Scopes
Capability strings granted at consent or PAT creation; v1 Lightroom uses media and portfolio scopes only.
Scopes are capabilities, not dashboard roles. Identity, workspace binding, and resource ownership still apply after scope checks.
v1 scope table
| Scope | Intent |
|---|---|
media:read | Read library media |
media:write | Upload media |
media:delete | Delete media (dangerous — separate scope) |
portfolios:read | List and read portfolios |
portfolios:write | Attach media to portfolios; portfolio_id on media create |
Lightroom Classic (platform client) uses: media:read, media:write, portfolios:read, portfolios:write.
Later scopes
| Scope | Intent |
|---|---|
observations:read / observations:write | DwC / taxon on media_id |
surveys:read / surveys:write | Conservation surveys |
deployments:read / deployments:write | Deployments |
media:geo:read | Unrestricted geo (future) |
Out of scope for API Bearer auth
These stay on dashboard session RBAC — not API scopes:
- Billing, subscription, team invite
workspace:adminor similar dashboard-admin capabilities
Consent UI shows human-readable labels with the technical scope as secondary text.