Minimal scopes per action
Each Microsoft Fabric connection also requests
openid, offline_access, and Workspace.Read.All. These connection scopes apply in addition to the action scopes in the table.| Action | Description | Minimum scopes |
|---|---|---|
| Execute GraphQL mutation | Executes one GraphQL mutation that can change Fabric data. | GraphQLApi.Execute.All |
| Execute GraphQL query | Executes one GraphQL query operation. | GraphQLApi.Execute.All |
| Inspect GraphQL schema | Inspects a Fabric GraphQL API schema before composing a query or mutation. | GraphQLApi.Execute.All |
| List GraphQL APIs | Lists Fabric GraphQL APIs in a workspace. | Workspace.Read.All |
| List workspaces | Lists Fabric workspaces the signed-in user can access. | Workspace.Read.All |
| Resolve GraphQL API | Resolves a Fabric GraphQL API by UUID, endpoint URL, or exact name. | Workspace.Read.All |
| Resolve workspace | Resolves a Fabric workspace by UUID, URL, or exact name. | Workspace.Read.All |
GraphQLApi.Execute.All covers both queries and mutations. The OAuth scope only lets Langdock call the API on the user’s behalf. Whether a user can actually read or change data depends on the Execute permission on the GraphQL API item in Fabric and on the permissions of its underlying sources. See Control access and mutations for how to keep an API read only.