Access creation, listing and revocation require owner/admin membership. Creation validates requested scopes against the human’s current permission ceiling and every selected project.
It cannot grant access the creator lacks.
pendingClientsStatus is available or unavailable. When available, pendingClients lists up to ten recent verified OAuth client requests belonging to the signed-in human, filtered to the configured issuer and resource.
Each record has a fixed 24-hour review window from its first request. An active grant in the selected workspace hides its pending record; revocation can expose the same recent record again.
Unavailable does not mean there are no requests. These identity records contain no tokens and grant no access: review still requires explicit client, workspace, scope and project choices through the existing human approval flow.
Choose scopes for the task
Scopes permit actions; project grants limit which records those actions can reach. A credential sets the technical ceiling. Your task or standing policy determines which actions the agent may take within it.
A selected candidate check requires both
discovery:read and watches:write; reading its result requires discovery:read and watches:read. An import needs discovery:write even when it buys no supplier data.
Source-event snapshot recovery can need exports:create in addition to events:read; see sync recovery.
Choose the smallest set for the actual commands. Command pages list combined requirements.
A scope grants no extra project access, spending authority or feature availability. Viewer membership receives read scopes and notifications:write; the current membership ceiling and selected project grants still apply.
API credential input
name is a nonempty string of up to 100 characters. scopes must contain supported scopes within current access. projectIds is null for unrestricted project access or an array of 1 to 100 project IDs in this workspace. Project-restricted access cannot request projects:write. expiresInDays is an integer from 1 to 90, default 30.
The response contains id, token, name, scopes, projectIds and expires_at. The full token is returned once.
Access listings expose metadata such as prefix, scopes_json, project_ids_json, created_at, expires_at and revoked_at; they do not recover a token.
For normal cloud work, use the HTTP command interface. Members, invitations and access changes have shared command pages. Creating an invitation does not authorize sending an email automatically.
Check the selected environment and workspace access before calling hosted operations. See capability status.