SideQuest · OAuth Scopes

SideQuest OAuth Scopes

OAuth 2.0 derived

SideQuest uses OAuth 2.0 but publishes no discrete scopes — access is governed by the grant itself (e.g. client-credentials or role-based authorization) rather than per-scope consent.

This index is generated from the provider’s OpenAPI security definitions (and, where available, its documented scope reference) and refreshes on every APIs.io network build. Browse every provider’s scopes at scopes.apis.io.

CompanyConsumerVirtual RealityVRXRGamingApp StoreDevelopers
Scopes: 0 Flows: Method: derived

Scopes (0)

SideQuest implements OAuth 2.0 but publishes no discrete scopes — access is governed by the grant itself (client-credentials or role-based authorization) rather than per-scope consent.

📄 Provider scope reference:

Source

OAuth Scopes

Raw ↑ 
generated: '2026-07-21'
method: derived
source: >-
  Derived from openapi/sidequest-openapi.json — the scopes enum on
  components.schemas.GetShortCodeRequest.scopes (the full set a client may
  request) and the per-operation security requirements on the SideQuest Public
  API (userAuth). No separate hosted scopes/permissions reference page was found
  (sidequestvr.com is a single-page app; developer.sidequestvr.com does not
  resolve), so descriptions are derived from the scope identifiers themselves.
api: SideQuest Public API
token_endpoint: https://api.sidequestvr.com/v2/oauth/token
authorization_flow: >-
  Device-style short-code login: POST /v2/oauth/getshortcode (client_id + scopes)
  returns a short code + verification_url the user approves; the client polls
  POST /v2/oauth/checkshortcode to redeem it for an access_token + refresh_token.
  Refresh via POST /v2/oauth/token (grant_type=refresh_token). Access tokens are
  presented as HTTP bearer tokens (userAuth).
scopes:
  - name: user.basic_profile.read
    description: Read a user's basic public profile (name, avatar preview, level, bio).
    used_by: ["GET /v2/users/{route_users_id}"]
  - name: user.app_achievements.read
    description: Read the achievements a user has unlocked for an app.
    used_by: ["GET /v2/users/{route_users_id}/apps/{apps_id}/achievements"]
  - name: user.app_achievements.write
    description: Grant or update a user's app achievements.
  - name: user.avatars.read
    description: Read a user's avatar(s).
  - name: user.avatars.write
    description: Create or update a user's avatar(s).
  - name: user.friends.read
    description: Read a user's friends list.
  - name: user.friends.write
    description: Modify a user's friends (add/remove).
  - name: user.rich_presence.write
    description: Publish rich-presence / activity status for a user.
  - name: user.communities.read
    description: Read the communities a user belongs to.
  - name: user.communities.write
    description: Join, leave, or modify a user's communities.
  - name: user.messages.read
    description: Read a user's messages.
  - name: user.messages.write
    description: Send messages on behalf of a user.
  - name: user.messagehistory.read
    description: Read a user's message history.
notes: >-
  Only user.basic_profile.read and user.app_achievements.read gate operations in
  the currently published spec (0.2.0); the remaining scopes are requestable per
  GetShortCodeRequest and correspond to product surfaces (avatars, friends,
  communities, messaging, rich presence) not yet exposed as public REST paths.