Permissions - FaWCOS Developers

A key can only call the endpoints its scopes allow. Give each key the smallest set it needs. A request that needs a scope the key does not hold is refused with 403 insufficient_scope, and the response names the scope that was missing:

{
  "error": {
    "code": "insufficient_scope",
    "message": "This API key does not have the attestations:read scope",
    "details": { "required": "attestations:read" }
  }
}

Scopes

Scopes follow the pattern <resource>:<action>.

Scope	Allows
`consents:request`	Ask a farmer for consent to share data with your organisation.
`consents:read`	Read the status of consent requests and consents addressed to you.
`attestations:read`	Read attestations issued to you under an active consent.

You can assign all three scopes to keys now. They take effect as the consent and attestation endpoints are released. The Changelog says when.

Which scope each endpoint needs

Endpoint	Scope
`GET /v1/relying-party/me`	None. Any valid key.

New endpoints are added to this table as they are released.