Create Scoped Token

The scope parameter in the Create Token REST API allows you to change the scope of access that the token provides.

Access to the REST API is always provided by default. Administrators can set any scope, while non-admin users can only create Identity Tokens (user scope). From Artifactory version 7.84.3, project admins can create access tokens that are tied to the projects in which they hold administrative privileges.

Applied Permission Scopes

These are scopes that apply the permissions based on existing permissions definitions in the platform, either for a specific user, group, admin, or project role.

User Permissions

This scope provides user access as specified in your platform. If left at the default setting, the token will be created with the user-identity scope, which allows users to identify themselves in the Platform but does not grant any other specific access permissions. This scope is used for the user identity tokens.

To apply user permissions, use the scope applied-permissions/user

Admin Permissions

This scope provides admin access as specified in your platform.

To apply admin permissions, use the scope applied-permissions/admin

For example, when setting the following scope in the Create Token REST API call:

applied-permissions/admin" -d "username=test-user"

The token is created with admin permissions and will be associated with the user test-user.

Group Permissions

This scope provides access to groups as specified in your platform. For more information on groups, see Manage Groups.

To apply group permissions, use this scope:

applied-permissions/groups:<GROUP_NAME>[,<GROUP_NAME>...]

Where <GROUP_NAME> is replaced by an actual group name.

Example 1: The following scope creates a token with the permissions of group2:

applied-permissions/groups:"group2"

Example 2: The following scope creates a token with the permissions of all three specified groups:

applied-permissions/groups:"group_1","group 2","group,3"

Role Permissions

This scope provides access to Project Roles as specified in your platform.

To apply role permissions, use this scope:

applied-permissions/roles:<PROJECT_KEY>:<ROLE>[,<ROLE>...]

Use actual values for the <PROJECT_KEY> and <ROLE> placeholders.

For example, The following scope applies the developer and QA role permissions in the jfrogdev project:

applied-permissions/roles:jfrogdev:developer,qa

Enclose a role name with more than one word in quotation marks. For example:

applied-permissions/roles:jfrogdev:developer,qa,"Project Admin"

Resource Permission Scopes

Starting from Artifactory version 7.38.x, you can use access tokens with resource permission scopes to provide scoped access to specific resources, without requiring any permissions to be predefined in the platform or in any project.

The resource permission scope follows this structure:

<RESOURCE_TYPE>:<TARGET>[/<SUB_RESOURCE>]:<ACTIONS>

Where:

Artifact Permissions

For permission to retrieve Artifacts, use this scope artifact:<path>:r,w

For example, the following scope generates an access token with read and write permissions to all files under the org folder in the maven-local repository:

"scope": "artifact:maven-local/org/**:r,w",

Project Permissions

This scope provides access to retrieve lists of projects and project members.

To retrieve the project list, use this scope: project:<project_key>:r

To retrieve project members (users and groups), use this scope: project:<project_key>/members/**:r

To retrieve individual project users only, use this scope: project:<project_key>/members/users/:r

System Permission Scopes

System Permission Scopes enable providing access to system resources without the need for granting admin access.

System Metrics Permissions

For permission to retrieve system metrics use this scope: system:metrics:r

Live Logs Permissions

For permission to retrieve live logs information use this scope: system:livelogs:r

System Access Identities

For permission to retrieve lists of users or groups, use this scope: system:identities:r

System Access Permissions

For permission to retrieve a list of all the permissions in the environment, use this scope: system:permissions:r

System Licenses

For permission to retrieve lists of the currently installed licenses in the environment, use this scope: system:info/licenses:r

System Storage Information

For permission to retrieve storage summary information, use this scope: system:info/storage:r

System Repositories

For permission to retrieve repository configuration information, use this scope: repo:<repo_name>:r

System Webhooks

For permission to retrieve, create, and manage Webhooks, use this scope:

system:webhooks@<project_key>/<JFrog_domain>:r,w,d,x

For example, the following scope generates a token with write permissions to Webhooks, allowing you to create a Webhook subscription.

system:webhooks@DEV1/JFrog.com:w

Non-Admin Read Access

You can provide non-admin users with read permissions for resources using the following token scopes: