Technical University of Berlin OAuth Scopes

generated: '2026-08-30'
method: probed
source: https://git.tu-berlin.de/.well-known/openid-configuration
note: >-
  TU Berlin publishes no OpenAPI, so no scope could be derived from a contract. Every scope
  string below is read verbatim from the scopes_supported array of the live OIDC discovery
  document served by the institution's self-hosted GitLab at git.tu-berlin.de (200,
  application/json, saved at well-known/tu-berlin-gitlab-openid-configuration.json). The
  scope vocabulary is GitLab's product vocabulary; the DEPLOYMENT advertising it is TU
  Berlin's, which is why it is recorded here and the descriptions are ours. No other TU
  Berlin host serves an OAuth/OIDC discovery document.
  This file was generated by API Evangelist from the live discovery document on 2026-08-30;
  TU Berlin publishes no scope documentation of its own.
schemes:
- name: gitlab-tu-berlin
  source: https://git.tu-berlin.de/.well-known/openid-configuration
  issuer: https://git.tu-berlin.de
  operator: institution
  flows:
  - flow: authorizationCode
    authorizationUrl: https://git.tu-berlin.de/oauth/authorize
    tokenUrl: https://git.tu-berlin.de/oauth/token
    pkce: S256
  - flow: clientCredentials
    tokenUrl: https://git.tu-berlin.de/oauth/token
  - flow: deviceCode
    tokenUrl: https://git.tu-berlin.de/oauth/token
scopes:
- scope: api
  description: Full read/write access to the GitLab API on behalf of the user, across all groups and projects they can reach.
- scope: read_api
  description: Read-only access to the whole GitLab API.
- scope: read_user
  description: Read the authenticated user's profile.
- scope: read_repository
  description: Read repository contents over HTTPS and the API.
- scope: write_repository
  description: Push to repositories over HTTPS and the API.
- scope: read_registry
  description: Pull container images from the instance registry.
- scope: write_registry
  description: Push container images to the instance registry.
- scope: read_virtual_registry
  description: Read from virtual (dependency-proxy style) registries.
- scope: write_virtual_registry
  description: Write to virtual registries.
- scope: read_observability
  description: Read observability (metrics/tracing) data.
- scope: write_observability
  description: Write observability data.
- scope: create_runner
  description: Create CI runners.
- scope: manage_runner
  description: Manage existing CI runners.
- scope: k8s_proxy
  description: Proxy access to Kubernetes clusters connected to the instance.
- scope: self_rotate
  description: Allow a token to rotate itself.
- scope: mcp
  description: Access GitLab's Model Context Protocol surface. Advertised by the instance; /api/v4/mcp returns 401 unauthenticated.
- scope: mcp_orbit
  description: GitLab MCP "orbit" surface, advertised alongside mcp.
- scope: ai_features
  description: Access GitLab AI features.
- scope: ai_workflows
  description: Access GitLab AI workflow features.
- scope: read_service_ping
  description: Read instance service-ping telemetry.
- scope: sudo
  description: Act as any user — administrator only.
- scope: admin_mode
  description: Perform administrative operations — administrator only.
- scope: openid
  description: Standard OpenID Connect scope; requests an ID token.
- scope: profile
  description: Release the user's profile claims.
- scope: email
  description: Release the user's email claim.
- scope: 'user:*'
  description: Wildcard user-scoped access as advertised in scopes_supported.