When setting up Pronto inside of Canvas, each institution has the option of whether or not they would like to "Enforce Scopes" for the tool. 

Below are the exact scopes that Pronto requires to run properly inside of Canvas:

Accounts:
​url:GET|/api/v1/accounts

url:GET|/api/v1/accounts/:id
url:GET|/api/v1/accounts/:account_id/courses
url:GET|/api/v1/accounts/:account_id/sub_accounts  

Courses:
​url:GET|/api/v1/courses
url:GET|/api/v1/courses/:id  

Enrollments:
​url:GET|/api/v1/sections/:section_id/enrollments  

Groups:
​url:GET|/api/v1/courses/:course_id/groups
url:GET|/api/v1/groups/:group_id/memberships  

Roles:
​url:GET|/api/v1/accounts/:account_id/roles  

Sections:
​url:GET|/api/v1/courses/:course_id/sections  

Users:
​url:GET|/api/v1/accounts/:account_id/users

url:GET|/api/v1/users/:id
url:GET|/api/v1/users/:user_id/custom_data(/*scope)
url:PUT|/api/v1/users/:user_id/custom_data(/*scope)
url:DELETE|/api/v1/users/:user_id/custom_data(/*scope)

url:GET|/api/v1/users/:user_id/profile

If you have any additional questions, please don't hesitate to reach out to our support team at support@pronto.io!