Wanna mention the scopes that are needed for requests that hit this endpoint via OAuth?