Scopes and consent

Ask for the smallest set of scopes needed for the current feature. A scope grants capability only within the token’s resource audience and the person’s current authorization.

Task and organization scopes

tasks:read, tasks:write, tasks:delete
categories:read, categories:write
tags:read, tags:write
places:read, places:write
calendar:read

The categories:* identifiers are stable wire names for public List capabilities. There is no calendar:write scope.

Context and collaboration scopes

prayer:read
settings:read, settings:write
comments:read, comments:write
collaborators:read, collaborators:write
attachments:read, attachments:write

Connection and integration scopes

connections:read, connections:write
activity:read
events:read
webhooks:read, webhooks:write

connections:write supports self-revocation by default. Event access also requires the underlying read scope owned by the event registry. Webhook control scopes belong to the REST resource and cannot be exercised with an MCP-audience token.