Scopes

Scopes provide fine-grained access control over what resources and actions your application can perform. Each subscription grants access to specific API endpoints based on the scopes you configure.

When subscribing to an API, you select which scopes your application needs. Apply the principle of least privilege: request only the scopes your application actually requires. For more information, see Subscriptions.

Compound scopes

Tealium uses compound scopes that encode the full access context in a single string:

{account}:{profile}:{resource}:{action}

Component	Description	Example
Account	The Tealium account the scope applies to	`my-company`
Profile	The profile within the account. Use `*` for all profiles.	`main`, `*`, `prod-web`
Resource	The type of resource being accessed	`labels`, `audiences`, `events`
Action	The operation permitted on the resource	`read`, `write`, `delete`, `manage`

For example:

my-account:main:labels:read: Reads labels from the main profile in my-account.
my-account:*:audiences:write: Writes audiences across all profiles in my-account.

The asterisk (*) wildcard applies only in the profile position and grants access to all profiles within the account. It cannot be used in the account, resource, or action positions.

Engine-level scopes

Some APIs, such as the Moments API, require engine-level authorization in addition to account and profile access. For these APIs, tokens carry engine-level compound scopes:

{account}:{profile}:{engineId}

Component	Description	Example
Account	The Tealium account the scope applies to	`my-company`
Profile	The profile within the account	`main`, `prod-web`
Engine ID	The specific Moments engine	`e01ce645-3964-...`. Use `*` for all engines in the profile.

For example:

my-account:main:e01ce645-3964-4343-9a0c-7d165e653b35: Access to a specific engine in the main profile of my-account.
my-account:main:*: Access to all engines in the main profile of my-account.

Engine scopes are added to your tokens automatically when a resource owner grants engine access during subscription or via third-party app access. You do not need to manually request engine scopes: they are derived from the engine selections made during the grant process.