Function allowed 

pub async fn allowed(
    ctx: &Ctx,
    player: i64,
    wanted: &[String],
) -> ApiResult<Vec<String>>

The scopes a player may give a token (staff-only ones aside).