Scopes
The Chat API is a resource at the Identity Server. Its identifier is https://chat.centralcodestation.com/api and its audience is chat-api. Clients request scopes with resource set to the identifier; see Identity and tokens.
A scope grants access to the API. What a user may do inside it comes from their Chat permissions in the tenant application. A machine client has no roles, so its scopes carry the permissions.
User scope
Section titled “User scope”| Scope | Granted to | Allows |
|---|---|---|
chat:access | User-facing clients (web app, mobile app) | Call Chat as the signed-in user. What the user may do comes from their Chat permissions in the tenant application. |
Machine scopes
Section titled “Machine scopes”A machine client is a confidential client with the client_credentials grant, on one of your tenant applications. It works only in its own tenant and application. See Machine scopes.
| Scope | Chat permissions it carries |
|---|---|
chat:sync | conversations.create, conversations.read, conversations.update, groups.create, groups.manage, channels.create, channels.manage, messages.send, messages.read, users.lookup |
chat:conversations.read | conversations.read, messages.read |
chat:conversations.manage | conversations.create, conversations.update |
chat:groups.manage | groups.create, groups.manage |
chat:channels.manage | channels.create, channels.manage |
chat:messages.send | messages.send |
chat:users.lookup | users.lookup |
Request chat:sync for everything above, or only the granular scopes your backend needs. Each must be granted to the client on the Chat API resource, or the token request fails with invalid_scope.
Never for machines
Section titled “Never for machines”Whatever scopes a machine client holds, it never gets these permissions:
messages.delete: Moderate messages: delete and edit other members' messages. Never granted to machines.administration.read: Open Chat Administration and read its data. Never granted to machines.administration.manage: Change Chat Administration: role permissions, settings, moderation. Never granted to machines.users.lookup.directory: Search the whole tenant directory at the Identity Server. Never granted to machines.
Reactions, read state, typing, the realtime token and push devices are user-only routes. A machine client calling them is refused. See Errors.