Skip to main content

The scope catalog

GET 
/public/api_scopes

Every scope an app can request (lib/api_scope_catalog.rb), in catalog order: what the developer docs, the app editor and the token pickers read. Throttle: public/catalogs/ip, 120 a minute.

Responses​

The catalog.

Response Headers
    Cache-Control

    Cached five minutes by browsers and CDNs. Every public response also carries Vary: Origin — its CORS headers depend on the caller's origin — so a shared cache keys on it.

    Access-Control-Allow-Origin

    *, without credentials, for any origin but the ones the app itself is served from: a https://<subdomain>.kudoscrm.com origin is echoed, with Access-Control-Allow-Credentials: true. The apex https://kudoscrm.com gets *. No Origin header, no CORS headers.