Personal Access Token Scopes

#Personal Access Token Scopes

Personal Access Tokens (PATs) in BountyHub can be configured with specific scopes to control the level of access they provide. Scopes define the permissions granted to the token, allowing you to tailor access based on your application's needs.

#Available Scopes

When creating a Personal Access Token, you can select from the following scopes:

• Projects: Grants access to read and manage project-related data.
• Project Runs: Allows interaction with project run data, including viewing and managing runs, and artifacts.
• Bhlast: Provides access to Bhlast server functionalities.
• Payloads: Enables management and interaction with payloads.
• Blobs: Allows access to blob storage and related operations.
• Runner: Grants permissions to manage and interact with runners.
• Workflow: Allows interaction with workflows and revisions.
• Workflow Templates: Grants access to workflow templates.
• Workflow Modules: Grants access to reusable workflow modules.
• Personal Access Tokens: Allows the token to manage PATs (list vs create/update/delete/rotate).
• Account: Grants access to the account profile and preferences.
• Billing: Provides access to plans, balance, invoices, and usage (reads) as well as checkout, top-ups, and subscription changes (writes).
• Notifications: Allows interaction with the notification inbox.
• Integrations: Enables management of integrations and notification channels. Browser OAuth flows stay cookie-only.
• Workflow LSP: Allows workflow editor language assistance. Requires Workflow read.
• Datasets: Grants access to project datasets and views (views fold into this scope, no separate bit). Requires Projects read.
• Tool Runs: Grants access to ad-hoc tool runs executed on your own runners (e.g. the Cookie Lab runner mode). Reads list and fetch runs; writes submit and cancel them.

CVE Watcher uses the Notifications scope to read the CVE feed and the Integrations scope to manage push channel assignments — see CVE Watcher API and scopes.

#Scope Hierarchies

Write scopes require their read scope (e.g. DatasetRw requires DatasetRo). Subservice scopes additionally require their parent service scope: dataset scopes require Projects read, and the workflow LSP scope requires Workflow read. The editor selects parent scopes automatically.