---
title: "Scopes"
description: "The scopes of the HTTP API available by default: content:read, content:write and admin."
canonical: scopes.html
---

<a id="usage-scopes"></a>

<a id="scopes"></a>

# Scopes

An app can call an action only if it has all scopes of the action. Otherwise,
the request fails with status `403`. These scopes are available by default:

| Scope | Access | Requirement of the backend user |
| --- | --- | --- |
| `content:read` | Read pages, records and files. | Access to one of the backend modules Content \> Layout, Content \> Records or Media. |
| `content:write` | Create, change and delete pages, records and files. | The requirement of `content:read`, and modify permission for a table or file permissions and access to Media. Administrators always have this scope. |
| `admin` | Do tasks for administrators: read and write records of tables for administrators (`adminOnly`), for example backend users. Generate secrets and static tokens for apps. | Only administrators. Records also need `content:read` or `content:write`. |

Extensions can add more scopes, see [Custom scopes](../developer/scopes.md#developer-scopes).

<a id="usage-scopes-granted"></a>

<a id="granted-scopes"></a>

## Granted scopes

The access of an app is never more than the access of its backend user. It is
also never more than an administrator selected.

```diagram
flow canvas=940
  columns 1,1
  gap 120,16
title "An app gets the scopes that all sources allow"
description "The granted scopes are the scopes that the app requests, for OAuth apps, that an administrator selected in the app record, and that the backend user can have."

requested "Requested by the app"
  at 0,0
  body "OAuth apps only"
selected "Selected in the app record"
  at 0,1
  body "By an administrator"
available "Available to the backend user"
  at 0,2
  body "The user of the app, or the user who approves"
granted "Granted scopes"
  at 1,0
  rows 3
  emphasis
  body "The scopes that are in all sources"

requested -> granted
selected -> granted
available -> granted
```

*An app gets only the scopes that are in all sources. A static token app does not request scopes.*

On each request, TYPO3 compares the scopes of a token with the current
configuration of the app. If you remove a scope from an app, this applies
immediately to its existing tokens. In an action, the permissions of the backend
user also apply.