Yea, my thinking here is this actually will accept incoming messages from a variety of sources.  It is the **public** endpoint.  As opposed to the API stuff where auth/oauth is assumed to be used.  So having a separate scope seemed best