mirror of
https://github.com/mastodon/documentation
synced 2025-04-11 22:56:17 +02:00
ffbe66a389
* fix relrefs around trends and related entities * revert moving caption-links to middle of page * hide empty menu in table of contents * clarify edit notifs are only for boosted statuses * following/followers no longer need auth * fix typo * specify cooldown period for account Move * use the correct cooldown * add missing parameters to accounts/id/statuses * link to account_statuses_filter.rb * fix typo (#1072) * fix typo (#1073) * fix link to http sig spec (#1067) * simply HTTP request examples in api methods docs * add missing client_secret to oauth/token (#1062) * Add any, all, none to hashtag timeline * minor formatting changes * Update signature requirements and advice * fix public key -> private key * clarify use of RSA with SHA256 * Add note about saving your profile after adding rel-me link * v2 filters api * comment out params that shouldn't be used in v2 filter api * admin trends * remove old todo * canonical email blocks + scheduled statuses * remove under-construction warnings from finished pages * verify api method params with source code * fix typo (#1088) * fix broken caption-links (#1100) * fix formatting of entities (#1094) * Remove keybase section from user guide (#1093) * fix typos (#1092) * Verify limits are accurate (#1086) * add mention of iframe limitation (#1084) * Add CORS header to WEB_DOMAIN example (#1083) * Fix typo (#1081) * pin http sigs spec at draft 8 * Revert "pin http sigs spec at draft 8" This reverts commit 9fd5f7032b69b29e77599dd62adfe8d2f5cd4f20. * add case sensitivity warning to 4.0 roles * Add url length note to bio (#1087) * remove follow scope from examples (#1103) * clarify usage of update_credentials to update profile fields * add noindex to Account entitity * remove required hint from technically not required property
138 lines
4.8 KiB
Markdown
138 lines
4.8 KiB
Markdown
---
|
||
title: OAuth Scopes
|
||
description: Defining what you have permission to do with the API
|
||
menu:
|
||
docs:
|
||
weight: 20
|
||
parent: api
|
||
---
|
||
|
||
## OAuth Scopes
|
||
|
||
The API is divided up into access scopes. The scopes are hierarchical, i.e. if you have access to `read`, you automatically have access to `read:accounts`. **It is recommended that you request as little as possible for your application.**
|
||
|
||
Multiple scopes can be requested at the same time: During app creation with the `scopes` param, and during the authorization phase with the `scope` query param (space-separate the scopes).
|
||
|
||
{{< hint style="info" >}}
|
||
Mind the `scope` vs `scopes` difference. This is because `scope` is a standard OAuth parameter name, so it is used in the OAuth methods. Mastodon’s own REST API uses the more appropriate `scopes`.
|
||
{{< /hint >}}
|
||
|
||
If you do not specify a `scope` in your authorization request, or a `scopes` in your app creation request, the resulting access token / app will default to `read` access.
|
||
|
||
The set of scopes saved during app creation must include all the scopes that you will request in the authorization request, otherwise authorization will fail.
|
||
|
||
### Version history {#versions}
|
||
|
||
- 0.9.0 - read, write, follow
|
||
- 2.4.0 - push
|
||
- 2.4.3 - granular scopes [#7929](https://github.com/mastodon/mastodon/pull/7929)
|
||
- 2.6.0 - read:reports deprecated (unused stub) [#8736/adcf23f](https://github.com/mastodon/mastodon/pull/8736/commits/adcf23f1d00c8ff6877ca2ee2af258f326ae4e1f)
|
||
- 2.6.0 - write:conversations added [#9009](https://github.com/mastodon/mastodon/pull/9009)
|
||
- 2.9.1 - Admin scopes added [#9387](https://github.com/mastodon/mastodon/pull/9387)
|
||
- 3.1.0 - Bookmark scopes added [#7107](https://github.com/mastodon/mastodon/pull/7107)
|
||
- 4.1.0 - Added admin scopes for blocks and allows [#20918](https://github.com/mastodon/mastodon/pull/20918)
|
||
|
||
## List of scopes
|
||
|
||
### `read` {#read}
|
||
|
||
Grants access to read data. Requesting `read` will also grant child scopes shown in the left column of the table below.
|
||
|
||
* `read`
|
||
* `read:accounts`
|
||
* `read:blocks`
|
||
* `read:bookmarks`
|
||
* `read:favourites`
|
||
* `read:filters`
|
||
* `read:follows`
|
||
* `read:lists`
|
||
* `read:mutes`
|
||
* `read:notifications`
|
||
* `read:search`
|
||
* `read:statuses`
|
||
|
||
### `write` {#write}
|
||
|
||
Grants access to write data. Requesting `write` will also grant child scopes shown in the right column of the table below.
|
||
|
||
* `write`
|
||
* `write:accounts`
|
||
* `write:blocks`
|
||
* `write:bookmarks`
|
||
* `write:conversations`
|
||
* `write:favourites`
|
||
* `write:filters`
|
||
* `write:follows`
|
||
* `write:lists`
|
||
* `write:media`
|
||
* `write:mutes`
|
||
* `write:notifications`
|
||
* `write:reports`
|
||
* `write:statuses`
|
||
|
||
### `follow` {#follow}
|
||
|
||
{{< hint style="danger" >}}
|
||
**Deprecated**\
|
||
This scope has been deprecated in 3.5.0 and newer. You should instead request the child scopes individually, or request read/write permission as needed.
|
||
{{< /hint >}}
|
||
|
||
Grants access to manage relationships. Requesting `follow` will also grant the following child scopes, shown in bold in the table:
|
||
|
||
* `read:blocks`, `write:blocks`
|
||
* `read:follows`, `write:follows`
|
||
* `read:mutes`, `write:mutes`
|
||
|
||
### `push` {#push}
|
||
|
||
Grants access to [Web Push API subscriptions.]({{< relref "methods/push" >}}) Added in Mastodon 2.4.0.
|
||
|
||
### Admin scopes {#admin}
|
||
|
||
Used for moderation API. Added in Mastodon 2.9.1. The following granular scopes are available (note that there is no singular `admin` scope):
|
||
|
||
* `admin:read`
|
||
* `admin:read:accounts`
|
||
* `admin:read:reports`
|
||
* `admin:read:domain_allows`
|
||
* `admin:read:domain_blocks`
|
||
* `admin:read:ip_blocks`
|
||
* `admin:read:email_domain_blocks`
|
||
* `admin:read:canonical_email_blocks`
|
||
* `admin:write`
|
||
* `admin:write:accounts`
|
||
* `admin:write:reports`
|
||
* `admin:write:domain_allows`
|
||
* `admin:write:domain_blocks`
|
||
* `admin:write:ip_blocks`
|
||
* `admin:write:email_domain_blocks`
|
||
* `admin:write:canonical_email_blocks`
|
||
|
||
## Granular scopes {#granular}
|
||
|
||
| read | write |
|
||
| :--- | :--- |
|
||
| read:accounts | write:accounts |
|
||
| **read:blocks** | **write:blocks** |
|
||
| read:bookmarks | write:bookmarks |
|
||
| | write:conversations |
|
||
| read:favourites | write:favourites |
|
||
| read:filters | write:filters |
|
||
| **read:follows** | **write:follows** |
|
||
| read:lists | write:lists |
|
||
| | write:media |
|
||
| **read:mutes** | **write:mutes** |
|
||
| read:notifications | write:notifications |
|
||
| | write:reports |
|
||
| read:search | |
|
||
| read:statuses | write:statuses |
|
||
|
||
| admin:read | admin:write |
|
||
| :--- | :--- |
|
||
| admin:read:accounts | admin:write:accounts |
|
||
| admin:read:reports | admin:write:reports |
|
||
| admin:read:domain_allows | admin:write:domain_allows |
|
||
| admin:read:domain_blocks | admin:write:domain_blocks |
|
||
| admin:read:ip_blocks | admin:write:ip_blocks |
|
||
| admin:read:email_domain_blocks | admin:write:email_domain_blocks |
|
||
| admin:read:canonical_email_blocks | admin:write:canonical_email_blocks | |