specification: API Commons OAuth Scopes
specificationVersion: '0.1'
provider: Contensis
providerId: contensis
generated: '2026-09-06'
method: searched
docs: https://www.contensis.com/help-and-docs/apis/management-http/security/scopes
source: >-
  The published scopes reference for the Contensis HTTP Management API (page last updated
  24 September 2024), cross-read against the provider's markdown mirror at
  https://github.com/contensis/contensis-docs. The captured OpenAPI declares no
  securitySchemes, so derive-oauth-scopes.py found nothing — every scope below is read
  from the provider's own documentation.
description: >-
  OAuth 2.0 scopes for the Contensis Management API. They are passed as a space-separated
  list in the `scope` parameter of a client_credentials token request against the
  per-tenant token endpoint. The published table is short — four named scopes covering
  projects and entries — and one further scope, ContentType_Read, appears in the docs' own
  worked example without appearing in the table.
flow: clientCredentials
token_endpoint: https://cms-{alias}.cloud.contensis.com/authenticate/connect/token
separator: space
scopes:
  - name: Project_Read
    documented: true
    description: Read a project.
    operations:
      - Get a project
  - name: Entry_Read
    documented: true
    description: Read entries.
    operations:
      - Get an entry
      - List entries
      - List entries by content type
  - name: Entry_Write
    documented: true
    description: Create, update and publish entries.
    operations:
      - Create an entry
      - Update an entry
      - Publish an entry
  - name: Entry_Delete
    documented: true
    description: Delete an entry.
    operations:
      - Delete an entry
  - name: ContentType_Read
    documented: false
    description: >-
      Read content types. Not listed in the scopes table, but used in the provider's own
      token-request example on the same page (`scope=Entry_Read ContentType_Read Project_Read`).
    operations: []
    evidence: >-
      Example request body on
      https://www.contensis.com/help-and-docs/apis/management-http/security/scopes
findings:
  - >-
    The Management API surface is far larger than the scope table covers. The published
    reference documents operations for components, content types, workflows, nodes,
    domains, certificates, blocks, renderers, proxies, assets, roles, groups, users and
    webhook subscriptions — none of which appear in the scopes table. Either those
    operations are unscoped, or the table is incomplete; the docs do not say which.
  - >-
    ContentType_Read appearing in an example but not the table is a straightforward
    documentation defect and the kind of thing that makes a client-credentials integration
    fail on first run with a 401.
  - >-
    The Delivery API has no scopes at all — one environment-wide token, read everything.
    See authentication/contensis-authentication.yml.
maintainers:
  - FN: Kin Lane
    email: kin@apievangelist.com