---
title: "Update Token Scopes"
method: PATCH
path: "/api/mcp-tokens/{token_id}/scopes"
tags: ["earmarkIQ Context"]
---

# Update Token Scopes

`PATCH /api/mcp-tokens/{token_id}/scopes`

## Request

- Base URL: `https://api.earmarkiq.app` (the document declares no server; this is the origin it was published from)
- URL: `https://api.earmarkiq.app/api/mcp-tokens/{token_id}/scopes`
- Auth: HTTP bearer

Narrow (or re-grant) what one connection can read, without severing it.

This is what makes a scope independently revocable: the user can take
away transactions and keep subscriptions, rather than having to kill
the whole connection. Applies on the connection's very next call —
tools read the scope from the token row, not from the bearer claims.

Narrowing a legacy context:read grant to an explicit set is the
supported way for an existing user to move off all-access.

## Path parameters

- `token_id` string, uuid, required

## Request body

- ScopeUpdate
  - `scopes` string[], required

## Response `200`

Successful Response

- TokenItem
  - `id` string, required
  - `kind` string, required
  - `name` string, nullable, required
  - `client_id` string, nullable, required
  - `created_at` string, required
  - `connected_at` string, required
  - `last_used_at` string, nullable, required
  - `revoked` boolean, required
  - `expires_at` string, nullable, required
  - `scopes` string[], required
  - `covers` string[], required
  - `legacy_full_access` boolean, required

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/earmarkiq/apis/earmark-api.md) · [All operations](https://skmtc.dev/earmarkiq/apis/earmark-api/llms.txt) · [OpenAPI document](https://skmtc.dev/earmarkiq/apis/earmark-api/revisions/4a2c41907105?raw)