OAuth Scopes Reference

OAuth scopes are layer 1 of the security model: they define which families of operations your OAuth application is allowed to perform. This page lists every scope and what it grants.

Scopes

Scope	Grants
`read:basic`	Read basic profile, organization, and API discovery info. Required for `GET /oauth/api-info`; see the callout below.
`read:hierarchy`	Read data nodes and site hierarchy.
`write:hierarchy`	Rename, move, or delete data nodes.
`read:bundle`	Read data bundles, their processing status, and input files.
`write:bundle`	Create data bundles and manage their uploads and processing.
`read:poi`	Read points of interest (POIs).
`write:poi`	Create, update, or delete points of interest (POIs).
`read:zone`	Read zones.
`write:zone`	Create, update, or delete zones.
`read:asset`	Read RealityAssets and asset types.
`write:asset`	Create, update, or delete RealityAssets and their metadata.
`search:objects`	Search business objects (assets, POIs, zones) in a twin.
`read:twin`	Read twin and reality plan spaces, bundles, and layouts.
`write:twin`	Create or update twin drafts.
`download:sitefile`	Get a signed download URL for a site file.
`write:sitefile`	Create and upload site files.
`download:scan`	Reserved; does not currently gate any endpoint.
`read:assetlibrary`	Read asset library models and tags.
`write:assetlibrary`	Create, update, or delete asset library models and tags.
`download:assetlibrary`	Get signed download links or thumbnails for an asset library model.
`read:assetsettings`	Read asset settings.
`write:assetsettings`	Reserved; does not currently gate any endpoint.
`read:user`	Read users.
`write:user`	Create, update, or delete users.
`read:invitation`	Read invitations.
`write:invitation`	Create invitations.

What’s next?

Explore the API reference for the exact scope each operation requires.