Scopes
Scopes gate what a general API key (gl_api_…) can read. They apply only to the read API — ingest tokens have no scopes (their access is fixed by the source they are bound to).
A key carries an explicit list of scopes, chosen when it is minted. Each read endpoint requires exactly one scope; if the key lacks it the request returns 403 (the key is valid, just not authorized for that resource):
{ "error": { "code": "forbidden", "message": "This API key is missing the required scope: issues:read." } }All scopes are read-only today.
Available scopes
| Scope | Enum | Grants |
|---|---|---|
apps:read | APPS_READ | Read applications in the key's organization |
sources:read | SOURCES_READ | Read log sources in the key's organization |
issues:read | ISSUES_READ | Read issues in the key's organization |
signals:read | SIGNALS_READ | Read signals (events) in the key's organization |
deployments:read | DEPLOYMENTS_READ | Read deployments in the key's organization |
Endpoint → required scope
| Endpoint | Required scope |
|---|---|
GET /api/v1/apps | apps:read |
GET /api/v1/apps/{id} | apps:read |
GET /api/v1/apps/{id}/sources | sources:read |
GET /api/v1/issues | issues:read |
GET /api/v1/issues/{id} | issues:read |
GET /api/v1/signals | signals:read |
GET /api/v1/deployments | deployments:read |
Grant a key only the scopes it needs. To read issues and the apps they belong to, for example, mint a key with both issues:read and apps:read.
See also: authentication.md · errors.md.