Scopes

A token's scopes decide what it may do. You pick them when you create a personal access token in Anikeen ID, or an app requests them in its Anikeen ID login.

General scopes

Scope	Anikeen ID label	Console API access
user	User (full access)	everything (read and write)
user:read	User (read-only)	GET requests only
products:read	Products (read-only)	GET requests of the product APIs
console-<family> beta	e.g. "Create and manage containers"	one product family: read, change, order
console-<family>:read beta	e.g. "Read your containers"	one product family, GET requests only

Other scopes (billing, invoices, …) do not grant access to the Console API.

A request without a fitting scope answers 403:

{
  "message": "The access token needs the scope \"user\" or \"console-zones\".",
  "error": "missing_scope",
  "scope": "console-zones",
  "scopes": ["user", "console-zones"]
}

Scopes per product family beta

console-<family> reads, changes and orders the family; console-<family>:read only reads it (GET).

Scope (+ :read)	Families (catalog/order family)	Endpoints
console-servers	server, floatingIp	Servers
console-containers	container	Containers
console-domains	domain	Domains (incl. contacts)
console-zones	zone	DNS zones
console-hosting	hosting	Web hosting
console-load-balancers	-	Load balancers
console-object-storage	objectStorage	catalog and orders only

• The core endpoints - catalog, orders (reading) and GET /app-team - accept any console-* scope.
• An order needs the full scope of every item's family (403, error: missing_scope, scope names the missing one).
• The catalog lists only the families your token's scopes cover (:read is enough).
• Personal access tokens can carry these scopes too - fine-grained tokens of your own. They act as you, without an app team.
• Tickets have no scope and are not reachable with app tokens.

In the PHP SDKs the scopes are constants on Anikeen\Id\Enums\Scope (Scope::CONSOLE_SERVERS, Scope::CONSOLE_CONTAINERS, …).

Reseller scopes

The reseller API has its own scopes. A full scope includes reading its area; user, user:read and * never count.

Scope	Allows
reseller-customers:read	every GET of the reseller API
reseller-customers	plus creating/changing/suspending customers, invitations, removing logins
reseller-grants	reading and writing grants; also needed for an order item with grant
reseller-orders	placing orders; reading catalog, discounts and orders