OAuth scopes

EventThing returns data only for scopes that were requested, allowed and accepted.

profile

{
  "profile": {
    "id": "usr_7k2h9...",
    "name": "Bean",
    "avatar_url": "https://..."
  }
}

No email, Steam or TruckersMP data is included.

vtcs

{
  "vtcs": [
    {
      "id": "vtc_onlytangs",
      "name": "OnlyTangs Haulage",
      "avatar_url": "https://...",
      "can_act": true
    }
  ]
}

events

events extends each VTC object rather than creating a separate top-level event collection.

{
  "vtcs": [
    {
      "id": "vtc_onlytangs",
      "name": "OnlyTangs Haulage",
      "can_act": true,
      "events": [
        {
          "id": "evt_123",
          "name": "September Community Convoy",
          "starts_at": "2026-09-12T18:00:00Z"
        }
      ]
    }
  ]
}

If events is not granted, the property is omitted.

If events is granted but there are no applicable events for a VTC:

{
  "events": []
}

invites:create

Allows creation of a new EventThing invitation on behalf of the authorised user and VTC.

It does not grant:

• read access to existing invitations
• update or deletion of existing invitations
• event management
• discussion access
• block management
• member access
• VTC settings access
• other VTC API operations

Effective access

The scopes requested by an application are not necessarily the scopes it ultimately receives.

Effective access is determined from:

Application-approved scopes
        ∩
VTC-approved scopes
        ∩
User consent
        ∩
User's current EventThing permissions

The context returned after authorisation reflects the effective grant.

EventThing still re-validates the user's current authority when an invitation is actually created.