Scopes

Scopes are the atomic permissions in S-Launch. Each one grants access to a specific set of features or API endpoints — for example, store:read lets a principal view assets, while forms:submit lets them submit forms and upload files.

Every action in the platform is gated by one or more scopes. A principal can hold scopes directly, through a role (scope set), or via a group.

The admin scope

admin is a special scope that grants access to everything, without needing other scopes alongside it. There is no separate admin account type — an internal user becomes an admin simply by being assigned this scope.

WARNING

Assign admin sparingly. It grants unrestricted access to all features, settings, and data.

Full catalogue

This page explains the concept. For the complete, authoritative list of every scope and the exact endpoints each one grants, see the API Scopes reference.

See also

• Roles (Scope Sets) — bundle scopes into reusable roles.
• Scopes catalogue — every scope and what it grants.