Permissions

The permissions section of the manifest.yml file controls your app's access to remote resources.

OAuth 2 scopes

The scopes list declares which OAuth 2 scopes are required by your app when using the authenticated Product Fetch APIs.

Example

Define each scope on a new line. Your app should use the minimum set of scopes required.

permissions:
  scopes:
    - 'read:confluence-content.summary'
    - 'write:jira-work'

If your app requires no OAuth 2 permissions, you must provide an empty scopes list as in the example below.

1
2

permissions:
  scopes: []

Note, Forge apps deployed in the development environment always receive all available OAuth 2 scopes.

Forge scopes

Certain platform features, such as the App storage API, are also authenticated using OAuth 2.

Scope	Description
`storage:app`	Enables the App storage API.

Product scopes

In addition to the reference tables below, you can find the required scopes in each product's REST API documentation on a per-operation basis in the OAuth scopes required field. Note, not all operations support OAuth 2 authentication.

Confluence Cloud

The Confluence Cloud REST API scopes.

Scope	Description
`read:confluence-content.all`	Read all content, including content body (expansions permitted). Note, APIs using this scope may also return data allowed by `read:confluence-space.summary`. However, this scope is not a substitute for `read:confluence-space.summary`.
`read:confluence-content.summary`	Read a summary of the content, which is the content without expansions. Note, APIs using this scope may also return data allowed by `read:confluence-space.summary`. However, this scope is not a substitute for `read:confluence-space.summary`.
`write:confluence-content`	Create pages, blogs, comments, and questions.
`read:confluence-space.summary`	Read a summary of space information without expansions.
`write:confluence-space`	Create, update, and delete space information.
`write:confluence-file`	Upload attachments.
`read:confluence-props`	Read content properties.
`write:confluence-props`	Write content properties.
`search:confluence`	Search Confluence. Note, APIs using this scope may also return data allowed by `read:confluence-space.summary` and `read:confluence-content.summary`. However, this scope is not a substitute for `read:confluence-space.summary` or `read:confluence-content.summary`.
`manage:confluence-configuration`	Manage global settings.

Jira Cloud platform

The Jira Cloud REST API scopes.

Scope	Description
`read:jira-user`	View user information in Jira that you have access to, including usernames, email addresses, and avatars.
`read:jira-work`	Read project and issue data, and search for issues and objects associated with issues, such as attachments and worklogs.
`write:jira-work`	Create and edit issues in Jira, post comments, create worklogs, and delete issues.
`manage:jira-project`	Create and edit project settings, and create new project-level objects, such as versions and components.
`manage:jira-configuration`	Configure Jira settings that require Jira administrator permissions, such as create projects and custom fields, view workflows, and manage issue link types.

Forge Developer