# User API keys specification

**URL:** https://meta.discourse.org/t/user-api-keys-specification/48536
**Category:** Integrations
**Tags:** rest-api, reference
**Created:** [August 12, 2016, 2:11am UTC](https://meta.discourse.org/t/user-api-keys-specification/48536 "2016-08-12T02:11:53Z")
**Posts on this page:** 1
**Showing post:** 35

<div class="post-metadata">

### Author: ![david](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/david/32/157490_2.png) [@david](https://meta.discourse.org/u/david)
#### Post date: [March 19, 2020, 10:03pm UTC](https://meta.discourse.org/t/user-api-keys-specification/48536/35 "2020-03-19T22:03:23Z")

</div>

How about creating a specific new scope, with a third parameter to indicate “get param allowed”. That way, people can’t misuse it for other things (e.g. bypassing CORS and requesting the discourse API from another site).

([from here](https://github.com/discourse/discourse/blob/067696df8f95e81b818cfcb4bcfe90c09ba68b45/app/models/user_api_key.rb#L5-L19))

```diff
SCOPES = {
    read: [:get],
    write: [:get, :post, :patch, :put, :delete],
    message_bus: [[:post, 'message_bus']],
    push: nil,
    one_time_password: nil,
    notifications: [[:post, 'message_bus'], [:get, 'notifications#index'], [:put, 'notifications#mark_read']],
    session_info: [
      [:get, 'session#current'],
      [:get, 'users#topic_tracking_state'],
      [:get, 'list#unread'],
      [:get, 'list#new'],
      [:get, 'list#latest']
    ],
+ calendar: [[:get, 'users#bookmarks_cal', true] ],
  }

```

(Aside: why are we using nested arrays here…)

---

_[View the full topic](https://meta.discourse.org/t/user-api-keys-specification/48536)._