Skip to main content
If you receive a 404 error from the Semgrep Web API, and you are sure the deployment, API endpoint, and other details are correct, you may be trying to use a token that does not have the Web API or Read-only scope assigned. When you create an API token, you select one scope: Agent (CI), Web API, Member, or Read-only. See Token scopes for details of their permissions. Tokens with the Agent (CI) scope can connect scans with the platform to request rules, send findings, and post PR/MR comments, but they cannot use the Web API. They are intended for use locally or in CI. A Read-only token can authenticate to the Web API for read endpoints only. It cannot perform write or mutate operations. If you need write access, create a new token with the Web API scope. You cannot change a Read-only token’s scope after creation.

​
Add scopes to a token

You must be an admin to perform this operation. Member users cannot access tokens in the Semgrep AppSec Platform.
1
Log in to Semgrep AppSec Platform and navigate to Settings > Tokens.
2
Identify the related token, and click the icon to edit the token.
3
Under Token scopes, select Web API.
If the token does not appear in the API Tokens section, it is a Member-scoped CLI token whose permissions cannot be escalated. Create a new token on the Settings page instead, and select the Web API scope. If the token is Read-only, you cannot escalate it to Web API. Create a new token with the scope you need instead.