Kaizen #3 - Scopes in OAuth2.0 Authorization #API

Kaizen #3 - Scopes in OAuth2.0 Authorization #API

Hello Everyone!

Welcome to another week of Kaizen. We hope you find this series of posts useful. Please share your feedback in the comments section and keep the discussion going. 

In the last kaizen post, we discussed the OAuth2.0 protocol and Self Client. There are two types of clients in OAuth 2.0—self client and web-based applications. 

What you will learn from this post?

In this post, we are going to explore different facets of "Scopes in OAuth2.0 Authorization" in detail. Towards the end of this post, we will see various errors related to scopes, and how you can handle them. 

Role of scopes in OAuth2.0

To use the Zoho CRM APIs, you must authenticate the client(either self client or web-based application) to make API calls on your behalf with an access token. 

The access token, in return, must be obtained from a grant token (authorization code).

Zoho CRM APIs grant access to the CRM data, only if you provide a legitimate access token.

Based on the client-type, there are two different ways to generate grant token:

a. For web-based applications

Web-based applications are chosen when it requires user intervention while authorizing your application. Now, let us see how the OAuth2.0 protocol is implemented for web-based applications.

Step 1: The web application redirects the user to the OAuth server.
Step 2: The user sees the authorization prompt and approves the app's request as shown in the below image.


Step 3: The user is redirected back to the application with an authorization code in a query  string.


Step 4: The application exchanges the authorization code for an access token.

As you can see, this involves user intervention while authorizing your application. 

In the above explanation, in Step 2, the user will authorize the set of permissions for which the token has to be generated. 


b. For self client

In our last kaizen post, in Step 5a, you must enter the set of permissions for which the token has to be generated for a self client.



These sets of permissions you define, before you generate a token are called scopes

Scopes play a major role in OAuth2.0 Authentication. It is required for both self-client and web-based applications. 




A. What is a scope in Zoho CRM?

The word scope translates to range or extent. In OAuth2.0, scopes define the liberty of a self client/ web application on a particular resource(data in Zoho CRM). The scope controls three aspects:

  • The resource to which the client application gains access. Example: Users, Modules, Files, and so on.
  • The client application.
  • The different types of operations that the client application can perform on that particular resource. Example: ALL, READ, WRITE, CREATE, UPDATE, DELETE.
B. How do scopes work?

The access and refresh tokens are generated based on the scopes you provide. 

Based on the token, the system decides whether you have access to perform a certain operation on a particular resource. Thus, there is no room left for data theft, loss, or corruption. For example, with a token that is generated just to view records, you cannot perform the update record operation.

C. Scope Format

The format to define a scope is:
scope=service_name.scope_name.operation_type

The scope consists of three components:
  • service_name - Service name will always be ZohoCRM.
  • scope_name - In scope name, mention the specific resource(data in Zoho CRM) for which the permissions are being defined. It can be settings, modules, users, org, bulk, notification, or coql.
  • operation_type - In operation type, mention what types of operations can be performed on that resource. The following table defines the different operation types in scope:
Operation Type
HTTP Method
Description
READ
GET
The user can just read the data.
CREATE
POST
The user can create records.
WRITE
POST, PUT, DELETE
The user can create, update, and delete the records.
UPDATE
PUT
The user can update the existing records.
DELETE
DELETE
The user can delete the records
ALL
GET, POST, PUT, DELETE
The user can read, create, update, and delete the records.
CUSTOM
It depends on how it is defined in the API.
User-defined, for instance, permission to send emails to leads.

Note:
  • If you give operation type as WRITE in your scope, it is implicitly understood that you are granting permission to CREATE, UPDATE, and DELETE records.
  • Similarly, if you give operation type as ALL in your scope, it is implicitly understood that you are granting permission to READ, CREATE, UPDATE, and DELETE records.
D. Types of scopes

Based on the scope and methods, scopes are broadly differentiated into two types:
  • Sub-scopes
  • Group Scopes
a. Sub-scopes

Here the permission is defined for a specific resource. For instance, if you want to define permissions for leads and contacts modules, the scopes will be:
ZohoCRM.modules.leads.ALL
ZohoCRM.modules.contacts.ALL

Format
scope=service_name.scope_name.sub_scope_name.operation_type

The following table gives you the data about the scopes and different sub scopes. Along with each sub-scope, you can view which resource it is associated with:



Scopes
Sub scopes
settings- This scope usually provides access to metadata and the information on the set-up page of Zoho CRM. 
territories - Data about Territory Management.
custom_views - Data about custom_views created by users in all the modules.
related_lists - Data about related_lists.
modules - Metadata of all the modules.
variables - Data about CRM Variables.
tags - Data about tags.
tab_groups - Data about the tab groups in Zoho CRM.
fields - Data about fields in all the modules.
layouts - Data about layouts in all the modules.
macros - Data about macros operations.
custom_links - Data about the custom links.
custom_buttons - Data about the custom buttons.
roles - Data about roles in your organization.
profiles - Data about profiles in your organization.
organization - Data about your organization.

modules- This scope gives access to all the modules in Zoho CRM.
approvals - Data in the 'My Jobs' tab.
leads
accounts
contacts
deals
campaigns
tasks - Part of the 'Activities' module.
cases
events - Part of the 'Activities' module.
calls - Part of the 'Activities' module.
solutions
products
vendors
pricebooks
quotes
salesorders
purchaseorders
invoices
custom - Scopes cannot be configured for individual custom modules. Use this method for all custom modules.
dashboard - Data on the dashboard page.
notes - Data about notes in each record.
activities - Data about events, calls, and tasks.
Apart from the above two, other scopes are– 
  • users - Data about individual users in Zoho CRM. For more information, refer to Users API.
  • org - Data about your organization. For more information, refer to Organization API.
  • bulk - Permissions to perform bulk operations. For more information, refer to Bulk API.
  • notification - Permissions to send/receive instant notifications of actions performed on a module. For more information, refer to Notification API.
  • coql - Permissions to write your queries. For more information, refer to Query API.
b. Group Scopes

Format
scope=service_name.scope_name.operation_type

Imagine that you need to set permissions for all the modules. With sub-scopes, you must enter the following list of scopes—
ZohoCRM.modules.leads.ALL,ZohoCRM.modules.accounts.ALL,ZohoCRM.modules.contacts.ALL,ZohoCRM.modules.deals.ALL,ZohoCRM.modules.campaigns.ALL,ZohoCRM.modules.tasks.ALL,ZohoCRM.modules.cases.ALL,ZohoCRM.modules.events.ALL,ZohoCRM.modules.calls.ALL,ZohoCRM.modules.solutions,ZohoCRM.modules.products,ZohoCRM.modules.vendors,ZohoCRM.modules.pricebooks,ZohoCRM.modules.quotes,ZohoCRM.modules.salesorders,ZohoCRM.modules.purchaseorders,ZohoCRM.modules.invoices,ZohoCRM.modules.custom.

This is both cumbersome and exposing all these details in UI is not advisable. Thus, we came up with group scopes. With group scopes, you can define a set of permissions for a collective resource set. So, if you need to set permissions for modules, you can define the scope as:

ZohoCRM.modules.ALLThis gives the user access to perform all operations in all the modules in Zoho CRM.




E. Possible Errors

Error Code
Reason
Strategy to handle 
INVALID_SCOPE
The scope value is invalid.
Check the service name, scope name, and the sub-scope.
INVALID_OPERATION_TYPE
The operation type is invalid.
Ensure you have defined the operation type correctly. It must be either—READ, CREATE, WRITE, UPDATE, DELETE, ALL, or CUSTOM.
OAUTH_SCOPE_MISMATCH
The operation you performed does not have the required scope.
Check if the operation you are trying to perform is allowed in the scopes defined or not.

Note:

The INVALID_SCOPE and INVALID_OPERATION_SCOPE errors might be thrown while generating a grant token. The OAUTH_SCOPE_MISMATCH error might be thrown while you make an API call.

F. How to revoke access?

As mentioned earlier in this post, tokens are generated based on the scopes. 

There are two use-cases here. 

a. If you are a user who wants to revoke the access given to any web-application, then it has to be done via accounts web UI. 

To revoke the access:


Step 2: Choose 'Active Authtokens'.

Step 3: Click on 'Connected Apps'. Here you will be able to see all the active applications, click on the delete button to revoke access. 




b. If you are a client/developer, to revoke permissions for your self-client, you must revoke the access and refresh tokens.

You cannot revoke the access token as it expires after an hour of its generation.
To revoke the refresh token, make a POST request with the following URL:
"{{Accounts_URL}}/oauth/v2/token/revoke?token={refresh_token}"

Note that you must use domain-specific Zoho Accounts URL to revoke your refresh token. 

We will meet you next week with another useful topic. 

Cheers!

Previous 'Kaizen' - OAuth2.0 and Self Client #API
Next 'Kaizen' - Troubleshooting OAuth2.0




























    Access your files securely from anywhere







                            Zoho Developer Community





                                                  Use cases

                                                  Make the most of Zoho Desk with the use cases.

                                                   
                                                    

                                                  eBooks

                                                  Download free eBooks and access a range of topics to get deeper insight on successfully using Zoho Desk.

                                                   
                                                    

                                                  Videos

                                                  Watch comprehensive videos on features and other important topics that will help you master Zoho Desk.

                                                   
                                                    

                                                  Webinar

                                                  Sign up for our webinars and learn the Zoho Desk basics, from customization to automation and more

                                                   
                                                    
                                                  • Desk Community Learning Series


                                                  • Meetups


                                                  • Ask the Experts


                                                  • Kbase


                                                  • Resources


                                                  • Glossary


                                                  • Desk Marketplace


                                                  • MVP Corner




                                                            • Sticky Posts

                                                            • Kaizen #197: Frequently Asked Questions on GraphQL APIs

                                                              🎊 Nearing 200th Kaizen Post – We want to hear from you! Do you have any questions, suggestions, or topics you would like us to cover in future posts? Your insights and suggestions help us shape future content and make this series better for everyone.
                                                            • Kaizen #198: Using Client Script for Custom Validation in Blueprint

                                                              Nearing 200th Kaizen Post – 1 More to the Big Two-Oh-Oh! Do you have any questions, suggestions, or topics you would like us to cover in future posts? Your insights and suggestions help us shape future content and make this series better for everyone.
                                                            • Celebrating 200 posts of Kaizen! Share your ideas for the milestone post

                                                              Hello Developers, We launched the Kaizen series in 2019 to share helpful content to support your Zoho CRM development journey. Staying true to its spirit—Kaizen Series: Continuous Improvement for Developer Experience—we've shared everything from FAQs
                                                            • Kaizen #193: Creating different fields in Zoho CRM through API

                                                              🎊 Nearing 200th Kaizen Post – We want to hear from you! Do you have any questions, suggestions, or topics you would like us to cover in future posts? Your insights and suggestions help us shape future content and make this series better for everyone.
                                                            • Client Script | Update - Introducing Commands in Client Script!

                                                              Have you ever wished you could trigger Client Script from contexts other than just the supported pages and events? Have you ever wanted to leverage the advantage of Client Script at your finger tip? Discover the power of Client Script - Commands! Commands


                                                            Manage your brands on social media



                                                                  Zoho TeamInbox Resources



                                                                      Zoho CRM Plus Resources

                                                                        Zoho Books Resources


                                                                          Zoho Subscriptions Resources

                                                                            Zoho Projects Resources


                                                                              Zoho Sprints Resources


                                                                                Qntrl Resources


                                                                                  Zoho Creator Resources



                                                                                      Zoho CRM Resources

                                                                                      • CRM Community Learning Series

                                                                                        CRM Community Learning Series


                                                                                      • Kaizen

                                                                                        Kaizen

                                                                                      • Functions

                                                                                        Functions

                                                                                      • Meetups

                                                                                        Meetups

                                                                                      • Kbase

                                                                                        Kbase

                                                                                      • Resources

                                                                                        Resources

                                                                                      • Digest

                                                                                        Digest

                                                                                      • CRM Marketplace

                                                                                        CRM Marketplace

                                                                                      • MVP Corner

                                                                                        MVP Corner






                                                                                          Design. Discuss. Deliver.

                                                                                          Create visually engaging stories with Zoho Show.

                                                                                          Get Started Now


                                                                                            Zoho Show Resources


                                                                                              Zoho Writer Writer

                                                                                              Get Started. Write Away!

                                                                                              Writer is a powerful online word processor, designed for collaborative work.

                                                                                                Zoho CRM コンテンツ








                                                                                                  Nederlandse Hulpbronnen


                                                                                                      ご検討中の方




                                                                                                            • Recent Topics

                                                                                                            • Search Records returning different values than actually present

                                                                                                              Hey! I have this following line in my deluge script: accountSearch = zoho.crm.searchRecords("Accounts","(RS_Enroll_ID:equals:" + rsid + ")",1,200,{"cvid":864868001088693817}); info "Account search size: " + accountSearch.size(); listOfAccounts = zoho.crm.searchRecords("Accounts","(RS_Enroll_ID:equals:"
                                                                                                            • Delete commerce website

                                                                                                              I need to delete a commerce website, but the only option is to click on settings, REQUEST DELETE, choose an urgency notice, add a message....AND THEN nothing, no way to send the request. Why is nothing simple!?!?!  I just want to delete the store.  The
                                                                                                            • Adding external users to Zoho Social under Zoho ONE licence - how to best achieve this

                                                                                                              My client has a small business, and we are looking to implementing Zoho ONE with a single flexible user licence as that is all they really need and offers the best pricing for the range of modules we eventually wish to set them up with, one of which will
                                                                                                            • Has anyone built a custom AI support agent inside Zoho (SalesIQ/Zobot)?

                                                                                                              Hi all, I’ve been experimenting with building my own AI support assistant and wanted to see if anyone here has tackled something similar within Zoho. Right now, I’ve set up a Retrieval-Augmented Generation (RAG) pipeline outside of Zoho using FAISS. It
                                                                                                            • Zoho Creatorの一括操作における処理の同期/非同期について

                                                                                                              現在、Creatorのレポート機能を利用して、複数のレコードに対して一括で処理を実行しようとしていますが、処理の実行順序について確認したいことがあります。 レポート内の複数レコードに一括で処理を実行した際、処理は同期的に行われるのでしょうか?それとも非同期的に行われるのでしょうか? 【同期処理の場合】 レコード①に対する処理が開始され、終了後にレコード②に対する処理が開始され、最後にレコード③に対する処理が実行されるように、処理が順番に行われる場合。 【非同期処理の場合】 レコード①、レコード②、レコード③の処理が一斉に開始され、それぞれ並行して処理が行われ、全処理が終了する場合。
                                                                                                            • Whats the Time out Limit for API Calls from Deluge?

                                                                                                              Hi Creator Devs, We are making API calls to third party server via Deluge. Getting this error message: Error at line : 24, The task has been terminated since the API call is taking too long to respond. Please try again after sometime. Whats the default
                                                                                                            • Can't create package until Bill created?

                                                                                                              I can't understand why we cannot create a package until a Bill is created? We are having to created draft Bills to create a package when the item is received, but we may not have received a Bill from the supplier. Also, Bill # is required, but we normally
                                                                                                            • This mobile number has been marked spam. Please contact support.

                                                                                                              Problem Description: One of our sales agents in our organization is unable to sign in to Zoho Mail. When attempting to log in, the following message appears: This mobile number has been marked as spam. Please contact support at as@zohocorp.com @zohocorp
                                                                                                            • Print checks for owner's draw

                                                                                                              Hi.  Can I use Zoho check printing for draws to Owner's Equity?  This may be a specific case of the missing Pay expenses via Check feature.  If it's not available, are there plans to add this feature?
                                                                                                            • Dynamically prefill ticket fields

                                                                                                              Hello, I am using Zoho Desk to collect tickets of our clients about orders they placed on our website. I would like to be able to prefill two tickets fields dynamically, in this case a readonly field for the order id, and a hidden field for the seller id. The clients access the ticket form by clicking a link in our customer area, so ideally I would like to pass the values to prefill with as part of the URL. I imagine that this could be along the lines of calling https://our-domain/portal/newticket?order_id=123&seller_id=456
                                                                                                            • Zoho Desk Partners with Microsoft's M365 Copilot for seamless customer service experiences

                                                                                                              Hello Zoho Desk users, We are happy to announce that Zoho Desk has partnered with Microsoft's M365 to empower customer service teams with enhanced capabilities and seamless experiences for agents. Microsoft announced their partnership during their keynote
                                                                                                            • Zoho Books - Show Related Sales Orders on Quotes

                                                                                                              Hi Books team, I've noticed that the Quotes don't show show the related Sales Order. My feature request is to also show related Sales Orders above the Quote so it's easy to follow the thread of records in the sales and fulfilment process. Below screenshot
                                                                                                            • Zoho Books - Hide Convert to Sales Order if it can't be used.

                                                                                                              Hi Books team, I noticed that it is not possible to convert a Quote to a Sales Order when a Quote is not yet marked as accepted. My idea is to not show the Convert to Sales Order button when it is not possible to use it, or show it in a grey inactive
                                                                                                            • What’s New in Zoho Inventory | April 2025

                                                                                                              Hello users, April has been a big month in Zoho Inventory! We’ve rolled out powerful new features to help you streamline production, optimise stock management, and tailor your workflows. While several updates bring helpful enhancements, three major additions
                                                                                                            • Copy a Record Template from one Form to another

                                                                                                              I have a Creator application with several forms.  I developed a record template for one of the reports/forms but want to use most of it for another of the form/report combinations in the application. Is there a way to copy the template (code or otherwise) to another form?
                                                                                                            • Zoho Books - Quotes to Sales Order Automation

                                                                                                              Hi Books team, In the Quote settings there is an option to convert a Quote to an Invoice upon acceptance, but there is not feature to convert a Quote to a Sales Order (see screenshot below) For users selling products through Zoho Inventory, the workflow
                                                                                                            • Zoho Books - Include Quote Status in Workflow Field Triggers

                                                                                                              Hi Zoho Books team, I recently tried to create a Workflow rule based on when a Quote is Accepted by the customer. This is something which I thought would be very easy to do, however I discovered that Status is not listed as a field which can be monitored
                                                                                                            • When Zoho Tables Beta will be open to EU data center

                                                                                                              Hello all, We in EU are looking at you all using and testing and are getting jealous :) When we will be able to get into the beta also? We don't mind testing and playing with beta software. Thank you!
                                                                                                            • Pass current date to a field using Zoho Flow

                                                                                                              I am trying to generate an invoice automatically once somebody submits a record in Zoho CRM. I get an error in the invoice date. I have entered {{zoho.currentdate}} in the Date field. When I test the flow, I get "Zoho Books says "Invalid value passed
                                                                                                            • API: Mark Sales Order as Open + Custom Status

                                                                                                              Hi, it's possible to create Custom Status (sub-status actually) states for the Sales Order. So you have Open, Void. Then under Open you can have Open, and create one called Order Paid, Order Shipped, etc etc...which is grouped under Open. I can use the
                                                                                                            • Zoho Quartz Screen Recording

                                                                                                              Hello, can we get access to Quartz, please, as a standalone solution? It would be great for creating training videos for current and future staff on how to use Zoho software according to our company requirements. Thank you
                                                                                                            • Zoho Books - France

                                                                                                              L’équipe de Zoho France reçoit régulièrement des questions sur la conformité de ses applications de finances (Zoho Books/ Zoho Invoice) pour le marché français.   Voici quelques points pour clarifier la question :   Zoho Books est un logiciel de comptabilité
                                                                                                            • Utilisation de Zoho en conformité avec l’article 286 du Code général des impôts (CGI)

                                                                                                              Cher(e) client(e), Conformément à l’article 286 du Code général des impôts (CGI) impose aux entreprises assujetties à la TVA d’utiliser des systèmes de caisse ou de gestion commerciale certifiés lorsqu’elles enregistrent des ventes à des particuliers.
                                                                                                            • Please add an “Auto-Apply Unused Credits” toggle

                                                                                                              Hello — please add a simple org-level option to automatically apply unused credits (credit notes, excess payments, retainers) to new invoices and/or bills. An ON/OFF toggle with choices “invoices”, “bills”, or “both” would save lots of manual work for
                                                                                                            • Tip 26: How to hide the "Submit" button from a form

                                                                                                              Hi everyone, Hope you're staying safe and working from home. We are, too. By now, we at Zoho are all very much accustomed to the new normal—working remotely. Today, we're back with yet another simple but interesting tip--how to hide the Submit button from your forms. In certain scenarios, you may want to hide the submit button from a form until all the fields are filled in.  Use case In this tip, we'll show you how to hide the Submit button while the user is entering data into the form, and then
                                                                                                            • filter broke my data

                                                                                                              I uploaded a file recently from Sheets and it has top 2 rows frozen, with table headers in second row and each one is filterable. somehow my first 2 columns became unfiltered and no matter what I do I cannot reapply the filter?? also didn't realize they
                                                                                                            • Zoho MCP has no tools for Creator or 3rd Party Apps?

                                                                                                              I don't see a Zoho MCP community forum so putting this here. Two big problems I see: 1) Although Zoho advertises "over 950 3rd party apps" as available through their MCP, when I go to "Add Tools" there are ZERO 3rd party apps available to choose from.
                                                                                                            • Generate a link for Zoho Sign we can copy and use in a separate email

                                                                                                              Please consider adding functionality that would all a user to copy a reminder link so that we can include it in a personalized email instead of sending a Zoho reminder. Or, allow us to customize the reminder email. Use Case: We have clients we need to
                                                                                                            • Zoho Calendar soft bounce on @hotmail.com and @yahoo.com email addresses

                                                                                                              Hello, our Zoho calendar recently does not send the calendar invites to emails with hotmail and yahoo domains and comes back with a "soft bounce". other domains like Gmail works fine. Also sending "email" to the same emails to the above domains work well
                                                                                                            • Zoho Sign: need to leave document pending for up to a year, or maybe there's a better way?

                                                                                                              I have zoho one, maybe there's a better way to do this with another service than sending a zoho sign template from zoho crm. At the end of the day this requirement is due to regulations, no matter how dumb it may seem. I'm just looking for a way of getting
                                                                                                            • how to use validation rules in subform

                                                                                                              Is it possible to use validation rules for subforms? I tried the following code: entityMap = crmAPIRequest.toMap().get("record"); sum = 0; direct_billing = entityMap.get("direct_billing_details"); response = Map(); for each i in direct_billing { if(i.get("type")
                                                                                                            • Separate Items & Services

                                                                                                              Hi, please separate items and services into different categories. Thank you
                                                                                                            • Control who sees Timeline and Interactions in Zoho CRM through Profiles

                                                                                                              The feature has been enabled for all DCs (except US, EU, and IN DCs). We will be rolling it out to the other DCs in the upcoming days. Dear All, In a CRM, not all users would require access to the history of a record. For instance, a Marketing Operations
                                                                                                            • Mastering Zia Match Scores | Let's Talk Recruit

                                                                                                              Feeling overwhelmed by hundreds of resumes for every job? You’re not alone! Welcome back to Let’s Talk Recruit, where we break down Zoho Recruit’s features and hiring best practices into simple, actionable insights for recruiters. Imagine having an assistant
                                                                                                            • We are unable to process your request now. Please try again after sometime or contact support@zohoaccounts.com

                                                                                                              I cannot sign up and return the error of we are unable to process your request now. Please try again after sometime or contact support@zohoaccounts.com
                                                                                                            • Multi-currency - What's cooking ?

                                                                                                              Hi,       We have been doing this feature for sometime and we would like to give you some glimpses of it.  Working with Multi Currency :        Multicurrency support gives you the ability to handle business transactions in multiple currencies. You can define a base currency for your organization and add more currencies with exchange rates based on the base currency.  Setup :        From the setup page, you can manage all the currencies supported by your organization.       Currencies page        
                                                                                                            • Integrating Chatbot with Zoho Creator Application

                                                                                                              Is it possible to integrate a chatbot with a Zoho Creator application?
                                                                                                            • How to reduce programmatically the image uploaded by user?

                                                                                                              I need a function that will automatically reduce the pixel dimension to 800 x 600 pixels / 180 resolution or (approx. 1.37MB) of image uploaded by user from digital camera, for example, 2271 x 1704 pixels /180 resolution or approx. 11.1MB. After the user selected the image, the function will able to detect if pixels is above 800x600, process the photo (crop/ reduce) and resume upload. Need help...  
                                                                                                            • Dark mode for Zoho Creator / Zoho CRM Code editor

                                                                                                              Hi Team, Is there any plans for Dark mode in Zoho creator / Zoho Crm code editor and development pages in pipeline?
                                                                                                            • Is there a way to make a button scroll down?

                                                                                                              Looking to have a button on a landing page scroll down to another section on the page. Any recomendations outside of coding?
                                                                                                            • Next Page