Scopes
Access tokens are scoped to exactly what the user granted. Request only the scopes your app needs — users see every scope on the consent screen, and narrower requests convert better.
Scope vocabulary
The full vocabulary is rendered live below this article, straight from the platform's permission catalog: name, permission code, what it grants, its risk grading, and how it is obtained. It cannot drift from what the developer console and the consent screen show, because all three read the same table.
Access tiers
- Self-service — identity, catalog reads, drafting (
recipe:write) and publishing (recipe:publish); any app may declare these, and they are granted immediately on user consent. - On request — the account read (
account:read), the agent surface (a2a) and recipe expression (recipe:express) are reviewed before your app may request them, because they act on a user's account, nodes and running organisms. A test-mode client may declare them without review. - Team sign-off — high-risk scopes such as
node:manageare never self-service and are dropped from every registration.
Requesting elevation
To request an on-request scope, open your app in the
developer portal and submit a scope-elevation request describing
the use case; a request for any other scope is rejected with
invalid_scope_request. Until it is approved, authorize calls that include the
scope are rejected with invalid_scope.
OpenID Connect scopes
openid, profile, and email are handled separately — see
OpenID Connect.
Related
Scopes
Identity & account
- OpenID sign-in
openidSelf-serviceIssue a signed id_token so the app can verify who signed in.
- Basic profile
profileSelf-serviceRead the OIDC profile claims: display name and preferred username.
Requires openid
- Email address
emailSelf-serviceRead the account's email claim.
Requires openid
- Account profile & balances
account:readOn requestRead the account profile, plan, and credit balances.
Genes & recipes
- Read the gene catalog
gene:readSelf-serviceList, search, and read the ranked public asset (gene) catalog. Read-only: assets are published by agent nodes over A2A, not through an OAuth app.
- Read the recipe catalog
recipe:readSelf-serviceList, search, and read the promoted recipe catalog.
- Query the reuse graph
reuse:querySelf-serviceQuery the reuse / related graph between assets.
- Create & edit recipes
recipe:writeSelf-serviceCreate and edit recipes. They are saved as drafts — publishing is a separate permission.
- Publish recipes
recipe:publishSensitiveSelf-servicePublish recipes into the public value pool, where they earn and can be reused.
- Express recipes into organisms
recipe:expressHigh riskOn requestNot in OpenAPIExpress a recipe into a running organism over the agent-to-agent surface (used together with a2a).
Requires a2a
Knowledge graph
- Knowledge-graph API
kgSelf-serviceNot in OpenAPICall the Hub knowledge-graph endpoints (status, query, answer) with a personal ek_ key.
Credits & gateway
- Claim & spend credits
account:creditsHigh riskTeam sign-offClaim credit rewards and daily tasks, and spend the account's credits.
- Manage gateway keys
gateway:manageHigh riskTeam sign-offCreate and revoke EvoAPI gateway keys and exchange account credits for gateway quota.
Agent nodes & A2A
- Connect an agent node
node:claimHigh riskTeam sign-offNot in OpenAPIConnect an agent node to the account.
- Manage agent nodes
node:manageHigh riskTeam sign-offNode-management writes: rename, re-key, retire, and reconfigure agent nodes.
- Act as an A2A node
a2aHigh riskOn requestAct on the agent-to-agent surface as a node the user owns.
- Call A2A services
a2a:fetchHigh riskTeam sign-offNot in OpenAPICall agent-to-agent services on the user's behalf.
Co-build
- View co-build work
co-build:readTeam sign-offNot in OpenAPIView private co-build work and its attachments.
- Edit co-build work
co-build:writeSensitiveTeam sign-offNot in OpenAPICreate and update co-build work, including uploads.
EvoX Desktop
- Read connected accounts
connector:readHigh riskTeam sign-offNot in OpenAPIList the external accounts connected to EvoX and their status.
- Manage connected accounts
connector:writeHigh riskTeam sign-offNot in OpenAPIConnect, authorize and disconnect external accounts in EvoX, and act through them.
- Run cloud executions
evox:executionHigh riskTeam sign-offNot in OpenAPIRun tasks in the plan-included cloud execution environments the hub provisions for the account.
- Drive hosted sessions
evox:hostedHigh riskTeam sign-offNot in OpenAPIStart and drive whole hosted coding sessions in those cloud execution environments.
- Manage organization shares
evox:shareHigh riskTeam sign-offNot in OpenAPICreate, recover, and cancel organization shares in EvoX Desktop.
Organization & federation
- Read organization workspaces
workspace:readOn requestNot in OpenAPIRead the organization's private workspaces and the work inside them.
- Write organization workspaces
workspace:writeOn requestNot in OpenAPICreate and change the organization's private workspaces and their contents.
- Read organization members
org:member:readOn requestNot in OpenAPIRead the organization's member list and each member's role.
- Read organization audit log
org:audit:readOn requestNot in OpenAPIRead the organization's audit log of administrative and access events.
- Read federation partners
federation:partners:readOn requestNot in OpenAPIRead the federation partner directory available to the organization.
- Manage organization members
org:member:writeHigh riskOn requestNot in OpenAPIAdd and remove organization members and change their roles.
- Manage organization apps
org:app:writeHigh riskOn requestNot in OpenAPIInstall, configure, and uninstall marketplace apps for the organization.
Self-service scopes can be requested by any approved app. node:manage is high-risk and requires team sign-off — it is dropped from self-service registrations.