Tower · OAuth Scopes

Tower OAuth Scopes

OAuth 2.0 searched

Tower publishes 53 OAuth 2.0 scopes. Scopes are the fine-grained permissions an application requests at authorization time to act against the Tower API on a user’s behalf.

This index is generated from the provider’s OpenAPI security definitions (and, where available, its documented scope reference) and refreshes on every APIs.io network build. Browse every provider’s scopes at scopes.apis.io.

Data InfrastructureData EngineeringPythonApache IcebergLakehouseOrchestrationData PipelinesAI AgentsMCPETL

Scopes: 53 Flows: Method: searched

Scopes (53)

Scope	Description	Flows
api_keys	Access to all API key operations.
api_keys:read	Read access for API keys.
api_keys:create	Create access for API keys.
api_keys:delete	Delete access for API keys.
apps	Access to all apps operations.
apps:read	Read access for apps.
apps:run	Allows the API to run apps.
apps:deploy	Allows the API key to be used to deploy a new app version.
apps:create	Create access for apps.
apps:update	Update access for apps (e.g. renaming app).
apps:delete	Delete access for apps.
catalogs	Access to all Tower catalog operations.
catalogs:read	Read access for catalogs.
catalogs:create	Create access for catalogs.
catalogs:update	Update access for catalogs.
catalogs:delete	Delete access for catalogs.
catalogs:export	Export access for catalogs.
envs	Access to all environment operations.
envs:create	Create access for environments.
envs:read	Read access for environments.
envs:update	Update access for environments.
notifications	Access to all notification operations.
notifications:read	Read access for notifications.
notifications:delete	Delete access for notifications.
runs	Access to all run operations.
runs:read	Read access for runs.
runs:cancel	Allows for canceling an active run.
runs:logs	Read access for run logs, including the stream of logs.
runners	Access to all self-hosted runner operations.
runners:read	Read access to runners.
runners:credentials:create	Allows for creating credentials for self-hosted runners.
sandbox	Access to all Tower sandbox operations.
sandbox:secrets:create	Allows for creating a new secret in a sandbox.
schedules	Access to all schedules operations.
schedules:create	Create access for schedules.
schedules:read	Read access for schedules.
schedules:update	Update access for schedules.
schedules:delete	Delete access for schedules.
secrets	Access to all secrets operations.
secrets:read	Read access for secrets.
secrets:create	Create access for secrets.
secrets:update	Update access for secrets.
secrets:delete	Delete access for secrets.
teams	Access to all team operations.
teams:create	Create access for teams.
teams:read	Read access for teams.
teams:update	Update access for teams.
teams:delete	Delete access for teams.
webhooks	Access to all webhooks operations.
webhooks:read	Read access for webhooks.
webhooks:create	Create access for webhooks.
webhooks:update	Update access for webhooks.
webhooks:delete	Delete access for webhooks.

📄 Provider scope reference: https://docs.tower.dev/docs/using-tower/api-keys

Source

OAuth Scopes

generated: '2026-07-21'
method: searched
source: https://docs.tower.dev/docs/using-tower/api-keys
docs: https://docs.tower.dev/docs/using-tower/api-keys
description: >-
  Tower's documented permission-scope system for API keys (not OAuth — Tower's
  OpenAPI declares apiKey + bearer schemes, no oauth2 flows). Every API endpoint
  requires a scope, listed per-operation in the API reference under
  "Authorization"; API keys default to the creating account's role and can be
  minted with a reduced scope set via the create-api-key operation's `scopes`
  parameter. A key lacking the required scope receives 403 Forbidden. Captured
  verbatim from the "Available scopes" table. (The only OAuth-shaped surface is
  vend-catalog-credentials, which mints short-lived OAuth bearer tokens for
  Iceberg catalog access.)
scheme: api-key-scopes
scopes:
  - {scope: "api_keys", description: "Access to all API key operations."}
  - {scope: "api_keys:read", description: "Read access for API keys."}
  - {scope: "api_keys:create", description: "Create access for API keys."}
  - {scope: "api_keys:delete", description: "Delete access for API keys."}
  - {scope: "apps", description: "Access to all apps operations."}
  - {scope: "apps:read", description: "Read access for apps."}
  - {scope: "apps:run", description: "Allows the API to run apps."}
  - {scope: "apps:deploy", description: "Allows the API key to be used to deploy a new app version."}
  - {scope: "apps:create", description: "Create access for apps."}
  - {scope: "apps:update", description: "Update access for apps (e.g. renaming app)."}
  - {scope: "apps:delete", description: "Delete access for apps."}
  - {scope: "catalogs", description: "Access to all Tower catalog operations."}
  - {scope: "catalogs:read", description: "Read access for catalogs."}
  - {scope: "catalogs:create", description: "Create access for catalogs."}
  - {scope: "catalogs:update", description: "Update access for catalogs."}
  - {scope: "catalogs:delete", description: "Delete access for catalogs."}
  - {scope: "catalogs:export", description: "Export access for catalogs."}
  - {scope: "envs", description: "Access to all environment operations."}
  - {scope: "envs:create", description: "Create access for environments."}
  - {scope: "envs:read", description: "Read access for environments."}
  - {scope: "envs:update", description: "Update access for environments."}
  - {scope: "notifications", description: "Access to all notification operations."}
  - {scope: "notifications:read", description: "Read access for notifications."}
  - {scope: "notifications:delete", description: "Delete access for notifications."}
  - {scope: "runs", description: "Access to all run operations."}
  - {scope: "runs:read", description: "Read access for runs."}
  - {scope: "runs:cancel", description: "Allows for canceling an active run."}
  - {scope: "runs:logs", description: "Read access for run logs, including the stream of logs."}
  - {scope: "runners", description: "Access to all self-hosted runner operations."}
  - {scope: "runners:read", description: "Read access to runners."}
  - {scope: "runners:credentials:create", description: "Allows for creating credentials for self-hosted runners."}
  - {scope: "sandbox", description: "Access to all Tower sandbox operations."}
  - {scope: "sandbox:secrets:create", description: "Allows for creating a new secret in a sandbox."}
  - {scope: "schedules", description: "Access to all schedules operations."}
  - {scope: "schedules:create", description: "Create access for schedules."}
  - {scope: "schedules:read", description: "Read access for schedules."}
  - {scope: "schedules:update", description: "Update access for schedules."}
  - {scope: "schedules:delete", description: "Delete access for schedules."}
  - {scope: "secrets", description: "Access to all secrets operations."}
  - {scope: "secrets:read", description: "Read access for secrets."}
  - {scope: "secrets:create", description: "Create access for secrets."}
  - {scope: "secrets:update", description: "Update access for secrets."}
  - {scope: "secrets:delete", description: "Delete access for secrets."}
  - {scope: "teams", description: "Access to all team operations."}
  - {scope: "teams:create", description: "Create access for teams."}
  - {scope: "teams:read", description: "Read access for teams."}
  - {scope: "teams:update", description: "Update access for teams."}
  - {scope: "teams:delete", description: "Delete access for teams."}
  - {scope: "webhooks", description: "Access to all webhooks operations."}
  - {scope: "webhooks:read", description: "Read access for webhooks."}
  - {scope: "webhooks:create", description: "Create access for webhooks."}
  - {scope: "webhooks:update", description: "Update access for webhooks."}
  - {scope: "webhooks:delete", description: "Delete access for webhooks."}