# Unable to assign PAT token scopes for Launchers **URL:** \ **Category:** SHF Discussion and Questions\ **Tags:** sailpoint-identity-security, apis\ **Created:** [May 28, 2026, 7:40am UTC](https://developer.sailpoint.com/discuss/t/unable-to-assign-pat-token-scopes-for-launchers/210706 "2026-05-28T07:40:05Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![david\_thomas](https://avatars.discourse-cdn.com/v4/letter/d/a6a055/32.png) [@david\_thomas](https://developer.sailpoint.com/discuss/u/david_thomas)\ **Post date:** [May 28, 2026, 7:40am UTC](https://developer.sailpoint.com/discuss/t/unable-to-assign-pat-token-scopes-for-launchers/210706/1 "2026-05-28T07:40:05Z")
I would like to assign permissions to a PAT token to read launcher information via this API: > **[get-launchers | SailPoint Developer Community](https://developer.sailpoint.com/docs/api/v2026/get-launchers/)** > > The SailPoint Developer Community has everything you need to build, extend, and automate scalable identity solutions. On the page above, it mentions you can use scopes ‘sp:launcher-admin:read’ or ‘sp:launcher-user:read’ to call this endpoint, but it’s not possible to add either of these scopes to a PAT token, they just aren’t there. Also, it’s not possible to create a User Level that includes this access. Are these scopes not implemented yet? Or is there another way to grant these to my PAT token? PS. the API call works if I give it full access via sp:scopes:all and am an admin, but if you aren’t, you get a 500 response from the API, not a 403 (forbidden). It feels like this endpoint isn’t fully implemented yet. ---
**Author:** ![ROHPU](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/rohpu/32/36109_2.png) [@ROHPU](https://developer.sailpoint.com/discuss/u/ROHPU)\ **Post date:** [May 28, 2026, 9:11am UTC](https://developer.sailpoint.com/discuss/t/unable-to-assign-pat-token-scopes-for-launchers/210706/2 "2026-05-28T09:11:19Z")
Yeah, I think you’re right. I’m seeing the same thing on my side too. The docs mention the `sp:launcher-admin:read` and `sp:launcher-user:read` scopes, but they just don’t show up anywhere when creating a PAT. I also tried checking via User Levels, and there’s no way to include those permissions there either. Right now, the only way I’ve been able to get the API working is by using `sp:scopes:all` with an admin account. If I try with anything more restricted, I either can’t assign the scope at all or I get a 500 error instead of a proper 403. So it definitely feels like either the scopes haven’t been fully implemented yet, or the documentation got ahead of what’s actually available in the product. ---
**Author:** ![vkashat](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/vkashat/32/9721_2.png) [@vkashat](https://developer.sailpoint.com/discuss/u/vkashat)\ **Post date:** [May 28, 2026, 2:32pm UTC](https://developer.sailpoint.com/discuss/t/unable-to-assign-pat-token-scopes-for-launchers/210706/3 "2026-05-28T14:32:32Z")
Out of curiosity, are either of you testing this in a sandbox tenant/environment? ---
**Author:** ![ROHPU](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/rohpu/32/36109_2.png) [@ROHPU](https://developer.sailpoint.com/discuss/u/ROHPU)\ **Post date:** [May 28, 2026, 3:03pm UTC](https://developer.sailpoint.com/discuss/t/unable-to-assign-pat-token-scopes-for-launchers/210706/4 "2026-05-28T15:03:43Z")
I am testing in sandbox , why ? ---
**Author:** ![vkashat](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/vkashat/32/9721_2.png) [@vkashat](https://developer.sailpoint.com/discuss/u/vkashat)\ **Post date:** [May 28, 2026, 3:11pm UTC](https://developer.sailpoint.com/discuss/t/unable-to-assign-pat-token-scopes-for-launchers/210706/5 "2026-05-28T15:11:55Z")
Just curious, the newer features get implemented in sandbox first, so I just wanted to know how ahead of the documentation you were 🤣 ---
**Author:** ![david\_thomas](https://avatars.discourse-cdn.com/v4/letter/d/a6a055/32.png) [@david\_thomas](https://developer.sailpoint.com/discuss/u/david_thomas)\ **Post date:** [May 28, 2026, 11:22pm UTC](https://developer.sailpoint.com/discuss/t/unable-to-assign-pat-token-scopes-for-launchers/210706/6 "2026-05-28T23:22:59Z")
Thanks for the reply. Yes, it works fine for me with `sp:scopes:all` and an admin account, but I need a non-admin account to access launcher definitions to analyse them. I am testing in our Sandbox environment. I will raise a bug with Customer Support to get it in the queue. Thanks, ---
**Author:** ![BBR1](https://avatars.discourse-cdn.com/v4/letter/b/c57346/32.png) [@BBR1](https://developer.sailpoint.com/discuss/u/BBR1)\ **Post date:** [May 29, 2026, 8:11am UTC](https://developer.sailpoint.com/discuss/t/unable-to-assign-pat-token-scopes-for-launchers/210706/7 "2026-05-29T08:11:43Z")
Correct, this is not a tenant configuration issue. It is : - incomplete feature rollout - Defect in Launcher API authorization model ---
**Author:** ![RAKRHEEM](https://avatars.discourse-cdn.com/v4/letter/r/f05b48/32.png) [@RAKRHEEM](https://developer.sailpoint.com/discuss/u/RAKRHEEM)\ **Post date:** [May 30, 2026, 5:07pm UTC](https://developer.sailpoint.com/discuss/t/unable-to-assign-pat-token-scopes-for-launchers/210706/8 "2026-05-30T17:07:24Z")
We also have the same requirement. Have raised Sailpoint ticket ---
**Author:** ![system](https://global.discourse-cdn.com/sailpoint/original/2X/f/f2136700ed5e3703e0b85e02f6be799dacca7735.png) [@system](https://developer.sailpoint.com/discuss/u/system)\ **Post date:** [July 29, 2026, 5:07pm UTC](https://developer.sailpoint.com/discuss/t/unable-to-assign-pat-token-scopes-for-launchers/210706/9 "2026-07-29T17:07:36Z")
Closed on July 29, 2026, 5:07pm UTC This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.