Scopes¶

The current external API divides authorization by domain and read/write intent.

Scope	Typical SDK methods
`organization:read`	`Organizations.GetAsync`
`projects:read`	project reads, members, labels, tags
`projects:write`	project create/update/delete
`boards:read`	board listing
`boards:write`	board create/update/delete/reorder
`tickets:read`	ticket list/read
`tickets:write`	ticket create/update/delete/move/reorder
`comments:write`	ticket comments
`analytics:read`	project analytics
`documents:read`	document list/read
`documents:write`	document create/update/delete
`document_comments:write`	document comments
`notifications:write`	organization notifications
`*`	all external operations within the credential organization

The same values are available as constants on OkatanaScopes, with OkatanaScopes.Known for the non-wildcard scope set.

Use the minimum set required by each integration. EndpointCatalog.All contains the scope associated with every typed SDK operation and can be used by internal tooling to audit required permissions.

foreach (var endpoint in EndpointCatalog.All.Where(x => x.Service == "Tickets"))
    Console.WriteLine($"{endpoint.MethodName}: {endpoint.Scope}");

var readScopes = new[]
{
    OkatanaScopes.OrganizationRead,
    OkatanaScopes.ProjectsRead,
    OkatanaScopes.TicketsRead
};