusions: WRITE
MalQuery: READ
MalQuery: WRITE
Malware Families (Falcon Intelligence): READ
Message Center: READ
Message Center: WRITE
Mobile Enrollment: WRITE
Monitoring rules (Falcon Intelligence Recon): READ
Monitoring rules (Falcon Intelligence Recon): WRITE
NGSIEM Dashboards: READ
NGSIEM Dashboards: WRITE
NGSIEM Data Connections API: READ
NGSIEM Data Connections API: WRITE
NGSIEM Lookup Files: READ
NGSIEM Lookup Files: WRITE
NGSIEM Parsers: READ
NGSIEM Parsers: WRITE
NGSIEM Saved Queries: READ
NGSIEM Saved Queries: WRITE
NGSIEM: READ
NGSIEM: WRITE
Network scanning: READ
Network scanning: WRITE
On-demand scans (ODS): READ
On-demand scans (ODS): WRITE
Prevention policies: READ
Prevention policies: WRITE
Quarantined Files: READ
Quarantined Files: WRITE
Quick Scan (Falcon Intelligence): READ
Quick Scan (Falcon Intelligence): WRITE
QuickScan Pro: READ
QuickScan Pro: WRITE
Real time response (admin): WRITE
Real time response audit: READ
Real time response: READ
Real time response: WRITE
Reports (Falcon Intelligence): READ
Response policies: READ
Response policies: WRITE
Risk Platform - Risk: READ
Rules (Falcon Intelligence): READ
SaaS Security (Falcon Shield): READ
SaaS Security (Falcon Shield): WRITE
Sample uploads: READ
Sample uploads: WRITE
Sandbox (Falcon Intelligence): READ
Sandbox (Falcon Intelligence): WRITE
Scheduled Reports: READ
Sensor Download: READ
Sensor Usage: READ
Sensor Visibility Exclusions: READ
Sensor Visibility Exclusions: WRITE
Sensor update policies: READ
Sensor update policies: WRITE
Snapshot Scanner Image Download: READ
Snapshot: READ
Snapshot: WRITE
Tailored Intelligence: READ
Threatgraph: READ
User management: READ
User management: WRITE
Vulnerabilities (Falcon Intelligence): READ
Vulnerabilities: READ
Workflow: READ
Workflow: WRITE
Zero Trust Assessment: READ

📄 Provider scope reference: https://developer.crowdstrike.com/falcon-mcp/getting-started/credentials/

Source

OAuth Scopes

specification: API Commons OAuth Scopes
specificationVersion: '0.1'
provider: CrowdStrike
providerId: crowdstrike
generated: '2026-09-19'
method: searched
source: https://developer.crowdstrike.com/api-reference/all-operations/
docs: https://developer.crowdstrike.com/falcon-mcp/getting-started/credentials/
description: 'The 187 named scopes a CrowdStrike Falcon API client can be granted, harvested from the provider''s
  own operation reference: every operation page states the scope it requires, in the form ''<Service collection>:
  READ'' or ''<Service collection>: WRITE''. Scopes are selected when the API client is created in the Falcon console.
  Counts are the number of documented operations that name each scope. NOT derived from an OpenAPI — CrowdStrike
  publishes none; derive-oauth-scopes.py has no spec to read in this repo.'
schemes:
- name: FalconOAuth2
  flow: clientCredentials
  token_url: https://api.crowdstrike.com/oauth2/token
scope_count: 187
operations_covered: 1444
operations_without_a_documented_scope: 19
scopes:
- scope: 'API integrations: READ'
  service: API integrations
  access: READ
  operation_count: 1
  example_operations:
  - GetCombinedPluginConfigs
- scope: 'API integrations: WRITE'
  service: API integrations
  access: WRITE
  operation_count: 2
  example_operations:
  - ExecuteCommand
  - ExecuteCommandProxy
- scope: 'ASPM Admin: READ'
  service: ASPM Admin
  access: READ
  operation_count: 10
  example_operations:
  - GetCloudSecurityIntegrationState
  - GetExecutorNodes
  - GetGroupHierarchy
  - GetGroupV2
  - GetIntegrationsV2
- scope: 'ASPM Admin: WRITE'
  service: ASPM Admin
  access: WRITE
  operation_count: 12
  example_operations:
  - CreateExecutorNode
  - CreateIntegration
  - CreateIntegrationTask
  - DeleteExecutorNode
  - DeleteIntegration
- scope: 'ASPM Analyst: WRITE'
  service: ASPM Analyst
  access: WRITE
  operation_count: 4
  example_operations:
  - DeleteTags
  - RunIntegrationTask
  - UpsertBusinessApplications
  - UpsertTags
- scope: 'ASPM Falcon Admin: WRITE'
  service: ASPM Falcon Admin
  access: WRITE
  operation_count: 3
  example_operations:
  - PostGroupV2
  - UpdateDefaultGroup
  - UpdateGroup
- scope: 'ASPM Read-Only: READ'
  service: ASPM Read-Only
  access: READ
  operation_count: 18
  example_operations:
  - ExecuteFunctionData
  - ExecuteFunctionDataCount
  - ExecuteFunctionDataQuery
  - ExecuteFunctionDataQueryCount
  - ExecuteFunctions
- scope: 'AWS accounts: READ'
  service: AWS accounts
  access: READ
  operation_count: 4
  example_operations:
  - GetAWSAccounts
  - GetAWSSettings
  - QueryAWSAccounts
  - QueryAWSAccountsForIDs
- scope: 'AWS accounts: WRITE'
  service: AWS accounts
  access: WRITE
  operation_count: 5
  example_operations:
  - CreateOrUpdateAWSSettings
  - DeleteAWSAccounts
  - ProvisionAWSAccounts
  - UpdateAWSAccounts
  - VerifyAWSAccountAccess
- scope: 'Access Scope: READ'
  service: Access Scope
  access: READ
  operation_count: 2
  example_operations:
  - ListAccessScopesExternal
  - QueryAccessScopesExternal
- scope: 'Actors (Falcon Intelligence): READ'
  service: Actors (Falcon Intelligence)
  access: READ
  operation_count: 6
  example_operations:
  - GetIntelActorEntities
  - GetMitreReport
  - PostMitreAttacks
  - QueryIntelActorEntities
  - QueryIntelActorIds
- scope: 'Alerts: READ'
  service: Alerts
  access: READ
  operation_count: 7
  example_operations:
  - GetQueriesAlertsV1
  - GetQueriesAlertsV2
  - PostAggregatesAlertsV1
  - PostAggregatesAlertsV2
  - PostCombinedAlertsV1
- scope: 'Alerts: WRITE'
  service: Alerts
  access: WRITE
  operation_count: 2
  example_operations:
  - PatchEntitiesAlertsV2
  - PatchEntitiesAlertsV3
- scope: 'Api Client Mgmt: READ'
  service: Api Client Mgmt
  access: READ
  operation_count: 3
  example_operations:
  - GetAccessibleScopes
  - GetAllAPIClientIdsForCustomer
  - GetAPIClients
- scope: 'Api Client Mgmt: WRITE'
  service: Api Client Mgmt
  access: WRITE
  operation_count: 4
  example_operations:
  - CreateAPIClient
  - DeleteAPIClients
  - ResetAPIClientSecret
  - UpdateAPIClient
- scope: 'App Logs: READ'
  service: App Logs
  access: READ
  operation_count: 4
  example_operations:
  - GetSavedSearchesExecuteV1
  - GetSavedSearchesJobResultsDownloadV1
  - ListReposV1
  - ListViewV1
- scope: 'App Logs: WRITE'
  service: App Logs
  access: WRITE
  operation_count: 5
  example_operations:
  - CreateSavedSearchesDynamicExecuteV1
  - CreateSavedSearchesExecuteV1
  - CreateSavedSearchesIngestV1
  - IngestDataAsyncV1
  - IngestDataV1
- scope: 'Apps: READ'
  service: Apps
  access: READ
  operation_count: 1
  example_operations:
  - ReadRequestBody
- scope: 'Assets: READ'
  service: Assets
  access: READ
  operation_count: 22
  example_operations:
  - ListCloudGroupIDsExternal
  - ListCloudGroupsByIDExternal
  - ListCloudGroupsExternal
  - combined-applications
  - combined-hosts
- scope: 'Assets: WRITE'
  service: Assets
  access: WRITE
  operation_count: 6
  example_operations:
  - CreateCloudGroupExternal
  - DeleteCloudGroupsExternal
  - UpdateCloudGroupExternal
  - delete-external-assets
  - patch-external-assets
- scope: 'Bulk uninstallation token: WRITE'
  service: Bulk uninstallation token
  access: WRITE
  operation_count: 1
  example_operations:
  - incrementUninstallToken
- scope: 'CAO Hunting: READ'
  service: CAO Hunting
  access: READ
  operation_count: 7
  example_operations:
  - AggregateHuntingGuides
  - AggregateIntelligenceQueries
  - GetArchiveExport
  - GetHuntingGuides
  - GetIntelligenceQueries
- scope: 'CAO Incidents: READ'
  service: CAO Incidents
  access: READ
  operation_count: 3
  example_operations:
  - cao_incidents_aggregates_v1
  - cao_incidents_entities_v1
  - cao_incidents_queries_v1
- scope: 'CSPM registration: READ'
  service: CSPM registration
  access: READ
  operation_count: 18
  example_operations:
  - DiscoverCloudAzureDownloadCertificate
  - GetBehaviorDetections
  - getCloudEventIDs
  - GetConfigurationDetectionEntities
  - GetConfigurationDetectionIDsV2
- scope: 'CSPM registration: WRITE'
  service: CSPM registration
  access: WRITE
  operation_count: 20
  example_operations:
  - AzureRefreshCertificate
  - ConnectCSPMGCPAccount
  - CreateCSPMAwsAccount
  - CreateCSPMAzureAccount
  - CreateCSPMAzureManagementGroup
- scope: 'Case Templates: READ'
  service: Case Templates
  access: READ
  operation_count: 20
  example_operations:
  - aggregates.access-tags.post.v1
  - aggregates.notification-groups.post.v1
  - aggregates.notification-groups.post.v2
  - aggregates.slas.post.v1
  - aggregates.templates.post.v1
- scope: 'Case Templates: WRITE'
  service: Case Templates
  access: WRITE
  operation_count: 13
  example_operations:
  - entities.notification-groups.delete.v1
  - entities.notification-groups.delete.v2
  - entities.notification-groups.patch.v1
  - entities.notification-groups.patch.v2
  - entities.notification-groups.post.v1
- scope: 'Cases: READ'
  service: Cases
  access: READ
  operation_count: 9
  example_operations:
  - aggregates.file-details.post.v1
  - combined.file-details.get.v1
  - entities.cases.post.v2
  - entities.file-details.get.v1
  - entities.files_bulk-download.post.v1
- scope: 'Cases: WRITE'
  service: Cases
  access: WRITE
  operation_count: 13
  example_operations:
  - entities.alert-evidence.post.v1
  - entities.case-tags.delete.v1
  - entities.case-tags.post.v1
  - entities.cases.patch.v2
  - entities.cases.put.v2
- scope: 'Charlotte AI Agent Definition: READ'
  service: Charlotte AI Agent Definition
  access: READ
  operation_count: 19
  example_operations:
  - EntitiesAgentTemplatesV1
  - QueriesAgentTemplatesV1
  - GetAgentVersionsV1
  - QueryAgentVersionsV1
  - CombinedKnowledgeBaseAuditEventsV1
- scope: 'Charlotte AI Agent Definition: WRITE'
  service: Charlotte AI Agent Definition
  access: WRITE
  operation_count: 5
  example_operations:
  - EntitiesKnowledgeBaseFilesCreateV1
  - EntitiesKnowledgeBaseFilesDeleteV1
  - EntitiesKnowledgeBaseFilesUpdateV1
  - EntitiesKnowledgeBasesCreateV1
  - EntitiesKnowledgeBasesUpdateV1
- scope: 'Cloud Registration: WRITE'
  service: Cloud Registration
  access: WRITE
  operation_count: 1
  example_operations:
  - cloud-registration-cross-provider-get-account-aggregates
- scope: 'Cloud Security API Assets: READ'
  service: Cloud Security API Assets
  access: READ
  operation_count: 7
  example_operations:
  - cloud-security-assets-combined-application-findings
  - cloud-security-assets-combined-compliance-by-account
  - cloud-security-assets-entities-get
  - cloud-security-assets-entities-post
  - cloud-security-assets-queries
- scope: 'Cloud Security API Detections: READ'
  service: Cloud Security API Detections
  access: READ
  operation_count: 4
  example_operations:
  - cspm-evaluations-combined-iom-by-rule
  - cspm-evaluations-iom-entities
  - cspm-evaluations-iom-entities-post
  - cspm-evaluations-iom-queries
- scope: 'Cloud Security API Risks: READ'
  service: Cloud Security API Risks
  access: READ
  operation_count: 2
  example_operations:
  - combined-cloud-risks
  - cloud-security-timeline-risks-enriched
- scope: 'Cloud Security AWS Registration: READ'
  service: Cloud Security AWS Registration
  access: READ
  operation_count: 4
  example_operations:
  - cloud-registration-aws-get-accounts
  - cloud-registration-aws-query-accounts
  - cloud-registration-aws-trigger-health-check
  - cloud-registration-aws-validate-accounts
- scope: 'Cloud Security AWS Registration: WRITE'
  service: Cloud Security AWS Registration
  access: WRITE
  operation_count: 3
  example_operations:
  - cloud-registration-aws-create-account
  - cloud-registration-aws-delete-account
  - cloud-registration-aws-update-account
- scope: 'Cloud Security Azure Registration: READ'
  service: Cloud Security Azure Registration
  access: READ
  operation_count: 9
  example_operations:
  - cloud-registration-azure-get-issue-suppression-values-by-field
  - cloud-registration-azure-get-issue-values-by-field
  - cloud-registration-azure-get-issues
  - cloud-registration-azure-get-registration
  - cloud-registration-azure-get-script
- scope: 'Cloud Security Azure Registration: WRITE'
  service: Cloud Security Azure Registration
  access: WRITE
  operation_count: 8
  example_operations:
  - cloud-registration-azure-create-registration
  - cloud-registration-azure-create-suppressions
  - cloud-registration-azure-delete-legacy-subscription
  - cloud-registration-azure-delete-registration
  - cloud-registration-azure-delete-suppressions
- scope: 'Cloud Security Google Cloud Registration: READ'
  service: Cloud Security Google Cloud Registration
  access: READ
  operation_count: 2
  example_operations:
  - cloud-registration-gcp-get-entities
  - cloud-registration-gcp-get-registration
- scope: 'Cloud Security Google Cloud Registration: WRITE'
  service: Cloud Security Google Cloud Registration
  access: WRITE
  operation_count: 6
  example_operations:
  - cloud-registration-gcp-create-registration
  - cloud-registration-gcp-delete-registration
  - cloud-registration-gcp-post-terraform-script
  - cloud-registration-gcp-put-registration
  - cloud-registration-gcp-trigger-health-check
- scope: 'Cloud Security OCI Registration: READ'
  service: Cloud Security OCI Registration
  access: READ
  operation_count: 2
  example_operations:
  - cloud-security-registration-oci-download-script
  - cloud-security-registration-oci-get-account
- scope: 'Cloud Security OCI Registration: WRITE'
  service: Cloud Security OCI Registration
  access: WRITE
  operation_count: 5
  example_operations:
  - cloud-security-registration-oci-create-account
  - cloud-security-registration-oci-delete-account
  - cloud-security-registration-oci-rotate-key
  - cloud-security-registration-oci-update-account
  - cloud-security-registration-oci-validate-tenancy
- scope: 'Cloud Security Policies: READ'
  service: Cloud Security Policies
  access: READ
  operation_count: 11
  example_operations:
  - GetComplianceControls
  - GetComplianceFrameworks
  - GetEnrichedAsset
  - GetRule
  - GetRuleInputSchema
- scope: 'Cloud Security Policies: WRITE'
  service: Cloud Security Policies
  access: WRITE
  operation_count: 19
  example_operations:
  - CloneComplianceFramework
  - CreateComplianceControl
  - CreateComplianceFramework
  - CreateRuleMixin0
  - CreateRuleOverride
- scope: 'Cloud Security Tools Download: READ'
  service: Cloud Security Tools Download
  access: READ
  operation_count: 1
  example_operations:
  - FetchFilesDownloadInfoV2
- scope: 'Configuration Assessment: READ'
  service: Configuration Assessment
  access: READ
  operation_count: 3
  example_operations:
  - getCombinedAssessmentsQuery
  - getRuleDetails
  - getEvaluationLogicMixin0
- scope: 'Content Update Policy: READ'
  service: Content Update Policy
  access: READ
  operation_count: 6
  example_operations:
  - getContentUpdatePolicies
  - queryCombinedContentUpdatePolicies
  - queryCombinedContentUpdatePolicyMembers
  - queryContentUpdatePolicies
  - queryContentUpdatePolicyMembers
- scope: 'Content Update Policy: WRITE'
  service: Content Update Policy
  access: WRITE
  operation_count: 5
  example_operations:
  - createContentUpdatePolicies
  - deleteContentUpdatePolicies
  - performContentUpdatePoliciesAction
  - setContentUpdatePoliciesPrecedence
  - updateContentUpdatePolicies
- scope: 'Correlation Rules Admin: WRITE'
  service: Correlation Rules Admin
  access: WRITE
  operation_count: 2
  example_operations:
  - entities.rules_ownership.put.v1
  - entities.rules_ownership.put.v2
- scope: 'Correlation Rules: READ'
  service: Correlation Rules
  access: READ
  operation_count: 9
  example_operations:
  - combined.rules.get.v1
  - combined.rules.get.v2
  - entities.latest-rules.get.v1
  - entities.rules.get.v1
  - entities.rules.get.v2
- scope: 'Correlation Rules: WRITE'
  service: Correlation Rules
  access: WRITE
  operation_count: 9
  example_operations:
  - aggregates.rule-versions.post.v1
  - entities.rule-versions.delete.v1
  - entities.rule-versions_export.post.v1
  - entities.rule-versions_import.post.v1
  - entities.rule-versions_publish.patch.v1
- scope: 'Custom IOA rules: READ'
  service: Custom IOA rules
  access: READ
  operation_count: 12
  example_operations:
  - get-patterns
  - get-platformsMixin0
  - get-rule-groupsMixin0
  - get-rule-types
  - get-rules-get
- scope: 'Custom IOA rules: WRITE'
  service: Custom IOA rules
  access: WRITE
  operation_count: 8
  example_operations:
  - create-rule
  - create-rule-groupMixin0
  - delete-rule-groupsMixin0
  - delete-rules
  - update-rule-groupMixin0
- scope: 'Custom storage: READ'
  service: Custom storage
  access: READ
  operation_count: 14
  example_operations:
  - DescribeCollection
  - DescribeCollections
  - GetObject
  - GetObjectMetadata
  - GetSchema
- scope: 'Custom storage: WRITE'
  service: Custom storage
  access: WRITE
  operation_count: 4
  example_operations:
  - DeleteObject
  - DeleteVersionedObject
  - PutObject
  - PutObjectByVersion
- scope: 'D4C registration: READ'
  service: D4C registration
  access: READ
  operation_count: 12
  example_operations:
  - GetD4CAwsAccount
  - GetD4CAWSAccountScriptsAttachment
  - GetD4CAwsConsoleSetupURLs
  - GetD4CCGPAccount
  - GetD4CGCPServiceAccountsExt
- scope: 'D4C registration: WRITE'
  service: D4C registration
  access: WRITE
  operation_count: 8
  example_operations:
  - ConnectD4CGCPAccount
  - CreateD4CAwsAccount
  - CreateD4CGCPAccount
  - CreateDiscoverCloudAzureAccount
  - DeleteD4CAwsAccount
- scope: 'Data Protection: READ'
  service: Data Protection
  access: READ
  operation_count: 22
  example_operations:
  - entities.classification.get.v2
  - entities.cloud-application.get
  - entities.content-pattern.get
  - entities.enterprise-account.get
  - entities.file-type.get
- scope: 'Data Protection: WRITE'
  service: Data Protection
  access: WRITE
  operation_count: 30
  example_operations:
  - entities.classification.delete.v2
  - entities.classification.patch.v2
  - entities.classification.post.v2
  - entities.cloud-application.create
  - entities.cloud-application.delete
- scope: 'Delete Managed Assets: WRITE'
  service: Delete Managed Assets
  access: WRITE
  operation_count: 1
  example_operations:
  - DevicesActionsDeleteV1
- scope: 'Delivery Settings: READ'
  service: Delivery Settings
  access: READ
  operation_count: 1
  example_operations:
  - GetDeliverySettings
- scope: 'Delivery Settings: WRITE'
  service: Delivery Settings
  access: WRITE
  operation_count: 1
  example_operations:
  - PostDeliverySettings
- scope: 'Deployment Coordinator: READ'
  service: Deployment Coordinator
  access: READ
  operation_count: 6
  example_operations:
  - CombinedReleaseNotesV1
  - CombinedReleasesV1Mixin0
  - GetDeploymentsExternalV1
  - GetEntityIDsByQueryPOST
  - GetEntityIDsByQueryPOSTV2
- scope: 'Detections: READ'
  service: Detections
  access: READ
  operation_count: 3
  example_operations:
  - GetAggregateDetects
  - GetDetectSummaries
  - QueryDetects
- scope: 'Detections: WRITE'
  service: Detections
  access: WRITE
  operation_count: 1
  example_operations:
  - UpdateDetectsByIdsV2
- scope: 'Device Content: READ'
  service: Device Content
  access: READ
  operation_count: 2
  example_operations:
  - entities.states.v1
  - queries.states.v1
- scope: 'Device control policies: READ'
  service: Device control policies
  access: READ
  operation_count: 8
  example_operations:
  - getDefaultDeviceControlPolicies
  - getDefaultDeviceControlSettings
  - getDeviceControlPolicies
  - getDeviceControlPoliciesV2
  - queryCombinedDeviceControlPolicies
- scope: 'Device control policies: WRITE'
  service: Device control policies
  access: WRITE
  operation_count: 10
  example_operations:
  - createDeviceControlPolicies
  - deleteDeviceControlPolicies
  - patchDeviceControlPoliciesClassesV1
  - patchDeviceControlPoliciesV2
  - performDeviceControlPoliciesAction
- scope: 'Event streams: READ'
  service: Event streams
  access: READ
  operation_count: 2
  example_operations:
  - listAvailableStreamsOAuth2
  - refreshActiveStreamSession
- scope: 'Falcon Complete Dashboard: READ'
  service: Falcon Complete Dashboard
  access: READ
  operation_count: 17
  example_operations:
  - AggregateAlerts
  - AggregateAllowList
  - AggregateBlockList
  - AggregateDeviceCountCollection
  - AggregateEscalations
- scope: 'Falcon Container CLI: READ'
  service: Falcon Container CLI
  access: READ
  operation_count: 2
  example_operations:
  - GetCredentials
  - HeadImageScanInventory
- scope: 'Falcon Container CLI: WRITE'
  service: Falcon Container CLI
  access: WRITE
  operation_count: 2
  example_operations:
  - PostImageScanInventory
  - ReadImageVulnerabilities
- scope: 'Falcon Container Image: READ'
  service: Falcon Container Image
  access: READ
  operation_count: 128
  example_operations:
  - ReadContainerAlertsCount
  - ReadContainerAlertsCountBySeverity
  - SearchAndReadContainerAlerts
  - GetRuntimeDetectionsCombinedV2
  - ReadCombinedDetections
- scope: 'Falcon Container Image: WRITE'
  service: Falcon Container Image
  access: WRITE
  operation_count: 15
  example_operations:
  - CreateBaseImagesEntities
  - DeleteBaseImages
  - CreateRegistryEntities
  - DeleteRegistryEntities
  - UpdateRegistryEntities
- scope: 'Falcon Container Policies: READ'
  service: Falcon Container Policies
  access: READ
  operation_count: 2
  example_operations:
  - admission-control-get-policies
  - admission-control-query-policies
- scope: 'Falcon Container Policies: WRITE'
  service: Falcon Container Policies
  access: WRITE
  operation_count: 13
  example_operations:
  - admission-control-add-host-groups
  - admission-control-add-rule-group-custom-rule
  - admission-control-create-policy
  - admission-control-create-rule-groups
  - admission-control-delete-policies
- scope: 'Falcon Data Replicator: READ'
  service: Falcon Data Replicator
  access: READ
  operation_count: 5
  example_operations:
  - fdrschema.combined.event.get
  - fdrschema.entities.event.get
  - fdrschema.entities.field.get
  - fdrschema.queries.event.get
  - fdrschema.queries.field.get
- scope: 'Falcon Discover IoT: READ'
  service: Falcon Discover IoT
  access: READ
  operation_count: 3
  example_operations:
  - get-iot-hosts
  - query-iot-hosts
  - query-iot-hostsV2
- scope: 'Falcon FileVantage Content: READ'
  service: Falcon FileVantage Content
  access: READ
  operation_count: 1
  example_operations:
  - getContents
- scope: 'Falcon FileVantage: READ'
  service: Falcon FileVantage
  access: READ
  operation_count: 12
  example_operations:
  - getActionsMixin0
  - getChanges
  - getPolicies
  - getRuleGroups
  - getRules
- scope: 'Falcon FileVantage: WRITE'
  service: Falcon FileVantage
  access: WRITE
  operation_count: 18
  example_operations:
  - createPolicies
  - createRuleGroups
  - createRules
  - createScheduledExclusions
  - deletePolicies
- scope: 'Falcon Id: READ'
  service: Falcon Id
  access: READ
  operation_count: 2
  example_operations:
  - GetThirdPartyPasskeyRegistry
  - QueryThirdPartyPasskeyRegistry
- scope: 'Falcon Id: WRITE'
  service: Falcon Id
  access: WRITE
  operation_count: 2
  example_operations:
  - DeleteThirdPartyPasskeyRegistry
  - UpdateThirdPartyPasskeyRegistry
- scope: 'Falcon Indicator Graph: READ'
  service: Falcon Indicator Graph
  access: READ
  operation_count: 5
  example_operations:
  - DownloadFeedArchive
  - ListFeedTypes
  - QueryFeedArchives
  - LookupIndicators
  - SearchIndicators
- scope: 'Firewall management: READ'
  service: Firewall management
  access: READ
  operation_count: 20
  example_operations:
  - get-events
  - get-firewall-fields
  - get-network-locations
  - get-network-locations-details
  - get-platforms
- scope: 'Firewall management: WRITE'
  service: Firewall management
  access: WRITE
  operation_count: 23
  example_operations:
  - aggregate-events
  - aggregate-policy-rules
  - aggregate-rule-groups
  - aggregate-rules
  - create-network-locations
- scope: 'Flight Control: READ'
  service: Flight Control
  access: READ
  operation_count: 17
  example_operations:
  - getChildren
  - getChildrenV2
  - getCIDGroupByIdV1
  - getCIDGroupByIdV2
  - getCIDGroupMembersByV1
- scope: 'Flight Control: WRITE'
  service: Flight Control
  access: WRITE
  operation_count: 13
  example_operations:
  - addCIDGroupMembers
  - addRole
  - addUserGroupMembers
  - createCIDGroups
  - createUserGroups
- scope: 'Host Migration: READ'
  service: Host Migration
  access: READ
  operation_count: 5
  example_operations:
  - GetHostMigrationIDsV1
  - GetHostMigrationsV1
  - GetMigrationDestinationsV1
  - GetMigrationIDsV1
  - GetMigrationsV1
- scope: 'Host Migration: WRITE'
  service: Host Migration
  access: WRITE
  operation_count: 5
  example_operations:
  - CreateMigrationV1
  - HostMigrationAggregatesV1
  - HostMigrationsActionsV1
  - MigrationAggregatesV1
  - MigrationsActionsV1
- scope: 'Host groups: READ'
  service: Host groups
  access: READ
  operation_count: 5
  example_operations:
  - getHostGroups
  - queryCombinedGroupMembers
  - queryCombinedHostGroups
  - queryGroupMembers
  - queryHostGroups
- scope: 'Host groups: WRITE'
  service: Host groups
  access: WRITE
  operation_count: 5
  example_operations:
  - createHostGroups
  - deleteHostGroups
  - performGroupAction
  - updateHostGroups
  - entities.perform_action
- scope: 'Hosts: READ'
  service: Hosts
  access: READ
  operation_count: 12
  example_operations:
  - CombinedDevicesByFilter
  - CombinedHiddenDevicesByFilter
  - GetDeviceDetails
  - GetDeviceDetailsV2
  - GetOnlineState.V1
- scope: 'Hosts: WRITE'
  service: Hosts
  access: WRITE
  operation_count: 2
  example_operations:
  - PerformActionV2
  - UpdateDeviceTags
- scope: 'IOA Exclusions: READ'
  service: IOA Exclusions
  access: READ
  operation_count: 4
  example_operations:
  - getIOAExclusionsV1
  - queryIOAExclusionsV1
  - ss-ioa-exclusions.get.v2
  - ss-ioa-exclusions.search.v2
- scope: 'IOA Exclusions: WRITE'
  service: IOA Exclusions
  access: WRITE
  operation_count: 10
  example_operations:
  - createIOAExclusionsV1
  - deleteIOAExclusionsV1
  - ss-ioa-exclusions.aggregates.v2
  - ss-ioa-exclusions.create.v2
  - ss-ioa-exclusions.delete.v2
- scope: 'IOC Management: READ'
  service: IOC Management
  access: READ
  operation_count: 13
  example_operations:
  - action.get.v1
  - action.query.v1
  - GetIndicatorsReport
  - indicator.aggregate.v1
  - indicator.combined.v1
- scope: 'IOC Management: WRITE'
  service: IOC Management
  access: WRITE
  operation_count: 4
  example_operations:
  - indicator.create.v1
  - indicator.delete.v1
  - indicator.sdmf-query.v1
  - indicator.update.v1
- scope: 'IOCs (Indicators of Compromise): READ'
  service: IOCs (Indicators of Compromise)
  access: READ
  operation_count: 4
  example_operations:
  - DevicesCount
  - DevicesRanOn
  - entities.processes
  - ProcessesRanOn
- scope: 'IT Automation - Policies: READ'
  service: IT Automation - Policies
  access: READ
  operation_count: 2
  example_operations:
  - ITAutomationGetPolicies
  - ITAutomationQueryPolicies
- scope: 'IT Automation - Policies: WRITE'
  service: IT Automation - Policies
  access: WRITE
  operation_count: 5
  example_operations:
  - ITAutomationCreatePolicy
  - ITAutomationDeletePolicy
  - ITAutomationUpdatePolicies
  - ITAutomationUpdatePoliciesPrecedence
  - ITAutomationUpdatePolicyHostGroups
- scope: 'IT Automation - Task Executions: READ'
  service: IT Automation - Task Executions
  access: READ
  operation_count: 10
  example_operations:
  - ITAutomationCombinedScheduledTasks
  - ITAutomationGetExecutionResults
  - ITAutomationGetExecutionResultsSearchStatus
  - ITAutomationGetScheduledTasks
  - ITAutomationGetTaskExecution
- scope: 'IT Automation - Task Executions: WRITE'
  service: IT Automation - Task Executions
  access: WRITE
  operation_count: 7
  example_operations:
  - ITAutomationCancelTaskExecution
  - ITAutomationCreateScheduledTask
  - ITAutomationDeleteScheduledTasks
  - ITAutomationRerunTaskExecution
  - ITAutomationRunLiveQuery
- scope: 'IT Automation - Tasks: READ'
  service: IT Automation - Tasks
  access: READ
  operation_count: 7
  example_operations:
  - ITAutomationGetAssociatedTasks
  - ITAutomationGetTaskGroups
  - ITAutomationGetTaskGroupsByQuery
  - ITAutomationGetTasks
  - ITAutomationGetTasksByQuery
- scope: 'IT Automation - Tasks: WRITE'
  service: IT Automation - Tasks
  access: WRITE
  operation_count: 6
  example_operations:
  - ITAutomationCreateTask
  - ITAutomationCreateTaskGroup
  - ITAutomationDeleteTask
  - ITAutomationDeleteTaskGroups
  - ITAutomationUpdateTask
- scope: 'IT Automation - User Groups: READ'
  service: IT Automation - User Groups
  access: READ
  operation_count: 2
  example_operations:
  - ITAutomationGetUserGroup
  - ITAutomationSearchUserGroup
- scope: 'IT Automation - User Groups: WRITE'
  service: IT Automation - User Groups
  access: WRITE
  operation_count: 3
  example_operations:
  - ITAutomationCreateUserGroup
  - ITAutomationDeleteUserGroup
  - ITAutomationUpdateUserGroup
- scope: 'Identity Protection Entities: READ'
  service: Identity Protection Entities
  access: READ
  operation_count: 3
  example_operations:
  - GetSensorAggregates
  - GetSensorDetails
  - QuerySensorsByFilter
- scope: 'Identity Protection GraphQL: WRITE'
  service: Identity Protection GraphQL
  access: WRITE
  operation_count: 1
  example_operations:
  - api_preempt_proxy_post_graphql
- scope: 'Identity Protection Policy Rules: READ'
  service: Identity Protection Policy Rules
  access: READ
  operation_count: 4
  example_operations:
  - get_policy_rules
  - get_policy_rules
  - get_policy_rules_query
  - get_policy_rules_query
- scope: 'Identity Protection Policy Rules: WRITE'
  service: Identity Protection Policy Rules
  access: WRITE
  operation_count: 4
  example_operations:
  - delete_policy_rules
  - delete_policy_rules
  - post_policy_rules
  - post_policy_rules
- scope: 'Indicators (Falcon Intelligence): READ'
  service: Indicators (Falcon Intelligence)
  access: READ
  operation_count: 3
  example_operations:
  - GetIntelIndicatorEntities
  - QueryIntelIndicatorEntities
  - QueryIntelIndicatorIds
- scope: 'Infrastructure as Code (IaC): READ'
  service: Infrastructure as Code (IaC)
  access: READ
  operation_count: 5
  example_operations:
  - CombinedDetections
  - GetCredentialsIAC
  - DownloadFile
  - EnumerateFile
  - FetchFilesDownloadInfo
- scope: 'Installation Tokens Settings: WRITE'
  service: Installation Tokens Settings
  access: WRITE
  operation_count: 1
  example_operations:
  - customer-settings-update
- scope: 'Installation Tokens: READ'
  service: Installation Tokens
  access: READ
  operation_count: 5
  example_operations:
  - audit-events-query
  - audit-events-read
  - customer-settings-read
  - tokens-query
  - tokens-read
- scope: 'Installation Tokens: WRITE'
  service: Installation Tokens
  access: WRITE
  operation_count: 3
  example_operations:
  - tokens-create
  - tokens-delete
  - tokens-update
- scope: 'Kubernetes Protection: READ'
  service: Kubernetes Protection
  access: READ
  operation_count: 10
  example_operations:
  - GetAWSAccountsMixin0
  - GetAzureInstallScript
  - GetAzureTenantConfig
  - GetAzureTenantIDs
  - GetClusters
- scope: 'Kubernetes Protection: WRITE'
  service: Kubernetes Protection
  access: WRITE
  operation_count: 8
  example_operations:
  - CreateAWSAccount
  - CreateAzureSubscription
  - DeleteAWSAccountsMixin0
  - DeleteAzureSubscription
  - PatchAzureServicePrincipal
- scope: 'Machine Learning Exclusions: READ'
  service: Machine Learning Exclusions
  access: READ
  operation_count: 8
  example_operations:
  - cb-exclusions.get.v1
  - cb-exclusions.query.v1
  - certificates.get.v1
  - exclusions.get-all.v2
  - exclusions.get.v2
- scope: 'Machine Learning Exclusions: WRITE'
  service: Machine Learning Exclusions
  access: WRITE
  operation_count: 13
  example_operations:
  - cb-exclusions.create.v1
  - cb-exclusions.delete.v1
  - cb-exclusions.update.v1
  - createMLExclusionsV1
  - deleteMLExclusionsV1
- scope: 'MalQuery: READ'
  service: MalQuery
  access: READ
  operation_count: 5
  example_operations:
  - GetMalQueryDownloadV1
  - GetMalQueryEntitiesSamplesFetchV1
  - GetMalQueryMetadataV1
  - GetMalQueryQuotasV1
  - GetMalQueryRequestV1
- scope: 'MalQuery: WRITE'
  service: MalQuery
  access: WRITE
  operation_count: 4
  example_operations:
  - PostMalQueryEntitiesSamplesMultidownloadV1
  - PostMalQueryExactSearchV1
  - PostMalQueryFuzzySearchV1
  - PostMalQueryHuntV1
- scope: 'Malware Families (Falcon Intelligence): READ'
  service: Malware Families (Falcon Intelligence)
  access: READ
  operation_count: 5
  example_operations:
  - GetMalwareEntities
  - GetMalwareMitreReport
  - QueryMalware
  - QueryMalwareEntities
  - QueryMitreAttacksForMalware
- scope: 'Message Center: READ'
  service: Message Center
  access: READ
  operation_count: 6
  example_operations:
  - AggregateCases
  - CaseDownloadAttachment
  - GetCaseActivityByIds
  - GetCaseEntitiesByIDs
  - QueryActivityByCaseID
- scope: 'Message Center: WRITE'
  service: Message Center
  access: WRITE
  operation_count: 3
  example_operations:
  - CaseAddActivity
  - CaseAddAttachment
  - CreateCaseV2
- scope: 'Mobile Enrollment: WRITE'
  service: Mobile Enrollment
  access: WRITE
  operation_count: 2
  example_operations:
  - RequestDeviceEnrollmentV3
  - RequestDeviceEnrollmentV4
- scope: 'Monitoring rules (Falcon Intelligence Recon): READ'
  service: Monitoring rules (Falcon Intelligence Recon)
  access: READ
  operation_count: 16
  example_operations:
  - AggregateNotificationsExposedDataRecordsV1
  - AggregateNotificationsV1
  - GetActionsV1
  - GetExportJobsV1
  - GetFileContentForExportJobsV1
- scope: 'Monitoring rules (Falcon Intelligence Recon): WRITE'
  service: Monitoring rules (Falcon Intelligence Recon)
  access: WRITE
  operation_count: 10
  example_operations:
  - CreateActionsV1
  - CreateExportJobsV1
  - CreateRulesV1
  - DeleteActionV1
  - DeleteExportJobsV1
- scope: 'NGSIEM Dashboards: READ'
  service: NGSIEM Dashboards
  access: READ
  operation_count: 2
  example_operations:
  - GetDashboardTemplate
  - ListDashboards
- scope: 'NGSIEM Dashboards: WRITE'
  service: NGSIEM Dashboards
  access: WRITE
  operation_count: 11
  example_operations:
  - addDashboardLabels
  - bulkAddDashboardLabels
  - BulkCreateDashboardsFromTemplate
  - bulkRemoveDashboardLabels
  - bulkUpdateDashboardLabels
- scope: 'NGSIEM Data Connections API: READ'
  service: NGSIEM Data Connections API
  access: READ
  operation_count: 6
  example_operations:


# --- truncated at 32 KB (44 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/crowdstrike/refs/heads/main/scopes/crowdstrike-scopes.yml

Work with this as data

Every scope set here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for oauth scopes

4 MCP tools reach this

find_scopesBrowse and filter every scope set in the catalog.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This scope set

curl "https://apis.io/api/v1/scopes/crowdstrike-scopes"

All oauth scopes

curl "https://apis.io/api/v1/scopes?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.