Editing SimTX API/Permissions (section)

== Scopes ==
A credential's scope is a list of permission identifiers, chosen during [[SimTX API/Device login|device login]] or when creating a personal credential. A scope never adds permissions. Each request is authorised with the permissions that are both in the credential's scope and held by the account.

* An empty scope at device login means every permission the account held when the user approved the login.
* Unknown identifiers are rejected with <code>400 scope_invalid</code>. Numeric capabilities are accepted in scopes if they are well formed and within range.
* An endpoint that needs a permission the scope lacks answers <code>403 scope_required</code> with <code>fieldErrors.scope</code>.
* Request the minimum. A transmitter needs <code>game.transmit</code>; a station editor <code>station.manage</code>; a catalog publishing tool <code>catalog.publish</code>; an ad-hoc receiver needs no credential at all.