# List of Scopes and Security Permissions for APIs
All Cornerstone APIs require a scope to be assigned to the OAuth 2.0 application and token. Most APIs also require a specific security permission to be assigned to the user account tied to the OAuth 2.0 application. The table below lists the scopes and permissions each API needs. The last column indicates whether the API respects any constraints placed on the security permission.
Note that scopes are grouped by logical operations you can perform in Cornerstone. Due to this, a single scope can grant your application access to more than one API endpoint.
# Core
| Product | API | Endpoints | HTTP Method | OAuth 2.0 Scope | Security Permission | Constraints Supported? |
|---|---|---|---|---|---|---|
| Employee | Employee API v2 | /services/api/x/users/v2/employees/{id}/employment-status/effective-date/{asOfDate} | GET | employee:read | Employee API - View or Employee API - View - Constrained | Yes |
| Employee | Employee API v2 | /services/api/x/users/v2/employees/{id}/employment-status | GET | employee:read | Employee API - View or Employee API - View - Constrained | Yes |
| Employee | Employee API v2 | /services/api/x/users/v2/employees/{id}/effective-date/{asOfDate} | GET | employee:read | Employee API - View or Employee API - View - Constrained | Yes |
| Employee | Employee API v2 | /services/api/x/users/v2/employees/{id}/effective-date/status | GET | employee:read | Employee API - View or Employee API - View - Constrained | Yes |
| Employee | Employee API v2 | /services/api/x/users/v2/employees | GET | employee:read | Employee API - View or Employee API - View - Constrained | Yes |
| Employee | Employee API v2 | /services/api/x/users/v2/employees/{id} | GET | employee:read | Employee API - View or Employee API - View - Constrained | Yes |
| Employee | Employee API v2 | /services/api/x/users/v2/employees/termination-reasons | GET | employee:read | Employee API - View or Employee API - View - Constrained | Yes |
| Employee | Employee API v2 | /services/api/x/users/v2/employees/employment-status | GET | employee:read | Employee API - View or Employee API - View - Constrained | Yes |
| Employee | Employee API v2 | /services/api/x/users/v2/employees/leave-reasons | GET | employee:read | Employee API - View or Employee API - View - Constrained | Yes |
| Employee | Employee API v2 | /services/api/x/users/v2/employees/custom-fields | GET | employee:read | Employee API - View or Employee API - View - Constrained | Yes |
| Employee | Employee API v2 | /services/api/x/users/v2/employees/employment-categories | GET | employee:read | Employee API - View or Employee API - View - Constrained | Yes |
| Employee | Employee API v2 | /services/api/x/users/v2/employees/custom-relations | GET | employee:read | Employee API - View or Employee API - View - Constrained | Yes |
| Employee | Employee API v2 | /services/api/x/users/v2/employees/{id}/activation-period | GET | employee:read | Employee API - View or Employee API - View - Constrained | Yes |
| Employee | Employee API v2 | /services/api/x/users/v2/employees/reasons-for-change | GET | employee:read | Employee API - View or Employee API - View - Constrained | Yes |
| Employee | Employee API v2 | /services/api/x/users/v2/employees/{id}/groups | GET | group:read | Employee API - View or Employee API - View - Constrained | Yes |
| Employee | Employee API v2 | /services/api/x/users/v2/employees | POST | employee:create | Employee API - Edit | Yes |
| Employee | Employee API v2 | /services/api/x/users/v2/employees/{id}/effective-date/{asOfDate} | PATCH | employee:updatepartial | Employee API - Edit | Yes |
| Employee | Employee API v2 | /services/api/x/users/v2/employees/{id} | PATCH | employee:updatepartial | Employee API - Edit | Yes |
| Employee | Employee API v2 | /services/api/x/users/v2/employees/{id}/employment-status | PATCH | employee:updatepartial | Employee API - Edit | Yes |
| Employee | Employee API v2 | /services/api/x/users/v2/employees/{id}/employment-status/effective-date/{asOfDate} | PATCH | employee:updatepartial | Employee API - Edit | Yes |
| Employee | Employee API v1 | /services/api/x/users/v1/employees/{id}/employmentstatus/effectivedate/{asOfDate} | GET | employee:read | Employee API - View | No |
| Employee | Employee API v1 | /services/api/x/users/v1/employees/{id}/employmentstatus | GET | employee:read | Employee API - View | No |
| Employee | Employee API v1 | /services/api/x/users/v1/employees/employmentstatus | GET | employee:read | Employee API - View | No |
| Employee | Employee API v1 | /services/api/x/users/v1/employees/customfields | GET | employee:read | Employee API - View | No |
| Employee | Employee API v1 | /services/api/x/users/v1/employees/{id}/effectivedate/{asOfDate} | GET | employee:read | Employee API - View | No |
| Employee | Employee API v1 | /services/api/x/users/v1/employees/{id}/effectivedate/status | GET | employee:read | Employee API - View | No |
| Employee | Employee API v1 | /services/api/x/users/v1/employees/{id}/activationperiod | GET | employee:read | Employee API - View | No |
| Employee | Employee API v1 | /services/api/x/users/v1/employees | GET | employee:read | Employee API - View | No |
| Employee | Employee API v1 | /services/api/x/users/v1/employees/{id} | GET | employee:read | Employee API - View | No |
| Employee | Employee API v1 | /services/api/x/users/v1/employees/groups | GET | group:read | Employee API - View | No |
| Employee | Employee API v1 | /services/api/x/users/v1/employees/{id}/employmentstatus/effectivedate/{asOfDate} | PUT | employee:updatefull | Employee API - Edit | No |
| Employee | Employee API v1 | /services/api/x/users/v1/employees/{id}/employmentstatus | PUT | employee:updatefull | Employee API - Edit | No |
| Employee | Employee API v1 | /services/api/x/users/v1/employees/{id}/activationperiod | PUT | employee:updatefull | Employee API - Edit | No |
| Employee | Employee API v1 | /services/api/x/users/v1/employees | POST | employee:create | Employee API - Edit | No |
| Employee | Employee API v1 | /services/api/x/users/v1/employees/{id}/effectivedate/{asOfDate} | PATCH | employee:updatepartial | Employee API - Edit | No |
| Employee | Employee API v1 | /services/api/x/users/v1/employees/{id} | PATCH | employee:updatepartial | Employee API - Edit | No |
| OU | OU API v1 | /services/api/x/organizations/v1/types | GET | outype:read | OU Hierarchy - Manage, View Grades | Yes |
| OU | OU API v1 | /services/api/x/organizations/v1/types/{type id} | GET | outype:read | OU Hierarchy - Manage, View Grades | Yes |
| OU | OU API v1 | /services/api/x/organizations/v1/ous | GET | ou:read | OU Hierarchy - Manage, View Grades | Yes |
| OU | OU API v1 | /services/api/x/organizations/v1/ous/{ou id} | GET | ou:read | OU Hierarchy - Manage, View Grades | Yes |
| OU | OU API v1 | /services/api/x/organizations/v1/ous/{ou id}/localizations | GET | ou:read | OU Hierarchy - Manage, View Grades | Yes |
| OU | OU API v1 | /services/api/x/organizations/v1/ous | POST | ou:write | OU Hierarchy - Manage, View Grades | Yes |
| OU | OU API v1 | /services/api/x/organizations/v1/ous | POST | ou:write | OU Hierarchy - Manage, View Grades | Yes |
| OU | OU API v1 | /services/api/x/organizations/v1/ous/{ou id} | PUT | ou:updatefull | OU Hierarchy - Manage, View Grades | Yes |
| OU | OU API v1 | /services/api/x/organizations/v1/ous/{ou id}/localizations | PUT | ou:updatefull | OU Hierarchy - Manage, View Grades | Yes |
| OU | OU API v1 | /services/api/x/organizations/v1/specifications | PATCH | ouspecification:read | OU Hierarchy - Manage, View Grades | Yes |
| OU | OU API v1 | /services/api/x/organizations/v1/specifications | PATCH | ouspecification:read | OU Hierarchy - Manage, View Grades | Yes |
| OU | OU API v1 | /services/api/x/organizations/v1/types | GET | outype:read | OU Hierarchy - Manage, View Grades | Yes |
| OU | OU API v1 | /services/api/x/organizations/v1/types/{type id} | GET | outype:read | OU Hierarchy - Manage, View Grades | Yes |
| OU | Global Search API | /services/api/Core/GlobalSearch | GET | globalsearch:read | n/a | No |
| Approvals | Approvals API | /services/api/Employee/{userName}/approvals | GET | approval:read | Request Items - View | No |
| Approvals | Approvals API | /services/api/Employee/{userName}/approvals | POST | approval:create | Request Items - View | No |
# Learning
| Product | API | Endpoints | HTTP Method | OAuth 2.0 Scope | Security Permission | Constraints Supported? |
|---|---|---|---|---|---|---|
| LO | Training (LO) API | /services/api/LO/GetDetails | GET | training:read | n/a | No |
| LO | Training (LO) API | /services/api/LO/Create | POST | training:create | Events - Create, Sessions - Create, | No |
| LO | Training (LO) API | /services/api/LO/Create | POST | training:create | Course Catalog - Update, | No |
| LO | Training (LO) API | /services/api/LO/Create | POST | training:create | LCMS Course Administrator, | No |
| LO | Training (LO) API | /services/api/LO/Create | POST | training:create | Materials Management | No |
| LO | Training (LO) API | /services/api/LO/Update | POST | training:updatefull | Session - Edit | No |
| LO | Training Custom Field API | /services/api/CustomField/ | POST | training:create | Training Custom Fields | No |
| Express Class | Express Class API | /services/x/lms-express-class/v1/ExpressClass | POST | expressclass:create | Express Class – Manage | Yes |
| Learning Assignment | Learning Assignment API | /services/x/lms-learning-assignment/v1/learning-assignment/standard | POST | learningassignment:create | Assignment Tool - Standard, | Yes |
| Learning Assignment | Learning Assignment API | /services/x/lms-learning-assignment/v1/learning-assignment/standard | POST | learningassignment:create | Assignment Tool - Email Settings - View | Yes |
| Learning Assignment | Learning Assignment API | /services/x/lms-learning-assignment/v1/learning-assignment/{id} | GET | learningassignment:read | Assignment Tool - Standard | Yes |
| Learning Assignment | Learning Assignment API | /services/x/lms-learning-assignment/v1/learning-assignment/search | GET | learningassignment:read | Assignment Tool - Standard | Yes |
| Session | Session Roster API | /services/api/SessionRoster/ | POST | sessionroster:create | Roster - Manage | No |
| Session | Session Roster API | /services/api/SessionRoster/GetSessionRoster | GET | sessionroster:read | Roster - View | No |
| Catalog Search | Catalog Search API | /services/api/Catalog/GlobalSearch | GET | training:read | Course Catalog - View | No |
| Transcript and Task | Transcript Search API | /services/api/LOTranscript/TranscriptSearch | GET | transcript:read | Users - View, View Transcript Item | No |
| Transcript and Task | Transcript and Task API | /services/api/TranscriptAndTask/Inbox | GET | inbox:read | n/a | No |
| Transcript and Task | Transcript and Task API | /services/api/TranscriptAndTask/Assigned | GET | transcript:read | n/a | No |
| Transcript and Task | Transcript and Task API | /services/api/TranscriptAndTask/Session | GET | transcript:read | n/a | No |
| Transcript and Task | Transcript and Task API | /services/api/TranscriptAndTask/Transcript | GET | transcript:read | n/a | No |
| Transcript and Task | Transcript and Task API | /services/api/TranscriptAndTask/SuggestedTraining | GET | transcript:read | n/a | No |
| Transcript and Task | Transcript and Task API | /services/api/TranscriptAndTask/Approval | GET | approval:read | n/a | No |
| Transcript and Task | Transcript and Task API | /services/api/TranscriptAndTask/Task | GET | task:read | n/a | No |
| Certification | Certification API | /services/api/Certification/Remove | POST | certification:delete | Certification - Manage | No |
| Certification | Certification API | /services/api/CertificationDetails/GetCertificationDetails | GET | certification:read | Certification - Manage | No |
| Certification | Certification API | /services/api/CertificationTranscript/CertificationTranscriptDetails | GET | certification:read | View Transcript Item - View | No |
| Training Unit | Training Unit API | /services/api/TrainingUnit | POST | trainingunit:create | Training Unit Assignment - View | No |
# Transcript
| Product | API | Endpoints | HTTP Method | OAuth 2.0 Scope | Additional Claim | Security Permission | Constraints Supported? |
|---|---|---|---|---|---|---|---|
| Transcript | Overview API | /services/api/v1/transcripts/overview | GET | transcript:read | n/a | View Transcript Item | Yes |
| Transcript | Details API | /services/api/v1/transcripts/details | GET | transcript:read | n/a | View Transcript Item | Yes |
| Transcript | Enhanced Details API | /services/api/v1/transcripts/enhanced-details | GET | transcript:read | n/a | View Transcript Item | Yes |
| Transcript | Curricula Child API | /services/api/v1/transcripts/curriculum-child-lo-data | GET | transcript:read | n/a | View Transcript Item | Yes |
| Transcript | Custom Fields API | /services/api/v1/transcripts/custom-fields | GET | transcript:read | n/a | View Transcript Item | Yes |
| Transcript | Form Fields API | /services/api/v1/transcripts/request-form-fields | GET | transcript:read | n/a | View Transcript Item | Yes |
| Transcript | Exempt Info API | /services/api/v1/transcripts/exempt-info | GET | transcript:read | n/a | View Transcript Item | Yes |
| Transcript | Removal Info API | /services/api/v1/transcripts/removal-info | GET | transcript:read | n/a | View Transcript Item | Yes |
| Transcript | Session Info API | /services/api/v1/transcripts/session-info | GET | transcript:read | n/a | View Transcript Item | Yes |
| Transcript | Version Info API | /services/api/v1/transcripts/version-info | GET | transcript:read | n/a | View Transcript Item | Yes |
| Transcript | Request API | /services/api/v1/transcripts/request | POST | transcript:create | transcript:create:request | Transcript API - Request | Yes |
| Transcript | Assign API | /services/api/v1/transcripts/assign | POST | transcript:create | transcript:create:assign | Assignment Tool - Standard | Yes |
| Transcript | Remove API | /services/api/v1/transcripts/remove | PATCH | transcript:update | transcript:update:remove | Remove Training | Yes |
| Transcript | Register API | /services/api/v1/transcripts/register | PATCH | transcript:update | transcript:update:register | Edit Transcript Items | Yes |
| Transcript | Progress API | /services/api/v1/transcripts/progress | PATCH | transcript:update | transcript:update:progress | Edit Transcript Items | Yes |
| Transcript | Complete API | /services/api/v1/transcripts/complete | PATCH | transcript:update | transcript:update:complete | Mark Training Complete | Yes |
| Transcript | Update API | /services/api/v1/transcripts/update | PATCH | transcript:update | transcript:update:updatepartial | Edit Transcript Items | Yes |
| Transcript | Approve API | /services/api/v1/transcripts/approve | PATCH | transcript:update | transcript:update:approve | Edit Transcript Items | Yes |
| Transcript | Archive API | /services/api/v1/transcripts/archive | PATCH | transcript:update | transcript:update:archive | Move training to Archived Transcript | Yes |
| Transcript | Withdraw API | /services/api/v1/transcripts/withdraw | PATCH | transcript:update | transcript:update:withdraw | Withdraw Users from Sessions | Yes |
| Transcript | Exempt API | /services/api/v1/transcripts/exempt | PATCH | transcript:update | transcript:update:exempt | Mark Transcript Exempt | Yes |
# Performance
| Product | API | Endpoints | HTTP Method | OAuth 2.0 Scope | Security Permission | Constraints Supported? |
|---|---|---|---|---|---|---|
| Performance Review Task | Performance Review API | /services/api/Review/PerformanceReview | GET | performancereview:read | n/a | No |
| Goals | Goal API | /services/api/Goals/Create | POST | goal:create | Goals - Create | No |
| Goals | Goal API | /services/api/Goals/Update | PUT | goal:updatefull | Goals - Create | No |
| Goals | Goal API | /services/api/Goals/UpdateProgress | PUT | goalprogress:updatefull | Goals - Create | No |
| Goals | Goal API | /services/api/Goals/GetDetails | GET | goal:read | Goals - Create | No |
# Recruiting
| Product | API | Endpoints | HTTP Method | OAuth 2.0 Scope | Security Permission | Constraints Supported? |
|---|---|---|---|---|---|---|
| Job Requisition | Job Requisition API | /services/api/Recruiting/JobRequisitionDetails | GET | jobrequisition:read | n/a | No |
| Job Requisition | Job Requisition API | /services/api/Recruiting/JobRequisitionDetails/Ad | GET | jobrequisition:read | n/a | No |
| Job Requisition | Job Requisition API | /services/api/Recruiting/JobRequisitionDetails/CustomField | GET | jobrequisition:read | n/a | No |
| Job Requisition | Application Workflow | /services/api/x/rec-job-requisition/v1/requisition/{externalId}/application-workflow | GET | applicationworkflow:read | n/a | No |
| Applicant | Job Applicant API | /services/api/Recruiting/JobApplicant | GET | jobapplicant:read | n/a | No |
| Applicant | Job Applicant API | /services/api/Recruiting/JobApplicant/CustomFields | GET | jobapplicant:read | n/a | No |
| Applicant | Job Applicant API | /services/api/Recruiting/JobApplicantUpdateStatus | GET | jobapplicant:update | Applicants - Status Change | No |
| Application | Job Application API | /services/api/x/external-application/v1/job-application/submit | GET | jobapplication:create | External Job Application API - Manage | No |
# Reporting
| Product | API | Endpoints | HTTP Method | OAuth 2.0 Scope | Security Permission | Constraints Supported? |
|---|---|---|---|---|---|---|
| Cross Module | Reporting API | /services/api/x/odata/api/views/ | GET | reportingmetadata:view | Reporting API - Read Only | No |
| Cross Module | Reporting API | /services/api/x/odata/api/views/$metadata | GET | reportingmetadata:view | Reporting API - Read Only | No |
| Cross Module | Reporting API | /services/api/x/odata/api/views/vw_rpt_* | GET | Scopes for each Reporting API view follows this pattern: {viewname}:read. For example, to access /services/api/x/odata/api/views/vw_rpt_user, you will need the vw_rpt_user:read scope. | Reporting API - Read Only | No |
| Cross Module | Data Exporter API | /services/api/x/dataexporter/api/objects | GET | obj_metadata:read | Reporting API - Read Only | No |
| Cross Module | Data Exporter API | services/api/x/dataexporter/api/objects/$metadata | GET | obj_metadata:read | Reporting API - Read Only | No |
| Cross Module | Data Exporter API | /services/api/x/dataexporter/api/objects/$cs_diagram | GET | obj_metadata:read | Reporting API - Read Only | No |
| Cross Module | Data Exporter API | services/api/x/dataexporter/api/objects/* | GET | Scopes for each Data Exporter API view follows this pattern: {obj_name}:read. For example, to access /services/api/x/dataexporter/api/objects/users_core, you will need the obj_users_core:read scope. | Reporting API - Read Only | No |
# Bulk
| Product | API | Endpoints | HTTP Method | OAuth 2.0 Scope | Security Permission | Constraints Supported? |
|---|---|---|---|---|---|---|
| Cross Module | Bulk API | /services/api/x/bulk-api/v1/specification | GET | bulkapispecification:read | Varies by load type | No |
| Cross Module | Bulk API | /services/api/x/bulk-api/v1/jobs/{job_id} | GET | bulkapijob:read | Varies by load type | No |
| Cross Module | Bulk API | /services/api/x/bulk-api/v1/imports/{import_id}/errors | GET | bulkapiimport:read | Varies by load type | No |
| Cross Module | Bulk API | /services/api/x/bulk-api/v1/imports/{import_id}/report | GET | bulkapiimport:read | Varies by load type | No |
| Cross Module | Bulk API | /services/api/x/bulk-api/v1/imports/{import_id}/warnings | GET | bulkapiimport:read | Varies by load type | No |
| Cross Module | Bulk API | /services/api/x/bulk-api/v1/schemas | POST | bulkapischema:read | Varies by load type | No |
| Cross Module | Bulk API | /services/api/x/bulk-api/v1/jobs | POST | bulkapijob:create | Varies by load type | No |
| Cross Module | Bulk API | /services/api/x/bulk-api/v1/imports/{import_id} | POST | bulkapiimport:load | Varies by load type | No |