---
title: "List the scope catalog"
method: GET
path: "/v1/api-keys/scopes"
tags: ["API Keys"]
---

# List the scope catalog

`GET /v1/api-keys/scopes`

Every scope an API key may hold, nested by resource with the actions a route actually requires. Static and cacheable. For what an omitted `scopes` mints for YOUR credential see `GET /v1/auth/whoami` → `credential.defaultScopes`; the most you may mint is `credential.scopes`. Requires no scope.

## Response `200`

The scope catalog

- ScopeCatalog
  - `resources` object[], required
    - `key` 'runs' | 'resources' | 'wallet' | 'topups' | 'controls' | 'api_keys', required
    - `label` string, required
    - `description` string, required
    - `actions` object[], required — ONLY the actions some route requires for this resource — `{resource}:{action}` for any other pair is not a scope and is rejected at creation.
      - `key` 'read' | 'create' | 'update' | 'delete', required
      - `description` string, required

## Other responses

- `400` — Bad request — input failed validation
- `401` — Unauthorized — missing or invalid credentials
- `403` — Forbidden — caller has no workspace or no access
- `500` — Internal server error

## Changes

- **2026-09-25** `5abada71ceae` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/monid/apis/monid-api/changes/v1/api-keys/scopes/get.md)

---

[API](https://skmtc.dev/monid/apis/monid-api.md) · [All operations](https://skmtc.dev/monid/apis/monid-api/llms.txt) · [OpenAPI document](https://skmtc.dev/monid/apis/monid-api/revisions/5abada71ceae?raw)