Scopes
An agent client can hold the scopes in this table. MapleID reads the table from its database, so it is always current.
| Scope | Resource in aud | What it allows |
|---|---|---|
email | none | See your email address |
mapleav.agent.scans.read | mapleav-agent | See the scans and reports of one organization |
mapleav.agent.scans.write | mapleav-agent | Scan files for one organization |
maplefile.agent.activity.read | maplefile-agent | See counts of your collections, files and shares in one organization |
maplefile.agent.ping | maplefile-agent | Check the connection to MapleFile for one organization |
maplefile.agent.storage.read | maplefile-agent | See the storage use and limits of one organization |
mapleid.agent.billing.read | mapleid-agent | Get the link to the billing page of the organization |
mapleid.agent.mcp | mapleid-agent | Use MapleID tools for one organization |
mapleid.agent.members.read | mapleid-agent | See the members of the organization |
mapleid.agent.members.write | mapleid-agent | Remove members of the organization |
mapleid.agent.organization.write | mapleid-agent | Rename the organization |
mapleid.organizations.invitations.write | mapleid-invitations | Invite people to organizations you own or manage |
maplescaffold.agent.ping | maplescaffold-agent | Check the connection to MapleScaffold for one organization |
offline_access | none | Stay signed in when you are not using the app |
openid | none | Sign you in with your MapleID account |
profile | none | See your name and whether you allow tracking across apps |
Rules
- Every sign-in needs
openid. The authorize endpoint refuses a request without it. - Ask for
offline_accessto get a refresh token. mapleid.agent.mcplets the client call/mcp. Each tool also needs its own scope.- An agent client never gets
mapleid.organizations.read, because that claim lists every organization of the person. It never gets the media scopes or a service scope. - A token has every resource of its scopes in aud. So a token for a Maple app also works on MapleID when it has a MapleID agent scope. Ask for the scopes that you need only.