Create Scope
curl --request POST \
--url https://api.truthlocks.com/v1/scopes \
--header 'Content-Type: application/json' \
--header 'X-API-Key: <api-key>' \
--data '
{
"action": "<string>",
"resource": "<string>"
}
'const options = {
method: 'POST',
headers: {'X-API-Key': '<api-key>', 'Content-Type': 'application/json'},
body: JSON.stringify({action: '<string>', resource: '<string>'})
};
fetch('https://api.truthlocks.com/v1/scopes', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://api.truthlocks.com/v1/scopes"
payload = {
"action": "<string>",
"resource": "<string>"
}
headers = {
"X-API-Key": "<api-key>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.truthlocks.com/v1/scopes"
payload := strings.NewReader("{\n \"action\": \"<string>\",\n \"resource\": \"<string>\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("X-API-Key", "<api-key>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}{
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"tenant_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"scope": "<string>",
"resource": "<string>",
"action": "<string>",
"display_name": "<string>",
"description": "<string>",
"category": "<string>",
"is_builtin": true,
"created_at": "2023-11-07T05:31:56Z"
}{
"code": "AUTH_REQUIRED",
"message": "Authentication required",
"http_status": 401
}{
"code": "AUTH_REQUIRED",
"message": "Authentication required",
"http_status": 401
}{
"code": "AUTH_REQUIRED",
"message": "Authentication required",
"http_status": 401
}{
"code": "AUTH_REQUIRED",
"message": "Authentication required",
"http_status": 401
}Agent Sessions & Tools
Create Scope
Create a custom tenant-scoped permission scope for fine-grained agent access control
POST
/
v1
/
scopes
Create Scope
curl --request POST \
--url https://api.truthlocks.com/v1/scopes \
--header 'Content-Type: application/json' \
--header 'X-API-Key: <api-key>' \
--data '
{
"action": "<string>",
"resource": "<string>"
}
'const options = {
method: 'POST',
headers: {'X-API-Key': '<api-key>', 'Content-Type': 'application/json'},
body: JSON.stringify({action: '<string>', resource: '<string>'})
};
fetch('https://api.truthlocks.com/v1/scopes', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://api.truthlocks.com/v1/scopes"
payload = {
"action": "<string>",
"resource": "<string>"
}
headers = {
"X-API-Key": "<api-key>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.truthlocks.com/v1/scopes"
payload := strings.NewReader("{\n \"action\": \"<string>\",\n \"resource\": \"<string>\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("X-API-Key", "<api-key>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}{
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"tenant_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"scope": "<string>",
"resource": "<string>",
"action": "<string>",
"display_name": "<string>",
"description": "<string>",
"category": "<string>",
"is_builtin": true,
"created_at": "2023-11-07T05:31:56Z"
}{
"code": "AUTH_REQUIRED",
"message": "Authentication required",
"http_status": 401
}{
"code": "AUTH_REQUIRED",
"message": "Authentication required",
"http_status": 401
}{
"code": "AUTH_REQUIRED",
"message": "Authentication required",
"http_status": 401
}{
"code": "AUTH_REQUIRED",
"message": "Authentication required",
"http_status": 401
}Create Scope
POST /v1/scopes
Creates a custom permission scope for the authenticated tenant. Custom scopes extend the built-in scope registry with tenant-specific permissions. The scope string is automatically composed from the resource and action fields in resource:action format.
Custom scopes are validated against the MAIP scope format rules: alphanumeric characters, dots, underscores, hyphens, and asterisks only.
Custom scopes are tenant-isolated. They do not appear in other tenants’ scope
registries. Built-in platform scopes cannot be overridden or duplicated.
Authentication
RequiresX-API-Key header or Bearer JWT token. The workspace is derived from the authenticated credential; do not send X-Tenant-ID.
Response
string
UUID of the newly created scope definition.
string
UUID of the owning tenant.
string
The composed scope string in
resource:action format.string
The resource component.
string
The action component.
string
Human-readable scope name.
string
Scope description.
string
Scope category.
boolean
Always
false for tenant-created scopes.string
ISO 8601 creation timestamp.
Example
curl -X POST https://api.truthlocks.com/v1/scopes \
-H "X-API-Key: tl_live_..." \
-H "Content-Type: application/json" \
-d '{
"resource": "crm",
"action": "contact.enrich",
"display_name": "CRM Contact Enrichment",
"description": "Allows agents to enrich CRM contact records via third-party providers",
"category": "integration"
}'
Assigning Custom Scopes to Agents
After creating a custom scope, assign it to agents during registration or via delegation:curl -X POST https://api.truthlocks.com/v1/agents \
-H "X-API-Key: tl_live_..." \
-H "Content-Type: application/json" \
-d '{
"agent_type": "pipeline",
"display_name": "CRM Enrichment Pipeline",
"scopes": ["crm:contact.enrich", "data:read"]
}'
Authorizations
API key for machine-to-machine authentication
Body
application/json
Action component of the scope (e.g. "read", "approve", "*")
Resource component of the scope (e.g. "crm", "payment")
Organizational category (defaults to "custom")
Detailed description of what the scope grants
Human-readable name for the scope