| Scope | Meaning |
|---|
anon | no credentials needed (an installation may also allow anonymous `guest` = kiosk mode) |
any | any authenticated principal (resource-level ownership rules apply, e.g. own jobs / clients) |
info:read | server info, venues, displays, engines, nodes, devices (read) |
events:subscribe | subscribe to topics / GET /events |
playback:read | players, output, audio state, parameters (read) |
content:read | shows, assets, presets, scenarios (read), exports, downloads |
playback:control | play / pause / seek / output / parameters / cues / scenario sessions |
apps:publish | ecosystem-app payloads |
content:write | assets, uploads, imports, shows, presets |
audio:control | audio mode / gain / zones / devices / sessions / generator / sources |
displays:control | test patterns, identify, power |
calibration:run | visual calibration jobs and sidecars |
audio:calibrate | audio calibration jobs (audio-room, audio-speaker-check) |
venues:write | venues, displays config, speaker layout, device pairing / binding |
gateways:manage | gateways, OSC send |
system:read | system status, logs, config (redacted), diagnostics, clients, jobs of others |
users:manage | local users, pairing approval |
keys:manage | API keys |
system:admin | reboot / shutdown / update / restore / config write / engine restart / backend / scenario enable |