Deliverd OAuth Scopes

generated: '2026-11-05'
method: searched
source: https://deliverd.dev/docs/developers/authentication
docs: https://deliverd.dev/docs/developers/authentication
scheme: 'OAuth 2.1 (MCP authorization: discovery, dynamic client registration, PKCE) and API keys — both carry the
  same scopes'
scopes:
- name: reports:read
  description: Read reports, their versions, datasets, templates and analytics.
- name: reports:write
  description: Publish, update, rename, archive, roll back and copy reports; write datasets.
- name: reports:share
  description: Grant and revoke access to reports, and send them.
- name: audiences:read
  description: Resolve an audience phrase to people, teams and groups.
- name: workspaces:read
  description: List workspaces.
- name: comments:read
  description: Read comment threads and revision briefs.
- name: comments:write
  description: Comment, reply, retract and resolve.
- name: schedules:read
  description: List recurring publishes and which are due.
- name: schedules:write
  description: Create, change and delete schedules. Refused to an agent key whatever its scopes.
- name: approvals:read
  description: Read approvals and their decisions.
- name: approvals:write
  description: Ask for approval, answer an approver's question, withdraw a request.
- name: reviews:read
  description: Read reviews and their verdicts.
- name: reviews:write
  description: Ask for a review, withdraw one.
- name: collections:read
  description: Read requests for information and their answers.
- name: collections:write
  description: Ask for information, withdraw a request.
- name: flows:read
  description: List flows and read their timelines.
- name: flows:write
  description: Start, complete and cancel flows.
- name: tasks:read
  description: Read objectives, side tasks, their findings and the context an agent is handed.
- name: tasks:write
  description: Start objectives and side tasks, update their state, record findings, complete and apply. Never confirms
    a decision.
- name: actions:read
  description: List the registered actions.
- name: actions:write
  description: Register actions. Also needs an owner or administrator; refused to an agent key and to an AI client
    connected over OAuth.
- name: policies:read
  description: Read gate policy and run simulations.
- name: policies:write
  description: Write gate policy. Also needs an owner or administrator; refused to an agent key and to an AI client
    connected over OAuth.
- name: gates:read
  description: Read a gate decision back while a person decides.
- name: gates:write
  description: Ask the gate before acting, and withdraw a request.
- name: gates:execute
  description: Report what was done with a gate's permission, and have Deliverd carry out a gated release. Accepted
    only from the agent that asked.
- name: agents:read
  description: List the organisation's agents and the platforms they run on.
- name: webhooks:manage
  description: List, add, change and remove webhook endpoints, and send one a test. Also needs an owner or administrator;
    refused to an agent key.
- name: audit:read
  description: Read the organisation's audit log with GET /audit-events. Also needs an owner, an administrator or
    a security administrator; refused to an agent key.
agent_key_scopes:
- reports:read
- reports:write
- reports:share
- comments:read
- comments:write
- schedules:read
- approvals:read
- approvals:write
- reviews:read
- reviews:write
- collections:read
- collections:write
- tasks:read
- tasks:write
- gates:read
- gates:write
- gates:execute
note: The OpenAPI declares only an http bearer scheme with no oauth2 flows; these scopes are from the docs. A call
  without the needed scope answers 403 insufficient_scope.