# RSS Observations **URL:** https://meta.discourse.org/t/rss-observations/83453 **Category:** Feature **Created:** [21 maart 2018 om 05:02 UTC](https://meta.discourse.org/t/rss-observations/83453 "2018-03-21T05:02:14Z") **Posts on this page:** 1 **Showing post:** 5
### Author: ![sam](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/sam/32/102149_2.png) [@sam](https://meta.discourse.org/u/sam) #### Post date: [26 april 2020 om 23:46 UTC](https://meta.discourse.org/t/rss-observations/83453/5 "2020-04-26T23:46:55Z")
We discussed the enabling work with @Falco and @david > [@User API keys specification](https://meta.discourse.org/t/user-api-keys-specification/48536/35): > > How about creating a specific new scope, with a third parameter to indicate “get param allowed”. That way, people can’t misuse it for other things (e.g. bypassing CORS and requesting the discourse API from another site). ([from here](https://github.com/discourse/discourse/blob/067696df8f95e81b818cfcb4bcfe90c09ba68b45/app/models/user_api_key.rb#L5-L19)) SCOPES = { read: [:get], write: [:get, :post, :patch, :put, :delete], message\_bus: [[:post, 'message\_bus']], push: nil, one\_time\_password: nil, notifications: [[:post, 'message\_bus'], [:get, 'notifications#index'], [:put, 'notifications#mark… That is a blocker on us supporting notifications as rss feeds, once that is done adding this will be trivial. --- _[View the full topic](https://meta.discourse.org/t/rss-observations/83453)._