# ApiKeyScope

> Tracon documentation. Tracon is a .NET package family that adds a control
> plane on Microsoft Agent Framework, published as NuGet packages that run
> inside your own ASP.NET Core application.
>
> Page: https://tracon.dev/api/tracon.apikeyscope/
> Summary: ApiKeyScope: An authority scope an API key may open.

<div class="api-provenance">Namespace Tracon · Assembly <code>Tracon.Abstractions.dll</code></div>

An authority scope an API key may open.

```csharp
[JsonConverter(typeof(JsonStringEnumConverter<ApiKeyScope>))]
public enum ApiKeyScope
```

## Fields

`AgentsAdmin = 3` 

Definition writes, version rollback.

`AgentsRead = 2` 

Catalog and definition reads.

`AuditRead = 16` 

Audit trail reads.

`EvalsAdmin = 10` 

Eval suite/case writes: saving, deleting, promoting a case from a run.
Triggering a run is not included in this scope — see [ApiKeyScope.RunsWrite](/api/tracon.apikeyscope/).

`EvalsRead = 9` 

Eval suite/case/run reads: listing, single fetch, online evaluation summary.

`ExperimentsAdmin = 12` 

Experiment writes: saving, deleting, starting/stopping, canary policy.

`ExperimentsRead = 11` 

Experiment reads: listing, single fetch, results, canary status.

`ExternalInvoke = 4` 

The external surface (MCP server, A2A). Kept separate: an internal
automation key must not open the externally exposed surface on its own.

`KnowledgeAdmin = 6` 

Knowledge-base writes: document upload, deletion.

`KnowledgeRead = 5` 

Knowledge-base reads: collection listing, semantic search.

`PlatformAdmin = 14` 

Platform operations configuration writes and running retention cleanup.

`PlatformRead = 13` 

Platform operations configuration and health reads: tenant
registration, quotas, retention, scheduling, webhooks, diagnostics,
provider health.

`RunsRead = 0` 

Run reads, event stream, statistics.

`RunsWrite = 1` 

Starting a run, cancelling, giving approval.

`SecurityAdmin = 15` 

Surfaces that generate/extend authority: API keys, skill script
grants, MCP OAuth start. The only self-elevating scope — should be
granted rarely.

`WorkflowsAdmin = 8` 

Workflow definition writes: saving, deleting. Running is not included in this
scope — see [ApiKeyScope.RunsWrite](/api/tracon.apikeyscope/).

`WorkflowsRead = 7` 

Workflow definition reads: catalog listing, graph, checkpoint/request listing.

## Remarks

A scope **does not replace role policies**, it narrows them.
A key's effective authority is the `role ∩ scope` set.

The scope list is **closed**: free-text scopes are not
accepted, an unknown value is rejected at creation time. Adding a new
member to this type is not a breaking change; making the list extensible
from the UI requires a separate, deliberate decision (an authority
language is a security surface).