> ## Documentation Index > Fetch the complete documentation index at: https://docs.lerian.studio/llms.txt > Use this file to discover all available pages before exploring further. # Retrieve a product's scope catalog > Returns the dimensions one product lets a partner be scoped on, in tree order, with the rules each one carries: `required`, `multi`, and the `collection` its siblings live in. `name` is the value to send as `field` on a partner's `scope` line; values are the product's own identifiers (as its list APIs return them) and are not checked for existence. Called by a partner editor that already knows which product it is scoping, and before a create or an update to know which lines the write will need. Read-only and global: the same for every organization. Failures: - `404 IDE-1053` — the product has not published a scope catalog. None of its partners can be scoped until it does. - `403` — your token does not hold the `partners` resource. - `503 IDE-0066` — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later. ## OpenAPI ````yaml /en/openapi/v3-current/AM-identity.yaml get /v1/scope-catalog/{product} openapi: 3.1.0 info: contact: name: Lerian Studio url: https://lerian.studio description: OpenAPI 3.1 surface for the Access Manager identity component. license: name: Lerian Studio General License title: Plugin Access Manager — Identity API version: v1 servers: - url: https://identity.sandbox.lerian.net security: [] tags: - description: >- M2M-only: each plugin declares its own permissions, roles and M2M contract, and the server reconciles them. name: Declarations - description: >- A tenant administrator's customers. Each partner holds what its credentials may DO (permissions, per product) and WHERE they may do it (scope, per product and dimension); an M2M application attached to one is confined to that intersection. Administrator-only: authorized on the "partners" resource, and every route resolves the owning organization from the caller's token. name: Partners paths: /v1/scope-catalog/{product}: get: tags: - Partners summary: Retrieve a product's scope catalog description: >- Returns the dimensions one product lets a partner be scoped on, in tree order, with the rules each one carries: `required`, `multi`, and the `collection` its siblings live in. `name` is the value to send as `field` on a partner's `scope` line; values are the product's own identifiers (as its list APIs return them) and are not checked for existence. Called by a partner editor that already knows which product it is scoping, and before a create or an update to know which lines the write will need. Read-only and global: the same for every organization. Failures: - `404 IDE-1053` — the product has not published a scope catalog. None of its partners can be scoped until it does. - `403` — your token does not hold the `partners` resource. - `503 IDE-0066` — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later. operationId: getScopeCatalog parameters: - description: Product slug, as returned by GET /v1/applications/available. in: path name: product required: true schema: description: Product slug, as returned by GET /v1/applications/available. examples: - midaz minLength: 1 type: string responses: '200': content: application/json: schema: $ref: '#/components/schemas/ScopeCatalog' description: OK '422': content: application/problem+json: schema: $ref: '#/components/schemas/Detail' description: Unprocessable Entity '500': content: application/problem+json: schema: $ref: '#/components/schemas/Detail' description: Internal Server Error '503': content: application/problem+json: schema: $ref: '#/components/schemas/Detail' description: Service Unavailable default: content: application/problem+json: schema: $ref: '#/components/schemas/Detail' description: Error security: - BearerAuth: [] components: schemas: ScopeCatalog: additionalProperties: false properties: dimensions: description: >- Dimensions in tree order: the first is the top of the funnel and every later one narrows inside the previous. A partner scope line's field must be one of these names. items: $ref: '#/components/schemas/ScopeDimension' type: - array - 'null' integrations: description: >- Lerian services this product calls while serving a request (e.g. midaz). A partner granted this product reaches them through it, and each of them also applies the partner's own rules for that service when the partner has any. Absent when the product declares none. examples: - - midaz items: type: string type: - array - 'null' levels: description: >- How wide one instance of each leveled resource is, per (resource, action). A partner is not granted a write on a resource wider than its scope. Absent when the product declares no level. items: $ref: '#/components/schemas/ScopeLevel' type: - array - 'null' partners: description: >- Whether the product accepts partner credentials. A partner can be granted the product only when true. examples: - true type: boolean product: description: Product slug, as returned by GET /v1/applications/available. examples: - midaz type: string required: - product - dimensions - partners type: object Detail: additionalProperties: true properties: code: description: >- Stable, machine-readable domain error code scoped to the emitting service (format: -NNNN). type: string detail: description: >- A human-readable explanation specific to this occurrence of the problem. examples: - Property foo is required but is missing. type: string errors: description: Optional list of individual error details items: $ref: '#/components/schemas/ErrorDetail' type: - array - 'null' instance: description: >- A URI reference that identifies the specific occurrence of the problem. examples: - https://example.com/error-log/abc123 format: uri type: string status: description: HTTP status code examples: - 400 format: int64 type: integer title: description: >- A short, human-readable summary of the problem type. This value should not change between occurrences of the error. examples: - Bad Request type: string type: default: about:blank description: A URI reference to human-readable documentation for the error. examples: - https://example.com/errors/example format: uri type: string upstream: $ref: '#/components/schemas/Upstream' description: >- RFC 9457 extension member: the error a proxied third-party provider reported. Absent unless the emitting service explicitly surfaced one. type: object ScopeDimension: additionalProperties: false properties: collection: description: >- The product collection the values are ids of. A partner scoped on this dimension may not list or create in this collection — that is where its siblings live. examples: - organizations type: string covers: description: >- Further product collections whose items each belong to ONE value of this dimension. A partner scoped on this dimension may not address them without naming its value. Absent when the dimension covers nothing beyond its own collection. examples: - - balances - operations items: type: string type: - array - 'null' explicit: description: >- A partner scoped on this product reaches the dimension's collection only through ids its scope names for it; one that names none is refused there. Absent when false. examples: - true type: boolean from: description: >- Where the product reads the value from on its own routes: path, query, header or form. examples: - path type: string label: description: Display name for the dimension. examples: - Midaz organization type: string multi: description: >- A line for this dimension may carry more than one value; when false, more than one is refused with IDE-0002. examples: - false type: boolean name: description: The value to send as field on a partner scope line. examples: - organizationId type: string param: description: >- What carries the value on the product's routes: the path parameter, the query key, the header name (compared case-insensitively) or the form field. examples: - organization_id type: string parent: description: >- Name of the dimension of this catalog whose instances hold this one's: a ledger's parent is its organization. Absent for a top-level dimension. examples: - organizationId type: string required: description: >- A partner scoped on this product must carry a line for this dimension, else IDE-0001. examples: - true type: boolean required: - name - from - param - required - multi - collection type: object ScopeLevel: additionalProperties: false properties: action: description: Action of the permission. examples: - update type: string level: description: tenant, or a dimension name of the catalog. examples: - organizationId type: string resource: description: Resource the permission applies to. examples: - ledgers type: string required: - resource - action - level type: object ErrorDetail: additionalProperties: false properties: location: description: >- Where the error occurred, e.g. 'body.items[3].tags' or 'path.thing-id' type: string message: description: Error message text type: string value: description: The value at the given location type: object Upstream: additionalProperties: false properties: code: description: The upstream provider's own error code, verbatim. examples: - E4001 type: string message: description: >- The upstream provider's own error message, verbatim (bounded, never its raw response body). examples: - account not found at provider type: string type: object securitySchemes: BearerAuth: bearerFormat: JWT description: JWT bearer token issued by the identity provider. scheme: bearer type: http ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.