---
title: "OAuth Scopes"
description: "OAuth Scopes"
---

Siglata enforces principle-of-least-privilege capability scopes:

| Scope | Description | Minimum Role |
| :-- | :-- | :-- |
| `files:read` | Inspect active files, list trash, inspect storage metrics, and obtain one-time download links. | `member` |
| `files:write` | Reserve uploads, cancel uploads, rename files, trash, and restore files. | `member` |
| `organizations:read` | Read organization profile and metadata for the granted workspace. | `member` |
| `organizations:write` | Rename the organization, change its slug or set version retention. | `admin` |
| `members:read` | List organization members and view pending invitations. | `member` |
| `members:write` | Invite new members, cancel pending invitations, update roles, or remove members. | `admin` |

In addition to OAuth scopes, Siglata checks connection validity and the user's current membership and role at the start of every MCP request and authenticated file transfer. A tool call uses the principal resolved for that request, retaining the token's original scopes and claims. Operations check their scopes and applicable file, source and destination permissions.