Currents OAuth Scopes

generated: '2026-11-04'
method: searched
source: https://docs.currents.dev/authentication/oauth.md
schemes:
- name: OAuth2
  source: openapi/currents-dev-openapi.yml
  flows:
  - flow: authorizationCode
    authorizationUrl: https://id.currents.dev/api/auth/oauth2/authorize
    tokenUrl: https://id.currents.dev/api/auth/oauth2/token
  description: 'An access token from the Currents authorization server, for an application acting as a user in one organization. Unlike an API key it is confined per endpoint: the operation lists the scope
    it needs, and a token that was not granted that scope gets 403.


    **The endpoints below are production''s.** They are written out so this specification can be exercised against production, and they are wrong for every other deployment — a token minted by `id.currents.dev`
    is refused by a staging or on-premise API, whose `OAUTH_ISSUER` and `OAUTH_API_AUDIENCE` are its own. Against anything but production, and in a client generated from this document, discover them instead:
    `GET {api origin}/.well-known/oauth-protected-resource`, then the `authorization_servers[0]` document.


    **The audience named here is the REST API''s.** `POST /mcp` is a second resource server on the same origin, identified by `{api origin}/mcp` and described by its own document at `/.well-known/oauth-protected-resource/mcp`.
    Every operation below refuses a token minted for it, and it refuses every token minted for these, so a client of this specification wants the audience above and not that one.'
scopes:
- scope: actions:read
  description: See quarantine and skip rules, and the tests they affect
  flows:
  - authorizationCode
  sources:
  - openapi/currents-dev-openapi.yml
- scope: actions:write
  description: Create, edit, enable, disable and archive quarantine and skip rules
  flows:
  - authorizationCode
  sources:
  - openapi/currents-dev-openapi.yml
- scope: analytics:read
  description: 'See aggregate metrics: flake and failure rates, error counts, durations and trends'
  flows:
  - authorizationCode
  sources:
  - openapi/currents-dev-openapi.yml
- scope: issues:write
  description: Create and link issues in a connected issue tracker, and list its projects and issue types
  flows:
  - authorizationCode
  sources:
  - openapi/currents-dev-openapi.yml
- scope: projects:read
  description: See which projects exist and their names
  flows:
  - authorizationCode
  sources:
  - openapi/currents-dev-openapi.yml
- scope: projects:write
  description: Change project configuration, including a project's tags
  flows:
  - authorizationCode
  sources:
  - openapi/currents-dev-openapi.yml
- scope: results:read
  description: See runs, specs and failure detail — errors, stacks and artifacts
  flows:
  - authorizationCode
  sources:
  - openapi/currents-dev-openapi.yml
- scope: runs:write
  description: Cancel and reset runs, and permanently delete runs and their artifacts
  flows:
  - authorizationCode
  sources:
  - openapi/currents-dev-openapi.yml
- scope: shares:write
  description: Create public links to test results that anyone with the link can open until they expire
  flows:
  - authorizationCode
  sources:
  - openapi/currents-dev-openapi.yml
- scope: webhooks:read
  description: See webhook configuration, including destination URLs and headers
  flows:
  - authorizationCode
  sources:
  - openapi/currents-dev-openapi.yml
- scope: webhooks:write
  description: Create, edit and delete webhooks
  flows:
  - authorizationCode
  sources:
  - openapi/currents-dev-openapi.yml
docs: https://docs.currents.dev/authentication/oauth
note: Docs Permissions table lists 10 permissions (shares:write is in the spec only). Consent is capped by the organization role (Admin / Actions Admin / Member / Guest); refusals use insufficient_scope,
  insufficient_role, api_key_required. PKCE S256 required; no dynamic client registration (Client ID Metadata Document instead).