Scopes
Available permission scopes for TournamentSuite API keys and OAuth 2 access tokens.
Scopes define which operations an API key or access token is permitted to perform. Assign the minimum set of scopes required for your integration.
Tournament scopes
| Scope | Description |
|---|---|
read:tournaments | List and retrieve tournaments, stages, and brackets |
manage:tournaments | Create, update, and delete tournaments |
read:participants | List and retrieve participants |
manage:participants | Register, update, and remove participants |
read:matches | Retrieve match details, schedules, and results |
manage:matches | Report scores, confirm results, and resolve disputes |
Circuit scopes
| Scope | Description |
|---|---|
read:circuits | List and retrieve circuits, standings, and seasons |
manage:circuits | Create and manage circuits and seasons |
Webhook scopes
| Scope | Description |
|---|---|
read:webhooks | List and inspect webhook subscriptions |
manage:webhooks | Create, update, and delete webhook subscriptions |
Analytics scopes
| Scope | Description |
|---|---|
read:analytics | Access tournament and participant analytics data |
User scopes
| Scope | Description |
|---|---|
read:users | Read public user profile information |
Using scopes in OAuth 2
Pass a space-separated list of scopes when requesting an access token:
curl -X POST "$OIDC_ISSUER/protocol/openid-connect/token" \
-d "grant_type=client_credentials" \
-d "client_id=$CLIENT_ID" \
-d "client_secret=$CLIENT_SECRET" \
-d "scope=read:tournaments manage:matches"The token returned will be limited to the scopes you requested, even if your client is authorized for more.
Scope minimization
It is good practice to grant only the scopes an API key actually uses. For example, a reporting dashboard that only reads data should use read:tournaments read:participants read:matches — not manage:*.
If a key is ever compromised, a narrow scope set limits what an attacker can do with it.