# API granular scope to list all badges
**URL:** https://meta.discourse.org/t/api-granular-scope-to-list-all-badges/405734
**Category:** Feature
**Tags:** badges, rest-api, completed
**Created:** [June 20, 2026, 12:03pm UTC](https://meta.discourse.org/t/api-granular-scope-to-list-all-badges/405734 "2026-06-20T12:03:35Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@TimMOz](https://meta.discourse.org/u/TimMOz)
#### Post date: [June 20, 2026, 12:03pm UTC](https://meta.discourse.org/t/api-granular-scope-to-list-all-badges/405734/1 "2026-06-20T12:03:36Z")
I am looking for an api-key granular scope to list all badges? (Not a user’s badges, or individual badge details.)
Currently it seems you can only list all badges if (a) the api-key has a global scope, or (b) you disable ‘Login Required’ and make an anonymous api request without any key.
Would it be possible if to add a badges-\>list scope or have like badges-\>show api-key scope include admin/badges#index and badges#index.
I am building an api server to coordinate discourse groups and badges with CiviCRM memberships, groups and tags for use on a closed site and would rather not be using global scope keys if possible.
Thanks for any help - not sure if this is the right spot to ask.
---
### Author:  [@zogstrip](https://meta.discourse.org/u/zogstrip)
#### Post date: [June 22, 2026, 2:59pm UTC](https://meta.discourse.org/t/api-granular-scope-to-list-all-badges/405734/2 "2026-06-22T14:59:46Z")
There you go 😉
>
>
> Previously, listing badges over the API required either a global-scope key or di…sabling "Login required" and issuing an anonymous request, because no granular scope was mapped to the badge-listing endpoints — a problem for closed-site integrations that want to avoid global keys.
>
> This change adds a \`badges -\> list\` scope mapped to both the public \`badges#index\` and the admin \`admin/badges#index\`, so a non-admin key can list enabled/listable badges (even on a login-required site, via the API JSON login bypass) and an admin-owned key can additionally fetch the full payload from \`/admin/badges.json\`. The admin route stays gated by \`ensure\_admin\` / \`AdminConstraint\`, so the scope grants no admin access on its own.
>
> Meta: https://meta.discourse.org/t/api-granular-scope-to-list-all-badges/405734
---
### Author:  [@TimMOz](https://meta.discourse.org/u/TimMOz)
#### Post date: [June 22, 2026, 11:20pm UTC](https://meta.discourse.org/t/api-granular-scope-to-list-all-badges/405734/5 "2026-06-22T23:20:36Z")
Wonderful - thank you.
---
### Author:  [@zogstrip](https://meta.discourse.org/u/zogstrip)
#### Post date: [June 27, 2026, 6:00am UTC](https://meta.discourse.org/t/api-granular-scope-to-list-all-badges/405734/6 "2026-06-27T06:00:57Z")
This topic was automatically closed after 4 days. New replies are no longer allowed.