---
title: "List available scopes"
method: GET
path: "/oauth-clients/scopes"
tags: ["OAuth Apps"]
---

# List available scopes

`GET /oauth-clients/scopes`

Returns the OAuth scopes the signed-in user is permitted to register on new or updated apps, grouped by category. Use this to populate scope-picker UIs and to validate `allowedScopes` client-side before submitting to `createOAuthApp` / `updateOAuthApp`.

The result is role-aware. Org admins (members of an admin user group) receive every registered scope; everyone else is filtered to exclude admin-only scopes: `org:write`, `org:admin`, `user:invite`, `user:delete`, `usergroup:write`, `team:write`, `config:write`, `crawl:write`, `crawl:delete`.

Each key in the `scopes` map matches the `category` field on the `OAuthScopeInfo` entries it contains. A category may appear with an empty array when every scope it contains is restricted for the caller — treat empty buckets as "no permitted scopes in this group", not as a missing category.

Shares the per-user rate limiter applied to every `/oauth-clients/*` route (default 1000 req/min, `MAX_OAUTH_CLIENT_REQUESTS_PER_MINUTE`).

## Response `200`

List of available scopes

- OAuthScopesGroupedResponse — OAuth scopes available to the signed-in user for app registration, grouped by category label. Category keys are UI labels (e.g. `Identity`, `Knowledge Base`); each maps to a list of scopes in that group. Categories defined in server config may appear with an **empty array** when every scope in that category is restricted for the caller's role (e.g. non–org-admin users never receive admin-only scopes).
  - `scopes` object, required — Map of category display name to scopes in that category

## Other responses

- `401` — Unauthorized — missing/invalid token, or session invalidated (e.g. password change after token issuance)
- `429` — Rate limit exceeded for OAuth client management routes

---

[API](https://skmtc.net/pipeshub-ai/apis/pipeshub-api.md) · [All operations](https://skmtc.net/pipeshub-ai/apis/pipeshub-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/pipeshub-ai/pipeshub-api/versions/abd27cfefc73/schema)