Scopes define what an API App is allowed to do when it accesses the 1Password SaaS Manager API. Aligned with information security best-practice, we strongly recommend choosing just the scopes that you need to access through the API.
When you create an API App you must select which scopes will be available to clients connecting with the app credentials.
If you use the Authorization Code flow, your application can request one or more of these scopes, and the user will be asked to consent to authorizing your application to access these sorts of SaaS Manager data.
| Scope | Description |
|---|---|
| Apps.Read | Read-only access to applications |
| Apps.Users.Read | Read-only access to application users |
| Assets.Read | Read-only access to devices |
| Assets.Write | Write access to devices |
| AuditLog.Read | Read-only access to the SaaS Manager audit log |
| Contracts.Read | Read-only access to contracts |
| Contracts.Write | Write access to contracts |
| People.Read | Read-only access to people |
| People.Write | Write access to people |
| Users.Read | Read-only access to users with access to SaaS Manager |
| Workflows.Read | Read-only access to workflow definitions |
| Workflows.Runs.Read | Read-only access to workflow runs |
| Workflows.Runs.Execute | Execute workflow run actions |
| Workflows.Runs.ReadSecrets | Read workflow run secrets |
| offline_access | Returns a refresh token, as well as an access token (as part of the Authorization Code flow) |
By accessing or using 1Password Developer Tools, you agree to the API and SDK Terms of Service.
Was this article helpful?
Glad to hear it! If you have anything you'd like to add, feel free to contact us.
Sorry to hear that. Please contact us if you'd like to provide more details.