Scopes

A credential can call an operation only if it holds the scopes that operation lists. Otherwise the API answers 403 insufficient_scope, and details names the missing scopes:

{
  "error": {
    "code": "insufficient_scope",
    "message": "The credential does not have the scope this operation needs.",
    "request_id": "req_3f0c2a9d5b6e4f7a8c1d2e3f4a5b6c7d",
    "details": { "required_scopes": ["issues:triage"], "any_of": false }
  }
}

• You can put a scope on a key only if your role in the workspace allows the matching actions. Workspace owners can grant every scope.
• Scopes that return DAST results also need permission to run DAST scans.
• Starting a scan needs the scope for that scan type, such as scans:code_execute for a code scan.
• Subscribing a webhook to an event type needs that event’s read scope; see Webhooks.

Scope	Grants	Operations
workspace:read	Read the workspace profile, plan and integration status.	GET /v1/workspace
usage:read	Read plan limits and scan usage.	GET /v1/workspace/usage
repos:read	List code repositories and container images.	GET /v1/repositories GET /v1/repositories/{repository_id}
scans:read	Read scans and scan history.	GET /v1/scans GET /v1/repositories/{repository_id}/scans GET /v1/scans/{scan_id} GET /v1/scans/{scan_id}/report
scans:code_execute	Start code scans (SAST, SCA, secrets, IaC).	POST /v1/scans
scans:dast_execute	Start DAST scans against authorised targets.	POST /v1/scans
scans:container_execute	Start container image scans.	POST /v1/scans
scans:pentest_execute	Start pentests against approved targets.	POST /v1/scans
issues:read	Read issues, issue counts and issue groups, including code snippets.	GET /v1/issues GET /v1/scans/{scan_id}/issues GET /v1/issues/counts GET /v1/issues/groups GET /v1/issues/groups/{group_id} GET /v1/issues/{issue_id} GET /v1/exception-requests GET /v1/exception-requests/{request_id}
issues:triage	Resolve and reopen issues.	POST /v1/issues/{issue_id}/resolve POST /v1/issues/{issue_id}/reopen
issues:exceptions	Request false-positive, snooze and risk-acceptance exceptions. A person approves them.	POST /v1/issues/{issue_id}/ignore POST /v1/issues/{issue_id}/snooze POST /v1/issues/{issue_id}/accept-risk POST /v1/exception-requests/{request_id}/cancel
issues:export	Export issues as JSON or CSV.	GET /v1/issues/export
autofix:read	Read autofix jobs, their patches and the remediation policy.	GET /v1/autofix/jobs GET /v1/autofix/jobs/{job_id} GET /v1/autofix/jobs/{job_id}/patch GET /v1/autofix/settings
autofix:execute	Request AI autofix pull requests.	POST /v1/autofix/jobs
autofix:settings_write	Change the workspace remediation policy.	PATCH /v1/autofix/settings
kubernetes:read	Read Kubernetes clusters, findings and images.	GET /v1/kubernetes/clusters GET /v1/kubernetes/clusters/{cluster_id} GET /v1/kubernetes/findings GET /v1/kubernetes/findings/{finding_id} GET /v1/kubernetes/images
kubernetes:triage	Change the status of Kubernetes findings.	POST /v1/kubernetes/findings/{finding_id}/status
dast:read	List authorised DAST targets.	GET /v1/dast/targets
pentest:read	Read pentest targets and reports.	GET /v1/pentest/targets GET /v1/scans/{scan_id}/pentest-report
pentest:request_target	Request a pentest target. A person approves it.	POST /v1/pentest/targets
teams:read	List teams and their repositories.	GET /v1/teams GET /v1/teams/{team_id}
members:read	List workspace members, including email addresses.	GET /v1/members
audit:read	Read the workspace audit log.	GET /v1/audit-log
reports:generate	Generate PDF reports.	GET /v1/reports/workspace GET /v1/scans/{scan_id}/report
webhooks:read	List webhook subscriptions and deliveries.	GET /v1/webhooks/event-types GET /v1/webhooks GET /v1/webhooks/{webhook_id} GET /v1/webhooks/{webhook_id}/deliveries GET /v1/webhooks/{webhook_id}/deliveries/{delivery_id}
webhooks:manage	Create, change and delete webhook subscriptions.	POST /v1/webhooks PATCH /v1/webhooks/{webhook_id} DELETE /v1/webhooks/{webhook_id} POST /v1/webhooks/{webhook_id}/rotate-secret POST /v1/webhooks/{webhook_id}/test POST /v1/webhooks/{webhook_id}/deliveries/{delivery_id}/redeliver