OAuth Scopes Reference

OAuth scopes are layer 1 of the security model: they define which families of operations your OAuth application is allowed to perform. This page lists every scope and what it grants.

---

Scopes

Scope	Grants
read:basic	Read basic profile, organization, and API discovery info; also required for GET /v1/roles and GET /v1/plugins. Required for GET /oauth/api-info; see the callout below.
mcp:access	Required to use the RealityConnect MCP server; does not gate any REST endpoint directly.
read:hierarchy	Read data nodes and site hierarchy.
write:hierarchy	Create, rename, move, or delete data nodes, and manage node thumbnails.
read:bundle	Read data bundles, their processing status, and input files.
write:bundle	Create data bundles and manage their uploads and processing.
read:poi	Read points of interest (POIs).
write:poi	Create, update, or delete points of interest (POIs).
read:zone	Read zones.
write:zone	Create, update, or delete zones.
read:asset	Read RealityAssets.
write:asset	Create, update, or delete RealityAssets and their metadata.
search:objects	Search business objects (assets, POIs, zones) in a twin.
read:twin	Read twin and reality plan spaces, bundles, and layouts.
write:twin	Create twin drafts.
embed:twin	Create and refresh embed sessions for a twin.
download:sitefile	Get a signed download URL for a site file.
write:sitefile	Create and upload site files.
download:scan	Reserved; does not currently gate any endpoint.
read:assetlibrary	Read asset library models and tags.
write:assetlibrary	Create, update, or delete asset library models and tags.
download:assetlibrary	Get signed download links or thumbnails for an asset library model.
read:assetsettings	Read asset settings.
write:assetsettings	Reserved; does not currently gate any endpoint.
read:user	Read users.
write:user	Create, update, or delete users.
read:invitation	Read invitations.
write:invitation	Create invitations.

Tip

Almost every integration needs read:basic, even if it never calls an operation that lists it. GET /oauth/api-info (the call nearly every guide on this site uses to resolve your regional API URL and organization ID) requires read:basic. Grant it by default; an application without it 403s on the very first call after getting a token.

What’s next?

• Explore the API reference for the exact scope each operation requires.