The API key scope vocabulary
GET/admin/apikey-scopes
Flat, not nested per casino — it is the same list for every one.
Served rather than hardcoded in a client for the same reason the permission catalog is: the issuer validates against this list, so a client working from its own copy would offer a scope the server refuses, and the evidence would be a form that rejects its own options.
These are the server-to-server scopes a key carries. They are a different vocabulary from the console's own permissions, which gate the routes on this surface.
Permission: apikeys.read
Request
Responses
- 200
- 400
- 401
- 403
- 404
The scopes, with the label to render
X-Tenant-Id is missing
No session cookie, or it expired
The role lacks apikeys.read, or the caller is not a member of this casino
No such casino