---
title: Scopes by product
description: How delegated-access permissions are named and approved, and where each product documents its own.
---

A scope is one permission inside one Zev product, named
`<product>.<name>`. Each product publishes its own scopes and decides what
they allow.

- **Approved per app, per product.** ZevID approves the scopes your app may
  request on each product. Request only those; anything else is refused at
  authorize with `invalid_scope`. The console lists them under
  **Delegated access**.
- **`scope` is the final set.** Every authorize sends the full set you want.
  A permission you leave out is removed from the connection. The only
  exception is `prompt=configure` without `scope`, which keeps the granted
  permissions and only changes targets.
- **Some are high risk.** Those need a separate approval and a recent sign-in
  from the user, and they expire. See
  [High-risk permissions](/delegated-access/high-risk).
- **Some actions are never grantable.** Billing, payments, keys, members,
  ownership, and deleting a team, workspace, organization or account always
  stay with the user.

Never read targets from the access token. They come from the token response
and webhooks, and the product's API says how to name the target on each call.

## ZevCloud

Targets are **teams**: the user picks which of their ZevCloud teams your app
may act on, from those they own or administer. Send `x-team-id` on every call
to `https://api.zevcloud.net/v1`.

| Scope | Risk | In short |
| --- | --- | --- |
| `zevcloud.services.read` | standard | Read services, deployments, logs and metrics. Environment variable values stay masked. |
| `zevcloud.services.create` | standard | Create projects and services, on free plans only, from a public URL or an upload. From GitHub only with `zevcloud.repos.read`. |
| `zevcloud.repos.read` | high | Build from your GitHub repositories, which lets it read their code. |
| `zevcloud.deploy` | standard | Deploy, roll back, and start, stop or restart services. |
| `zevcloud.env.write` | standard | Set and delete environment variables, write-only. |
| `zevcloud.services.delete` | high | Delete services your app created, on teams the user owns. |
| `zevcloud.services.all` | high | Act on every service in the team, not only the ones your app created. |

Asking for `zevcloud.services.delete` narrows which teams a user can pick:
deleting needs the team's owner, so teams where they are only an admin are
shown but cannot be chosen. Ask for it only if your app deletes services.

> **Note:**
> [ZevCloud's connected apps guide](https://docs.zevcloud.net/guide/connected-apps) is the source of truth for what each
> scope allows, which calls need which, ZevCloud's error codes and its own rate
> limits. Read it alongside this guide.

More Zev products will accept partners on the same model. Each gets its own
table here, linking to its guide.