---
title: "List available OAuth scopes"
method: GET
path: "/api/v1/sso/scopes"
tags: ["SSO - Scopes"]
---

# List available OAuth scopes

`GET /api/v1/sso/scopes`

**Rate limit:** 60 requests per 60 seconds. This is the **default shared quota** — it is shared with every other endpoint that has no dedicated limit, so requests across those endpoints all draw from the same budget.

---

Returns the public catalog of OAuth scopes that can be requested when creating or updating an application. Scopes are served from an in-memory cache that is refreshed periodically from the upstream sts-metadata-api. Use this endpoint to render scope pickers and to validate scope ids client-side before calling create/update.

## Headers

- `x-request-id` string, uuid, required
- `x-api-key` string, password, required
- `x-user-key` string, password, required

## Response `200`

Successfully retrieved the list of supported scopes.

- GetScopesResponse
  - `scopes` ScopeResponseItem[] — Public catalog of OAuth scopes available for application registration.
    - `scopeId` integer — Scope identifier.
    - `scopeName` string — Machine-readable scope name (e.g. `etoro-public:sso-applications:read`).
    - `description` string — Human-readable description of what the scope grants.

## Other responses

- `401` — Missing or invalid STS access token.
- `429` — Too Many Requests — the shared rate limit (60 requests / 60s) was exceeded.

---

[API](https://skmtc.net/etoro/apis/etoro-api.md) · [All operations](https://skmtc.net/etoro/apis/etoro-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/etoro/etoro-api/revisions/69c1fb266c35/schema)