Every scope this deployment recognises
GET
/api/tokens/capabilities
const url = 'https://app.dycrypt.com/o/acme/api/tokens/capabilities';const options = {method: 'GET', headers: {cookie: 'JSESSIONID=<JSESSIONID>'}};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request GET \ --url https://app.dycrypt.com/o/acme/api/tokens/capabilities \ --cookie JSESSIONID=<JSESSIONID>A capability with no write half is derived data. A scope not in this list is refused at creation rather than stored and silently ignored — a token claiming a permission nobody enforces is a lie waiting to be believed.
Authorizations
Section titled “Authorizations”Responses
Section titled “Responses”The catalogue.
Media typeapplication/json
Array<object>
object
key
string
label
string
description
string
read
string
write
Null where the capability is derived data.
string | null
Examplegenerated
[ { "key": "example", "label": "example", "description": "example", "read": "example", "write": "example" }]No credential, or one that no longer resolves — revoked, expired, deleted. Replace it.
Media typeapplication/json
Every failure in this API has this shape and no other.
object
error
required
string
Example
{ "error": "this token does not have licenses:write"}Not available to API tokens, or the caller is not an organisation administrator.
Media typeapplication/json
Every failure in this API has this shape and no other.
object
error
required
string
Example
{ "error": "this token does not have licenses:write"}