Developer Portal scopes

Scopes provide fine-grained access control over what resources and actions your application can perform. Each subscription grants access to specific API endpoints based on the scopes you configure.

When subscribing to an API, you select which scopes your application needs. Apply the principle of least privilege: request only the scopes your application actually requires. For more information, see Subscriptions.

Compound scopes

Tealium uses compound scopes that encode the full access context in a single string:

{account}:{profile}:{apiFamily}:{apiVersion}:{resource}:{action}

Component	Description	Example
Account	The Tealium account the scope applies to	`my-company`
Profile	The profile within the account. Use `*` for all profiles.	`main`, `*`, `prod-web`
API family	Which API the scope authorizes. Taken from the API itself; you do not choose it.	`cdp-api`, `context-api`
API version	Which version of that API. Use `*` to cover every version.	`2026-07`, `*`
Resource	The type of resource being accessed	`labels`, `audiences`, `events`
Action	The operation permitted on the resource	`read`, `write`, `delete`, `manage`

For example:

my-account:main:cdp-api:2026-07:labels:read: Reads labels from the main profile in my-account, on version 2026-07 of the CDP API.
my-account:*:cdp-api:2026-07:audiences:write: Writes audiences across all profiles in my-account.
my-account:main:cdp-api:2026-07:*:*: Every scope the API offers, including scopes added later.
my-account:main:cdp-api:*:labels:read: Reads labels on every version of the CDP API.

The asterisk (*) wildcard can be used in any position and matches every value of that segment. To request every scope an API offers, both the resource and the action position must be *: {account}:{profile}:{apiFamily}:{apiVersion}:*:*. A single trailing asterisk is a different format: it is the engine wildcard described below.

Engine-level scopes

Some APIs, such as the Context API, require engine-level authorization in addition to account and profile access. For these APIs, tokens carry engine-level compound scopes:

{account}:{profile}:{apiFamily}:{apiVersion}:{engineId}

Component	Description	Example
Account	The Tealium account the scope applies to	`my-company`
Profile	The profile within the account	`main`, `prod-web`
API family	Which API the scope authorizes	`context-api`
API version	Which version of that API	`2026-06`, `*`
Engine ID	The specific Moments engine	`e01ce645-3964-...`. Use `*` for all engines in the profile.

For example:

my-account:main:context-api:2026-06:e01ce645-3964-4343-9a0c-7d165e653b35: Access to a specific engine in the main profile of my-account.
my-account:main:context-api:2026-06:*: Access to all engines in the main profile of my-account.

When a subscription to an engine-enforced API also grants resource scopes, the two are combined into a single scope:

{account}:{profile}:{apiFamily}:{apiVersion}:{engineId}:{resource}:{action}

For example, my-account:main:context-api:2026-06:e01ce645-3964-4343-9a0c-7d165e653b35:actions:read reads actions from that one engine.

Engine scopes are added to your tokens automatically when a resource owner grants engine access during subscription or via third-party app access. You do not need to manually request engine scopes: they are derived from the engine selections made during the grant process.