Quest re rest scopes and global theme rest calls

There are not safe endpoints. You would need to grant the noscope.default.readonly scope to all widgets that make use of your custom endpoint until it has a unique scope. Any endpoint that doesn't define its own scope is put into the noscope category.

Looking at tags as a global example, the widgets do not specify the scope for the api.ashx/v2/aggregatetags.json endpoint, so as we are replacing this to avoid changing every widget this doesn't seem like workable option?

Can we use the same scope for the replacement endpoint ? 

Endpoints used by the platform javascript (such as tag editing UI implemented as jQuery plugins in the platform javascript) are considered globally accessible to the UI and are not registered individually by widgets. There is not, currently, however a way to add additional globally accessible REST scopes.

I take that back slightly. Adding the scopes to the themes of the community will allow those scopes from any page within the theme. This may be the best approach for overriding platform functionality (which I assume is done within the theme)

I take that back slightly. Adding the scopes to the themes of the community will allow those scopes from any page within the theme. This may be the best approach for overriding platform functionality (which I assume is done within the theme)

Ah thanks Ben  I had not seen anything about the theme scope in the documentation, which mention widgets but not the theme itself