# The eight scopes

`GET /functions/v1/mandate-scopes`

A closed vocabulary of eight scopes, matched exactly, with labels served by the engine so every consent screen reads identically.

Public, cacheable, and it carries no subject data. Optional `accept-language`: `en`, `pt-BR`, `es`, with a silent English fallback.

## The scopes

| scope | What it authorises | Amount ceiling | Constraints |
| --- | --- | --- | --- |
| login | Sign in as you | no | optional |
| purchase | Buy something | allowed | optional |
| payment | Pay someone | allowed | optional |
| task | Carry out an action with no money involved | no | **required** |
| signature | Sign a document | no | optional |
| data_share | Share your data with a third party | no | optional |
| id_proof | Prove an attribute without revealing it | no | optional |
| access | Open a door or unlock a resource | no | optional |

## The rules that keep the vocabulary closed

- Exact matching only — no wildcard, no prefix, no dot-notation. An unknown scope is refused with `UNKNOWN_SCOPE`, a dotted scope with `WILDCARD_SCOPE_FORBIDDEN`.
- One scope per use is promised publicly, so a consent screen can be written once.
- Only `purchase` and `payment` take money; anything else with an amount is `AMOUNT_CEILING_NOT_APPLICABLE`.
- `task` is the single scope for a non-money action and has no subtypes. It requires constraints, because an unconstrained task mandate is a shared password with a biometric proof attached.
- Recurrence is `ceiling.period`, never a scope.

## Response

`version: v2`, `locale`, `matching: "exact"`, `money_scopes`, `constraint_required_scopes`, and the scope list with `{ scope, accepts_amount_ceiling, requires_constraints, label, description }`.

Accept-Language: en:

```
{
  "version": "v2",
  "locale": "en",
  "matching": "exact",
  "money_scopes": ["purchase", "payment"],
  "constraint_required_scopes": ["task"],
  "scopes": [
    {
      "scope": "login",
      "accepts_amount_ceiling": false,
      "requires_constraints": false,
      "label": "Sign in",
      "description": "Sign in on your behalf"
    }
  ]
}
```

Accept-Language: pt-BR:

```
{
  "version": "v2",
  "locale": "pt-BR",
  "matching": "exact",
  "scopes": [
    {
      "scope": "login",
      "accepts_amount_ceiling": false,
      "requires_constraints": false,
      "label": "Entrar",
      "description": "Entrar em seu nome"
    }
  ]
}
```

`scope` and every other field name are always English and never localised; only `label` and `description` change.

## Why the labels come from the engine

Every client's consent screen then reads identically, instead of each one writing its own wording for the same authority.