.. index::
    single: Authentication, Scope

Scopes
======

.. attention::
    This list is very preliminary and will be subject to change.

.. _scopes:

The API currently supports the following scopes for authentication:

.. list-table::
 :widths: 10 30 30 60
 :header-rows: 1

 * - Name
   - Default
   - Remarks
   - Description

 * - read
   - Yes
   - Deprecated
   - Allows reading of resources. Deprecated, because it is too coarse

 * - write
   - Yes
   - Deprecated
   - Allows writing of resources. Deprecated, because it is too coarse

 * - create_account
   - No
   - --
   - If set, the client is allowed to create new user accounts.

 * - create_activated_account
   - No
   - --
   - If set, the client is allowed to create new user accounts which do not need e-mail confirmation.

 * - invoice_allowed
   - No
   - --
   - If set, the resource owner is allowed to pay orders with 'invoice' payment type.

 * - dealer_video
   - No
   - --
   - If set, the resource owner is allowed to add video's to advertisement and buy the additional feature to show video's on LR.
     In general this is currently only available for car dealers.

 * - retail_price
   - No
   - --
   - If set, the resource owner is allowed to set the retail price of an ad.

 * - confirm_upcall
   - No
   - --
   - If set, the client is allowed to confirm upcalls for advertisements.

 * - branding
   - No
   - --
   - To be clarified

 * - feed_me
   - No
   - --
   - To be clarified

 * - update_category
   - No
   - --
   - To be clarified

 * - update_nap
   - No
   - --
   - To be clarified

 * - reviews
   - No
   - --
   - To be clarified

 * - fitments
   - No
   - Deprecated
   - If set, the resource owner is allowed to set and get fitments for an advertisement

Scope Errors
------------

When an endpoint requires one of the above mentioned scopes and the scope is not provided by the API client, the API will thrown an error.
The error is consisted of three parts:

    * code = "insuficient_scope" - always present.
    * description = "Scope <needed_scope_name> is required." - optional, may not be present at all times.
    * httpCode = 403 - always present.