GitLab · OAuth Scopes

GitLab OAuth Scopes

OAuth 2.0 searched

GitLab publishes 25 OAuth 2.0 scopes via the authorizationCode, clientCredentials, and deviceCode flows. Scopes are the fine-grained permissions an application requests at authorization time to act against the GitLab API on a user’s behalf.

This index is generated from the provider’s OpenAPI security definitions (and, where available, its documented scope reference) and refreshes on every APIs.io network build. Browse every provider’s scopes at scopes.apis.io.

CodePlatformSoftware DevelopmentSource Control

Scopes: 25 Flows: authorizationCode, clientCredentials, deviceCode Method: searched

Scopes (25)

Scope	Description	Flows
api	Complete read/write access to the API, including all groups and projects, the container registry, the dependency proxy, and the package registry.
read_api	Read access to the API, including all groups and projects, the container registry, and the package registry.
read_user	Read-only access to the authenticated user's profile through the /user API, including username, public email, and full name.
create_runner	Grants create access to the runners.
manage_runner	Grants access to manage the runners.
k8s_proxy	Perform Kubernetes API calls using the agent for Kubernetes.
self_rotate	Rotate the access token used to make the request. Documented via the live discovery metadata; not enumerated on the OAuth provider scopes page.
mcp	Access to the GitLab Model Context Protocol (MCP) server at /api/v4/mcp for AI agents.
mcp_orbit	Scope for the GitLab Orbit agent context surface (from live discovery metadata).
read_repository	Read-only access to repositories on private projects using Git-over-HTTP or the Repository Files API.
write_repository	Read-write access to repositories on private projects using Git-over-HTTP.
read_registry	Read-only access to container registry images on private projects.
write_registry	Write access to container registry images on private projects.
read_virtual_registry	Read-only access to container images through the dependency proxy.
write_virtual_registry	Read, write, and delete access to container images through the dependency proxy.
read_observability	Read-only access to GitLab Observability.
write_observability	Write access to GitLab Observability.
ai_features	Access to GitLab Duo related API endpoints.
ai_workflows	Access to AI workflow endpoints (from live discovery metadata).
sudo	Perform API actions as any user in the system (available only for administrators).
admin_mode	Perform API actions as an administrator when Admin Mode is enabled.
read_service_ping	Download Service Ping payloads through the API when authenticated as an administrator.
openid	Authenticate with GitLab using OpenID Connect; also grants read-only access to the user's profile and group memberships.
profile	Read-only access to the user's profile data using OpenID Connect.
email	Read-only access to the user's primary email address using OpenID Connect.

📄 Provider scope reference: https://docs.gitlab.com/integration/oauth_provider/

Source

OAuth Scopes

generated: '2026-06-20'
method: searched
source: https://gitlab.com/.well-known/oauth-authorization-server
docs: https://docs.gitlab.com/integration/oauth_provider/
schemes:
- name: OAuth2
  issuer: https://gitlab.com
  authorizationUrl: https://gitlab.com/oauth/authorize
  tokenUrl: https://gitlab.com/oauth/token
  device_authorization_endpoint: https://gitlab.com/oauth/authorize_device
  registration_endpoint: https://gitlab.com/oauth/register
  grant_types: [authorization_code, client_credentials, device_code, refresh_token]
  code_challenge_methods: [plain, S256]
  flows: [authorizationCode, clientCredentials, deviceCode]
scopes:
- scope: api
  description: Complete read/write access to the API, including all groups and projects, the container registry, the dependency proxy, and the package registry.
- scope: read_api
  description: Read access to the API, including all groups and projects, the container registry, and the package registry.
- scope: read_user
  description: Read-only access to the authenticated user's profile through the /user API, including username, public email, and full name.
- scope: create_runner
  description: Grants create access to the runners.
- scope: manage_runner
  description: Grants access to manage the runners.
- scope: k8s_proxy
  description: Perform Kubernetes API calls using the agent for Kubernetes.
- scope: self_rotate
  description: Rotate the access token used to make the request. Documented via the live discovery metadata; not enumerated on the OAuth provider scopes page.
- scope: mcp
  description: Access to the GitLab Model Context Protocol (MCP) server at /api/v4/mcp for AI agents.
- scope: mcp_orbit
  description: Scope for the GitLab Orbit agent context surface (from live discovery metadata).
- scope: read_repository
  description: Read-only access to repositories on private projects using Git-over-HTTP or the Repository Files API.
- scope: write_repository
  description: Read-write access to repositories on private projects using Git-over-HTTP.
- scope: read_registry
  description: Read-only access to container registry images on private projects.
- scope: write_registry
  description: Write access to container registry images on private projects.
- scope: read_virtual_registry
  description: Read-only access to container images through the dependency proxy.
- scope: write_virtual_registry
  description: Read, write, and delete access to container images through the dependency proxy.
- scope: read_observability
  description: Read-only access to GitLab Observability.
- scope: write_observability
  description: Write access to GitLab Observability.
- scope: ai_features
  description: Access to GitLab Duo related API endpoints.
- scope: ai_workflows
  description: Access to AI workflow endpoints (from live discovery metadata).
- scope: sudo
  description: Perform API actions as any user in the system (available only for administrators).
- scope: admin_mode
  description: Perform API actions as an administrator when Admin Mode is enabled.
- scope: read_service_ping
  description: Download Service Ping payloads through the API when authenticated as an administrator.
- scope: openid
  description: Authenticate with GitLab using OpenID Connect; also grants read-only access to the user's profile and group memberships.
- scope: profile
  description: Read-only access to the user's profile data using OpenID Connect.
- scope: email
  description: Read-only access to the user's primary email address using OpenID Connect.