Manage Action-Level Scopes

Control which integration actions are enabled in your workspace and which OAuth scopes Langdock can request when users connect. Use this page when you want to review action access, prepare a custom OAuth client, or understand why an action shows Missing scope.

How scopes control actions

Every integration action needs one or more OAuth scopes from the connected provider. For example, an Outlook Calendar action may need Calendars.ReadWrite before it can create or update calendar events. Langdock groups actions by the scopes they need. When you enable or disable an action, you may also change which scopes Langdock requests from the OAuth provider. The OAuth client selected for a new connection determines how these requested scopes are managed. Use the table below to compare how different OAuth Clients can manage the available scopes of your integration.

Mode	Scope behavior
Langdock Client	Langdock keeps requested scopes in sync with enabled or shared actions.
Scope sync on	The selected custom OAuth client uses the same automatic scope sync behavior.
Scope sync off	The selected custom OAuth client uses Fixed scopes that you manage manually.

Control new actions

In your Integrations settings, you can find the New actions enabled by default setting, which controls what happens when Langdock adds an action to an existing integration.

The New actions enabled by default toggle in workspace integration settings

Langdock checks whether the OAuth client for the new connection already covers the action’s required scopes.

Actions whose required scopes are covered are enabled automatically.
Actions with missing scopes stay disabled until you add or sync the required scopes.

When a new action starts disabled, each active workspace admin gets an in-app notification for that integration and one email for the workspace. Both open the integration settings so you can turn the action on. A Delete action stays locked while Enable delete actions is off.

On dedicated deployments, the email is only sent if the deployment is configured for email delivery. The in-app notification is still created.

The same rule applies when Langdock adds a scope to an existing action. A new scope never silently expands what Langdock can request from your provider. That change does not send an in-app notification or an email.

Enable delete actions

In your Integrations settings, Enable delete actions controls every action classified as Delete. It sits next to New actions enabled by default, and it is on by default.

Each Delete action keeps the enabled state you set for it. View and Change actions are not controlled by this switch.

Manage built-in integrations with Enable delete actions turned off

Action list with View and Change still on, and Delete expense locked off. The tooltip says delete actions were turned off by a workspace admin.

Turn Enable delete actions back on and each Delete action returns to the setting it had before.

Choose an OAuth client mode

When using integrations, you can either choose to use the Langdock Client or to Bring Your Own OAuth Client. In your Integrations settings, select a built-in integration and scroll to Scopes and Action Access to configure the OAuth client mode for that integration.

Langdock Client
Custom OAuth client

Use the Langdock Client when you want Langdock to manage OAuth scopes for you. This is the default on Multi-Tenant Cloud for integrations where Langdock provides a managed OAuth client.Langdock requests the auth scopes needed to identify the user, such as openid, email, and offline_access. It also requests the scopes required by actions that are enabled for everyone or shared with specific users and groups.You do not edit scopes manually. To change the requested scopes, enable, disable, or share actions.

Scopes and Action Access section with the Langdock Client active, showing scope groups with their status badges

Review scope status

Use Scope view to see which scopes are part of the active requested set. Scope groups with a green check are requested. Scope groups with a red X are not requested.

Scope view active in the Scopes and Action Access section, with one scope group expanded to show its actions

Use Action view to manage actions one by one. This view is useful when you want to search for an action, sort by enabled state, or check the scopes a specific action needs.

Action view active in the Scopes and Action Access section, showing actions with their required scopes and enabled toggles

If an action needs a scope that is not currently requested, hover the Missing scope badge. With the Langdock Client, enabling the action adds that scope to the requested scopes after you confirm the change.

Hover tooltip on a Missing scope badge in the Langdock Client view, showing the message Enable action to add it to the requested OAuth scopes

Confirm scope updates

When your change adds or removes a scope, Langdock shows a confirmation dialog before updating the requested scopes. After you confirm, users need to refresh their connection before the newly granted scope is available.

Confirmation dialog shown when enabling an action introduces a new OAuth scope

Existing connections keep their granted scopes until users refresh the connection or their access token expires.

Manage action access

Each action can be available to all users or shared with specific users and groups. See Manage Action Access for how to control who can use an integration and its actions.

What changes in this mode

Change	Result
Enable an action	The action is enabled. Missing scopes are added after you confirm. A Delete action stays off, and its switch stays locked, while Enable delete actions is off.
Disable an action	The action is disabled. Scopes are removed if no other enabled or shared action needs them.
Langdock adds an action whose required scopes are covered	The action follows New actions enabled by default. A new Delete action still stays off while Enable delete actions is off.
Langdock adds an action with missing scopes	The action stays disabled until you enable it and confirm the scope change. You can’t turn a Delete action on while Enable delete actions is off.
Langdock adds a scope to an existing action	The action keeps its current state. The scope is requested only if an enabled or shared action needs it.

Use custom OAuth clients when your workspace runs on a dedicated deployment, or when you want your own branding, tenant policies, and rate limits on the consent screen.See Bring Your Own OAuth Client for the setup steps.Each custom client stores its own scopes and Sync scopes with enabled actions setting. Open the settings icon on the client card you want to configure. The setting applies to new connections that select that client and to existing connections when they reauthorize through it.

Sync scopes with enabled actions

Turn Sync scopes with enabled actions on when you want that custom OAuth client to behave like the Langdock Client. Langdock requests auth scopes plus the scopes required by enabled or shared actions.This is the recommended setup if you mainly need your own OAuth client because the Langdock Client cannot be used. In this case, Langdock still keeps the requested scopes minimal and up to date with your enabled actions.When you turn Sync scopes with enabled actions off, you manage the requested scopes for that client yourself. You can either use Langdock’s recommended scopes as a fixed list, or define custom scopes for your own setup.

Use Fixed scopes

Turn Sync scopes with enabled actions off when you want to manage the requested scopes yourself. The OAuth client switches to Fixed scopes mode, and the Scopes field becomes the source of truth.Use the controls next to the scope pills to reset to the recommended defaults, copy the full list, or edit scopes manually.Fixed scopes are useful when your security team reviews OAuth scopes separately from action access, or when you want the requested scopes to stay stable across action changes.

Manage actions with Fixed scopes

Langdock still checks every action against the scopes the selected custom OAuth client requests.

Scope configured means the action’s required scopes are included in your client. You can enable a View or Change action normally. A Delete action stays locked while Enable delete actions is off.
Missing scope means at least one required scope is not included in your client.

Hover Missing scope to see which scopes need to be added. The tooltip includes Add it to your OAuth client configuration, which opens the OAuth client dialog with the missing scopes prefilled.

Confirm actions with missing scopes

If you enable an action with missing scopes, Langdock asks you to confirm first. The action can appear enabled, but it will not run until the missing scopes are added to the OAuth client.

Work with custom scopes

Some workspaces request different scopes than Langdock’s defaults. A common Microsoft example is using Sites.Selected instead of Sites.ReadWrite.All for SharePoint, so Langdock can only access selected sites. See Microsoft integration scopes for the affected actions and selected-site limitations.Langdock compares actions against the scopes they declare. If an action declares Sites.ReadWrite.All, it may still show Missing scope even when Sites.Selected gives the action enough access in your tenant.To use custom scopes:

Switch to Fixed scopes

Open the settings icon on the custom client card, turn Sync scopes with enabled actions off, and enter the exact scopes you want Langdock to request through that client.

Turn off new actions by default

In Manage built-in integrations, turn New actions enabled by default off.

Enable actions manually

Enable each action after you confirm that it works with your custom scopes. You can’t turn a Delete action on while Enable delete actions is off.

Review every release

When Langdock adds actions, review whether they can run with your custom scopes. If those actions start disabled, each active workspace admin gets an in-app notification and an email. Use the Export scope configuration CSV to share the review with your OAuth client admin.

What changes in this mode

Change	Result
Enable an action with configured scopes	The action is enabled. The requested scopes do not change. A Delete action stays off, and its switch stays locked, while Enable delete actions is off.
Enable an action with missing scopes and scope sync on	Langdock adds the missing scopes to the requested scopes after you confirm. A Delete action stays off while Enable delete actions is off, and Langdock does not add its scopes.
Enable an action with missing scopes and Fixed scopes	The action can be enabled after confirmation, but it may not run unless your custom scopes provide the required access. A Delete action stays off, and its switch stays locked, while Enable delete actions is off. Review this before enabling the action for users.
Add a scope to the OAuth client	View and Change actions that need the scope can be enabled and run. A Delete action stays off while Enable delete actions is off.
Remove a scope from the OAuth client	Actions that need the scope show Missing scope. They remain enabled, but fail to run until you add it back or confirm that your custom scopes provide the required access.
Langdock adds an action with configured scopes and scope sync on	The action follows New actions enabled by default. A new Delete action still stays off while Enable delete actions is off.
Langdock adds an action with configured scopes and Fixed scopes	The action stays disabled until you review and enable it. You can’t turn a Delete action on while Enable delete actions is off.
Langdock adds an action with missing scopes	The action stays disabled until you add the scope and enable it, or until you enable it manually after confirming that your custom scopes provide the required access. You can’t turn a Delete action on while Enable delete actions is off.

Pair Fixed scopes with New actions enabled by default turned off. New actions will not appear enabled before you review their scopes.

Native actions

Native actions that power core Langdock features stay on. You cannot turn them off. Those native actions support:

File attachments from integrations in chat and Agents.
Folder syncing.
Company Knowledge.
Access checks for synchronized attachments from integrations.

Native actions that show names instead of raw IDs in forms can be turned off. While the action is on, forms show names. Turn it off and the fields accept raw IDs.

Action view with List files in folder locked on beside Resolve file turned on. The tooltip says forms show names instead of raw IDs, and turning the action off stops requesting its scopes.

Action view with List files in folder still locked and Resolve file turned off, with no Share button. The tooltip says fields accept raw IDs and its scopes are no longer requested.

When you use the Langdock Client or a custom OAuth client with Sync scopes with enabled actions turned on, scopes for native actions that stay on cannot be removed from the requested set. Turning off a native action that shows names instead of raw IDs removes its scopes from that set when no other enabled or shared action needs them. With a custom OAuth client that uses Fixed scopes, you can configure a setup where Langdock does not request the scopes required for native actions. Changing these switches does not rewrite a fixed scope list.

Not requesting scopes for the native actions listed above can break those features. It can also affect the user experience beyond direct integration usage in chat, Agents, or Workflows.

Export scope configuration

Click Export scope configuration to download a CSV of the current action and scope configuration.

The export includes each action’s name, description, required scopes, enabled state, and sharing configuration. Use it when you need to review integration access with your security team or the admin who manages your OAuth provider.

FAQ

A new action is disabled. What happened?

The action is disabled when New actions enabled by default is off, when the OAuth client selected for new connections does not request every scope the action needs, or when the action is classified as Delete and Enable delete actions is off.When a new action starts disabled because New actions enabled by default is off or scopes are missing, each active workspace admin gets an in-app notification and an email. Turning Enable delete actions off does not send that notification.You can turn the action on from your OAuth setup, unless it is a Delete action and Enable delete actions is off. The Delete action switch stays locked until Enable delete actions is on. Turning another action on may add permissions to the requested scopes. If you use Fixed scopes, add the missing scopes to your OAuth client first.To enable future actions automatically when all required scopes are already part of the OAuth client, turn New actions enabled by default on. Delete actions still follow Enable delete actions.

Why don't I see Sync scopes with enabled actions?

The toggle only appears for custom OAuth clients. The Langdock Client always syncs scopes with enabled and shared actions.

I enabled an action but users still see an error. Why?

Existing connections keep the scopes granted at connection time. After you add a scope, users need to refresh their connection before the new scope is granted.

An action shows Missing scope, but I added it in Azure.

Open the settings icon on the custom client card that applies to the affected users. Confirm that the scope is listed there and as an API permission in your Azure app registration. If admin consent is required, confirm that it has been granted.

Can I keep current actions enabled but block future ones?

Yes. Turn New actions enabled by default off. Existing actions keep their current state. Future actions are disabled until you review them. A Delete action still follows Enable delete actions.

Can a workspace use more than one custom OAuth client?

Yes. A workspace can keep one client active for the entire workspace, several User choice clients, and group clients whose members do not overlap. Each client keeps its own scope list and scope sync setting.

Why are scopes still requested after I disabled an action?

With the Langdock Client or a custom OAuth client with Sync scopes with enabled actions turned on, Langdock removes a scope only when no enabled or shared action needs it. Auth scopes such as offline_access and openid are always requested.With Fixed scopes, Langdock never changes the requested scopes automatically.

Bring Your Own OAuth Client

Set up a custom OAuth application for an integration.

Integrations settings

Review action access in your workspace.

Microsoft

Grant tenant-wide admin consent for Microsoft integrations.

Integrations Guide

Learn how integrations work in Langdock.

Workspace

Manage Agents

Manage Workflows

Manage Meetings

Manage Apps

Desktop app

Manage Integrations

Manage Usage

Bring your own Keys (BYOK)

Governance

Compliance & Governance

AI Adoption & Rollout

Security

Billing

Manage Action-Level Scopes

How scopes control actions

Control new actions

Enable delete actions