---
title: "List Scope Catalog"
method: GET
path: "/api-keys/scopes"
tags: ["API Keys"]
---

# List Scope Catalog

`GET /api-keys/scopes`

## Request

- Base URL: `https://be.graph8.com/api/v1`
- URL: `https://be.graph8.com/api/v1/api-keys/scopes`
- Auth: HTTP bearer

The scope vocabulary a key may be granted, so an automation can decide
what to ask for without reading source. Read-only, org-independent.

## Headers

- `X-Target-Org-Id` string, nullable
- `Authorization` string, nullable

## Response `200`

Successful Response

- ApiResponseScopeCatalogResponse
  - `data` ScopeCatalogResponse, required
    - `resources` ScopeCatalogResource[], required
      - `resource` string, required
      - `scopes` ScopeCatalogEntry[], required
        - `scope` string, required
        - `action` string, required
        - `default` boolean, required
        - `strict` boolean, required
    - `default_scopes` string[], required
    - `read_only_scopes` string[]: The read-only preset: every ':read' scope in the grantable vocabulary. Minting a key with exactly these produces a credential that can look but never write, run, launch or delete — the 'read-only key' standard option (issue #21188).
    - `full_access_scopes` string[]: The full-access preset: every grantable scope except the explicit-only strict ones. `default_scopes` is read-only, so this is what a creator picks to opt in to write/run/launch/delete.
    - `total` integer, required
  - `pagination` PaginationMeta
    - `page` integer, required: Current page number (1-indexed)
    - `limit` integer, required: Items per page
    - `total` integer, required: Total number of items
    - `has_next` boolean, required: Whether there are more pages
    - `next_cursor` string, nullable: Opaque cursor for the next page; null when there are no more items. Pass it back as the `cursor` query param to fetch the following page without computing page numbers.
    - `total_available` integer, nullable: Search endpoints only: how many records really match, when known. Can be larger than `total`, which is capped at the 10,000 results that can be paged. For company search this is a distinct-company estimate. Null when unknown; absent outside search.
    - `total_is_lower_bound` boolean, nullable: Search endpoints only: true when more records match than `total` shows (the result set is larger than the 10,000 results that can be paged). Absent outside search.
    - `notes` string[], nullable: Search endpoints only: plain-language notes about the result, e.g. that more records match than can be paged, or that a reversed `between` range was put in order.

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/graph8/apis/graph8-developer-api.md) · [All operations](https://skmtc.dev/graph8/apis/graph8-developer-api/llms.txt) · [OpenAPI document](https://skmtc.dev/graph8/apis/graph8-developer-api/revisions/2e7cfa0ca921?raw)