The scopes this connection holds. For an API key that is the key's own scopes, or every scope when the key has none set. For an OAuth caller it is what the user granted, narrowed to the application's ceiling. This route needs no scope of its own, so a caller can always read its own grant.Access