involve.me · OAuth Scopes

involve.me OAuth Scopes

OAuth 2.0 probed

involve.me publishes 21 OAuth 2.0 scopes. Scopes are the fine-grained permissions an application requests at authorization time to act against the involve.me API on a user’s behalf.

This index is generated from the provider’s OpenAPI security definitions (and, where available, its documented scope reference) and refreshes on every APIs.io network build. Browse every provider’s scopes at scopes.apis.io.

CompanyMarketingLead GenerationFormsSurveysQuizzesNo-CodeEmail MarketingCRMWebhooksModel Context ProtocolAustria

Scopes: 21 Flows: Method: probed

Scopes (21)

Scope	Description	Flows
*	Wildcard — full access to every resource family below.
content:read	Read CMS content across all content types.
content:write	Create, update and delete CMS content.
entries:read	Read Statamic entries (individual pages, blog posts, templates).
entries:write	Create, update and delete Statamic entries.
structures:read	Read navigation structures and content trees.
structures:write	Modify navigation structures and content trees.
assets:read	Read media assets and asset containers.
assets:write	Upload, replace and delete media assets.
users:read	Read CMS user accounts and roles.
users:write	Create, update and delete CMS user accounts.
system:read	Read CMS system configuration and site settings.
system:write	Modify CMS system configuration and site settings.
blueprints:read	Read Statamic blueprints and fieldsets (the content schema).
blueprints:write	Modify Statamic blueprints and fieldsets.
terms:read	Read taxonomy terms.
terms:write	Create, update and delete taxonomy terms.
globals:read	Read global content sets shared across the site.
globals:write	Modify global content sets.
content-facade:read	Read content through the Statamic content facade abstraction.
content-facade:write	Write content through the Statamic content facade abstraction.

📄 Provider scope reference:

Source

OAuth Scopes

generated: '2026-08-12'
method: probed
source: >-
  https://www.involve.me/.well-known/oauth-authorization-server (HTTP 200,
  application/json) — scopes_supported, read verbatim. Corroborated by
  https://www.involve.me/.well-known/oauth-protected-resource (HTTP 200), which
  publishes the identical list for the protected resource
  https://www-cdn.involve.me/mcp/statamic.
description: >-
  The OAuth 2.0 scopes involve.me publishes for its Model Context Protocol server.
  These are read straight off RFC 8414 authorization-server metadata, so they are
  the provider's own values — but note that no human-readable scope reference page
  exists anywhere on involve.me, help.involve.me, or any developer site. The
  descriptions below are marked derived and are inferred from Statamic CMS resource
  naming; they are NOT provider-authored text.

authorization_server: https://www-cdn.involve.me
protected_resource: https://www-cdn.involve.me/mcp/statamic
docs: null
docs_note: >-
  involve.me publishes no scopes/permissions reference. There is no developer
  portal (developers.involve.me and docs.involve.me both 302 to the marketing
  homepage). The only public record of these scopes is the .well-known metadata
  document itself.

pkce_required: S256
grant_types: [authorization_code, refresh_token]
scope_count: 20

scopes:
  - scope: '*'
    description_method: provider
    description: Wildcard — full access to every resource family below.
    risk: high

  - scope: content:read
    description_method: derived
    description: Read CMS content across all content types.
  - scope: content:write
    description_method: derived
    description: Create, update and delete CMS content.

  - scope: entries:read
    description_method: derived
    description: Read Statamic entries (individual pages, blog posts, templates).
  - scope: entries:write
    description_method: derived
    description: Create, update and delete Statamic entries.

  - scope: structures:read
    description_method: derived
    description: Read navigation structures and content trees.
  - scope: structures:write
    description_method: derived
    description: Modify navigation structures and content trees.

  - scope: assets:read
    description_method: derived
    description: Read media assets and asset containers.
  - scope: assets:write
    description_method: derived
    description: Upload, replace and delete media assets.

  - scope: users:read
    description_method: derived
    description: Read CMS user accounts and roles.
    risk: high
  - scope: users:write
    description_method: derived
    description: Create, update and delete CMS user accounts.
    risk: high

  - scope: system:read
    description_method: derived
    description: Read CMS system configuration and site settings.
  - scope: system:write
    description_method: derived
    description: Modify CMS system configuration and site settings.
    risk: high

  - scope: blueprints:read
    description_method: derived
    description: Read Statamic blueprints and fieldsets (the content schema).
  - scope: blueprints:write
    description_method: derived
    description: Modify Statamic blueprints and fieldsets.

  - scope: terms:read
    description_method: derived
    description: Read taxonomy terms.
  - scope: terms:write
    description_method: derived
    description: Create, update and delete taxonomy terms.

  - scope: globals:read
    description_method: derived
    description: Read global content sets shared across the site.
  - scope: globals:write
    description_method: derived
    description: Modify global content sets.

  - scope: content-facade:read
    description_method: derived
    description: Read content through the Statamic content facade abstraction.
  - scope: content-facade:write
    description_method: derived
    description: Write content through the Statamic content facade abstraction.

findings:
  - >-
    A wildcard '*' scope is offered alongside the granular pairs. An agent that
    requests '*' receives write access to users and system configuration; there is
    no published guidance steering integrators toward least privilege.
  - >-
    Every family is offered as a read/write pair with no finer granularity, so
    there is no way to grant, for example, publish-without-delete.
  - >-
    These scopes govern the marketing website's CMS only. No OAuth scope surface
    exists for the involve.me funnel product's own data (funnels, submissions,
    participants, contacts).