Validate Scope

Overview

You send requested scopes, an allowed list, and optional required scopes; we return granted, denied, and missing-required separately so authorization is explainable. Comparison is exact and fail-closed — wildcards are disabled unless you set wildcardMode to suffix or hierarchical. Do not use this to persist grants or store policy long term.

Scope checks written inline tend to drift into "starts with admin" and quietly hand out more than intended. Here matching is exact until you say otherwise, and you get the granted, denied and missing lists separately so the decision is easy to log and easy to explain.

When to use it

Scope

Non-goals

• Does not grant or persist scopes
• Does not store authorization policy

Properties

Capabilities

Cost & billing

Flat rate per invocation

File handling

How we handle your data

Input schema

Output schema

API contract

curl -sS -X POST "$BASE/v1/execute" -H "Authorization: Bearer $KEY" -H 'Content-Type: application/json' -d '{"skillKey":"identity.validate_scope","input":{"requestedScopes":["read:user"],"allowedScopes":["read:user"]}}'

import { Squillify } from "@squillify/sdk";

const sq = new Squillify({ apiKey: process.env.SQUILLIFY_API_KEY });

const { output } = await sq.execute("identity.validate_scope", {"allowedScopes":["read:user"],"requestedScopes":["read:user"]});

Errors

Other limits

Limitations

• Does not grant or persist scopes
• Does not store authorization policy
• Storing authorization decisions or policy versions
• Assuming wildcard patterns unless you explicitly enable wildcardMode

How to call

POST /v1/execute (requires authentication)

{
  "skillKey": "identity.validate_scope",
  "input": {
    "allowedScopes": [
      "read:user"
    ],
    "requestedScopes": [
      "read:user"
    ]
  }
}

Examples

{
  "allowedScopes": [
    "read:user"
  ],
  "requestedScopes": [
    "read:user"
  ]
}

{
  "warnings": [],
  "valid": true,
  "granted": [
    "read:user"
  ],
  "missingRequired": [],
  "denied": []
}

{
  "allowedScopes": [
    "read:user"
  ],
  "requestedScopes": [
    "admin"
  ]
}

{
  "warnings": [],
  "valid": false,
  "granted": [],
  "missingRequired": [],
  "denied": [
    "admin"
  ]
}

{
  "requestedScopes": [
    "read:user",
    "read:org"
  ],
  "requiredScopes": [
    "read:user"
  ],
  "allowedScopes": [
    "read:*"
  ],
  "wildcardMode": "hierarchical"
}

{
  "warnings": [
    {
      "message": "Wildcard mode 'hierarchical' is enabled; scopes may match by pattern.",
      "code": "WILDCARD_ENABLED"
    }
  ],
  "valid": true,
  "granted": [
    "read:user",
    "read:org"
  ],
  "missingRequired": [],
  "denied": []
}

Recommended use cases

• Pre-flight OAuth scope checks before you issue a token
• Validate an agent's requested scopes against tenant policy
• Explain which scopes were denied and which required scopes are missing

Avoid for

• Storing authorization decisions or policy versions
• Assuming wildcard patterns unless you explicitly enable wildcardMode

Related skills

Composable with

Safety & privacy

• Runs without calling any external service.
• Your payloads are never stored permanently.
• Telemetry captures metadata only — never your payload contents.
• We never train models on your payloads.
• No human reviews your payloads.

Tags