Permissions

Every API Token carries a set of permissions (scopes) that decide which data it can read. A permission is named after the data type. The same data uses the same permission whether you read it over HTTP or over an SSE stream, and it counts against the same resource’s quota.

The live JSON is the full list: https://manager.exptech.com.tw/api/v1/info/permissions (see the public info API).

Permission list

Name	Description	Counts toward quota	Related docs
*	All permissions	—	—
account	Account API	No	—
trem.rts	TREM real-time stations	Yes	trem.rts.v1
trem.rtw	TREM real-time waveform	Yes	—
trem.raw	TREM raw data	Yes	—
trem.eew	TREM EEW, computed by our TREM system. Unofficial; only provided to specific users (see below)	Yes	—
trem.intensity	TREM seismic intensity	Yes	trem.intensity.v1
trem.oeews	TREM on-site EEW. Unofficial; only provided to specific users	No	—
trem.control	Not open to third parties	—	—
eq.report	Earthquake report	Yes	eq.report.v1

• A permission that counts toward quota maps to one resource (resource_id). Usage and the daily quota are counted per resource. See /api/v1/info/resources.
• A permission whose related docs are — is not used by any API that has public docs right now.
• trem.control is for ExpTech internal use. Third parties do not need it and should not request it.
• trem.eew is TREM EEW, which our TREM system computes on its own from TREM-net observations. It is not official information. Under the Meteorological Act, it is provided only to specific users who have ExpTech’s individual approval or a contract, and is not issued to the general public. Information published by the CWA always prevails.

All permissions

* passes every permission check, including permissions added later. It does not replace a subscription, and usage still counts against each resource’s quota. Use it for testing. In production, grant only the permissions you need.

Groups

A group is a way to select several permissions at once. A group is not itself a permission.

Group	Description	Includes
trem.*	All TREM permissions (excludes trem.control)	trem.rts, trem.rtw, trem.raw, trem.eew, trem.intensity, trem.oeews
eq.*	All earthquake permissions	eq.report

• When you create a token, a group expands into the permissions in the table above. The token stores the expanded names. If a group later gains a new permission, tokens already created do not gain it. Create them again.
• Use the Includes column for the exact set. Do not infer it from the name prefix. trem.control starts with trem. and is not part of trem.*.
• The OAuth2 access_token response and the dashboard both show the expanded names. Group names do not appear there.

How to set permissions

• Create a token on the dashboard: select them on the API Tokens page.
• OAuth2: the scope parameter of the authorization request, separated by spaces, for example eq.report trem.rts or trem.*. An unknown name fails the whole request (invalid_scope). It is not skipped. See OAuth2.

How permissions are checked

Transport	Check	When it fails
HTTP (endpoints that require a token)	The token has the permission that endpoint requires, or it has *	403, empty body
SSE (topics that require a permission)	1. The token has that topic’s permission, or it has * 2. The account is subscribed to that resource (* does not replace this)	forbidden: token scope missing forbidden: not subscribed
SSE (public topics)	Permissions and subscription are not checked	—

After the permission check, the daily quota is checked. See Usage and quota. Status codes and messages are in Error codes.