Runtime · OAuth Scopes

Runtime OAuth Scopes

OAuth 2.0 searched

Runtime publishes 20 OAuth 2.0 scopes. Scopes are the fine-grained permissions an application requests at authorization time to act against the Runtime API on a user’s behalf.

This index is generated from the provider’s OpenAPI security definitions (and, where available, its documented scope reference) and refreshes on every APIs.io network build. Browse every provider’s scopes at scopes.apis.io.

CompanyCoding AgentsDeveloper ToolsAI InfrastructureSandboxesAgent OrchestrationDevOpsCloud

Scopes: 20 Flows: Method: searched

Scopes (20)

Scope	Description	Flows
sessions:read	List and view sessions
sessions:write	Create, pause, resume, rename sessions
sessions:delete	Destroy sessions
sessions:prompt	Send prompts and cancel them
sessions:terminal	WebSocket terminal access
context:read	Read instructions, skills, directives
context:write	Update instructions, manage skills
secrets:read	List secret names (values are never returned)
secrets:write	Set and delete secrets
deployments:read	View deploy info and limits
deployments:write	Run deploys
templates:read	List and view templates
templates:write	Create and update templates
templates:build	Trigger template builds
templates:delete	Delete templates
integrations:read	View integrations
integrations:write	Manage integrations
guardrails:read	View org guardrails
guardrails:write	Update org guardrails
activity:read	View telemetry and usage

📄 Provider scope reference: https://docs.runtm.com/cloud-api/scopes

Source

OAuth Scopes

generated: '2026-07-21'
method: searched
source: https://docs.runtm.com/cloud-api/scopes
docs: https://docs.runtm.com/cloud-api/scopes
notes: >-
  Runtime uses API-key scopes (not OAuth), following the pattern `resource:action`. Every key carries
  a set of scopes that determine which endpoints it can call, bounded by the creating user's org role
  ceiling. Captured verbatim from the published scope reference.
model: api-key-scopes
scheme:
  name: BearerApiKey
  pattern: "resource:action"
  enforcement: "403 Insufficient scope: requires <scope> when a key lacks a required scope"
  runtime_check: "GET /api/cloud/auth/verify returns a scopes[] array"
scopes:
- scope: sessions:read
  description: List and view sessions
- scope: sessions:write
  description: Create, pause, resume, rename sessions
- scope: sessions:delete
  description: Destroy sessions
- scope: sessions:prompt
  description: Send prompts and cancel them
- scope: sessions:terminal
  description: WebSocket terminal access
- scope: context:read
  description: Read instructions, skills, directives
- scope: context:write
  description: Update instructions, manage skills
- scope: secrets:read
  description: List secret names (values are never returned)
- scope: secrets:write
  description: Set and delete secrets
- scope: deployments:read
  description: View deploy info and limits
- scope: deployments:write
  description: Run deploys
- scope: templates:read
  description: List and view templates
- scope: templates:write
  description: Create and update templates
- scope: templates:build
  description: Trigger template builds
- scope: templates:delete
  description: Delete templates
- scope: integrations:read
  description: View integrations
- scope: integrations:write
  description: Manage integrations
- scope: guardrails:read
  description: View org guardrails
- scope: guardrails:write
  description: Update org guardrails
- scope: activity:read
  description: View telemetry and usage
presets:
- name: Session automation
  scopes: [sessions:read, sessions:write, sessions:delete, sessions:prompt, sessions:terminal, context:read, secrets:read]
- name: Full access
  scopes: [all]
- name: Read-only
  scopes: [sessions:read, context:read, secrets:read, deployments:read, templates:read, integrations:read, guardrails:read, activity:read]
role_ceilings:
- role: Member
  ceiling: "Any scope for member-accessible resources; cannot grant guardrails:write or templates:delete"
- role: Admin
  ceiling: "All scopes except owner-reserved"
- role: Owner
  ceiling: "No restrictions"