Read custom scope

GET

/scopes/{name}

Last modified:2026-10-07 23:37:16

OperationId:readCustomScope

Returns one custom scope by name. Requires Super User or Super User Read Only scope. A hidden scope is returned too.

The name of a built-in scope returns its catalog entry, with built-in: yes and its hidden setting.

A custom scope takes a built-in parent scope and removes rights from it, so it can never do more than its parent. Users and API keys are assigned it by name. Its rights come from these settings:

modifications. Per-object limits, keyed by API object name: none removes the object, ro allows reads only, update-only allows reads and updates, and no-delete allows everything but deletes.

read-only. yes refuses every write, on every object.

enabled. no refuses every token issued under the scope until you set it back to yes.

Changes apply to tokens already issued within seconds. Tokens are not reissued.

Request

Authorization

Bearer Token

Provide your bearer token in the

Authorization

header when making requests to protected resources.

Example:

Authorization: Bearer ********************

Path Params

Responses

🟢200OK

application/json

The scope.

Bodyapplication/json

🟠401Unauthorized

🟠403Forbidden

🟠404Not Found

Request Example

Shell

JavaScript

Java

Swift

curl --location 'https://awqacore01.crexendocloud.com/ns-api/v2/scopes/Platform Manager' \
--header 'Authorization: Bearer <token>'

Response Example

200 - Custom scope

{
    "name": "Platform Manager",
    "parent-scope": "Super User",
    "description": "Operations admin with no platform configuration or routing changes",
    "read-only": "no",
    "modifications": {
        "nsconfig": "none",
        "route": "ro"
    },
    "enabled": "yes",
    "hidden": "no",
    "built-in": "no"
}

Modified at 2026-10-07 23:37:16

Count custom scopes

Update custom scope