Scopes
A token carries only what the athlete approved. Ask for the least you need: a consent screen listing six permissions converts worse than one listing two.
Available scopes
These are the exact strings to put in the scope parameter, space separated, and the wording the athlete sees beside each one.
activities.readRead your activities, their analysis and your planned sessions
activities.writeCreate, change and delete activities on your calendar
athlete.emailRead your email address
athlete.readRead your profile, connected integrations and subscription status
calendar.readRead your calendar notes: races, holidays, illness and injury
cycle.readRead your menstrual cycle data
files.readDownload the original recording files of your activities
metrics.readRead your thresholds and wellness metrics
metrics.writeRecord thresholds and wellness metrics for you
sleep.readRead your sleep sessions
teams.readSee your teams and their members
workouts.readRead the workout library available to you
workouts.writeSave structured workouts to your library
Two are never granted in bulk
cycle.read and athlete.email must always be asked for by name. Nothing else implies them, and an athlete's email is absent from GET /athlete without the scope rather than the request failing.
When a scope is missing
The request is refused with 403 and code insufficient_scope, and the WWW-Authenticate header names the scope that was needed, so you can ask the athlete to re-authorize for it rather than guessing.