Start here · v1

Scopes and company permissions

An OAuth scope is a ceiling on what a client may request. It does not grant company membership or replace a user’s existing permissions.

Scope	Client capability	Additional authority
`orchesphere.read`	Read assigned companies, permitted connections, portals, tasks and saved jobs.	Current company membership and the relevant portal/service rights still apply.
`orchesphere.jobs`	Create or update permitted tasks; request and cancel authorized verification jobs.	Current task creation/edit rights, service verification grants and job requester/cancellation rights. Task review alone does not grant editing.
`orchesphere.manage`	Configure connections and manage service permissions where allowed.	Current service configure rights, including delegated grants; service-permission changes require the designated global access administrator.
`offline_access`	Receive a rotating refresh token for the consented resource.	Keeps an existing grant usable; creates no company access or additional operation rights.

Always choose an assigned workspace

Call GET /v1/workspaces first. Every company operation includes the workspace ID in its path. The server checks the current user against that company, then enforces portal membership, service rights and production/sandbox rules.

Request the smallest useful scope set

A reporting client needs orchesphere.read. A task or verification workflow additionally needs orchesphere.jobs. Request orchesphere.manage only for an application that actually configures connections and whose users already have that authority.

orchesphere.admin is reserved for the existing internal platform administration flow. Registered developer applications cannot request it, and the REST API has no global-role mutation endpoint.

Access changes take effect

Removed company access, revoked application/client grants and invalidated account security prevent later calls. Scope approval does not freeze a user’s old access. Company administrators do not bypass provider authorization, and a configured connection does not prove live access.

Service rights

read, verify, configure, jobs_read_all, jobs_cancel_all

Exact environment rights override the all-environments default. Empty actions deny access.
Nonempty service grants require read; jobs_cancel_all also requires jobs_read_all.
Company viewers receive read-only rights. Scope does not create membership or service/portal/task authority.
Service-permission writes require designated global access-administrator authority.