Scopes for Knox cloud services APIs
Last updated August 5th, 2025
OAuth 2.0 scopes are required to access the Knox cloud services APIs. These scopes are service-specific, and the level of access you require for your app determines which scopes to select. For more information about the scope requirements, you can refer to the API specifications of its associated Knox cloud service.
The following scopes are available:
Knox Asset Intelligence
| Scope name | Description | Applicable API endpoints | Applicable KWN events |
|---|---|---|---|
| kai | Manage all Knox Asset Intelligence functionality, including devices, diagnostics logs, and network settings. | All endpoints in the Knox Asset Intelligence API. | KAI_APP_ANR_FC, KAI_BATTERY_STATUS, KAI_DEVICE_DIAGNOSTICSLOGS, KAI_WIFI_DISCONNECTIONS, KAI_BATTERY_LEVEL_TRIGGERED, KAI_APP_USAGE_TIME_BATTERY, KAI_APP_USAGE_NETWORK, KAI_APP_USAGE_SCREENTIME, KAI_BATTERY_CHARGING, KAI_BATTERY_LEVEL_SHIFT_START, KAI_BATTERY_LEVEL_SHIFT_END, KAI_WIFI_CONNECTIONS |
| kai.settings | View and configure your Knox Asset Intelligence tenant information, including battery threshold levels and enrollment settings. | All settings endpoints in the Knox Asset Intelligence API. | |
| kai.devices | View Knox Asset Intelligence device and group information. | All devices endpoints in the Knox Asset Intelligence API. | |
| kai.diagnostics | Request and view Knox Asset Intelligence diagnostics logs. | All diagnostics logs endpoints in the Knox Asset Intelligence API. | KAI_DEVICE_DIAGNOSTICSLOGS |
| kai.network | Subscribe to Knox Asset Intelligence notifications about Wi-Fi connection and disconnection events. | All network endpoints in the Knox Asset Intelligence API. | KAI_WIFI_DISCONNECTIONS, KAI_WIFI_CONNECTIONS |
| kai.battery | Subscribe to Knox Asset Intelligence notifications about battery-related events. | KAI_BATTERY_STATUS, KAI_BATTERY_LEVEL_TRIGGERED, KAI_BATTERY_CHARGING, KAI_BATTERY_LEVEL_SHIFT_START, KAI_BATTERY_LEVEL_SHIFT_END | |
| kai.app | Subscribe to Knox Asset Intelligence notifications about app usage and abnormal app events. | KAI_APP_ANR_FC, KAI_APP_USAGE_TIME_BATTERY, KAI_APP_USAGE_NETWORK, KAI_APP_USAGE_SCREENTIME | |
| kai.miscellaneous | View the deployment status of your Knox Service Plugin policies. | POST /kai/v1/miscellaneous/getKspStatus | |
For detailed API specification, see Knox Asset Intelligence API reference.
Knox Configure
| Scope name | Description | Applicable API endpoints |
|---|---|---|
| kc | Manage all Knox Configure functionality. | All endpoints in the Knox Configure API v2.0. |
| kc.devices | Manage all functionality related to Knox Configure devices. | All endpoints in the Knox Configure API v2.0. |
| kc.devices:view | View Knox Configure devices and their information. | POST /kc/v2/devices/getDevices |
| POST /kc/v2/devices/getDeviceLogs | ||
| kc.devices:manage | Send commands to devices and delete them from Knox Configure. | POST /kc/v2/devices/sendCommand |
| POST /kc/v2/devices/bulkDelete |
For detailed API specification, see Knox Deployment Program API reference.
Knox Deployment Program
| Scope name | Description | Applicable API endpoints |
|---|---|---|
| kdp | Manage all Knox Deployment Program functionality. | All endpoints in Knox Deployment Program API. |
| kdp.devices | Upload and delete devices, and get device information. | PUT /kcs/v1/rp/devices/upload |
| GET /kcs/v1/rp/devices/status | ||
| GET /kcs/v1/rp/devices | ||
| PUT /kcs/v1/rp/devices/delete | ||
| kdp.devices:view | View devices and device statuses. | GET /kcs/v1/rp/devices/status |
| GET /kcs/v1/rp/devices | ||
| kdp.devices:manage | Upload and delete devices. | PUT /kcs/v1/rp/devices/upload |
| PUT /kcs/v1/rp/devices/delete | ||
| kdp.profilealias | View all Knox Mobile Enrollment profile aliases. | GET /kcs/v1/rp/profilealias/kme |
| kdp.customers | View all Knox Deployment Program customers. | GET /kcs/v1/rp/customers/list |
For detailed API specification, see Knox Deployment Program API reference.
Knox E-FOTA
| Scope | Description | Applicable API endpoints |
|---|---|---|
| ke | Manage all Knox E-FOTA functionality. | All endpoints in the Knox E-FOTA API. |
| ke.campaign | View, assign, create, delete, and cancel Knox E-FOTA campaigns. | All campaign endpoints in the Knox E-FOTA API. |
| ke.campaign:view | View Knox E-FOTA campaign information. | GET /campaigns |
| GET /campaigns/{campaignId} | ||
| GET /campaignSchemas | ||
| ke.campaign:assign | Assign or unassign devices from a Knox E-FOTA campaign. | POST /campaigns/{campaignId}/bulkAssign |
| POST /campaigns/{campaignId}/bulkUnassign | ||
| ke.campaign:manage | Create and edit Knox E-FOTA campaigns. | POST /campaigns |
| PUT /campaigns/{campaignId} | ||
| ke.campaign:delete | Delete and cancel Knox E-FOTA campaigns. | DELETE /campaigns/{campaignId} |
| PUT /campaigns/{campaignId}/cancel | ||
| ke.devices | View, upload, manage, and delete Knox E-FOTA devices. | All device endpoints in the Knox E-FOTA API. |
| ke.devices:view | View Knox E-FOTA device information. | GET /devices/models |
| GET /devices/salesCodes | ||
| GET /devices/aggregateDeviceUpdateStatus | ||
| GET /devices/csc | ||
| POST /devices/getDevices | ||
| ke.devices:manage | Upload, refresh, and unenroll Knox E-FOTA devices. | POST /devices/bulkUpload |
| POST /devices/bulkRefresh | ||
| POST /devices/bulkUnenroll | ||
| ke.devices:delete | Delete devices from Knox E-FOTA. | POST /devices/bulkDelete |
| ke.licenses | View, register, and delete Knox E-FOTA licenses. | All license endpoints in the Knox E-FOTA API. |
| ke.licenses:view | View Knox E-FOTA license information. | GET /licenses |
| ke.licenses:manage | Register commercial licenses and generate trial licenses for Knox E-FOTA. | POST /licenses |
| POST /trialLicenses | ||
| ke.licenses:delete | Delete Knox E-FOTA licenses. | DELETE /licenses/{licenseId} |
| ke.fota:view | View Knox E-FOTA firmware information. | GET /fota |
| ke.privacyPolicy | View and manage the skip privacy policy setting. | All privacy policy endpoints in the Knox E-FOTA API |
| ke.privacyPolicy:view | View the skip privacy policy setting. | GET /privacyPolicy |
| ke.privacyPolicy:manage | Manage the skip privacy policy setting. | PUT /privacyPolicy |
Knox Manage (exclusive to MSP partners)
| Scope name | Description | Applicable API endpoints |
|---|---|---|
| km | Manage all Knox Manage functionality. | All endpoints in Knox Manage API. |
| km.group | View, create, and add users to groups. | POST /km/v1/group/insertGroup |
| POST /km/v1/group/insertGroupUnits | ||
| GET /km/v1/group/selectGroups | ||
| km.group:view | View groups and their information. | GET /km/v1/group/selectGroups |
| km.group:manage | Update groups and their information. | POST /km/v1/group/insertGroup |
| POST /km/v1/group/insertGroupUnits | ||
| km.user | View and create users, and request enrollment through email. | POST /km/v1/user/createUser |
| POST /km/v1/user/requestEnrollment | ||
| GET /km/v1/user/selectUserWithID | ||
| km.user:view | View users. | GET /km/v1/user/selectUserWithID |
| km.user:manage | Create users and request enrollment through email. | POST /km/v1/user/createUser |
| POST /km/v1/user/requestEnrollment | ||
| km.profile | Assign profiles to groups. | POST /km/v1/mdm/profileServiceWrapper/assign |
For detailed API specification, see Knox Manage API reference.
The Knox Manage scopes are intended exclusively for use by MSP partners, direct use by end customers is currently not supported.
Knox Mobile Enrollment
| Scope name | Description | Applicable API endpoints |
|---|---|---|
| kme | Manage all Knox Mobile Enrollment functionality, including profiles, devices, and resellers. | All endpoints in Knox Mobile Enrollment API. |
| kme.profiles | Manage all functionality related to Knox Mobile Enrollment profiles. | All profile management endpoints in Knox Mobile Enrollment API. |
| kme.profiles:view | View Knox Mobile Enrollment profiles. | GET /kcs/v1/kme/profiles/list |
| GET /kcs/v1/kme/profiles/status | ||
| GET /kcs/v1/kme/profiles/{id}/get | ||
| kme.profiles:manage | Create, update, and delete Knox Mobile Enrollment profiles. | POST /kcs/v1/kme/profiles/create |
| POST /kcs/v1/kme/profiles/createAsync/ | ||
| PUT /kcs/v1/kme/profiles/{profileId} | ||
| DELETE /kcs/v1/kme/profiles/{id} | ||
| kme.devices | Manage all functionality related to devices in Knox Mobile Enrollment. | PUT /kcs/v1/kme/devices/assignProfile |
| POST /kcs/v1/kme/devices/delete | ||
| GET /kcs/v1/kme/devices/list | ||
| PUT /kcs/v1/kme/devices/unassignProfile | ||
| PUT /kcs/v2/kme/devices/unassignProfile | POST /kcs/v1/kme/devices/uploads/approvals | |
| GET /kcs/v1/kme/devices/uploads/list | ||
| kme.devices:view | View Knox Mobile Enrollment device information. | GET /kcs/v1/kme/devices/list |
| GET /kcs/v1/kme/devices/uploads/list | ||
| kme.devices:manage | Assign, unassign, and delete profiles, as well as approve device uploads. | PUT /kcs/v1/kme/devices/assignProfile |
| POST /kcs/v1/kme/devices/delete | ||
| PUT /kcs/v1/kme/devices/unassignProfile | ||
| PUT /kcs/v2/kme/devices/unassignProfile | ||
| POST /kcs/v1/kme/devices/uploads/approvals | ||
| kme.reseller | Manage all functionality related to Knox Mobile Enrollment resellers. | POST /kcs/v1/kme/reseller/approvals |
| POST /kcs/v1/kme/reseller/profilealias | ||
| PUT /kcs/v1/kme/reseller/profilealias/{profileAliasId} | ||
| DELETE /kcs/v1/kme/reseller/profilealias/{profileAliasId} |
For detailed API specification, see Knox Mobile Enrollment API reference.
Knox MSP Portal
| Scope name | Description | Applicable API endpoints |
|---|---|---|
| msp | Manage all Knox MSP Portal functionality. | POST /msp/v1/managedCustomers |
| POST /msp/v1/managedCustomers/link | ||
| POST /msp/v1/managedCustomers/delink | ||
| GET /msp/v1/managedCustomers | ||
| GET /msp/v1/managedCustomers/{customerId} | ||
| PUT /msp/v1/managedCustomers/{customerId} | ||
| GET /msp/v1/profiles | ||
| POST /msp/v1/profiles/copy | ||
| POST /msp/v1/profiles/overwrite | ||
| msp.customers | Add and delink MSP customers, as well as view and edit their information. | POST /msp/v1/managedCustomers |
| POST /msp/v1/managedCustomers/link | ||
| POST /msp/v1/managedCustomers/delink | ||
| GET /msp/v1/managedCustomers | ||
| GET /msp/v1/managedCustomers/{customerId} | PUT /msp/v1/managedCustomers/{customerId} | |
| msp.profiles | Copy existing profiles to managed customers. | GET /msp/v1/profiles |
| POST /msp/v1/profiles/copy | ||
| POST /msp/v1/profiles/overwrite |
For detailed API specification, see Knox MSP Portal API reference.
Knox E-FOTA
| Scope | Description | Applicable API endpoints |
|---|---|---|
| ke | Manage all Knox E-FOTA functionality. | All endpoints in the Knox E-FOTA API. |
| ke.campaign | View, assign, create, delete, and cancel Knox E-FOTA campaigns. | All campaign endpoints in the Knox E-FOTA API. |
| ke.campaign:view | View Knox E-FOTA campaign information. | GET /campaigns |
| GET /campaigns/{campaignId} | ||
| GET /campaignSchemas | ||
| ke.campaign:assign | Assign or unassign devices from a Knox E-FOTA campaign. | POST /campaigns/{campaignId}/bulkAssign |
| POST /campaigns/{campaignId}/bulkUnassign | ||
| ke.campaign:manage | Create and edit Knox E-FOTA campaigns. | POST /campaigns |
| PUT /campaigns/{campaignId} | ||
| ke.campaign:delete | Delete and cancel Knox E-FOTA campaigns. | DELETE /campaigns/{campaignId} |
| PUT /campaigns/{campaignId}/cancel | ||
| ke.devices | View, upload, manage, and delete Knox E-FOTA devices. | All device endpoints in the Knox E-FOTA API. |
| ke.devices:view | View Knox E-FOTA device information. | GET /devices/models |
| GET /devices/salesCodes | ||
| GET /devices/aggregateDeviceUpdateStatus | ||
| GET /devices/csc | ||
| POST /devices/getDevices | ||
| ke.devices:manage | Upload, refresh, and unenroll Knox E-FOTA devices. | POST /devices/bulkUpload |
| POST /devices/bulkRefresh | ||
| POST /devices/bulkUnenroll | ||
| ke.devices:delete | Delete devices from Knox E-FOTA. | POST /devices/bulkDelete |
| ke.licenses | View, register, and delete Knox E-FOTA licenses. | All license endpoints in the Knox E-FOTA API. |
| ke.licenses:view | View Knox E-FOTA license information. | GET /licenses |
| ke.licenses:manage | Register commercial licenses and generate trial licenses for Knox E-FOTA. | POST /licenses |
| POST /trialLicenses | ||
| ke.licenses:delete | Delete Knox E-FOTA licenses. | DELETE /licenses/{licenseId} |
| ke.fota:view | View Knox E-FOTA firmware information. | GET /fota |
| ke.privacyPolicy | View and manage the skip privacy policy setting. | All privacy policy endpoints in the Knox E-FOTA API. |
| ke.privacyPolicy:view | View the skip privacy policy setting. | GET /privacyPolicy |
| ke.privacyPolicy:manage | Manage the skip privacy policy setting. | PUT /privacyPolicy |
Knox OAuth 2.0 Authentication — Authorization server operations
| Scope name | Description | Applicable API endpoints |
|---|---|---|
| Use your email address to verify your identity. | POST /ams/v1/oauth2/token | |
| openid | Use your Samsung Knox user identifier. | POST /ams/v1/oauth2/token |
For detailed API specification, see Knox OAuth 2.0 Authentication API reference.
On this page
Is this page helpful?