Scopes
An app can call an action only if it has all scopes of the action. Otherwise,
the request fails with status 403. These scopes are available by default:
content:readcontent:writecontent:read, and modify permission for a
table or file permissions and access to Media.
Administrators always have this scope.adminadminOnly), for example backend users. Generate
secrets and static tokens for apps.content:read or
content:write.| Scope | Access | Requirement of the backend user |
|---|---|---|
content:read | Read pages, records and files. | Access to one of the backend modules Content > Layout, Content > Records or Media. |
content:write | Create, change and delete pages, records and files. | The requirement of content:read, and modify permission for a
table or file permissions and access to Media.
Administrators always have this scope. |
admin | Do tasks for administrators: read and write records of tables for
administrators (adminOnly), for example backend users. Generate
secrets and static tokens for apps. | Only administrators. Records also need content:read or
content:write. |
Extensions can add more scopes, see Custom scopes.
Granted scopes#
The access of an app is never more than the access of its backend user. It is also never more than an administrator selected.
On each request, TYPO3 compares the scopes of a token with the current configuration of the app. If you remove a scope from an app, this applies immediately to its existing tokens. In an action, the permissions of the backend user also apply.