What are the correct scopes to use for different applications?

Question

I am writing a desktop application (or several) to access mail, contacts and chat via the REST api (User-Agent Flow)

What are the correct and minimal scopes to use for each of these individually or for all three in one go?

I have found this page but it is not quite clear enough.

Current thoughts would be:

All: api refresh_token

Mail: api refresh_token

Contacts: api refresh_token

Chat: chatter_api refresh_token

Is there any need for full?

Do I have to pass refresh_token with everything or is it included in eg. api?

It says on the page that id is implicit in everything so is there any need to send it?

Answer 1

Yes, api gives you access to all the user's data via the APIs. Definitely gives you Contacts, and I believe it gives you SendEmail also. Note that api also gives you access to Chatter, so you don't need to specify both. chatter_api, on the other hand, gives you access to the Chatter API, but no other APIs.

I don't think you need full - as far as I know, that's just a synonym for api web visualforce, which transitively includes id chatter_api.

Yes, you will need to specify refresh_token with everything - it's not included in any other scope.

You don't need to send id if you're specifying any other scope - it's only useful if you need to access the identity service only.